better-dsh 0.3.1 → 0.3.2

package/lib/url-schemes/index.d.ts

@@ -1,6 +1,6 @@
 import { Context } from "@deepseek-ai/cordis";
 import { ToolDefinition } from "@deepseek-ai/dsh-tools";
-import * as _deepseek_ai_schemastery17 from "@deepseek-ai/schemastery";
+import * as _deepseek_ai_schemastery11 from "@deepseek-ai/schemastery";
 
 //#region src/url-schemes/tools/write.d.ts
 
@@ -50,12 +50,12 @@ declare const inject: string[];
  * real patch-line config. Schema-level defaults (both ON — the service is
  * opt-out) survive every overlay layer, per the v0.2.2a ruling.
  */
-declare const Config: _deepseek_ai_schemastery17.default<Schemastery.ObjectS<NoInfer<{
-  urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-  hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+declare const Config: _deepseek_ai_schemastery11.default<Schemastery.ObjectS<NoInfer<{
+  urlSchemes: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
+  hashline: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-  hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+  urlSchemes: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
+  hashline: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
 }>>, "plain">;
 /** Register the four URL-aware tools on one agent's own scope layer. */
 /**
@@ -75,12 +75,12 @@ declare function apply(ctx: Context, config: UrlSchemesConfig | undefined): void
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery17.default<Schemastery.ObjectS<NoInfer<{
-    urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-    hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+  Config: _deepseek_ai_schemastery11.default<Schemastery.ObjectS<NoInfer<{
+    urlSchemes: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
+    hashline: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    urlSchemes: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
-    hashline: _deepseek_ai_schemastery17.default<boolean, boolean, "defined">;
+    urlSchemes: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
+    hashline: _deepseek_ai_schemastery11.default<boolean, boolean, "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/url-schemes/index.js

@@ -1,10 +1,10 @@
-import { r as __toESM, t as __commonJS } from "../chunk-DQxbwPpZ.js";
-import { t as Schema } from "../lib-C8_jXvwA.js";
-import { i as PACKAGE_ROOT } from "../kernel-env-BOF0fNHn.js";
-import { n as captureNativeTools } from "../native-capture-BEByDXYM.js";
-import { a as createHttpHandler, c as listDvcDevices, d as UrlResolver, f as UrlSchemesError, h as SCHEME_NAMES, i as HTTP_SCHEMES, l as registerDvcDevice, m as parseUrl, n as wrapFsWithSchemes, o as createDvcHandler, p as applySelector, r as resolveDocsDir, s as dispatchDvcWrite, u as createDshHandler } from "../wrap-0VA0uFx8.js";
-import { n as Parser } from "../web-tree-sitter-CPrPD4J2.js";
-import { a as primaryServerForFile, c as serversForFile, n as findWorkspaceRoot, o as resolveCommandPath, r as installHintFor, s as serverByName } from "../lsp-server-registry-D4VLs1Sm.js";
+import { r as __toESM, t as __commonJS } from "../chunk.js";
+import { t as Schema } from "../lib.js";
+import { t as PACKAGE_ROOT } from "../kernel-env2.js";
+import { n as captureNativeTools } from "../native-capture.js";
+import { a as createHttpHandler, c as listDvcDevices, d as UrlResolver, f as UrlSchemesError, h as SCHEME_NAMES, i as HTTP_SCHEMES, l as registerDvcDevice, m as parseUrl, n as wrapFsWithSchemes, o as createDvcHandler, p as applySelector, r as resolveDocsDir, s as dispatchDvcWrite, u as createDshHandler } from "../wrap.js";
+import { n as Parser } from "../web-tree-sitter.js";
+import { a as primaryServerForFile, c as serversForFile, n as findWorkspaceRoot, o as resolveCommandPath, r as installHintFor, s as serverByName } from "../lsp-server-registry.js";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
@@ -12,12 +12,12 @@ import * as path$1 from "node:path";
 import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { homedir, tmpdir } from "node:os";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import * as fsPromises from "node:fs/promises";
 import { lstat, mkdir, mkdtemp, readFile, readdir, readlink, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { ESCALATION_TARGETS, approveEscalation, escalationHintMarker, sandboxDenialMarker, validateEscalationArgs } from "@deepseek-ai/dsh-sandbox";
-import { homedir, tmpdir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
@@ -133,7 +133,7 @@ function astEngine() {
 	return enginePromise;
 }
 async function boot() {
-	const bg = await import("../wasm_bg-CNXhHjVg.js");
+	const bg = await import("../wasm_bg.js");
 	const bytes = await readAsset(ASTGREP_WASM.file);
 	const { instance } = await WebAssemblyGlobal.instantiate(bytes, { "./wasm_bg.js": bg });
 	bg.__wbg_set_wasm(instance.exports);
@@ -1435,7 +1435,7 @@ const PUPPETEER_CORE_VERSION = "25.3.0";
 */
 async function loadPuppeteer() {
 	if (puppeteerModule === void 0) try {
-		puppeteerModule = await import("../puppeteer-core-Dnd7eqel.js");
+		puppeteerModule = await import("../puppeteer-core.js");
 	} catch {
 		try {
 			puppeteerModule = await import(pathToFileURL((await ensureVendored({
@@ -2500,7 +2500,7 @@ function ensureMustHave(gate, language) {
 	if (!MUST_HAVE.has(language) || gate.installTried.has(language)) return;
 	gate.installTried.add(language);
 	(async () => {
-		const registry = await import("../lsp-server-registry-BcdkHROD.js");
+		const registry = await import("../lsp-server-registry2.js");
 		const probePath = `/tmp/x.${language === "python" ? "py" : "ts"}`;
 		const primary = registry.primaryServerForFile(probePath);
 		if (primary === null) return;
@@ -3189,7 +3189,7 @@ async function lspDeviceRead(subpath, session) {
 	if (parsed === void 0) return `unknown read path dvc://lsp/${subpath} — reads: status | diagnostics?file=…[&all=1] | definition?file=&line=[&character=|&symbol=] | references?… | hover?…`;
 	if (parsed.action === "status") {
 		const availability = {};
-		const registry = await import("../lsp-server-registry-BcdkHROD.js");
+		const registry = await import("../lsp-server-registry2.js");
 		for (const language of [
 			"python",
 			"typescript",

package/lib/{wasm_bg-CNXhHjVg.js → wasm_bg.js}

@@ -1,4 +1,4 @@
-import { n as Parser, t as Language } from "./web-tree-sitter-CPrPD4J2.js";
+import { n as Parser, t as Language } from "./web-tree-sitter.js";
 
 //#region node_modules/@ast-grep/wasm/wasm_bg.js
 var Pos = class Pos {

package/lib/web-password.d.ts

@@ -1,7 +1,7 @@
 import { Context } from "@deepseek-ai/cordis";
 import { IncomingMessage } from "node:http";
 import { CredentialRecord } from "@deepseek-ai/dsh-credentials";
-import * as _deepseek_ai_schemastery11 from "@deepseek-ai/schemastery";
+import * as _deepseek_ai_schemastery21 from "@deepseek-ai/schemastery";
 
 //#region src/web-password.d.ts
 
@@ -123,10 +123,10 @@ interface WebPasswordConfig {
   /** Absolute browser-session lifetime in days. Default: 30 (the native default). */
   cookieMaxAgeDays?: number;
 }
-declare const Config: _deepseek_ai_schemastery11.default<Schemastery.ObjectS<NoInfer<{
-  cookieMaxAgeDays: _deepseek_ai_schemastery11.default<number, number, "defined">;
+declare const Config: _deepseek_ai_schemastery21.default<Schemastery.ObjectS<NoInfer<{
+  cookieMaxAgeDays: _deepseek_ai_schemastery21.default<number, number, "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
-  cookieMaxAgeDays: _deepseek_ai_schemastery11.default<number, number, "defined">;
+  cookieMaxAgeDays: _deepseek_ai_schemastery21.default<number, number, "defined">;
 }>>, "plain">;
 /** Cordis plugin name; also the scope of this row's credential record. */
 declare const name = "dashr-web-password";
@@ -145,10 +145,10 @@ declare function apply(ctx: Context, config?: WebPasswordConfig): void;
 declare const _default: {
   name: string;
   inject: string[];
-  Config: _deepseek_ai_schemastery11.default<Schemastery.ObjectS<NoInfer<{
-    cookieMaxAgeDays: _deepseek_ai_schemastery11.default<number, number, "defined">;
+  Config: _deepseek_ai_schemastery21.default<Schemastery.ObjectS<NoInfer<{
+    cookieMaxAgeDays: _deepseek_ai_schemastery21.default<number, number, "defined">;
   }>>, Schemastery.ObjectT<NoInfer<{
-    cookieMaxAgeDays: _deepseek_ai_schemastery11.default<number, number, "defined">;
+    cookieMaxAgeDays: _deepseek_ai_schemastery21.default<number, number, "defined">;
   }>>, "plain">;
   apply: typeof apply;
 };

package/lib/web-password.js

@@ -1,4 +1,4 @@
-import { t as Schema } from "./lib-C8_jXvwA.js";
+import { t as Schema } from "./lib.js";
 import { createHash, createHmac, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { credentialKey } from "@deepseek-ai/dsh-credentials";

package/lib/web-trust.d.ts

@@ -1,2 +1,2 @@
-import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust-CwZrTBcl.js";
+import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust2.js";
 export { BootScriptRow, Config, MobileConfig, TrustConfig, apply, buildMobileScript, buildTrustScript, _default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/web-trust.js

@@ -1,4 +1,4 @@
-import "./lib-C8_jXvwA.js";
-import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust-D6gJpUMf.js";
+import "./lib.js";
+import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust2.js";
 
 export { Config, apply, buildMobileScript, buildTrustScript, web_trust_default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/{web-trust-D6gJpUMf.js → web-trust2.js}

@@ -1,4 +1,4 @@
-import { t as Schema } from "./lib-C8_jXvwA.js";
+import { t as Schema } from "./lib.js";
 import { Context } from "@deepseek-ai/cordis";
 
 //#region src/mobile/zoom-guard.ts
@@ -252,20 +252,32 @@ function buildZoomGuardSection() {
 * A fixed, query-free index path prevents token exchange or redirects here;
 * original Host and Cookie headers preserve the native authority binding and
 * lifetime. No upstream private fields or cookie-format copies are needed.
+*
+* 0.2.1: the fence core is `admit()` — the HTTP bridge calls it directly and
+* `requestRejection()` is a thin wrapper over it, so overriding the public
+* `admit` is the one seam that still steers both paths. A fence rejection
+* (403) is retried as cookie-only admission; every other verdict (a live
+* peer, 401 from failed native authentication, disposed) passes through
+* untouched. An accepted cookie admits as the shared browser peer — the same
+* scope native browser authentication grants.
 */
 function installAuthenticationOnlyAdmission(connection) {
-	const original = connection.requestRejection;
+	const original = connection.admit;
 	const response = {
 		writeHead() {},
 		end() {}
 	};
-	connection.requestRejection = (request) => connection.authorizeIndex({
-		headers: request.headers,
-		method: "GET",
-		url: "/index.html"
-	}, response) ? void 0 : 401;
+	connection.admit = (request) => {
+		const admission = original.call(connection, request);
+		if (!("rejection" in admission) || admission.rejection !== 403) return admission;
+		return connection.authorizeIndex({
+			headers: request.headers,
+			method: "GET",
+			url: "/index.html"
+		}, response) ? { peer: connection.browserPeer } : { rejection: 401 };
+	};
 	return () => {
-		connection.requestRejection = original;
+		connection.admit = original;
 	};
 }
 

package/lib/welcome-notice.js

@@ -1,4 +1,4 @@
-import { t as Schema } from "./lib-C8_jXvwA.js";
+import { t as Schema } from "./lib.js";
 
 //#region src/welcome-notice.ts
 const name = "dashr-welcome-notice";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-dsh",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Make your dsh ready for serious coding tasks. (Tools x Schemas)^REPL. `skill://`, `ctx://`, `agent://`, `dvc://`, `dsh://`, Python REPL, Context as Variables, cross compactions recallable, full context revive. `hash-edit`, `dvc://browser`, subagent as function, workflow as function.",
   "type": "module",
   "main": "lib/index.js",
@@ -71,17 +71,17 @@
     "cordis.patch.yml",
     "eval-description.md",
     "url-schemes-instruction.md",
-    "scripts/kernel-provision.mjs"
+    "scripts/kernel-check.mjs"
   ],
   "scripts": {
     "prebuild": "node scripts/copy-docs.mjs",
-    "build": "tsdown && npm run build-client && node scripts/copy-kernel-bridge.mjs && node scripts/copy-ast-assets.mjs",
+    "build": "tsdown && npm run build-client && node scripts/copy-kernel-bridge.mjs && node scripts/copy-ast-assets.mjs && node scripts/copy-helper-bins.mjs",
     "typecheck": "npm run typecheck:host && npm run typecheck:client",
     "typecheck:host": "tsc --noEmit",
     "typecheck:client": "tsc -p tsconfig.client.json",
     "test": "vitest --run",
     "test:watch": "vitest",
-    "kernel:venv": "node scripts/kernel-provision.mjs",
+    "kernel:check": "node scripts/kernel-check.mjs",
     "build-client": "tsx scripts/build-client.ts"
   },
   "license": "MIT",

package/scripts/kernel-check.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+/** Check an existing interpreter; never install Python or create an environment. */
+const { resolveKernelEnv } = await import(new URL('../lib/kernel-env.js', import.meta.url).href)
+const env = await resolveKernelEnv({ python: process.env.DASHR_KERNEL_PYTHON })
+console.log(`Better Python REPL ready: Python ${env.version} at ${env.python}`)

package/lib/BrowserWebSocketTransport-D1aFReu_.js

@@ -1,4 +0,0 @@
-import "./util-BHL_dfV_.js";
-import { t as BrowserWebSocketTransport } from "./BrowserWebSocketTransport-wm99h94r.js";
-
-export { BrowserWebSocketTransport };

package/lib/LaunchOptions-DxQQ0s-A.js

@@ -1,4 +0,0 @@
-import "./main-BeCgUd20.js";
-import { t as convertPuppeteerChannelToBrowsersChannel } from "./LaunchOptions-5eg7E0ye.js";
-
-export { convertPuppeteerChannelToBrowsersChannel };

package/lib/NodeWebSocketTransport-BRLjmu2R.js

@@ -1,4 +0,0 @@
-import "./util-BHL_dfV_.js";
-import { t as NodeWebSocketTransport } from "./NodeWebSocketTransport-D9ysYGLM.js";
-
-export { NodeWebSocketTransport };

package/lib/kernel-env-BOF0fNHn.js

@@ -1,91 +0,0 @@
-import { existsSync, mkdirSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { execFile } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
-
-//#region src/kernel-env.ts
-const exec = promisify(execFile);
-const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const AUTO_PYTHON_SENTINEL = "python3";
-const DEFAULT_KERNEL_PYTHON_VERSION = "3.11";
-const DILL_VERSION = "0.4.1";
-function uvToolEnv(venvDir) {
-	const cache = join(dirname(venvDir), ".uv-cache");
-	return {
-		...process.env,
-		UV_CACHE_DIR: cache,
-		UV_PYTHON_INSTALL_DIR: join(cache, "python"),
-		UV_LINK_MODE: "copy"
-	};
-}
-function uvVenvArgs(dir, version) {
-	return [
-		"venv",
-		dir,
-		"--python",
-		version
-	];
-}
-function venvFallbackArgs(dir) {
-	return [
-		"-m",
-		"venv",
-		"--without-pip",
-		dir
-	];
-}
-function venvPython(dir) {
-	return join(dir, process.platform === "win32" ? "Scripts/python.exe" : "bin/python");
-}
-async function probe(python) {
-	try {
-		const { stdout } = await exec(python, ["-c", "import ast, asyncio, json, sys; assert sys.version_info >= (3, 9), \"Python >=3.9 required\"; print(json.dumps(sys.version.split()[0]))"], {
-			timeout: 15e3,
-			env: {
-				...process.env,
-				PYTHONDONTWRITEBYTECODE: "1"
-			}
-		});
-		return JSON.parse(stdout.trim());
-	} catch (error) {
-		throw new Error(`Better Python REPL requires Python >=3.9. Could not use ${JSON.stringify(python)}: ${error instanceof Error ? error.message : String(error)}. Configure python with a working interpreter path.`);
-	}
-}
-async function resolveKernelEnv(options = {}) {
-	if (options.python && options.python !== AUTO_PYTHON_SENTINEL) return {
-		python: options.python,
-		managed: false,
-		venvDir: void 0,
-		dill: true,
-		version: await probe(options.python)
-	};
-	const venvDir = options.venvDir ?? join(PACKAGE_ROOT, ".venv-kernel");
-	const python = venvPython(venvDir);
-	if (!existsSync(python)) {
-		if (options.autoInstall === false) throw new Error(`Better Python REPL managed interpreter is missing at ${python}; configure python or run npm run kernel:venv`);
-		options.log?.("info", `Creating stdlib-only Python environment at ${venvDir} (no pip packages)`);
-		let uv = false;
-		try {
-			await exec("uv", ["--version"], { timeout: 1e4 });
-			uv = true;
-		} catch {}
-		if (uv) {
-			mkdirSync(join(dirname(venvDir), ".uv-cache"), { recursive: true });
-			await exec("uv", uvVenvArgs(venvDir, options.pythonVersion ?? DEFAULT_KERNEL_PYTHON_VERSION), {
-				timeout: 12e4,
-				env: uvToolEnv(venvDir)
-			});
-		} else await exec("python3", venvFallbackArgs(venvDir), { timeout: 12e4 });
-	}
-	return {
-		python,
-		managed: true,
-		venvDir,
-		dill: true,
-		version: await probe(python)
-	};
-}
-
-//#endregion
-export { resolveKernelEnv as a, venvFallbackArgs as c, PACKAGE_ROOT as i, DEFAULT_KERNEL_PYTHON_VERSION as n, uvToolEnv as o, DILL_VERSION as r, uvVenvArgs as s, AUTO_PYTHON_SENTINEL as t };

package/scripts/kernel-provision.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-/** Explicit compatibility command: prepare only a stdlib Python environment, never pip packages. */
-const { resolveKernelEnv } = await import(new URL('../lib/kernel-env.js', import.meta.url).href)
-const env = await resolveKernelEnv({ log: (level, message) => console[level === 'warn' ? 'warn' : 'log'](message) })
-console.log(`Better Python REPL ready: Python ${env.version} at ${env.python}`)