better-dsh 0.2.5-c → 0.2.5-e

package/lib/{web-trust-CL9P6jVe.d.ts → web-trust-D9jFaQbH.d.ts}

@@ -1,5 +1,5 @@
 import { Context } from "@deepseek-ai/cordis";
-import * as _deepseek_ai_schemastery5 from "@deepseek-ai/schemastery";
+import * as _deepseek_ai_schemastery9 from "@deepseek-ai/schemastery";
 
 //#region src/web-trust.d.ts
 
@@ -50,10 +50,11 @@ interface BootScriptRow {
  * inert-when-empty).
  *
  * @param trustedPageAuthorities - the operator-declared hostnames.
+ * @param trustAllHosts - delegate admission to native authentication without an address fence.
  * @returns the script text, or `undefined` when the list is empty (inject
  *   nothing — the feature is fully inert).
  */
-declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined): string | undefined;
+declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined, trustAllHosts?: boolean): string | undefined;
 /**
  * Build the mobile-leg script. Pure: same config in, same script out — the
  * unit tests pin the shape (mobile global, tuned thresholds, zoomGuard
@@ -69,14 +70,18 @@ declare function buildMobileScript(mobile: MobileConfig | undefined): string | u
  * the mobile knobs are the `dashr-mobile` row's own config.
  */
 interface TrustConfig {
+  /** Accept every serving address after native cookie authentication, including in the browser UI. */
+  trustAllHosts?: boolean;
   /** Hostnames this operator declares their own devices' pages run on. */
   trustedPageAuthorities?: readonly string[];
 }
 /** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
-declare const Config: _deepseek_ai_schemastery5.default<Schemastery.ObjectS<NoInfer<{
-  trustedPageAuthorities: _deepseek_ai_schemastery5.default<string[], string[], "defined">;
+declare const Config: _deepseek_ai_schemastery9.default<Schemastery.ObjectS<NoInfer<{
+  trustAllHosts: _deepseek_ai_schemastery9.default<boolean, boolean, "defined">;
+  trustedPageAuthorities: _deepseek_ai_schemastery9.default<string[], string[], "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  trustedPageAuthorities: _deepseek_ai_schemastery5.default<string[], string[], "defined">;
+  trustAllHosts: _deepseek_ai_schemastery9.default<boolean, boolean, "defined">;
+  trustedPageAuthorities: _deepseek_ai_schemastery9.default<string[], string[], "defined">;
 }>>, "plain">;
 /** Cordis plugin name. */
 declare const name = "dashr-web-trust";
@@ -95,10 +100,12 @@ declare function apply(ctx: Context, config: TrustConfig | undefined): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery5.default<Schemastery.ObjectS<NoInfer<{
-    trustedPageAuthorities: _deepseek_ai_schemastery5.default<string[], string[], "defined">;
+  Config: _deepseek_ai_schemastery9.default<Schemastery.ObjectS<NoInfer<{
+    trustAllHosts: _deepseek_ai_schemastery9.default<boolean, boolean, "defined">;
+    trustedPageAuthorities: _deepseek_ai_schemastery9.default<string[], string[], "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    trustedPageAuthorities: _deepseek_ai_schemastery5.default<string[], string[], "defined">;
+    trustAllHosts: _deepseek_ai_schemastery9.default<boolean, boolean, "defined">;
+    trustedPageAuthorities: _deepseek_ai_schemastery9.default<string[], string[], "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/{web-trust-B27wcZEw.js → web-trust-jR0o70JS.js}

@@ -245,6 +245,30 @@ function buildZoomGuardSection() {
 	].join("");
 }
 
+//#endregion
+//#region src/connection-trust.ts
+/**
+* Use the native index authenticator as a cookie-only admission delegate.
+* A fixed, query-free index path prevents token exchange or redirects here;
+* original Host and Cookie headers preserve the native authority binding and
+* lifetime. No upstream private fields or cookie-format copies are needed.
+*/
+function installAuthenticationOnlyAdmission(connection) {
+	const original = connection.requestRejection;
+	const response = {
+		writeHead() {},
+		end() {}
+	};
+	connection.requestRejection = (request) => connection.authorizeIndex({
+		headers: request.headers,
+		method: "GET",
+		url: "/index.html"
+	}, response) ? void 0 : 401;
+	return () => {
+		connection.requestRejection = original;
+	};
+}
+
 //#endregion
 //#region src/web-trust.ts
 /**
@@ -284,10 +308,12 @@ function frame(body) {
 * inert-when-empty).
 *
 * @param trustedPageAuthorities - the operator-declared hostnames.
+* @param trustAllHosts - delegate admission to native authentication without an address fence.
 * @returns the script text, or `undefined` when the list is empty (inject
 *   nothing — the feature is fully inert).
 */
-function buildTrustScript(trustedPageAuthorities) {
+function buildTrustScript(trustedPageAuthorities, trustAllHosts = false) {
+	if (trustAllHosts) return frame(["if(!window.__DSH_TRANSPORT__)window.__DSH_TRANSPORT__={ownsHost:true};"]);
 	const authorities = [...trustedPageAuthorities ?? []];
 	if (authorities.length === 0) return void 0;
 	for (const entry of authorities) assertBareHostname(entry);
@@ -323,7 +349,10 @@ function buildMobileScript(mobile) {
 	return frame(body);
 }
 /** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
-const Config = Schema.object({ trustedPageAuthorities: Schema.array(String).default(deriveDefaultPageAuthorities(process.env.DSH_TRUSTED_HOSTS)) });
+const Config = Schema.object({
+	trustAllHosts: Schema.boolean().default(false),
+	trustedPageAuthorities: Schema.array(String).default(deriveDefaultPageAuthorities(process.env.DSH_TRUSTED_HOSTS))
+});
 /** Cordis plugin name. */
 const name = "dashr-web-trust";
 /**
@@ -339,9 +368,12 @@ const inject = [];
 */
 function apply(ctx, config) {
 	const authorities = config?.trustedPageAuthorities;
+	if (config?.trustAllHosts) ctx.inject(["connection"], (owner) => {
+		owner.effect(() => installAuthenticationOnlyAdmission(owner.connection), "dashr-web-trust: authentication-only admission");
+	});
 	ctx.inject(["webServer"], () => {
 		ctx.on("webserver/index-inject", (table) => {
-			const text = buildTrustScript(authorities);
+			const text = buildTrustScript(authorities, config?.trustAllHosts);
 			if (text !== void 0) table.push({
 				kind: "script",
 				placement: "head",

package/lib/web-trust.d.ts

@@ -1,2 +1,2 @@
-import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust-CL9P6jVe.js";
+import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust-D9jFaQbH.js";
 export { BootScriptRow, Config, MobileConfig, TrustConfig, apply, buildMobileScript, buildTrustScript, _default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/web-trust.js

@@ -1,4 +1,4 @@
 import "./lib-C8_jXvwA.js";
-import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust-B27wcZEw.js";
+import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust-jR0o70JS.js";
 
 export { Config, apply, buildMobileScript, buildTrustScript, web_trust_default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/{wrap-0VA0uFx8.js → wrap-kTohEeis.js}

@@ -242,6 +242,120 @@ function stringifyNode(node) {
 	}
 }
 
+//#endregion
+//#region src/url-schemes/handlers/dvc.ts
+/** Module-level device registry: insertion-ordered, shared by every handler instance. */
+const devices = /* @__PURE__ */ new Map();
+/** Register (or replace) the device mounted under `name`. */
+function registerDvcDevice(name, device) {
+	devices.set(name, device);
+}
+/** Read-only view of the registered devices, in registration order. */
+function listDvcDevices() {
+	return devices;
+}
+/**
+* The first path segment is the device name (`dvc://name`, `dvc://name/sub`).
+* A leading `dvc://` is tolerated so callers may pass either the parsed path
+* (the write tool's contract) or the full URL.
+*/
+/** Subpath after the device name (`status`, `diagnostics?file=…`), or undefined. */
+function subpathOf(path$1) {
+	const trimmed = (path$1.startsWith("dvc://") ? path$1.slice(6) : path$1).replace(/^\/+/, "");
+	const slash = trimmed.indexOf("/");
+	if (slash === -1) return void 0;
+	const sub = trimmed.slice(slash + 1);
+	return sub === "" ? void 0 : sub;
+}
+function deviceNameFromPath(path$1) {
+	const trimmed = (path$1.startsWith("dvc://") ? path$1.slice(6) : path$1).replace(/^\/+/, "");
+	const slash = trimmed.indexOf("/");
+	return slash === -1 ? trimmed : trimmed.slice(0, slash);
+}
+/** Uniform `unknown`-error rendering for structured error messages. */
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Build the `dvc://` scheme handler over the module-level device registry.
+* Bare `dvc://` yields the roster (`no devices mounted` while empty); a
+* registered `<device>` yields its summary plus a usage hint; an unregistered
+* name keeps the `unknown device` placeholder text.
+*/
+function createDvcHandler(_deps = {}) {
+	return {
+		selectorAware: true,
+		async resolve(_env, path$1, selector) {
+			const name = deviceNameFromPath(path$1);
+			if (name === "") {
+				if (devices.size === 0) return "no devices mounted";
+				return applySelector([...devices].map(([n, device$1]) => `${n}\t${device$1.summary}`).join("\n"), selector ?? null);
+			}
+			const device = devices.get(name);
+			if (device === void 0) return `unknown device: ${name}`;
+			const subpath = subpathOf(path$1);
+			if (subpath !== void 0 && device.read !== void 0) {
+				const query = selector?.kind === "query" ? `?${selector.q}` : "";
+				let text;
+				try {
+					text = await device.read(`${subpath}${query}`, _env.agent?.id);
+				} catch (error) {
+					return `Error: ${error instanceof Error ? error.message : String(error)}`;
+				}
+				return selector !== void 0 && selector !== null && selector.kind !== "query" ? applySelector(text, selector) : text;
+			}
+			if (subpath !== void 0) return `unknown read path dvc://${name}/${subpath} (device serves doc only)`;
+			return applySelector(`${device.summary}\nusage: write dvc://${name} with a JSON args object to execute this device`, selector ?? null);
+		}
+	};
+}
+/**
+* Write dispatch for `dvc://` URLs — called by the write tool's URL branch.
+* `path` addresses the device (parsed path or full `dvc://` URL); `content`
+* must be the JSON args payload.
+*
+* Routing and args failures (`DVC_NO_DEVICE`, `DVC_UNKNOWN_DEVICE`,
+* `DVC_BAD_ARGS`) throw synchronously — the placeholder wave's observable
+* contract — while a device-reported failure rejects the returned promise as
+* `DVC_DEVICE_ERROR` carrying the device name.
+*/
+function dispatchDvcWrite(path$1, content, session, cwd) {
+	if (devices.size === 0) throw new UrlSchemesError("DVC_NO_DEVICE", "dvc:// write dispatch: no devices mounted to route the write to");
+	const name = deviceNameFromPath(path$1);
+	const device = devices.get(name);
+	if (device === void 0) throw new UrlSchemesError("DVC_UNKNOWN_DEVICE", `dvc:// write dispatch: no device named "${name}" (registered: ${[...devices.keys()].sort().join(", ")})`);
+	let args;
+	try {
+		args = JSON.parse(content);
+	} catch (error) {
+		throw new UrlSchemesError("DVC_BAD_ARGS", `dvc:// write dispatch: device "${name}" requires a JSON args payload (${messageOf(error)})`);
+	}
+	if (session !== void 0 && args !== null && typeof args === "object" && !Array.isArray(args)) args = { ...args };
+	return Promise.resolve().then(() => device.execute(args, {
+		session,
+		...cwd === void 0 ? {} : { cwd }
+	})).catch((error) => {
+		throw new UrlSchemesError("DVC_DEVICE_ERROR", `dvc:// device "${name}" execute failed: ${messageOf(error)}`);
+	});
+}
+
+//#endregion
+//#region src/url-schemes/docs-dir.ts
+function resolveDocsDir() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (;;) {
+		for (const name of ["dsh-docs", "docs"]) {
+			const candidate = join(dir, name);
+			try {
+				if (statSync(candidate).isDirectory()) return candidate;
+			} catch {}
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+
 //#endregion
 //#region src/url-schemes/resolver.ts
 /** Scheme→handler registry that resolves `scheme://` URLs end-to-end. */
@@ -427,103 +541,6 @@ function createDshHandler(deps) {
 	};
 }
 
-//#endregion
-//#region src/url-schemes/handlers/dvc.ts
-/** Module-level device registry: insertion-ordered, shared by every handler instance. */
-const devices = /* @__PURE__ */ new Map();
-/** Register (or replace) the device mounted under `name`. */
-function registerDvcDevice(name, device) {
-	devices.set(name, device);
-}
-/** Read-only view of the registered devices, in registration order. */
-function listDvcDevices() {
-	return devices;
-}
-/**
-* The first path segment is the device name (`dvc://name`, `dvc://name/sub`).
-* A leading `dvc://` is tolerated so callers may pass either the parsed path
-* (the write tool's contract) or the full URL.
-*/
-/** Subpath after the device name (`status`, `diagnostics?file=…`), or undefined. */
-function subpathOf(path$1) {
-	const trimmed = (path$1.startsWith("dvc://") ? path$1.slice(6) : path$1).replace(/^\/+/, "");
-	const slash = trimmed.indexOf("/");
-	if (slash === -1) return void 0;
-	const sub = trimmed.slice(slash + 1);
-	return sub === "" ? void 0 : sub;
-}
-function deviceNameFromPath(path$1) {
-	const trimmed = (path$1.startsWith("dvc://") ? path$1.slice(6) : path$1).replace(/^\/+/, "");
-	const slash = trimmed.indexOf("/");
-	return slash === -1 ? trimmed : trimmed.slice(0, slash);
-}
-/** Uniform `unknown`-error rendering for structured error messages. */
-function messageOf(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-/**
-* Build the `dvc://` scheme handler over the module-level device registry.
-* Bare `dvc://` yields the roster (`no devices mounted` while empty); a
-* registered `<device>` yields its summary plus a usage hint; an unregistered
-* name keeps the `unknown device` placeholder text.
-*/
-function createDvcHandler(_deps = {}) {
-	return {
-		selectorAware: true,
-		async resolve(_env, path$1, selector) {
-			const name = deviceNameFromPath(path$1);
-			if (name === "") {
-				if (devices.size === 0) return "no devices mounted";
-				return applySelector([...devices].map(([n, device$1]) => `${n}\t${device$1.summary}`).join("\n"), selector ?? null);
-			}
-			const device = devices.get(name);
-			if (device === void 0) return `unknown device: ${name}`;
-			const subpath = subpathOf(path$1);
-			if (subpath !== void 0 && device.read !== void 0) {
-				const query = selector?.kind === "query" ? `?${selector.q}` : "";
-				let text;
-				try {
-					text = await device.read(`${subpath}${query}`, _env.agent?.id);
-				} catch (error) {
-					return `Error: ${error instanceof Error ? error.message : String(error)}`;
-				}
-				return selector !== void 0 && selector !== null && selector.kind !== "query" ? applySelector(text, selector) : text;
-			}
-			if (subpath !== void 0) return `unknown read path dvc://${name}/${subpath} (device serves doc only)`;
-			return applySelector(`${device.summary}\nusage: write dvc://${name} with a JSON args object to execute this device`, selector ?? null);
-		}
-	};
-}
-/**
-* Write dispatch for `dvc://` URLs — called by the write tool's URL branch.
-* `path` addresses the device (parsed path or full `dvc://` URL); `content`
-* must be the JSON args payload.
-*
-* Routing and args failures (`DVC_NO_DEVICE`, `DVC_UNKNOWN_DEVICE`,
-* `DVC_BAD_ARGS`) throw synchronously — the placeholder wave's observable
-* contract — while a device-reported failure rejects the returned promise as
-* `DVC_DEVICE_ERROR` carrying the device name.
-*/
-function dispatchDvcWrite(path$1, content, session, cwd) {
-	if (devices.size === 0) throw new UrlSchemesError("DVC_NO_DEVICE", "dvc:// write dispatch: no devices mounted to route the write to");
-	const name = deviceNameFromPath(path$1);
-	const device = devices.get(name);
-	if (device === void 0) throw new UrlSchemesError("DVC_UNKNOWN_DEVICE", `dvc:// write dispatch: no device named "${name}" (registered: ${[...devices.keys()].sort().join(", ")})`);
-	let args;
-	try {
-		args = JSON.parse(content);
-	} catch (error) {
-		throw new UrlSchemesError("DVC_BAD_ARGS", `dvc:// write dispatch: device "${name}" requires a JSON args payload (${messageOf(error)})`);
-	}
-	if (session !== void 0 && args !== null && typeof args === "object" && !Array.isArray(args)) args = { ...args };
-	return Promise.resolve().then(() => device.execute(args, {
-		session,
-		...cwd === void 0 ? {} : { cwd }
-	})).catch((error) => {
-		throw new UrlSchemesError("DVC_DEVICE_ERROR", `dvc:// device "${name}" execute failed: ${messageOf(error)}`);
-	});
-}
-
 //#endregion
 //#region src/url-schemes/handlers/http.ts
 /** The schemes one handler instance serves; register it under each of these. */
@@ -643,23 +660,6 @@ function createHttpHandler() {
 	} };
 }
 
-//#endregion
-//#region src/url-schemes/docs-dir.ts
-function resolveDocsDir() {
-	let dir = dirname(fileURLToPath(import.meta.url));
-	for (;;) {
-		for (const name of ["dsh-docs", "docs"]) {
-			const candidate = join(dir, name);
-			try {
-				if (statSync(candidate).isDirectory()) return candidate;
-			} catch {}
-		}
-		const parent = dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-}
-
 //#endregion
 //#region src/fs-aware/wrap.ts
 const WRAPPED = Symbol("dsh-url-schemes.fs-wrap");
@@ -747,4 +747,4 @@ function wrapFsWithSchemes(fs$1, services) {
 }
 
 //#endregion
-export { createHttpHandler as a, listDvcDevices as c, UrlResolver as d, UrlSchemesError as f, SCHEME_NAMES as h, HTTP_SCHEMES as i, registerDvcDevice as l, parseUrl as m, wrapFsWithSchemes as n, createDvcHandler as o, applySelector as p, resolveDocsDir as r, dispatchDvcWrite as s, buildFsLayerResolver as t, createDshHandler as u };
+export { createDshHandler as a, createDvcHandler as c, registerDvcDevice as d, UrlSchemesError as f, SCHEME_NAMES as h, createHttpHandler as i, dispatchDvcWrite as l, parseUrl as m, wrapFsWithSchemes as n, UrlResolver as o, applySelector as p, HTTP_SCHEMES as r, resolveDocsDir as s, buildFsLayerResolver as t, listDvcDevices as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-dsh",
-  "version": "0.2.5-c",
+  "version": "0.2.5-e",
   "description": "Make your dsh ready for serious coding tasks. (Tools x Schemas)^REPL. `skill://`, `ctx://`, `agent://`, `dvc://`, `dsh://`, IPython REPL, Context as Variables, cross compactions recallable, full context revive. `hash-edit`, `dvc://browser`, subagent as function, workflow as function.",
   "type": "module",
   "main": "lib/index.js",
@@ -71,7 +71,7 @@
   ],
   "scripts": {
     "prebuild": "node scripts/copy-docs.mjs",
-    "build": "tsdown && npm run build-client && node scripts/copy-kernel-bridge.mjs",
+    "build": "tsdown && npm run build-client && node scripts/copy-kernel-bridge.mjs && node scripts/copy-ast-assets.mjs",
     "typecheck": "npm run typecheck:host && npm run typecheck:client",
     "typecheck:host": "tsc --noEmit",
     "typecheck:client": "tsc -p tsconfig.client.json",
@@ -109,12 +109,24 @@
     "@deepseek-ai/dsh-agent-loop": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-agent-presets": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-agent-tool-presentation": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-api-remotes": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-code-runtime": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-code-runtime-worker-thread": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-command-compact": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-commands": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-credentials": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-fs": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-fs-local": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-home-paths": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-invariants": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-llm": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-llm-retry": ">=0.1.5-0 <0.3.0-0",
@@ -141,23 +153,11 @@
     "@deepseek-ai/dsh-tool-web": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-tool-workflow": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-tools": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-user-approval": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-workflow-worker-thread": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-api-remotes": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-commands": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-credentials": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-host-webserver": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-web-app": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-typert-registry": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-user-approval": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-web-app": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-workflow-worker-thread": ">=0.1.5-0 <0.3.0-0",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
@@ -340,14 +340,36 @@
     }
   },
   "devDependencies": {
+    "@ast-grep/wasm": "^0.45.3",
+    "@lumis-sh/wasm-bash": "^0.26.6",
+    "@lumis-sh/wasm-c": "^0.26.3",
+    "@lumis-sh/wasm-cpp": "^0.26.2",
+    "@lumis-sh/wasm-css": "^0.26.4",
+    "@lumis-sh/wasm-go": "^0.26.3",
+    "@lumis-sh/wasm-html": "^0.26.4",
+    "@lumis-sh/wasm-javascript": "^0.26.4",
+    "@lumis-sh/wasm-json": "^0.26.5",
+    "@lumis-sh/wasm-python": "^0.26.5",
+    "@lumis-sh/wasm-ruby": "^0.26.4",
+    "@lumis-sh/wasm-rust": "^0.26.5",
+    "@lumis-sh/wasm-tsx": "^0.26.3",
+    "@lumis-sh/wasm-typescript": "^0.26.3",
+    "@lumis-sh/wasm-yaml": "^0.26.3",
     "@types/node": "^22.10.5",
     "@types/react": "~18.3.31",
+    "diff": "^8.0.4",
+    "file-type": "21.3.4",
+    "ignore": "^7.0.12",
     "node-addon-require-builtin": "^0.1.5",
+    "puppeteer-core": "^25.3.0",
     "react": "^18.3.1",
     "tsdown": "^0.15.7",
     "tsx": "^4.22.4",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.10"
+    "use-sync-external-store": "^1.7.0",
+    "vitest": "^4.1.10",
+    "web-tree-sitter": "^0.26.12",
+    "xxhash-wasm": "1.1.0"
   },
   "repository": {
     "type": "git",

package/docs/80_upstream-docs-and-skills/dsh-dev-skill/pi-and-omp/.tools/MdxPage-CTY7atqe.js

@@ -1,11 +0,0 @@
-// Stub of the site's MdxPage module.
-export function n() { return {}; }   // default component map (base tags are string literals in content chunks)
-export function t(page, meta) {
-  const C = (props) => {
-    let tree = null;
-    try { tree = typeof page === 'function' ? page(props || {}) : null; } catch (e) { tree = null; }
-    return { kind: 'doc', meta: meta || {}, tree };
-  };
-  return C;
-}
-export default t;

package/docs/80_upstream-docs-and-skills/dsh-dev-skill/pi-and-omp/.tools/extract_omp.mjs

@@ -1,42 +0,0 @@
-import { writeFileSync } from "fs";
-
-const chunks = [
-  "start-Dj2bs0Kq",
-  "capabilities-Cqy7s-PF",
-  "customization-okh9xJ8M",
-  "models-DZr7pp6i",
-  "programmatic-D_fLU-fi",
-  "reference-BWFEeAhZ",
-];
-
-const all = {};
-for (const c of chunks) {
-  let mod;
-  try {
-    mod = await import("./chunk_" + c + ".js");
-  } catch (err) {
-    console.error("IMPORT FAIL", c, String(err));
-    continue;
-  }
-  for (const [k, v] of Object.entries(mod)) {
-    if (typeof v !== "function") continue;
-    let res;
-    try {
-      res = v({});
-    } catch (err) {
-      continue; // not a doc-page component
-    }
-    if (res && res.kind === "doc") {
-      const slug = (res.meta && res.meta.slug) || k;
-      all[slug] = {
-        group: (res.meta && res.meta.group) || "",
-        title: (res.meta && res.meta.title) || k,
-        lede: (res.meta && res.meta.lede) || "",
-        tree: res.tree,
-      };
-    }
-  }
-}
-writeFileSync(new URL("./omp_extracted.json", import.meta.url), JSON.stringify(all));
-console.log("pages extracted:", Object.keys(all).length);
-for (const s of Object.keys(all)) console.log(" ", s);

package/docs/80_upstream-docs-and-skills/dsh-dev-skill/pi-and-omp/.tools/fetch_pi.py

@@ -1,52 +0,0 @@
-#!/usr/bin/env python3
-"""Fetch + convert all pi.dev docs pages (30) into ../pi-and-omp/pi/*.md"""
-import os, re, sys, time, urllib.request, datetime
-from concurrent.futures import ThreadPoolExecutor, as_completed
-import pi_convert
-
-HERE = os.path.dirname(os.path.abspath(__file__))
-OUT = os.path.join(os.path.dirname(HERE), "pi")   # HERE=pi-and-omp/.tools -> pi-and-omp/pi
-os.makedirs(OUT, exist_ok=True)
-TODAY = datetime.date.today().isoformat()
-
-def slug(url):
-    if url.rstrip("/").endswith("/docs/latest"):
-        return "index"
-    return url.rstrip("/").rsplit("/", 1)[-1]
-
-def fetch(url):
-    req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
-    for a in range(4):
-        try:
-            with urllib.request.urlopen(req, timeout=40) as r:
-                return r.read().decode("utf-8", "replace")
-        except Exception:
-            if a == 3:
-                return None
-            time.sleep(1.5)
-
-def one(url):
-    raw = fetch(url)
-    if raw is None:
-        return url, None
-    body = pi_convert.html_to_md(raw)
-    name = slug(url)
-    header = f"<!--\nsource: {url}\nfetched: {TODAY}\n-->\n\n"
-    with open(os.path.join(OUT, name + ".md"), "w", encoding="utf-8") as f:
-        f.write(header + body)
-    return url, name
-
-urls = [l.strip() for l in open(os.path.join(HERE, "pi_pages.txt")) if l.strip()]
-print("pi pages to fetch:", len(urls))
-ok, fail = [], []
-with ThreadPoolExecutor(max_workers=8) as ex:
-    futs = {ex.submit(one, u): u for u in urls}
-    for fut in as_completed(futs):
-        u, name = fut.result()
-        if name is None:
-            fail.append(u)
-        else:
-            ok.append(name)
-print("OK:", len(ok), " FAIL:", len(fail))
-for u in fail:
-    print("  MISSING:", u)

package/docs/80_upstream-docs-and-skills/dsh-dev-skill/pi-and-omp/.tools/jsx-runtime-BHwPObl3.js

@@ -1,13 +0,0 @@
-// Stub of the site's jsx-runtime: records element trees as plain JSON.
-export const i = undefined, n = undefined, o = undefined;
-export function t() {
-  return {
-    Fragment: '@@FRAGMENT@@',
-    jsx: el,
-    jsxs: el,
-  };
-}
-function el(type, props) {
-  return { t: type, p: props || {} };
-}
-export default t;