better-dsh 0.3.1-d → 0.3.1-e

package/cordis.patch.yml

@@ -90,17 +90,22 @@
 # dsh-web-app bundle declares (same id), restating its full shape per the
 # patch-layer contract, with `trustedHosts` merging the DSH_TRUSTED_HOSTS
 # environment (whitespace-separated, operator-declared serving authorities)
-# ahead of the upstream webRuntime-derived ones (LAN literals from an
-# all-interface bind plus --trusted-host extras). Unset/empty env ⇒ identical
-# behavior to the unpatched row. Malformed entries fail plugin load loudly
-# (upstream assertTrustedAuthority). The browser-side twin (page-authority
-# loopback verdict) is the plugin's webserver/index-inject boot script —
-# see src/web-trust.ts.
+# ahead of the upstream invocation authorities. Since DSH 0.1.7 the parsed
+# Web flags live on the `webStartup` service and every host in the declared
+# peer range provides it, so the row injects webStartup and reads
+# `ctx.webStartup.trustedHosts` (the --trusted-host values) — the 0.2.1+
+# upstream row's own source; on pre-0.2.1 hosts this drops only the LAN
+# literals an all-interface bind used to derive (wildcard binds are rejected
+# there too, and this repo's lines always declare authorities explicitly).
+# Unset/empty env ⇒ identical behavior to the unpatched row. Malformed entries
+# fail plugin load loudly (upstream assertTrustedAuthority). The browser-side
+# twin (page-authority loopback verdict) is the plugin's
+# webserver/index-inject boot script — see src/web-trust.ts.
 - id: connection
   name: '@deepseek-ai/dsh-client-connection'
-  inject: [webRuntime]
+  inject: [webStartup]
   config:
-    trustedHosts: !!js (process.env.DSH_TRUSTED_HOSTS ?? '').split(/\s+/).filter(Boolean).concat(ctx.webRuntime.trustedHosts)
+    trustedHosts: !!js (process.env.DSH_TRUSTED_HOSTS ?? '').split(/\s+/).filter(Boolean).concat(ctx.webStartup.trustedHosts)
 
 - id: ui-settings-models
   name: '@deepseek-ai/dsh-client-ui-settings-models'

package/lib/index.js

@@ -1409,8 +1409,7 @@ const agentExecutor = async (rawArgs, exec, deps) => {
 	if (!exec.agent) return { error: "agent() requires a calling agent (this run has no agent to delegate from)" };
 	const subagents = deps.requireSubagents?.();
 	if (!subagents) return { error: "agent() is unavailable: no ctx.subagents service is mounted in this composition" };
-	const delegation = {
-		label: description,
+	const request = {
 		prompt: [{
 			type: "text",
 			text: prompt
@@ -1419,30 +1418,60 @@ const agentExecutor = async (rawArgs, exec, deps) => {
 		maxDepth: NATIVE_MAX_DEPTH
 	};
 	const runInBackground = a["run_in_background"] ?? true;
+	const legacyRequest = {
+		label: description,
+		...request,
+		signal: exec.signal
+	};
+	if (subagents.startActivation === void 0) try {
+		if (runInBackground) {
+			if (subagents.startContinuable === void 0) return { error: "agent() is unavailable: this DSH host exposes neither managed activations nor the legacy continuable seam" };
+			return {
+				kind: "continuable",
+				subagentId: (await subagents.startContinuable({
+					provider,
+					request: legacyRequest
+				})).childId
+			};
+		}
+		if (subagents.start === void 0) return { error: "agent() is unavailable: this DSH host exposes neither managed activations nor the legacy one-shot seam" };
+		const run = await subagents.start(provider, legacyRequest);
+		try {
+			const result = await run.result;
+			if (result.stopReason !== "completed") return { error: `agent() ${stopReasonError(result.stopReason)}` };
+			return {
+				kind: "foreground",
+				subagentId: run.id,
+				output: result.output
+			};
+		} finally {
+			await run.dispose();
+		}
+	} catch (error) {
+		return { error: `agent() failed: ${error instanceof Error ? error.message : String(error)}` };
+	}
 	try {
+		const activation = await subagents.startActivation({
+			provider,
+			label: description,
+			request,
+			signal: exec.signal,
+			delivery: runInBackground ? "parent" : "caller"
+		});
 		if (runInBackground) return {
 			kind: "continuable",
-			subagentId: (await subagents.startContinuable({
-				provider,
-				label: description,
-				request: delegation,
-				signal: exec.signal
-			})).childId
+			subagentId: activation.childId
 		};
-		const run = await subagents.start(provider, {
-			...delegation,
-			signal: exec.signal
-		});
 		try {
-			const result = await run.result;
+			const result = await activation.result;
 			if (result.stopReason !== "completed") return { error: `agent() ${stopReasonError(result.stopReason)}` };
 			return {
 				kind: "foreground",
-				runId: run.id,
+				subagentId: activation.childId,
 				output: result.output
 			};
 		} finally {
-			await run.dispose();
+			await activation.dispose();
 		}
 	} catch (error) {
 		return { error: `agent() failed: ${error instanceof Error ? error.message : String(error)}` };
@@ -1650,7 +1679,7 @@ function createAgentBridgeTools(deps) {
 								type: "string",
 								enum: ["foreground"]
 							},
-							runId: { type: "string" },
+							subagentId: { type: "string" },
 							output: { type: "json" }
 						},
 						additionalProperties: false

package/lib/main.js

@@ -8,8 +8,8 @@ import { URL as URL$1, urlToHttpOptions } from "node:url";
 import os from "node:os";
 import { debuglog, promisify } from "node:util";
 import { mkdir, readdir, symlink, unlink } from "node:fs/promises";
-import { pipeline } from "node:stream/promises";
 import { Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { EventEmitter } from "node:events";
 import * as https from "node:https";
 

package/lib/remote/plugin.js

@@ -8,8 +8,8 @@ import { fileURLToPath } from "node:url";
 import { homedir, tmpdir } from "node:os";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { createConnection, createServer } from "node:net";
 
 //#region src/remote/archive.ts

package/lib/url-schemes/index.d.ts

@@ -1,6 +1,6 @@
+import { t as Schema } from "../index2.js";
 import { Context } from "@deepseek-ai/cordis";
 import { ToolDefinition } from "@deepseek-ai/dsh-tools";
-import * as _deepseek_ai_schemastery17 from "@deepseek-ai/schemastery";
 
 //#region src/url-schemes/tools/write.d.ts
 
@@ -50,12 +50,12 @@ declare const inject: string[];
  * real patch-line config. Schema-level defaults (both ON — the service is
  * opt-out) survive every overlay layer, per the v0.2.2a ruling.
  */
-declare const Config: _deepseek_ai_schemastery17.default<Schemastery.ObjectS<NoInfer<{
-  urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-  hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  urlSchemes: Schema<boolean, boolean, "defined">;
+  hashline: Schema<boolean, boolean, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-  hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+  urlSchemes: Schema<boolean, boolean, "defined">;
+  hashline: Schema<boolean, boolean, "defined">;
 }>>, "plain">;
 /** Register the four URL-aware tools on one agent's own scope layer. */
 /**
@@ -75,12 +75,12 @@ declare function apply(ctx: Context, config: UrlSchemesConfig | undefined): void
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery17.default<Schemastery.ObjectS<NoInfer<{
-    urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-    hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    urlSchemes: Schema<boolean, boolean, "defined">;
+    hashline: Schema<boolean, boolean, "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-    hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+    urlSchemes: Schema<boolean, boolean, "defined">;
+    hashline: Schema<boolean, boolean, "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-password.d.ts

@@ -1,7 +1,7 @@
+import { t as Schema } from "./index2.js";
 import { Context } from "@deepseek-ai/cordis";
 import { IncomingMessage } from "node:http";
 import { CredentialRecord } from "@deepseek-ai/dsh-credentials";
-import * as _deepseek_ai_schemastery0 from "@deepseek-ai/schemastery";
 
 //#region src/web-password.d.ts
 
@@ -123,10 +123,10 @@ interface WebPasswordConfig {
   /** Absolute browser-session lifetime in days. Default: 30 (the native default). */
   cookieMaxAgeDays?: number;
 }
-declare const Config: _deepseek_ai_schemastery0.default<Schemastery.ObjectS<NoInfer<{
-  cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  cookieMaxAgeDays: Schema<number, number, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+  cookieMaxAgeDays: Schema<number, number, "defined">;
 }>>, "plain">;
 /** Cordis plugin name; also the scope of this row's credential record. */
 declare const name = "dashr-web-password";
@@ -145,10 +145,10 @@ declare function apply(ctx: Context, config?: WebPasswordConfig): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery0.default<Schemastery.ObjectS<NoInfer<{
-    cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    cookieMaxAgeDays: Schema<number, number, "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+    cookieMaxAgeDays: Schema<number, number, "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-trust.d.ts

@@ -1,2 +1,3 @@
+import "./index2.js";
 import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust2.js";
 export { BootScriptRow, Config, MobileConfig, TrustConfig, apply, buildMobileScript, buildTrustScript, _default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/web-trust2.d.ts

@@ -1,5 +1,5 @@
+import { t as Schema } from "./index2.js";
 import { Context } from "@deepseek-ai/cordis";
-import * as _deepseek_ai_schemastery7 from "@deepseek-ai/schemastery";
 
 //#region src/web-trust.d.ts
 
@@ -76,12 +76,12 @@ interface TrustConfig {
   trustedPageAuthorities?: readonly string[];
 }
 /** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
-declare const Config: _deepseek_ai_schemastery7.default<Schemastery.ObjectS<NoInfer<{
-  trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-  trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  trustAllHosts: Schema<boolean, boolean, "defined">;
+  trustedPageAuthorities: Schema<string[], string[], "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-  trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+  trustAllHosts: Schema<boolean, boolean, "defined">;
+  trustedPageAuthorities: Schema<string[], string[], "defined">;
 }>>, "plain">;
 /** Cordis plugin name. */
 declare const name = "dashr-web-trust";
@@ -100,12 +100,12 @@ declare function apply(ctx: Context, config: TrustConfig | undefined): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery7.default<Schemastery.ObjectS<NoInfer<{
-    trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-    trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    trustAllHosts: Schema<boolean, boolean, "defined">;
+    trustedPageAuthorities: Schema<string[], string[], "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-    trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+    trustAllHosts: Schema<boolean, boolean, "defined">;
+    trustedPageAuthorities: Schema<string[], string[], "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-trust2.js

@@ -252,20 +252,32 @@ function buildZoomGuardSection() {
 * A fixed, query-free index path prevents token exchange or redirects here;
 * original Host and Cookie headers preserve the native authority binding and
 * lifetime. No upstream private fields or cookie-format copies are needed.
+*
+* 0.2.1: the fence core is `admit()` — the HTTP bridge calls it directly and
+* `requestRejection()` is a thin wrapper over it, so overriding the public
+* `admit` is the one seam that still steers both paths. A fence rejection
+* (403) is retried as cookie-only admission; every other verdict (a live
+* peer, 401 from failed native authentication, disposed) passes through
+* untouched. An accepted cookie admits as the shared browser peer — the same
+* scope native browser authentication grants.
 */
 function installAuthenticationOnlyAdmission(connection) {
-	const original = connection.requestRejection;
+	const original = connection.admit;
 	const response = {
 		writeHead() {},
 		end() {}
 	};
-	connection.requestRejection = (request) => connection.authorizeIndex({
-		headers: request.headers,
-		method: "GET",
-		url: "/index.html"
-	}, response) ? void 0 : 401;
+	connection.admit = (request) => {
+		const admission = original.call(connection, request);
+		if (!("rejection" in admission) || admission.rejection !== 403) return admission;
+		return connection.authorizeIndex({
+			headers: request.headers,
+			method: "GET",
+			url: "/index.html"
+		}, response) ? { peer: connection.browserPeer } : { rejection: 401 };
+	};
 	return () => {
-		connection.requestRejection = original;
+		connection.admit = original;
 	};
 }
 

package/lib/welcome-notice.d.ts

@@ -1,15 +1,15 @@
+import { t as Schema } from "./index2.js";
 import { Context } from "@deepseek-ai/cordis";
-import * as _deepseek_ai_schemastery5 from "@deepseek-ai/schemastery";
 
 //#region src/welcome-notice.d.ts
 declare const name = "dashr-welcome-notice";
 declare const inject: string[];
-declare const Config: _deepseek_ai_schemastery5.default<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
+declare const Config: Schema<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
 declare function apply(ctx: Context): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery5.default<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
+  Config: Schema<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
   apply: typeof apply;
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-dsh",
-  "version": "0.3.1-d",
+  "version": "0.3.1-e",
   "description": "Make your dsh ready for serious coding tasks. (Tools x Schemas)^REPL. `skill://`, `ctx://`, `agent://`, `dvc://`, `dsh://`, Python REPL, Context as Variables, cross compactions recallable, full context revive. `hash-edit`, `dvc://browser`, subagent as function, workflow as function.",
   "type": "module",
   "main": "lib/index.js",