dsh-cindy-host 0.1.20

package/src/cindy-session-row.js

@@ -0,0 +1,171 @@
+/**
+ * Fold a DSH session row into the wire shape the Cindy controller stores.
+ *
+ * THE CONTRACT IS FLAT. `local-db:sessions:list` returns `RemoteSession[]` —
+ * one flat session object per row, identity and status at the top level — and
+ * `local-db:sessions:get` returns exactly one such object. The controller does
+ * NOT unwrap anything: it hands the invoke result straight to
+ * `remoteSessionStore.setDeviceSessions`, which de-dupes on `session.id`.
+ *
+ * `RemoteSessionListItem` (the `{ session: {...}, subtitle, detail, … }` view
+ * model) is built *inside* the controller's own renderers
+ * (`maker-shared/sessionList.ts`, `mobileHome.ts`) and must never cross the wire.
+ * An earlier revision of this file emitted that view model, citing a
+ * `mobileMakerTransport.listSessions()` that does not exist in the Cindy tree;
+ * the result was a silently empty list — `id`, `status` and `deviceLinkDeviceId`
+ * all arrived as `undefined`, so the controller's status filter, device filter,
+ * and de-dupe key each discarded every row without raising anything.
+ *
+ * Only the wire shape belongs here. Anything the controller derives for display
+ * (subtitle, detail, live activity, pending counts, schedule info) is its own
+ * business and is deliberately absent.
+ */
+
+import { toCindyPermissionMode } from './host-models.js';
+
+/** Cindy wire aliases for the one DSH harness; never use these to route a model. */
+export function agentKindForModel({ model, provider, catalog } = {}) {
+  let resolvedModel = typeof model === 'string' && model.trim() !== '' ? model.trim() : null;
+  let resolvedProvider = typeof provider === 'string' && provider.trim() !== '' ? provider.trim() : null;
+  if (resolvedModel === null && resolvedProvider === null) {
+    const fallback = catalog?.default;
+    resolvedModel = typeof fallback?.model === 'string' && fallback.model !== '' ? fallback.model : null;
+    resolvedProvider = typeof fallback?.provider === 'string' && fallback.provider !== '' ? fallback.provider : null;
+  } else if (resolvedProvider === null) {
+    // The default route applies only to its own model. A model shared by two
+    // providers cannot be classified without the session's source.
+    if (catalog?.default?.model === resolvedModel) {
+      resolvedProvider = catalog.default.provider ?? null;
+    } else {
+      const matches = (Array.isArray(catalog?.groups) ? catalog.groups : [])
+        .filter((group) => Array.isArray(group?.models) && group.models.some((candidate) => candidate?.id === resolvedModel));
+      if (matches.length === 1) resolvedProvider = matches[0].id;
+    }
+  }
+  // Pi is reserved for a confirmed DeepSeek source, even if its model is unknown.
+  if (typeof resolvedProvider === 'string' && /^deepseek(?:$|[-_./])/i.test(resolvedProvider)) return 'pi';
+  if (resolvedModel === null || typeof resolvedProvider !== 'string' || resolvedProvider === '') return 'claude-code';
+  if (/^(?:gpt(?:$|[-_./])|chatgpt(?:$|[-_./]))/i.test(resolvedModel)) return 'codex';
+  return 'claude-code';
+}
+const DSH_MODEL = 'pi';
+const DSH_EFFORT = 'default';
+const DSH_PERMISSION_MODE = 'default';
+const UNTITLED = 'Untitled DSH task';
+const MAX_TITLE = 160;
+
+/** Trim a title the way the local read model does, so both surfaces agree. */
+function titleOf(value) {
+  const title = typeof value === 'string' ? value.trim() : '';
+  return title.slice(0, MAX_TITLE) || UNTITLED;
+}
+
+/**
+ * Build one wire session row.
+ * @param item - a source row: `{ id, title, running, updatedAt, createdAt, cwd, blank }`.
+ * @param options - injectable clock and this Host's relay identity.
+ * @returns the flat `RemoteSession` the controller stores.
+ */
+export function toCindySessionListRow(item, { now = () => new Date(), device, defaultModel, catalog } = {}) {
+  const id = String(item.id);
+  const updatedAt = item.updatedAt ?? now().toISOString();
+  const createdAt = item.createdAt ?? updatedAt;
+  const title = titleOf(item.title);
+  const workingDir = typeof item.cwd === 'string' && item.cwd !== '' ? item.cwd : null;
+
+  return {
+    id,
+    title,
+    createdAt,
+    updatedAt,
+    // `'active' | 'archived' | 'deleted'`; the controller's default status filter
+    // is `'active'`, so this field decides whether a row is visible at all.
+    //
+    // DSH has no archived or deleted state, so the value can only come from this
+    // Host's own flags (`session-flags.js`), folded onto the source row before it
+    // reaches here. A row that carries none is active, which is what every row was
+    // before the flags existed.
+    status: item.status === 'archived' || item.status === 'deleted' ? item.status : 'active',
+    agentKind: agentKindForModel({ model: item.model ?? defaultModel, provider: item.providerId, catalog }),
+    // The controller looks the current model up by id in the catalog it fetched
+    // (`availableModels.find(item => item.id === session.model)`), so a
+    // placeholder here leaves the picker with nothing selected even when the
+    // catalog is right. The session's own selection wins; the Host default is
+    // the honest fallback while it is unknown.
+    model: typeof item.model === 'string' && item.model !== ''
+      ? item.model
+      : (typeof defaultModel === 'string' && defaultModel !== '' ? defaultModel : DSH_MODEL),
+    // The source that serves that model, when the session recorded one. The
+    // controller keeps `providerId` beside the model and derives its new-chat draft
+    // runtime from the most recent session (`pickRecentSessionRuntime`), so a row that
+    // drops it hands the next conversation a model with no source. Absent — not null —
+    // when nothing recorded one: the controller reads a missing field as "the Host's
+    // default route", which is exactly what such a session runs.
+    ...(typeof item.providerId === 'string' && item.providerId !== '' ? { providerId: item.providerId } : {}),
+    // The session's own effort, which DSH carries as part of its model
+    // selection. The placeholder is only for a session that has not chosen yet:
+    // answering "default" after a successful `maker:set-effort` would make the
+    // write look like it never landed.
+    effort: typeof item.effort === 'string' && item.effort !== '' ? item.effort : DSH_EFFORT,
+    // The session's own preset when the list carried the `permissions`
+    // projection, so the composer shows the mode actually in force rather than a
+    // placeholder that no picker entry matches.
+    permissionMode: typeof item.permissionMode === 'string' && item.permissionMode !== ''
+      ? toCindyPermissionMode(item.permissionMode)
+      : DSH_PERMISSION_MODE,
+    fastMode: false,
+    workingDir,
+    // The controller groups by this: `workspaceKind === 'dialogue' || !workingDir`
+    // puts a row in the "chats" bucket, everything else under its project.
+    workspaceKind: workingDir === null ? 'dialogue' : 'project',
+    // A blank session has no user turn yet; the controller shows it as a draft.
+    preview: null,
+    userSendAt: typeof item.userSendAt === 'string' && item.userSendAt !== '' ? item.userSendAt : null,
+    _count: Number.isFinite(item.messageCount) && item.messageCount >= 0
+      ? { messages: Math.floor(item.messageCount) }
+      : null,
+    // Not part of the stored row's contract, but harmless and honest: the
+    // controller reads running state from `maker:list-active`, not from here.
+    running: item.running === true,
+    // Which device this row came from. The controller's home aggregates sessions
+    // from every linked computer and filters with
+    // `canonicalDeviceId ?? deviceLinkDeviceId === selectedDeviceId`
+    // (`maker-shared/mobileHome.ts`), so a row that names neither is dropped the
+    // moment the user selects this Host — which is the only way to see it.
+    deviceLinkDeviceId: device?.deviceId ?? null,
+    deviceLinkDeviceName: device?.deviceName ?? null,
+    // Present only when a controller pinned this session here (the flag store's
+    // doing, not DSH's). The controller reads a missing field as "not pinned" — and
+    // on a write reply it reads a missing field as "keep what I have", which is
+    // exactly how an unpin stays applied without this row asserting `null`.
+    ...(typeof item.pinnedAt === 'string' && item.pinnedAt !== '' ? { pinnedAt: item.pinnedAt } : {}),
+  };
+}
+
+/**
+ * Fold a whole listing.
+ * @param items - source rows.
+ * @param options - injectable clock and this Host's relay identity.
+ * @returns the flat array the controller stores.
+ */
+export function toCindySessionList(items, options = {}) {
+  const list = Array.isArray(items) ? items : [];
+  return list.map((item) => toCindySessionListRow(item, options));
+}
+
+/**
+ * Build the `maker:list-active` answer.
+ *
+ * This channel has its own shape — `[{ sessionId, isTurnRunning }]` — and is
+ * neither a session row nor a list item. Answering it with session rows makes
+ * the controller skip every entry, which shows up only as a running badge that
+ * never lights up.
+ * @param items - source rows.
+ * @returns one entry per session that is currently in a turn.
+ */
+export function toCindyActiveSessions(items) {
+  const list = Array.isArray(items) ? items : [];
+  return list
+    .filter((item) => item?.running === true)
+    .map((item) => ({ sessionId: String(item.id), isTurnRunning: true }));
+}

package/src/console-sink.js

@@ -0,0 +1,6 @@
+export class ConsoleSink {
+  constructor(out = console.log) { this.out = out; }
+  async replaceConversations(items) { this.out(JSON.stringify({ channel: "dsh:conversations", items }, null, 2)); }
+  async appendActivity(item) { this.out(JSON.stringify({ channel: "dsh:activity", item }, null, 2)); }
+  async markStale() { this.out(JSON.stringify({ channel: "dsh:projection", state: "stale" }, null, 2)); }
+}

package/src/contracts.js

@@ -0,0 +1,26 @@
+export const ACTIVITY_KINDS = new Set(["session-added", "session-removed", "session-status", "session-subscribed"]);
+
+export function toConversationRow(session) {
+  return {
+    sessionId: String(session.id),
+    title: safeTitle(session.title),
+    phase: session.running ? "running" : session.pendingInteraction ? "waiting" : "idle",
+    updatedAt: session.updatedAt || new Date().toISOString(),
+  };
+}
+
+export function toActivityItem(event) {
+  if (!ACTIVITY_KINDS.has(event.kind)) return null;
+  return {
+    sessionId: String(event.sessionId),
+    sequence: Number(event.sequence),
+    kind: event.kind,
+    phase: event.phase || "unknown",
+    occurredAt: event.occurredAt || new Date().toISOString(),
+  };
+}
+
+function safeTitle(value) {
+  const title = typeof value === "string" ? value.trim() : "";
+  return title.slice(0, 160) || "Untitled DSH task";
+}

package/src/credential-store.js

@@ -0,0 +1,128 @@
+import { createRequire } from 'node:module';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { resolve as resolvePath } from 'node:path';
+
+const SERVICE = 'DSH Cindy Host';
+
+/**
+ * `keytar` is a **native** module, so it is loaded lazily and its absence is not fatal.
+ *
+ * Measured on a clean install (a packed tarball into a fresh `DSH_HOME`): pnpm 10 does not run
+ * dependency build scripts by default, so `keytar.node` was never built, and a top-level import
+ * here made the whole plugin fail to load — the profile would not boot over a *credential store*
+ * it may never need. An optional capability must not be able to break mounting, so the module is
+ * required the moment it is used and a failure degrades to "no credential store": a read answers
+ * "no stored session" (the card asks for a login), and a write throws a named error instead of
+ * pretending to have saved.
+ *
+ * @returns the keytar module, or null when it cannot be loaded on this machine.
+ */
+let keytarModule;
+function keytar() {
+  if (keytarModule === undefined) {
+    try {
+      keytarModule = createRequire(import.meta.url)('keytar');
+    } catch {
+      keytarModule = null;
+    }
+  }
+  return keytarModule;
+}
+
+/** Whether a credential store is usable here, for callers that want to say so. */
+export function credentialStoreAvailable() {
+  return keytar() !== null;
+}
+
+/** The error a write raises when this machine has no usable credential store. */
+export class CredentialStoreUnavailableError extends Error {
+  constructor() {
+    super('this machine has no usable credential store (keytar is not built; on pnpm 10 approve the keytar build script)');
+    this.code = 'CREDENTIAL_STORE_UNAVAILABLE';
+  }
+}
+
+/**
+ * The credential-store entry the default installation has always used.
+ *
+ * The OS keeps these per (service, account), and the account is what separates two DSH
+ * installations on one machine — not a folder, because there is no folder: one machine,
+ * one credential store.
+ */
+export const DEFAULT_ACCOUNT = 'session-v1';
+
+/** DSH's own default home: `~/.dsh` (the same precedence `dsh-home-paths` documents). */
+export function defaultDshHome() {
+  return resolvePath(homedir(), '.dsh');
+}
+
+/** Compare two home paths the way the filesystem would: `~` expanded, case-insensitive on Windows. */
+function sameHome(left, right) {
+  const normalize = (value) => {
+    const expanded = value.startsWith('~')
+      ? resolvePath(homedir(), value.slice(1).replace(/^[\\/]+/, ''))
+      : resolvePath(value);
+    const trimmed = expanded.replace(/[\\/]+$/, '');
+    return process.platform === 'win32' ? trimmed.toLowerCase() : trimmed;
+  };
+  return normalize(left) === normalize(right);
+}
+
+/**
+ * Which credential entry this process owns.
+ *
+ * The rule is **"is this the default home"**, not **"is `DSH_HOME` set"**. That
+ * distinction is not academic: this deployment sets `DSH_HOME=C:\Users\<user>\.dsh`
+ * explicitly — the default home, spelled out — and a rule keyed on the variable being
+ * present sent the real installation looking for an entry that had never existed, so it
+ * booted with no session and would not connect, offering a login form for an account that
+ * was already signed in. Measured right after a restart: `no stored session`.
+ *
+ * `DSH_HOME` naming a *different* home is a separate installation and does get its own
+ * entry.
+ *
+ * Why scoping exists at all: the relay's device identity comes from the *login* —
+ * `hello-ack` echoes a `deviceId` that the stored credential also carries — so two
+ * installations sharing one entry present the **same** device id. The relay enforces one
+ * connection per device (the client's own code: `4409: 同 deviceId 的新连接顶掉了本连接`),
+ * and with a reconnect ladder on both sides that is not a brief overlap but a kicking
+ * loop, with the controller's session list caught in the middle. A scoped credential gives
+ * each installation its own device, its own login, and therefore its own task list.
+ *
+ * @param env - environment to read (injectable for tests).
+ * @param defaultHome - the home treated as the default installation.
+ * @returns the keytar account name for this process.
+ */
+export function credentialAccount(env = process.env, defaultHome = defaultDshHome()) {
+  const home = typeof env?.DSH_HOME === 'string' ? env.DSH_HOME.trim() : '';
+  if (home === '' || sameHome(home, defaultHome)) return DEFAULT_ACCOUNT;
+  // A digest, not the path: this string is written into the OS credential store, and a
+  // Windows path with backslashes and a drive letter has no business being there.
+  const digest = createHash('sha256').update(home).digest('hex').slice(0, 12);
+  return `${DEFAULT_ACCOUNT}@${digest}`;
+}
+
+export async function loadSession(ports = {}) {
+  const account = ports.account ?? credentialAccount();
+  const store = keytar();
+  if (store === null) return null; // no store here: "no stored session", never a crash
+  const value = await store.getPassword(SERVICE, account);
+  return value ? JSON.parse(value) : null;
+}
+
+export async function saveSession(session, ports = {}) {
+  const account = ports.account ?? credentialAccount();
+  const store = keytar();
+  if (store === null) throw new CredentialStoreUnavailableError();
+  await store.setPassword(SERVICE, account, JSON.stringify(session));
+}
+
+export async function clearSession(ports = {}) {
+  const account = ports.account ?? credentialAccount();
+  const store = keytar();
+  // Clearing what does not exist is the outcome the caller wanted, so a missing store is not an
+  // error here — unlike a save, which must not report success it cannot deliver.
+  if (store === null) return;
+  await store.deletePassword(SERVICE, account);
+}

package/src/demo.js

@@ -0,0 +1,9 @@
+import { ConsoleSink } from "./console-sink.js";
+import { FixtureDshSource } from "./fixture-source.js";
+import { ReadOnlyProjection } from "./projection.js";
+
+const source = new FixtureDshSource();
+const projection = new ReadOnlyProjection(new ConsoleSink());
+await projection.start(source);
+await source.emit({ sessionId: "dsh-host-demo", sequence: 1, kind: "session-status", phase: "running", occurredAt: "2026-09-16T05:46:00.000Z" });
+await source.emit({ sessionId: "remote-research", sequence: 2, kind: "session-added", phase: "waiting", occurredAt: "2026-09-16T05:46:01.000Z" });

package/src/dsh-active-sessions.js

@@ -0,0 +1,59 @@
+/**
+ * Read the running subset from DSH's live registry, never the persisted corpus.
+ *
+ * Services are resolved for each call so unload/reload cannot leave cached running
+ * flags behind. `null` means this runtime lacks the required API; an empty array
+ * is authoritative. Actual read failures propagate to the caller's legacy fallback.
+ *
+ * DSH's session-controller summary uses Agent.status, Agent.session identity,
+ * sessionListMetadata.blank (falling back to Session.seq), and lastPromptAt.
+ * Keep the same facts here without controller.list(), persistence, or log copies.
+ * snapshot() is current, unlike cachedSnapshot(); a first touch may still lazily
+ * materialize in-memory projections, but only for eligible running roots.
+ */
+export function readActiveSessionSummaries(ctx) {
+  if (typeof ctx?.get !== 'function') return null;
+  const agents = ctx.get('agents');
+  const sessions = ctx.get('sessions');
+  const projections = ctx.get('sessionProjections');
+  if (typeof agents?.list !== 'function' || typeof agents?.get !== 'function'
+    || typeof sessions?.get !== 'function' || typeof projections?.snapshot !== 'function') {
+    return null;
+  }
+
+  const listed = agents.list();
+  if (!Array.isArray(listed)) throw new TypeError('agents.list() must return an array');
+  const result = [];
+  for (const agent of listed) {
+    if (agent?.status !== 'running') continue;
+    const id = agent.id;
+    if (agents.get(id) !== agent) continue;
+    const session = sessions.get(id);
+    if (!session || agent.session !== session) continue;
+    const header = session.header;
+    if (!header || header.id !== id || header.origin === 'subagent'
+      || header.parentSession != null || typeof header.cwd !== 'string' || !header.cwd) continue;
+
+    const snapshot = projections.snapshot(session, ['sessionListMetadata']);
+    const metadata = snapshot.values.sessionListMetadata;
+    const blank = metadata?.blank ?? session.seq === 0;
+    if (blank === true) continue;
+    // A service may synchronously trigger lifecycle work while deriving a view.
+    // Never publish an entry replaced or detached during that read.
+    if (agents.get(id) !== agent || agent.status !== 'running'
+      || sessions.get(id) !== session || agent.session !== session) continue;
+    result.push({
+      sessionId: id,
+      updatedAt: Math.max(header.createdAt, metadata?.lastPromptAt ?? 0),
+      agentAvailable: true,
+      running: true,
+      blank,
+      cwd: header.cwd,
+      ...(header.parentSession === undefined ? {} : { parentSessionId: header.parentSession }),
+      ...(header.origin === undefined ? {} : { origin: header.origin }),
+      projections: snapshot,
+    });
+  }
+  result.sort((left, right) => right.updatedAt - left.updatedAt);
+  return result;
+}

package/src/dsh-host-source.js

@@ -0,0 +1,62 @@
+/**
+ * Host-only integration seam. A DSH profile bundle constructs the public
+ * InProcessApiClient and supplies the public events API. This standalone demo
+ * never imports DSH nested dependencies.
+ */
+export class DshHostSource {
+  constructor(client) {
+    this.client = client;
+    this.controller = null;
+  }
+
+  async listSessions() {
+    const response = await this.client.sessions.list({});
+    if (!response.result.ok) throw new Error('DSH session list failed');
+    return response.result.value.items.map((session) => ({
+      id: session.sessionId,
+      running: Boolean(session.running),
+      // session.list intentionally carries no title or pending-interaction payload.
+      updatedAt: new Date(session.updatedAt).toISOString(),
+    }));
+  }
+
+  onEvent(listener) {
+    this.controller = new AbortController();
+    const signal = this.controller.signal;
+    Promise.all([this.consumeHost(signal, listener), this.consumeMux(signal, listener)])
+      .catch(() => { if (!signal.aborted) listener({ kind: "stream-failed" }); });
+    return () => this.controller.abort();
+  }
+
+  async consumeHost(signal, listener) {
+    for await (const frame of this.client.events.host({}, signal)) {
+      const item = hostFrame(frame.payload);
+      if (item) await listener(item);
+    }
+  }
+
+  async consumeMux(signal, listener) {
+    for await (const frame of this.client.events.mux({}, signal)) {
+      const item = muxFrame(frame.payload);
+      if (item) await listener(item);
+    }
+  }
+}
+
+function hostFrame(frame) {
+  if (frame.type === 'stream/error') return { kind: 'stream-failed' };
+  if (frame.type === 'host/session-added') return summary(frame, 'session-added');
+  if (frame.type === 'host/session-removed') return summary(frame, 'session-removed');
+  if (frame.type === 'host/session-status') return summary(frame, 'session-status');
+  return null;
+}
+
+function summary(frame, kind) {
+  return { sessionId: frame.sessionId, sequence: 0, kind, phase: frame.running ? 'running' : 'idle' };
+}
+
+function muxFrame(frame) {
+  if (frame.type === 'stream/error') return { kind: 'stream-failed' };
+  if (frame.type !== 'session/subscribed') return null;
+  return { sessionId: frame.sessionId, sequence: frame.lastSeq || 0, kind: 'session-subscribed', phase: 'subscribed' };
+}