better-dsh 0.3.1-d → 0.3.1-f

package/cordis.patch.yml

@@ -90,17 +90,22 @@
 # dsh-web-app bundle declares (same id), restating its full shape per the
 # patch-layer contract, with `trustedHosts` merging the DSH_TRUSTED_HOSTS
 # environment (whitespace-separated, operator-declared serving authorities)
-# ahead of the upstream webRuntime-derived ones (LAN literals from an
-# all-interface bind plus --trusted-host extras). Unset/empty env ⇒ identical
-# behavior to the unpatched row. Malformed entries fail plugin load loudly
-# (upstream assertTrustedAuthority). The browser-side twin (page-authority
-# loopback verdict) is the plugin's webserver/index-inject boot script —
-# see src/web-trust.ts.
+# ahead of the upstream invocation authorities. Since DSH 0.1.7 the parsed
+# Web flags live on the `webStartup` service and every host in the declared
+# peer range provides it, so the row injects webStartup and reads
+# `ctx.webStartup.trustedHosts` (the --trusted-host values) — the 0.2.1+
+# upstream row's own source; on pre-0.2.1 hosts this drops only the LAN
+# literals an all-interface bind used to derive (wildcard binds are rejected
+# there too, and this repo's lines always declare authorities explicitly).
+# Unset/empty env ⇒ identical behavior to the unpatched row. Malformed entries
+# fail plugin load loudly (upstream assertTrustedAuthority). The browser-side
+# twin (page-authority loopback verdict) is the plugin's
+# webserver/index-inject boot script — see src/web-trust.ts.
 - id: connection
   name: '@deepseek-ai/dsh-client-connection'
-  inject: [webRuntime]
+  inject: [webStartup]
   config:
-    trustedHosts: !!js (process.env.DSH_TRUSTED_HOSTS ?? '').split(/\s+/).filter(Boolean).concat(ctx.webRuntime.trustedHosts)
+    trustedHosts: !!js (process.env.DSH_TRUSTED_HOSTS ?? '').split(/\s+/).filter(Boolean).concat(ctx.webStartup.trustedHosts)
 
 - id: ui-settings-models
   name: '@deepseek-ai/dsh-client-ui-settings-models'

package/lib/client/index.js

@@ -172,6 +172,20 @@ function FailoverRow({ catalog, loadConfig, save, t }) {
 
 //#endregion
 //#region src/mobile/gesture.ts
+/**
+* Whether the mobile adaptation mounts at all (2026-10-18 user ruling):
+* touch-first means the device's PRIMARY input is a finger. A query
+* answering FALSE — a hover-capable or fine primary pointer — decides
+* desktop on its own (a touchscreen laptop keeps desktop behavior); the
+* pair answering true is the standard idiom; and only when the queries
+* are entirely unavailable does `maxTouchPoints` become the honest
+* degrade (every such legacy device is a phone or tablet anyway).
+*/
+function isTouchFirstDevice(input) {
+	if (input.hoverNone === false || input.pointerCoarse === false) return false;
+	if (input.hoverNone === true && input.pointerCoarse === true) return true;
+	return (input.maxTouchPoints ?? 0) > 0;
+}
 /** Resolved defaults — the `1706b81` constants (120 / viewport÷4 / 40 / 1.3)
 * plus the one addition, the velocity gate. A slow text-selection drag runs
 * ~0.13 px/ms; 0.15 px/ms filters those while any comfortable sweep (0.4
@@ -260,6 +274,18 @@ function resolveMobileConfig(pageConfig) {
 
 //#endregion
 //#region src/mobile/client/index.ts
+/**
+* One media query, or `undefined` when the environment has none (old
+* webviews throw or omit `matchMedia`) — the probe then rides the
+* touch-points fallback in {@link isTouchFirstDevice}.
+*/
+function safeMatchMedia(query) {
+	try {
+		return globalThis.matchMedia?.(query) ?? void 0;
+	} catch {
+		return;
+	}
+}
 /** Left sidebar state, live off AppFrame's semantic attribute. */
 function readLeftCollapsed() {
 	return document.querySelector("[data-sidebar-collapsed]") !== null;
@@ -340,17 +366,46 @@ function mobileCss() {
 }
 /**
 * Mount the mobile feature: style injection plus the swipe listeners.
-* Inert unless the host's boot script opted the page in.
+* Inert unless the host's boot script opted the page in AND the device is
+* touch-first (2026-10-18 user ruling). Capability flips (a tablet's
+* primary pointer hardware changing) re-evaluate and mount/unmount the
+* surface live; the media queries answer on every browser since ~2015 and
+* a webview without `matchMedia` degrades to the touch-points probe.
 *
 * @param ctx - client root context.
-* @returns the effect disposer (style tag + listeners removed on unload).
 */
 function setupMobileLayout(ctx) {
 	const pageConfig = globalThis.__DASHR_MOBILE__;
 	const config = resolveMobileConfig(pageConfig);
 	if (!config.enabled) return;
-	const styleTagId = "better-dsh/mobile";
+	const coarseQuery = safeMatchMedia("(pointer: coarse)");
+	const hoverQuery = safeMatchMedia("(hover: none)");
 	ctx.effect(() => {
+		let disposeSurface;
+		const apply$1 = () => {
+			const touchFirst = isTouchFirstDevice({
+				hoverNone: hoverQuery?.matches,
+				pointerCoarse: coarseQuery?.matches,
+				maxTouchPoints: navigator.maxTouchPoints
+			});
+			if (touchFirst && disposeSurface === void 0) disposeSurface = mountTouchSurface();
+			else if (!touchFirst && disposeSurface !== void 0) {
+				disposeSurface();
+				disposeSurface = void 0;
+			}
+		};
+		coarseQuery?.addEventListener("change", apply$1);
+		hoverQuery?.addEventListener("change", apply$1);
+		apply$1();
+		return () => {
+			coarseQuery?.removeEventListener("change", apply$1);
+			hoverQuery?.removeEventListener("change", apply$1);
+			disposeSurface?.();
+		};
+	}, "dashr: mobile layout");
+	/** The style tag + gesture listeners, mounted and disposed as one surface. */
+	function mountTouchSurface() {
+		const styleTagId = "better-dsh/mobile";
 		const tag = document.createElement("style");
 		tag.dataset.plugin = "better-dsh";
 		tag.dataset.pluginCss = styleTagId;
@@ -363,9 +418,7 @@ function setupMobileLayout(ctx) {
 			const onPointerDown = (event) => {
 				start = void 0;
 				const viewport = window.innerWidth;
-				const coarsePointer = window.matchMedia?.("(pointer: coarse)").matches === true;
 				const panels = readPanelState();
-				if (!coarsePointer && !panels.leftCollapsed && !panels.rightOpen) return;
 				if (!admitsSwipeStart(event.clientX, viewport, panels, config)) return;
 				start = {
 					x: event.clientX,
@@ -405,7 +458,7 @@ function setupMobileLayout(ctx) {
 			tag.remove();
 			Promise.resolve(offLayout.dispose());
 		};
-	}, "dashr: mobile layout");
+	}
 }
 
 //#endregion

package/lib/index.js

@@ -1409,8 +1409,7 @@ const agentExecutor = async (rawArgs, exec, deps) => {
 	if (!exec.agent) return { error: "agent() requires a calling agent (this run has no agent to delegate from)" };
 	const subagents = deps.requireSubagents?.();
 	if (!subagents) return { error: "agent() is unavailable: no ctx.subagents service is mounted in this composition" };
-	const delegation = {
-		label: description,
+	const request = {
 		prompt: [{
 			type: "text",
 			text: prompt
@@ -1419,30 +1418,60 @@ const agentExecutor = async (rawArgs, exec, deps) => {
 		maxDepth: NATIVE_MAX_DEPTH
 	};
 	const runInBackground = a["run_in_background"] ?? true;
+	const legacyRequest = {
+		label: description,
+		...request,
+		signal: exec.signal
+	};
+	if (subagents.startActivation === void 0) try {
+		if (runInBackground) {
+			if (subagents.startContinuable === void 0) return { error: "agent() is unavailable: this DSH host exposes neither managed activations nor the legacy continuable seam" };
+			return {
+				kind: "continuable",
+				subagentId: (await subagents.startContinuable({
+					provider,
+					request: legacyRequest
+				})).childId
+			};
+		}
+		if (subagents.start === void 0) return { error: "agent() is unavailable: this DSH host exposes neither managed activations nor the legacy one-shot seam" };
+		const run = await subagents.start(provider, legacyRequest);
+		try {
+			const result = await run.result;
+			if (result.stopReason !== "completed") return { error: `agent() ${stopReasonError(result.stopReason)}` };
+			return {
+				kind: "foreground",
+				subagentId: run.id,
+				output: result.output
+			};
+		} finally {
+			await run.dispose();
+		}
+	} catch (error) {
+		return { error: `agent() failed: ${error instanceof Error ? error.message : String(error)}` };
+	}
 	try {
+		const activation = await subagents.startActivation({
+			provider,
+			label: description,
+			request,
+			signal: exec.signal,
+			delivery: runInBackground ? "parent" : "caller"
+		});
 		if (runInBackground) return {
 			kind: "continuable",
-			subagentId: (await subagents.startContinuable({
-				provider,
-				label: description,
-				request: delegation,
-				signal: exec.signal
-			})).childId
+			subagentId: activation.childId
 		};
-		const run = await subagents.start(provider, {
-			...delegation,
-			signal: exec.signal
-		});
 		try {
-			const result = await run.result;
+			const result = await activation.result;
 			if (result.stopReason !== "completed") return { error: `agent() ${stopReasonError(result.stopReason)}` };
 			return {
 				kind: "foreground",
-				runId: run.id,
+				subagentId: activation.childId,
 				output: result.output
 			};
 		} finally {
-			await run.dispose();
+			await activation.dispose();
 		}
 	} catch (error) {
 		return { error: `agent() failed: ${error instanceof Error ? error.message : String(error)}` };
@@ -1650,7 +1679,7 @@ function createAgentBridgeTools(deps) {
 								type: "string",
 								enum: ["foreground"]
 							},
-							runId: { type: "string" },
+							subagentId: { type: "string" },
 							output: { type: "json" }
 						},
 						additionalProperties: false

package/lib/url-schemes/index.d.ts

@@ -1,6 +1,6 @@
+import { t as Schema } from "../index2.js";
 import { Context } from "@deepseek-ai/cordis";
 import { ToolDefinition } from "@deepseek-ai/dsh-tools";
-import * as _deepseek_ai_schemastery17 from "@deepseek-ai/schemastery";
 
 //#region src/url-schemes/tools/write.d.ts
 
@@ -50,12 +50,12 @@ declare const inject: string[];
  * real patch-line config. Schema-level defaults (both ON — the service is
  * opt-out) survive every overlay layer, per the v0.2.2a ruling.
  */
-declare const Config: _deepseek_ai_schemastery17.default<Schemastery.ObjectS<NoInfer<{
-  urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-  hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  urlSchemes: Schema<boolean, boolean, "defined">;
+  hashline: Schema<boolean, boolean, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-  hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+  urlSchemes: Schema<boolean, boolean, "defined">;
+  hashline: Schema<boolean, boolean, "defined">;
 }>>, "plain">;
 /** Register the four URL-aware tools on one agent's own scope layer. */
 /**
@@ -75,12 +75,12 @@ declare function apply(ctx: Context, config: UrlSchemesConfig | undefined): void
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery17.default<Schemastery.ObjectS<NoInfer<{
-    urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-    hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    urlSchemes: Schema<boolean, boolean, "defined">;
+    hashline: Schema<boolean, boolean, "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-    hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+    urlSchemes: Schema<boolean, boolean, "defined">;
+    hashline: Schema<boolean, boolean, "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-password.d.ts

@@ -1,7 +1,7 @@
+import { t as Schema } from "./index2.js";
 import { Context } from "@deepseek-ai/cordis";
 import { IncomingMessage } from "node:http";
 import { CredentialRecord } from "@deepseek-ai/dsh-credentials";
-import * as _deepseek_ai_schemastery0 from "@deepseek-ai/schemastery";
 
 //#region src/web-password.d.ts
 
@@ -123,10 +123,10 @@ interface WebPasswordConfig {
   /** Absolute browser-session lifetime in days. Default: 30 (the native default). */
   cookieMaxAgeDays?: number;
 }
-declare const Config: _deepseek_ai_schemastery0.default<Schemastery.ObjectS<NoInfer<{
-  cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  cookieMaxAgeDays: Schema<number, number, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+  cookieMaxAgeDays: Schema<number, number, "defined">;
 }>>, "plain">;
 /** Cordis plugin name; also the scope of this row's credential record. */
 declare const name = "dashr-web-password";
@@ -145,10 +145,10 @@ declare function apply(ctx: Context, config?: WebPasswordConfig): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery0.default<Schemastery.ObjectS<NoInfer<{
-    cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    cookieMaxAgeDays: Schema<number, number, "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    cookieMaxAgeDays: _deepseek_ai_schemastery0.default<number, number, "defined">;
+    cookieMaxAgeDays: Schema<number, number, "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-trust.d.ts

@@ -1,2 +1,3 @@
+import "./index2.js";
 import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust2.js";
 export { BootScriptRow, Config, MobileConfig, TrustConfig, apply, buildMobileScript, buildTrustScript, _default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/web-trust2.d.ts

@@ -1,5 +1,5 @@
+import { t as Schema } from "./index2.js";
 import { Context } from "@deepseek-ai/cordis";
-import * as _deepseek_ai_schemastery7 from "@deepseek-ai/schemastery";
 
 //#region src/web-trust.d.ts
 
@@ -76,12 +76,12 @@ interface TrustConfig {
   trustedPageAuthorities?: readonly string[];
 }
 /** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
-declare const Config: _deepseek_ai_schemastery7.default<Schemastery.ObjectS<NoInfer<{
-  trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-  trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+  trustAllHosts: Schema<boolean, boolean, "defined">;
+  trustedPageAuthorities: Schema<string[], string[], "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-  trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+  trustAllHosts: Schema<boolean, boolean, "defined">;
+  trustedPageAuthorities: Schema<string[], string[], "defined">;
 }>>, "plain">;
 /** Cordis plugin name. */
 declare const name = "dashr-web-trust";
@@ -100,12 +100,12 @@ declare function apply(ctx: Context, config: TrustConfig | undefined): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery7.default<Schemastery.ObjectS<NoInfer<{
-    trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-    trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+  Config: Schema<Schemastery.ObjectS<NoInfer<{
+    trustAllHosts: Schema<boolean, boolean, "defined">;
+    trustedPageAuthorities: Schema<string[], string[], "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    trustAllHosts: _deepseek_ai_schemastery7.default<boolean, boolean, "defined">;
-    trustedPageAuthorities: _deepseek_ai_schemastery7.default<string[], string[], "defined">;
+    trustAllHosts: Schema<boolean, boolean, "defined">;
+    trustedPageAuthorities: Schema<string[], string[], "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-trust2.js

@@ -252,20 +252,32 @@ function buildZoomGuardSection() {
 * A fixed, query-free index path prevents token exchange or redirects here;
 * original Host and Cookie headers preserve the native authority binding and
 * lifetime. No upstream private fields or cookie-format copies are needed.
+*
+* 0.2.1: the fence core is `admit()` — the HTTP bridge calls it directly and
+* `requestRejection()` is a thin wrapper over it, so overriding the public
+* `admit` is the one seam that still steers both paths. A fence rejection
+* (403) is retried as cookie-only admission; every other verdict (a live
+* peer, 401 from failed native authentication, disposed) passes through
+* untouched. An accepted cookie admits as the shared browser peer — the same
+* scope native browser authentication grants.
 */
 function installAuthenticationOnlyAdmission(connection) {
-	const original = connection.requestRejection;
+	const original = connection.admit;
 	const response = {
 		writeHead() {},
 		end() {}
 	};
-	connection.requestRejection = (request) => connection.authorizeIndex({
-		headers: request.headers,
-		method: "GET",
-		url: "/index.html"
-	}, response) ? void 0 : 401;
+	connection.admit = (request) => {
+		const admission = original.call(connection, request);
+		if (!("rejection" in admission) || admission.rejection !== 403) return admission;
+		return connection.authorizeIndex({
+			headers: request.headers,
+			method: "GET",
+			url: "/index.html"
+		}, response) ? { peer: connection.browserPeer } : { rejection: 401 };
+	};
 	return () => {
-		connection.requestRejection = original;
+		connection.admit = original;
 	};
 }
 

package/lib/welcome-notice.d.ts

@@ -1,15 +1,15 @@
+import { t as Schema } from "./index2.js";
 import { Context } from "@deepseek-ai/cordis";
-import * as _deepseek_ai_schemastery5 from "@deepseek-ai/schemastery";
 
 //#region src/welcome-notice.d.ts
 declare const name = "dashr-welcome-notice";
 declare const inject: string[];
-declare const Config: _deepseek_ai_schemastery5.default<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
+declare const Config: Schema<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
 declare function apply(ctx: Context): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery5.default<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
+  Config: Schema<NoInfer<Schemastery.ObjectS<{}>>, NoInfer<Schemastery.ObjectT<{}>>, "volatile">;
   apply: typeof apply;
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-dsh",
-  "version": "0.3.1-d",
+  "version": "0.3.1-f",
   "description": "Make your dsh ready for serious coding tasks. (Tools x Schemas)^REPL. `skill://`, `ctx://`, `agent://`, `dvc://`, `dsh://`, Python REPL, Context as Variables, cross compactions recallable, full context revive. `hash-edit`, `dvc://browser`, subagent as function, workflow as function.",
   "type": "module",
   "main": "lib/index.js",