dsh-agent-plugins-market 0.9.0 → 0.9.2

package/lib/packages/market-runtime/src/runtime/host/extension-progress.js

@@ -0,0 +1,120 @@
+/**
+ * Session progress for the extension window: whether a session carries work the
+ * user authored.
+ *
+ * The host folds this answer once per session through its projection registry and
+ * then advances it per committed event, so a window read no longer scans the whole
+ * event log. The wire meaning is unchanged: a started turn, or a user/inbox
+ * message this plugin did not author. A host that publishes no projection registry
+ * falls back to the historical log scan instead of answering a constant.
+ *
+ * @module runtime/host/extension-progress
+ */
+import { z } from 'zod';
+import { EXTENSION_SESSION_SOURCE } from './extension-session-state.js';
+/** The projection key this plugin owns; host-only, so it never reaches a client view. */
+export const EXTENSION_PROGRESS_KEY = 'marketExtensionProgress';
+const STARTED = { started: true };
+const BLANK = { started: false };
+/**
+ * Whether one committed event is authored progress.
+ *
+ * This is the definition the wire field has always carried: a started turn, or a
+ * user/inbox message whose source is not this plugin's own and carries no form.
+ * @param event - one committed session event.
+ * @returns true when the event proves the user started work.
+ */
+export function eventCarriesProgress(event) {
+    if (event.type === 'turn/start')
+        return true;
+    const messages = event.type === 'user/message' ? [event.data] : event.type === 'agent/inbox/spliced' ? event.data.inserted : [];
+    return messages.some(message => message.source.kind !== EXTENSION_SESSION_SOURCE && !('form' in message.source));
+}
+/** The host fold this plugin registers: monotonic, because progress never un-happens. */
+export const extensionProgressProjection = {
+    key: EXTENSION_PROGRESS_KEY,
+    stateVersion: 1,
+    stateSchema: z.object({ started: z.boolean() }),
+    init: () => BLANK,
+    apply: (state, event) => (state.started || !eventCarriesProgress(event) ? state : STARTED)
+};
+/**
+ * Read progress from the log itself.
+ *
+ * The compatibility fallback for a host without the projection registry. The
+ * synchronous full-log reader is deprecated host-side; this call carries the
+ * deferred-migration waiver the deprecation decision allows, and disappears when
+ * every supported host publishes the registry.
+ * @param session - session whose log is scanned.
+ * @returns true when the log carries authored progress.
+ */
+export function scanExtensionProgress(session) {
+    return session.snapshotEvents().some(eventCarriesProgress);
+}
+/**
+ * Owns this plugin's projection registration and answers one session's progress.
+ *
+ * The injected callback re-runs whenever a required service changes, so the
+ * reader guards it with its own disposal flag and owns the injected fiber: a
+ * disposed reader never registers again, and an older effect cleanup never
+ * clears a newer registration pointer.
+ */
+export class ExtensionProgressReader {
+    ctx;
+    unregister;
+    injection;
+    disposed = false;
+    /** Settles once the current registration attempt has run; production reads do not await it. */
+    ready;
+    /**
+     * Register the projection for the lifetime of the calling context.
+     * @param ctx - context whose fiber owns the registration.
+     */
+    constructor(ctx) {
+        this.ctx = ctx;
+        this.injection = this.ctx.inject(['sessionProjections'], scoped => {
+            if (this.disposed)
+                return;
+            scoped.effect(() => {
+                if (this.disposed)
+                    return () => { };
+                const dispose = scoped.sessionProjections.register(extensionProgressProjection);
+                this.unregister = dispose;
+                return () => {
+                    // Identity guard: a cleanup for an older registration must not clear a newer one.
+                    if (this.unregister === dispose)
+                        this.unregister = undefined;
+                    dispose();
+                };
+            }, 'dsh-agent-plugins-market: extension progress projection');
+        });
+        this.ready = Promise.resolve(this.injection);
+    }
+    /** True while this plugin's projection is registered in the live registry. */
+    get registered() {
+        return this.unregister !== undefined;
+    }
+    /**
+     * Whether one session carries authored progress.
+     * @param session - session to answer for.
+     * @returns the folded answer, or the log scan when no registry is published.
+     */
+    read(session) {
+        const state = this.ctx.get('sessionProjections')?.stateOf(session, EXTENSION_PROGRESS_KEY);
+        return state === undefined ? scanExtensionProgress(session) : state.started;
+    }
+    /**
+     * Unregister the projection and release the injected fiber, so a registry that
+     * arrives or cycles later cannot register this reader again.
+     * @returns after the injected fiber has unloaded.
+     */
+    async dispose() {
+        this.disposed = true;
+        const dispose = this.unregister;
+        this.unregister = undefined;
+        dispose?.();
+        const injection = this.injection;
+        this.injection = undefined;
+        await injection?.dispose();
+    }
+}

package/lib/packages/market-runtime/src/runtime/host/extension-runtime.js

@@ -0,0 +1,405 @@
+/** Session-addressed preset operations; only acknowledged session changes replace live contributions. */
+import { isAbsolute } from 'node:path';
+import { SessionId } from '@deepseek-ai/dsh-session';
+import { ExtensionPresetStore, ExtensionPresetError } from '../../application/state/extension-presets.js';
+import { loadResourceFilters } from '../../application/state/resource-filters.js';
+import { extensionResourceEnabled } from '../../application/extension-authorization.js';
+import { CONFIGURATION_PARENT_IDS, captureExtensionSelection } from '../../../../market-contracts/src/contracts/extension-presets.js';
+import { ExtensionSessionState } from './extension-session-state.js';
+import { ExtensionProgressReader } from './extension-progress.js';
+function failure(code) {
+    return Object.assign(new Error(code), { code });
+}
+export function extensionWorkspace(agent) {
+    const cwd = agent.session.header.cwd;
+    if (typeof cwd !== 'string' || !isAbsolute(cwd))
+        throw failure('extension-workspace-unavailable');
+    return cwd;
+}
+export class ExtensionRuntime {
+    ctx;
+    ports;
+    state;
+    store;
+    /** Folded session progress; the log scan is only the no-registry fallback. */
+    progress;
+    resources = new Map();
+    /** Agents whose cached inventory predates the current catalog; authorization fails closed until re-read. */
+    stale = new Set();
+    /** Bumped on every catalog change: a read that began earlier may not publish its answer. */
+    epoch = 0;
+    dirty = new Set();
+    /** Eligible inventory at the last successful rebuild; selection and current availability still gate every call. */
+    registeredIds = new Map();
+    appliedEpochs = new Map();
+    refreshing = new Map();
+    lifetime = new AbortController();
+    disposed = false;
+    /** Per-agent read sequence: a slow earlier response must not overwrite a newer inventory. */
+    reads = new Map();
+    targets = new Map();
+    off = [];
+    constructor(ctx, ports) {
+        this.ctx = ctx;
+        this.ports = ports;
+        this.store = new ExtensionPresetStore(ports.dataRoot);
+        this.progress = new ExtensionProgressReader(ctx);
+        this.state = new ExtensionSessionState(ctx, {
+            ...(ports.eligible === undefined ? {} : { eligible: (agent) => ports.eligible?.(agent) === true }),
+            initialSelection: (agent, source) => this.initialSelection(agent, source),
+            committed: agent => {
+                if (this.appliedEpochs.get(agent) === this.epoch)
+                    this.dirty.delete(agent);
+                try {
+                    ports.committed?.(agent);
+                }
+                catch (error) {
+                    this.dirty.add(agent);
+                    throw error;
+                }
+            },
+            applySelection: async (agent, selection) => {
+                const epoch = this.epoch;
+                await this.refreshInventory(agent);
+                this.targets.set(agent, selection);
+                try {
+                    const receipt = await ports.applySelection(agent, selection);
+                    if (!this.stale.has(agent) && epoch === this.epoch) {
+                        this.appliedEpochs.set(agent, epoch);
+                        this.registeredIds.set(agent, this.availableIds(agent));
+                    }
+                    return receipt;
+                }
+                finally {
+                    this.targets.delete(agent);
+                }
+            }
+        });
+        this.off.push(ctx.on('agent/created', async ({ agent, source }) => {
+            await ports.ready?.(agent, source);
+        }));
+        this.off.push(ctx.on('agent/disposed', ({ agent }) => {
+            this.resources.delete(agent);
+            this.targets.delete(agent);
+            this.dirty.delete(agent);
+            this.stale.delete(agent);
+            this.reads.delete(agent);
+            this.registeredIds.delete(agent);
+            this.appliedEpochs.delete(agent);
+        }));
+    }
+    async start() {
+        await this.state.start();
+        for (const agent of this.ctx.agents.list())
+            await this.ports.ready?.(agent, 'legacy');
+    }
+    ready(agent) {
+        try {
+            return this.state.read(agent) !== undefined;
+        }
+        catch {
+            return false;
+        }
+    }
+    allows(agent, resourceId, suiteId) {
+        if (this.stale.has(agent))
+            return false;
+        if (this.dirty.has(agent) && !this.registeredIds.get(agent)?.has(resourceId))
+            return false;
+        try {
+            const snapshot = this.state.read(agent);
+            return snapshot !== undefined && this.selected(agent, snapshot.selection, resourceId, suiteId);
+        }
+        catch {
+            return false;
+        }
+    }
+    availableIds(agent) {
+        return new Set((this.resources.get(agent) ?? []).filter(row => row.available && row.control !== 'global-only').map(row => row.id));
+    }
+    /** Registration alone may inspect a pending target; execution must call allows. */
+    registrationAllows(agent, resourceId, suiteId) {
+        if (this.stale.has(agent))
+            return false;
+        const target = this.targets.get(agent);
+        return target === undefined ? this.allows(agent, resourceId, suiteId) : this.selected(agent, target, resourceId, suiteId);
+    }
+    selected(agent, selection, resourceId, suiteId) {
+        const resources = this.resources.get(agent) ?? [];
+        const row = resources.find(resource => resource.id === resourceId);
+        // A configuration parent publishes no row anywhere: the hooks bridge and the
+        // mount filter still address it by its suite id, so the grant is derived from
+        // the children it owns, exactly as extensionResourceEnabled derives it for a
+        // parent row that does exist.
+        if (row === undefined) {
+            if (!CONFIGURATION_PARENT_IDS.has(resourceId))
+                return false;
+            return resources.some(child => child.suiteResourceId === resourceId && extensionResourceEnabled(child, selection, resources));
+        }
+        // The caller names the suite with a bare 'source/suite' while the selection
+        // holds 'market:source/suite' resource ids, and extensionResourceEnabled
+        // already requires the authoritative parent (suiteResourceId) to be selected
+        // and available. Comparing the caller's suiteId here could only ever deny a
+        // granted call, so the argument is deliberately not consulted.
+        void suiteId;
+        return extensionResourceEnabled(row, selection, resources);
+    }
+    /**
+     * A catalog change can revoke a global resource at any moment, so every live
+     * agent's cached inventory is dropped and authorization denies until the
+     * inventory has been re-read from the new catalog. Callers never wait for a
+     * panel poll to observe a disable or uninstall.
+     */
+    invalidate() {
+        this.epoch += 1;
+        for (const agent of this.ctx.agents.list()) {
+            if (this.ports.eligible?.(agent) === false)
+                continue;
+            this.stale.add(agent);
+            this.dirty.add(agent);
+        }
+    }
+    /** Re-read every live agent's inventory; an agent whose read fails stays denied. */
+    async refreshAll() {
+        await Promise.all(this.ctx.agents
+            .list()
+            .filter(agent => this.ports.eligible?.(agent) !== false)
+            .map(agent => this.refreshAgent(agent)));
+    }
+    async refreshAgent(agent) {
+        if (this.disposed || !this.dirty.has(agent) || this.refreshing.has(agent))
+            return;
+        const work = async () => {
+            const epoch = this.epoch;
+            await agent.runMaintenance(async (signal) => {
+                const snapshot = this.state.status(agent);
+                if (!snapshot.ready || !snapshot.selection)
+                    return;
+                await this.refreshInventory(agent);
+                signal.throwIfAborted();
+                if (this.stale.has(agent))
+                    return;
+                this.targets.set(agent, snapshot.selection);
+                let receipt = undefined;
+                try {
+                    receipt = await this.ports.applySelection(agent, snapshot.selection);
+                    signal.throwIfAborted();
+                    if (epoch !== this.epoch) {
+                        const staleReceipt = receipt;
+                        receipt = undefined;
+                        await staleReceipt?.rollback();
+                        return;
+                    }
+                    receipt?.commit();
+                }
+                catch (error) {
+                    try {
+                        await receipt?.rollback();
+                    }
+                    catch (cleanupError) {
+                        this.ctx.logger.warn(String(cleanupError));
+                    }
+                    throw error;
+                }
+                finally {
+                    this.targets.delete(agent);
+                }
+                this.registeredIds.set(agent, this.availableIds(agent));
+                this.dirty.delete(agent);
+                try {
+                    this.ports.committed?.(agent);
+                }
+                catch (error) {
+                    this.dirty.add(agent);
+                    throw error;
+                }
+            });
+        };
+        if (agent.status !== 'idle') {
+            // Availability can revoke a capability during a turn without taking over the host's input queue.
+            try {
+                await this.refreshInventory(agent);
+            }
+            catch (error) {
+                this.ctx.logger.warn('extension inventory refresh: ' + String(error));
+            }
+            let removeAbort = () => { };
+            const aborted = new Promise(resolve => {
+                const stop = () => resolve();
+                this.lifetime.signal.addEventListener('abort', stop, { once: true });
+                removeAbort = () => this.lifetime.signal.removeEventListener('abort', stop);
+            });
+            const deferred = Promise.race([agent.whenIdle(), aborted]).then(async () => {
+                removeAbort();
+                this.refreshing.delete(agent);
+                if (!this.disposed && this.ctx.agents.get(agent.id) === agent)
+                    await this.refreshAgent(agent);
+            });
+            this.refreshing.set(agent, deferred);
+            void deferred.catch(error => this.ctx.logger.warn('extension refresh: ' + String(error)));
+            return;
+        }
+        const startedEpoch = this.epoch;
+        const pending = work().catch(error => {
+            this.ctx.logger.warn('extension refresh: ' + String(error));
+        });
+        this.refreshing.set(agent, pending);
+        await pending;
+        this.refreshing.delete(agent);
+        if (!this.disposed && this.dirty.has(agent) && startedEpoch !== this.epoch)
+            await this.refreshAgent(agent);
+    }
+    async refreshInventory(agent) {
+        const epoch = this.epoch;
+        const sequence = (this.reads.get(agent) ?? 0) + 1;
+        this.reads.set(agent, sequence);
+        const resources = await this.ports.inventory(agent);
+        // Publish only when this is still the newest read and the catalog has not
+        // changed since it started: a read that predates a revoke must never clear
+        // the stale mark, and a slow answer must never overwrite a newer inventory.
+        if (this.reads.get(agent) === sequence && epoch === this.epoch) {
+            this.resources.set(agent, resources);
+            this.stale.delete(agent);
+            if (this.dirty.has(agent))
+                this.ports.committed?.(agent);
+        }
+        return resources;
+    }
+    /** The settings Hooks tab: sessionless by design, so no agent is resolved and no session state is consulted. */
+    async hooksOverview() {
+        if (this.ports.hooksOverview === undefined)
+            throw failure('extension-hooks-unavailable');
+        return this.ports.hooksOverview();
+    }
+    /** One declared hook's dry run: the composition resolves the command, this service only gates availability and forwards. */
+    async hookRun(input) {
+        if (this.ports.hookRun === undefined)
+            throw failure('extension-hook-run-unavailable');
+        return this.ports.hookRun(input);
+    }
+    agent(sessionId) {
+        const agent = this.ctx.agents.get(SessionId(sessionId));
+        if (!agent)
+            throw failure('extension-session-not-found');
+        extensionWorkspace(agent);
+        return agent;
+    }
+    async initialSelection(agent, source) {
+        const workspace = extensionWorkspace(agent);
+        const resources = await this.refreshInventory(agent);
+        const library = await this.store.read(workspace);
+        const preset = source === 'legacy' ? undefined : library.presets.find(row => row.id === library.defaultPresetId);
+        if (preset)
+            return captureExtensionSelection(preset, []);
+        const legacy = source === 'legacy' ? await loadResourceFilters(this.ports.dataRoot, workspace) : undefined;
+        const available = resources.filter(row => row.control !== 'global-only' &&
+            row.available &&
+            row.globalEnabled !== false &&
+            // The legacy resource filter predates the hooks face, so it carries no
+            // evidence for it; those rows select like any other when no filter ran.
+            (legacy === undefined || row.face === 'hooks' || (legacy.toggles[row.face] && !legacy.offEntries[row.face]?.includes(row.id))));
+        // The guard set keeps every available id, the configuration parents
+        // included: the child-keeps-parent check below must still see them. Only
+        // the published selection drops a configuration parent, whose grant is
+        // derived from the selected children at read time.
+        const ids = new Set(available.map(row => row.id));
+        return captureExtensionSelection(null, available.filter(row => row.suiteResourceId === undefined || ids.has(row.suiteResourceId)).map(row => row.id));
+    }
+    async window(sessionId) {
+        const agent = this.agent(sessionId);
+        const [library, resources] = await Promise.all([this.store.read(extensionWorkspace(agent)), this.refreshInventory(agent)]);
+        await this.state.whenSelectionSettled(agent);
+        const status = this.state.status(agent);
+        // Not ready is a reportable state, not a failed read: the payload carries
+        // the diagnostics plus a display-only snapshot that authorizes nothing.
+        const state = status.ready ? this.state.read(agent) : undefined;
+        const started = this.progress.read(agent.session);
+        const intent = this.state.intended(agent);
+        return {
+            sessionId,
+            workspace: extensionWorkspace(agent),
+            started,
+            busy: agent.status !== 'idle',
+            library,
+            state: state ?? { revision: status.revision, selection: status.selection ?? captureExtensionSelection(null, []) },
+            // The pending request rides the payload so the manager shows what is coming
+            // without a banner and cannot snap back to the superseded selection.
+            ...(intent === undefined ? {} : { intendedSelection: intent.selection, intendedRevision: intent.revision }),
+            // The last accepted selection revision, effective or pending: the CAS base a
+            // client keeps across a promotion, which never moves backwards.
+            selectionRevision: this.state.selectionRevision(agent),
+            resources,
+            status
+        };
+    }
+    /** Recovery is an explicit, revision-checked act; it never invents a selection. */
+    async recover(sessionId, revision) {
+        const agent = this.agent(sessionId);
+        if (this.dirty.has(agent) && this.state.status(agent).ready) {
+            if (this.state.read(agent)?.revision !== revision)
+                throw failure('extension-session-conflict');
+            await this.refreshAgent(agent);
+            if (this.dirty.has(agent))
+                throw failure('extension-refresh-pending');
+        }
+        else
+            await this.state.recover(agent, revision);
+        await this.ports.ready?.(agent);
+    }
+    async create(sessionId, revision, input) {
+        await this.store.create(extensionWorkspace(this.agent(sessionId)), revision, input);
+    }
+    async update(sessionId, revision, id, input) {
+        const agent = this.agent(sessionId);
+        const workspace = extensionWorkspace(agent);
+        await this.store.update(workspace, revision, id, input);
+        // An edit to the preset this session is running, or has already asked for, is a
+        // request for this session alone: every other session keeps its own snapshot.
+        const library = await this.store.read(workspace);
+        const revised = library.presets.find(row => row.id === id);
+        // A pending request is the newer intent, so it decides both whether this edit
+        // concerns this session and which revision the new request compares against.
+        const intended = this.state.intended(agent);
+        const effective = this.state.status(agent).ready ? this.state.read(agent) : undefined;
+        const selection = intended?.selection ?? effective?.selection;
+        if (revised === undefined || selection?.presetId !== id)
+            return;
+        const resources = await this.refreshInventory(agent);
+        await this.state.requestSelection(agent, this.state.selectionRevision(agent), captureExtensionSelection(revised, resources.filter(row => row.control !== 'global-only' && row.available && row.globalEnabled !== false).map(row => row.id)));
+    }
+    async delete(sessionId, revision, id) {
+        await this.store.delete(extensionWorkspace(this.agent(sessionId)), revision, id);
+    }
+    async setDefault(sessionId, revision, id) {
+        await this.store.setDefault(extensionWorkspace(this.agent(sessionId)), revision, id);
+    }
+    async select(sessionId, revision, id) {
+        const agent = this.agent(sessionId);
+        const library = await this.store.read(extensionWorkspace(agent));
+        const preset = library.presets.find(row => row.id === id);
+        if (id !== null && !preset)
+            throw new ExtensionPresetError('preset-not-found', 'extension preset no longer exists');
+        const resources = await this.refreshInventory(agent);
+        // A request made while a turn owns the session is durable intent, not an
+        // application: the committed selection keeps authorizing until the boundary.
+        const outcome = await this.state.requestSelection(agent, revision, captureExtensionSelection(preset ?? null, resources.filter(row => row.control !== 'global-only' && row.available && row.globalEnabled !== false).map(row => row.id)));
+        if (outcome.applied)
+            await this.ports.ready?.(agent);
+    }
+    async dispose() {
+        this.disposed = true;
+        this.lifetime.abort();
+        await Promise.allSettled([...this.refreshing.values()]);
+        for (const off of this.off.splice(0))
+            off();
+        await this.progress.dispose();
+        await this.state.dispose();
+        this.resources.clear();
+        this.targets.clear();
+        this.stale.clear();
+        this.reads.clear();
+        this.registeredIds.clear();
+        this.appliedEpochs.clear();
+        this.dirty.clear();
+    }
+}