dsh-code 1.0.4 → 1.0.5

package/lib/index.mjs

@@ -4,11 +4,11 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import { readFileSync, realpathSync } from "node:fs";
 import os, { homedir } from "node:os";
-import { mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { installModelSelection } from "@deepseek-ai/dsh-agent";
-import { MessageId, ReasoningEffortId, assertNever, boundContextSummary, createUserMessage, normalizeApiKey } from "@deepseek-ai/dsh-llm";
+import { MessageId, ReasoningEffortId, boundContextSummary, createUserMessage, normalizeApiKey } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { PassThrough, Stream } from "node:stream";
 import process$1, { cwd, env } from "node:process";
@@ -22,6 +22,7 @@ import { AuthorizationDeclinedError } from "@deepseek-ai/dsh-authorization";
 import { fileURLToPath } from "node:url";
 import { UserQuestionError } from "@deepseek-ai/dsh-user-questions";
 import { isUserInvocable } from "@deepseek-ai/dsh-skill";
+import { assertNever } from "@deepseek-ai/dsh-util-values";
 //#region node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js
 /**
 * @license React
@@ -30061,6 +30062,26 @@ function parseHistoryFile(raw, max = 100) {
 	return kept.slice(-max);
 }
 /**
+* The append unit for the persistent file: one JSON line, so a multi-line
+* draft still occupies exactly one physical line. Each submission appends
+* this unit at the end of the file, so concurrent terminals add entries
+* after each other. Node chunks one append at 512 KiB: a pasted entry
+* beyond that size could interleave mid-line with another writer's
+* chunks, and the damaged line then drops out at the next parse —
+* recall tolerates the loss by design.
+*/
+function historyLine(text) {
+	return serializeHistoryEntry(text) + "\n";
+}
+/**
+* Whether the file on disk differs from its canonical form (deduped and
+* capped). True means stale lines have accumulated and the next boot
+* should rewrite it once, atomically.
+*/
+function needsCompaction(raw, max = 100) {
+	return serializeHistoryList(parseHistoryFile(raw, max)) !== raw;
+}
+/**
 * Record one in-session submission: empty text is ignored and an adjacent
 * duplicate collapses (Codex `record_local_submission` semantics). The local
 * pool shares the persistent pool's cap so the recall space stays bounded.
@@ -30075,10 +30096,10 @@ function recordLocalEntry(local, text, max = 100) {
 	return [...local, text].slice(-max);
 }
 /**
-* Serialize a capped entry list to the history file format (one JSON line per
-* entry, trailing newline). The runner writes the in-memory list as the whole
-* file, so rapid same-process submissions cannot lose entries to a
-* read-modify-write race (the file is never read back before writing).
+* Serialize a capped entry list to the history file format (one JSON line
+* per entry, trailing newline). The boot-time compaction writes this
+* canonical form once when stale lines have accumulated; submissions
+* themselves only ever append a single line.
 * @param entries - the entries to persist, oldest first.
 * @returns the file content, '' for an empty list.
 */
@@ -35789,13 +35810,15 @@ async function syncModelCapabilities(ctx, notify) {
 //#region src/questions.ts
 const ABORT_ERROR = new UserQuestionError("ask_user_question was interrupted before the user answered", "ASK_ABORTED");
 /**
-* Mount the single `ctx.userQuestions` UI provider over a FIFO queue.
-* @param ctx - context carrying the `userQuestions` service (dsh-base).
-* @returns the store the renderer subscribes to; a context without the
-* service yields a permanently empty store.
+* Mount the `user-questions/request` answerer over a FIFO queue.
+* @param ctx - plugin context whose event bus carries the waterfall.
+* @param owns - agents this terminal answers for; every other request is
+* deferred back into the waterfall (`next()`), so sibling answerers stay
+* usable. Agent-less asks are claimed: this TUI is the only human surface
+* in the process.
+* @returns the store the renderer subscribes to.
 */
-function mountQuestionProvider(ctx) {
-	const service = ctx.get("userQuestions");
+function mountQuestionProvider(ctx, owns) {
 	let snapshot = { pending: void 0 };
 	let active;
 	const queue = [];
@@ -35810,54 +35833,40 @@ function mountQuestionProvider(ctx) {
 		active = next;
 		set({ pending: next });
 	};
-	if (service !== void 0) {
-		if (typeof service.registerProvider !== "function") return {
-			subscribe(listener) {
-				listeners.add(listener);
-				return () => {
-					listeners.delete(listener);
-				};
-			},
-			getSnapshot() {
-				return snapshot;
-			},
-			submit() {},
-			cancel() {}
-		};
-		service.registerProvider({ ask(request) {
-			return new Promise((resolve, reject) => {
-				const onAbort = () => {
-					if (active === pending) {
-						active = void 0;
-						set({ pending: void 0 });
-						advance();
-					} else {
-						const at = queue.indexOf(pending);
-						if (at >= 0) queue.splice(at, 1);
-					}
-					reject(ABORT_ERROR);
-				};
-				const detachAbort = () => {
-					if (request.signal !== void 0) request.signal.removeEventListener("abort", onAbort);
-				};
-				const pending = {
-					request,
-					resolve,
-					reject,
-					detachAbort
-				};
-				if (request.signal?.aborted === true) {
-					reject(ABORT_ERROR);
-					return;
+	ctx.on("user-questions/request", (request, next) => {
+		if (request.agent !== void 0 && !owns(request.agent)) return next();
+		return new Promise((resolve, reject) => {
+			const onAbort = () => {
+				if (active === pending) {
+					active = void 0;
+					set({ pending: void 0 });
+					advance();
+				} else {
+					const at = queue.indexOf(pending);
+					if (at >= 0) queue.splice(at, 1);
 				}
-				request.signal?.addEventListener("abort", onAbort, { once: true });
-				if (active === void 0) {
-					active = pending;
-					set({ pending });
-				} else queue.push(pending);
-			});
-		} });
-	}
+				reject(ABORT_ERROR);
+			};
+			const detachAbort = () => {
+				if (request.signal !== void 0) request.signal.removeEventListener("abort", onAbort);
+			};
+			const pending = {
+				request,
+				resolve,
+				reject,
+				detachAbort
+			};
+			if (request.signal?.aborted === true) {
+				reject(ABORT_ERROR);
+				return;
+			}
+			request.signal?.addEventListener("abort", onAbort, { once: true });
+			if (active === void 0) {
+				active = pending;
+				set({ pending });
+			} else queue.push(pending);
+		});
+	});
 	return {
 		subscribe(listener) {
 			listeners.add(listener);
@@ -36633,7 +36642,12 @@ function selectForkSeed(events, atSeq) {
 }
 //#endregion
 //#region src/git-workflow.ts
-/** Read-only Git inspection used by /diff and /review. */
+/**
+* Read-only Git inspection used by /diff and /review. Every diff
+* invocation carries --no-ext-diff and --no-textconv, so configured
+* external diff drivers and text converters can never execute as a
+* side effect of reading a diff.
+*/
 /** Split Git's stable `diff --git` framing without interpreting patch content. */
 function parseGitDiffFiles(text) {
 	if (text === "") return [];
@@ -36656,6 +36670,7 @@ function parseGitDiffSpec(argument) {
 		args: [
 			"diff",
 			"--no-ext-diff",
+			"--no-textconv",
 			"--unified=3",
 			"HEAD",
 			"--"
@@ -36666,6 +36681,7 @@ function parseGitDiffSpec(argument) {
 		args: [
 			"diff",
 			"--no-ext-diff",
+			"--no-textconv",
 			"--unified=3",
 			"--cached",
 			"--"
@@ -36677,6 +36693,7 @@ function parseGitDiffSpec(argument) {
 		args: [
 			"diff",
 			"--no-ext-diff",
+			"--no-textconv",
 			"--unified=3",
 			value,
 			"--"
@@ -36700,8 +36717,25 @@ function executeGit(cwd, args, signal) {
 		});
 	});
 }
+/** Arguments for the unstaged-only fallback below. */
+const UNSTAGED_DIFF_ARGS = [
+	"diff",
+	"--no-ext-diff",
+	"--no-textconv",
+	"--unified=3",
+	"--"
+];
+/** Whether the repository has at least one commit (a HEAD revision). */
+function hasHeadRevision(cwd, signal) {
+	return executeGit(cwd, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	], signal).then(() => true).catch(() => false);
+}
 /**
-* Load one complete textual diff without invoking external diff drivers.
+* Load one complete textual diff without invoking external programs.
 * @param signal - aborted by the caller on session switches/quit, killing the
 * git subprocess instead of letting a stale repository's diff land later.
 */
@@ -36714,15 +36748,10 @@ async function loadGitDiff(cwd, argument, signal) {
 			files: parseGitDiffFiles(text)
 		};
 	} catch (error) {
-		if (argument.trim() !== "") throw error;
+		if (argument.trim() !== "" || signal?.aborted === true || await hasHeadRevision(cwd, signal)) throw error;
 		return {
-			title: "git diff - working tree",
-			files: parseGitDiffFiles(await executeGit(cwd, [
-				"diff",
-				"--no-ext-diff",
-				"--unified=3",
-				"--"
-			], signal))
+			title: "git diff - working tree (no commits yet)",
+			files: parseGitDiffFiles(await executeGit(cwd, UNSTAGED_DIFF_ARGS, signal))
 		};
 	}
 }
@@ -36797,16 +36826,24 @@ function agentPresetsFrom(ctx) {
 function isBlankSession(events) {
 	return !events.some((event) => event.type === "turn/start");
 }
+/** Upstream renamed the shipped `code` preset to `ptc` in 0.1.2-rc.1; sessions
+* and CLI choices recorded before the rename keep resolving through this map. */
+const LEGACY_PRESET_IDS = { code: "ptc" };
+function normalizePresetId(id) {
+	return id === void 0 ? void 0 : LEGACY_PRESET_IDS[id] ?? id;
+}
 /** Latest logged selection wins; legacy sessions deliberately fall back to standard. */
 function resolvePreset(session) {
-	for (let index = session.events.length - 1; index >= 0; index -= 1) {
-		const event = session.events[index];
-		if (event.type === "agent-preset/selected" && event.data?.agentPreset !== void 0) return event.data.agentPreset;
+	const events = session.snapshotEvents();
+	for (let index = events.length - 1; index >= 0; index -= 1) {
+		const event = events[index];
+		if (event.type === "agent-preset/selected" && event.data?.agentPreset !== void 0) return normalizePresetId(event.data.agentPreset);
 	}
-	return session.header.agentPreset ?? "standard";
+	return normalizePresetId(session.header.agentPreset) ?? "standard";
 }
 /** Resolve a pre-session choice, or recompose an active blank Agent. */
 async function selectPreset(service, agent, presetId) {
+	presetId = normalizePresetId(presetId);
 	if (agent !== void 0) return switchPreset(service, agent, presetId);
 	const preset = await service.resolve(presetId);
 	if (preset.broken !== void 0) throw new Error(preset.broken);
@@ -36814,7 +36851,7 @@ async function selectPreset(service, agent, presetId) {
 }
 /** Recompose atomically from the caller's perspective, logging only success. */
 async function switchPreset(service, agent, presetId) {
-	if (!isBlankSession(agent.session.events)) throw new Error("mode is locked after the first turn; use /new <mode>");
+	if (!isBlankSession(agent.session.snapshotEvents())) throw new Error("mode is locked after the first turn; use /new <mode>");
 	const preset = await service.recompose(agent.ctx, presetId);
 	agent.session.append("agent-preset/selected", { agentPreset: preset.id });
 	return preset;
@@ -36827,7 +36864,7 @@ function permissionPresetsFrom(ctx) {
 }
 /** Effective label for either an active session or the not-yet-created first one. */
 function effectivePermission(service, session, pending) {
-	return session === void 0 ? pending ?? service.defaultPreset : service.current(session.events);
+	return session === void 0 ? pending ?? service.defaultPreset : service.current(session);
 }
 /** Validate a preset and write it only when a durable session already exists. */
 function selectPermission(service, session, preset) {
@@ -36909,6 +36946,38 @@ function listPluginRows(ctx) {
 * @module @deepseek-ai/dsh-code/settings-file
 */
 /**
+* Run one file operation with a bounded retry: one initial try plus at
+* most `retries` more. Creating or replacing a file can fail transiently
+* with EPERM/EACCES while an antivirus scanner or search indexer holds
+* it — the standard graceful-fs remedy, not a workaround for a
+* persistent permission problem. A save that still fails leaves its
+* uniquely named temp file behind, so repeated crashed saves accumulate
+* distinct leftovers rather than corrupting a shared one.
+*/
+async function withTransientRetry(operation, retries = 5) {
+	for (let attempt = 0;; attempt += 1) try {
+		await operation();
+		return;
+	} catch (error) {
+		const code = error.code;
+		if (attempt >= retries || code !== "EPERM" && code !== "EACCES") throw error;
+		await new Promise((resolve) => setTimeout(resolve, 30 * (attempt + 1)));
+	}
+}
+/**
+* Write one file atomically: create the parent directory, write to a
+* uniquely named temp file, and rename it into place. A crash midway
+* can never leave a half-written document behind. Unique temp names
+* keep concurrent writers (two terminals, two chains in one process)
+* from sharing one temp path.
+*/
+async function writeFileAtomically(path, text) {
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	await withTransientRetry(() => writeFile(temp, text, "utf8"));
+	await withTransientRetry(() => rename(temp, path));
+}
+/**
 * Create the shared settings-write chain. One instance per process keeps
 * every user-level JSON file mutually serialized.
 * @returns the persistence handle.
@@ -36917,12 +36986,7 @@ function createUserSettingsPersistence() {
 	let chain = Promise.resolve();
 	return {
 		save(path, text) {
-			const write = chain.then(async () => {
-				await mkdir(dirname(path), { recursive: true });
-				const temp = `${path}.tmp`;
-				await writeFile(temp, text, "utf8");
-				await rename(temp, path);
-			});
+			const write = chain.then(() => writeFileAtomically(path, text));
 			chain = write.catch(() => {});
 			return write;
 		},
@@ -37161,7 +37225,7 @@ async function run(ctx, startup, io) {
 		const nextCwd = next.cwd ?? cwd;
 		const selectionState = pendingSelection === void 0 ? {} : { picked: pendingSelection };
 		let mode = next.resume ? next.mode : next.mode ?? pendingMode;
-		if (!next.resume) mode = (await presets.resolve(mode)).id;
+		if (!next.resume) mode = (await presets.resolve(normalizePresetId(mode ?? presets.defaultId))).id;
 		const setup = async (agentCtx) => {
 			const sessionPreset = next.resume ? resolvePreset(agentCtx.agent.session) : mode;
 			mode = (await presets.mount(agentCtx, sessionPreset)).id;
@@ -37206,7 +37270,7 @@ async function run(ctx, startup, io) {
 			handle,
 			agent: handle.agent,
 			session,
-			store: createTranscriptStore(session.events),
+			store: createTranscriptStore(session.snapshotEvents()),
 			mentions: createMentions(ctx, handle.agent, session.header.cwd ?? nextCwd),
 			mode: mode ?? "standard",
 			selection: selectionState,
@@ -37290,7 +37354,7 @@ async function run(ctx, startup, io) {
 		const picked = subagentOverride ?? resolveEffectiveSelection(belongsToActive && activeAgent !== void 0 ? activeAgent.selection.picked ?? pendingSelection : void 0, subject.session.requestHeader()?.config, currentDefaults());
 		return next().then((resolved) => applyModelSelectionToConfig(resolved, picked));
 	});
-	const questions = mountQuestionProvider(ctx);
+	const questions = mountQuestionProvider(ctx, (candidate) => agent !== void 0 && candidate.id === agent.id);
 	const bridge = { notify: () => {} };
 	const capabilitySyncDebounceMs = 400;
 	const runCapabilitySync = () => {
@@ -37348,17 +37412,27 @@ async function run(ctx, startup, io) {
 	};
 	const historyPath = join(homedir(), ".dsh", "dsh-code", "history.jsonl");
 	let inputHistory = [];
+	let historyWriteChain = Promise.resolve();
 	try {
-		inputHistory = parseHistoryFile(readFileSync(historyPath, "utf8"));
+		const rawHistory = readFileSync(historyPath, "utf8");
+		inputHistory = parseHistoryFile(rawHistory);
+		if (needsCompaction(rawHistory)) historyWriteChain = historyWriteChain.then(() => writeFileAtomically(historyPath, serializeHistoryList(inputHistory))).catch(() => {});
 	} catch {
 		inputHistory = [];
 	}
-	/** Serialized history writes: each submission rewrites the latest in-memory snapshot. */
-	let historyWriteChain = Promise.resolve();
+	/**
+	* Serialized history writes: each submission appends one JSON line at the
+	* end of the file, so concurrent terminals add entries after each other
+	* instead of overwriting snapshots they read at their own boot. A
+	* multi-line draft still occupies one physical line (JSON escapes the
+	* newline), and a regular-length line reaches the disk as one positioned
+	* write; an oversized paste may interleave mid-line, which the next
+	* parse simply drops.
+	*/
 	const recordHistory = (text) => {
 		if (text === "") return;
 		inputHistory = [...inputHistory, text].slice(-100);
-		historyWriteChain = historyWriteChain.then(() => mkdir(dirname(historyPath), { recursive: true })).then(() => writeFile(historyPath, serializeHistoryList(inputHistory), "utf8")).catch((writeError) => {
+		historyWriteChain = historyWriteChain.then(() => mkdir(dirname(historyPath), { recursive: true })).then(() => appendFile(historyPath, historyLine(text), "utf8")).catch((writeError) => {
 			bridge.notify("history save failed: " + (writeError instanceof Error ? writeError.message : String(writeError)), "error");
 		});
 	};
@@ -37977,10 +38051,6 @@ async function run(ctx, startup, io) {
 	};
 	const reviewChanges = (argument) => {
 		const currentAgent = agent;
-		if (currentAgent === void 0) {
-			bridge.notify("no session yet - submit a message to start", "warning");
-			return;
-		}
 		const atEpoch = epoch;
 		const reviewCwd = session?.header.cwd ?? cwd;
 		const controller = new AbortController();
@@ -38014,7 +38084,7 @@ async function run(ctx, startup, io) {
 			const text = argument.trim();
 			const atSeq = text === "" ? void 0 : Number(text);
 			if (text !== "" && (!Number.isSafeInteger(atSeq) || (atSeq ?? -1) < 0)) throw new Error("usage: /fork [event-seq]");
-			const seed = selectForkSeed(session.events, atSeq);
+			const seed = selectForkSeed(session.snapshotEvents(), atSeq);
 			const id = `session-${randomUUID()}`;
 			requestSwitch({
 				target: {
@@ -38070,7 +38140,7 @@ async function run(ctx, startup, io) {
 			branch: gitBranch(sessionCwd),
 			sessionId: session === void 0 ? "" : session.id.slice(-8),
 			resumed: active?.resumed ?? false,
-			mode: active?.mode ?? pendingMode ?? presets.defaultId,
+			mode: active?.mode ?? pendingMode ?? normalizePresetId(presets.defaultId),
 			permission,
 			dispatch,
 			steer,

package/lib/types/git-workflow.d.ts

@@ -1,4 +1,9 @@
-/** Read-only Git inspection used by /diff and /review. */
+/**
+ * Read-only Git inspection used by /diff and /review. Every diff
+ * invocation carries --no-ext-diff and --no-textconv, so configured
+ * external diff drivers and text converters can never execute as a
+ * side effect of reading a diff.
+ */
 export interface GitDiffSpec {
     readonly label: string;
     readonly args: readonly string[];
@@ -18,7 +23,7 @@ export declare function parseGitDiffFiles(text: string): readonly GitDiffFile[];
 /** Parse the intentionally small, option-safe /diff argument vocabulary. */
 export declare function parseGitDiffSpec(argument: string): GitDiffSpec;
 /**
- * Load one complete textual diff without invoking external diff drivers.
+ * Load one complete textual diff without invoking external programs.
  * @param signal - aborted by the caller on session switches/quit, killing the
  * git subprocess instead of letting a stale repository's diff land later.
  */

package/lib/types/history.d.ts

@@ -21,14 +21,21 @@ export declare function serializeHistoryEntry(text: string): string;
  */
 export declare function parseHistoryFile(raw: string, max?: number): readonly string[];
 /**
- * Append one entry to the persistent file content: JSON line, capped to the
- * newest `max` entries with a trailing newline.
- * @param current - existing file content.
- * @param text - submission to persist.
- * @param max - entry cap.
- * @returns the new file content.
+ * The append unit for the persistent file: one JSON line, so a multi-line
+ * draft still occupies exactly one physical line. Each submission appends
+ * this unit at the end of the file, so concurrent terminals add entries
+ * after each other. Node chunks one append at 512 KiB: a pasted entry
+ * beyond that size could interleave mid-line with another writer's
+ * chunks, and the damaged line then drops out at the next parse —
+ * recall tolerates the loss by design.
+ */
+export declare function historyLine(text: string): string;
+/**
+ * Whether the file on disk differs from its canonical form (deduped and
+ * capped). True means stale lines have accumulated and the next boot
+ * should rewrite it once, atomically.
  */
-export declare function appendHistoryContent(current: string, text: string, max?: number): string;
+export declare function needsCompaction(raw: string, max?: number): boolean;
 /**
  * Record one in-session submission: empty text is ignored and an adjacent
  * duplicate collapses (Codex `record_local_submission` semantics). The local
@@ -40,10 +47,10 @@ export declare function appendHistoryContent(current: string, text: string, max?
  */
 export declare function recordLocalEntry(local: readonly string[], text: string, max?: number): readonly string[];
 /**
- * Serialize a capped entry list to the history file format (one JSON line per
- * entry, trailing newline). The runner writes the in-memory list as the whole
- * file, so rapid same-process submissions cannot lose entries to a
- * read-modify-write race (the file is never read back before writing).
+ * Serialize a capped entry list to the history file format (one JSON line
+ * per entry, trailing newline). The boot-time compaction writes this
+ * canonical form once when stale lines have accumulated; submissions
+ * themselves only ever append a single line.
  * @param entries - the entries to persist, oldest first.
  * @returns the file content, '' for an empty list.
  */

package/lib/types/presets.d.ts

@@ -11,8 +11,11 @@ export type AgentPresetsService = AgentPresets;
 export declare function agentPresetsFrom(ctx: Context): AgentPresetsService | undefined;
 /** A preset may change only before the first durable turn begins. */
 export declare function isBlankSession(events: readonly SessionEvent[]): boolean;
+/** Translate a preset id recorded before an upstream rename to its current id. */
+export declare function normalizePresetId(id: string): string;
+export declare function normalizePresetId(id: string | undefined): string | undefined;
 /** Latest logged selection wins; legacy sessions deliberately fall back to standard. */
-export declare function resolvePreset(session: Pick<Session, 'header' | 'events'>): string;
+export declare function resolvePreset(session: Pick<Session, 'header' | 'snapshotEvents'>): string;
 /** Resolve a pre-session choice, or recompose an active blank Agent. */
 export declare function selectPreset(service: AgentPresetsService, agent: Agent | undefined, presetId: string): Promise<PresetRow>;
 /** Recompose atomically from the caller's perspective, logging only success. */

package/lib/types/questions.d.ts

@@ -1,18 +1,19 @@
 /**
- * The terminal ask_user_question provider: registers the single UI provider
- * on `ctx.userQuestions` and drives it with a FIFO queue — one question
- * request on screen at a time, everything else waiting — then resolves the
- * collected answers back into the tool's promise. The community TUI proved
- * this exact pipeline shape; here the dialog is an Ink bar instead of a
- * pi-tui inline modal.
+ * The terminal ask_user_question answerer: one `user-questions/request`
+ * waterfall listener that drives a FIFO queue — one question request on
+ * screen at a time, everything else waiting — then resolves the collected
+ * answers back into the waterfall. Mirrors the approval answerer's claim/
+ * defer split: only agents this TUI owns are answered, every other request
+ * falls through to the next answerer.
  *
- * Plan reviews (`exit_plan_mode`) arrive through the same service with an
+ * Plan reviews (`exit_plan_mode`) arrive through the same waterfall with an
  * `intent: { kind: 'plan-review' }` — the renderer highlights the approve
  * option; the answer encoding is identical either way.
  *
  * @module @deepseek-ai/dsh-code/questions
  */
 import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
 import { type AskUserQuestionAnswer, type AskUserQuestionRequest } from '@deepseek-ai/dsh-user-questions';
 /** One question request waiting on the human, with its settle channels. */
 export interface PendingQuestion {
@@ -42,9 +43,12 @@ export interface QuestionStore {
     cancel(pending: PendingQuestion): void;
 }
 /**
- * Mount the single `ctx.userQuestions` UI provider over a FIFO queue.
- * @param ctx - context carrying the `userQuestions` service (dsh-base).
- * @returns the store the renderer subscribes to; a context without the
- * service yields a permanently empty store.
+ * Mount the `user-questions/request` answerer over a FIFO queue.
+ * @param ctx - plugin context whose event bus carries the waterfall.
+ * @param owns - agents this terminal answers for; every other request is
+ * deferred back into the waterfall (`next()`), so sibling answerers stay
+ * usable. Agent-less asks are claimed: this TUI is the only human surface
+ * in the process.
+ * @returns the store the renderer subscribes to.
  */
-export declare function mountQuestionProvider(ctx: Context): QuestionStore;
+export declare function mountQuestionProvider(ctx: Context, owns: (agent: Agent) => boolean): QuestionStore;

package/lib/types/render/projection.d.ts

@@ -7,7 +7,8 @@
  * @module @deepseek-ai/dsh-tui/render/projection
  */
 import { type ImageBlock, type MessageId } from '@deepseek-ai/dsh-llm';
-import type { SessionEvent, TodoItem } from '@deepseek-ai/dsh-session';
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
+import type { TodoItem } from '@deepseek-ai/dsh-tool-todo';
 import { type ToolDetail } from './tool-detail.ts';
 /** One user prompt line. */
 export interface UserEntry {

package/lib/types/settings-file.d.ts

@@ -15,6 +15,14 @@
  *
  * @module @deepseek-ai/dsh-code/settings-file
  */
+/**
+ * Write one file atomically: create the parent directory, write to a
+ * uniquely named temp file, and rename it into place. A crash midway
+ * can never leave a half-written document behind. Unique temp names
+ * keep concurrent writers (two terminals, two chains in one process)
+ * from sharing one temp path.
+ */
+export declare function writeFileAtomically(path: string, text: string): Promise<void>;
 /** The serialized persistence surface; flush() is handed to the quit sequence. */
 export interface UserSettingsPersistence {
     /**