dsh-creator-mode-plus 0.3.8 → 0.3.11

package/src/desktop-profile.js

@@ -0,0 +1,95 @@
+/** Private, per-invocation adapter to the application's public profile APIs. */
+import { randomBytes } from 'node:crypto'
+import { readFileSync, realpathSync } from 'node:fs'
+import { join, resolve, sep } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { stringify } from 'yaml'
+
+const PATH = '/dsh-creator-mode-plus/desktop-profile'
+const REGISTRY = Symbol.for('dsh-creator-mode-plus.desktop-profile.v1')
+const ID = /^[a-z][a-z0-9-]*$/
+
+export function createDesktopProfileBridge(ctx, dependencies = {}) {
+  const profile = ctx.profileContext
+  if (profile?.name !== 'desktop') return {}
+  const anchorSuffix = '/node_modules/@deepseek-ai/dsh/package.json'
+  if (!profile.installAnchor.endsWith(anchorSuffix)) throw new Error('Unrecognized Desktop runtime install anchor')
+  const hostRoot = profile.installAnchor.slice(0, -anchorSuffix.length)
+  const server = ctx.webServer
+  const hostKey = ctx.root ?? server
+  globalThis[REGISTRY] ??= new WeakMap()
+  let shared = globalThis[REGISTRY].get(hostKey)
+  if (!shared) {
+    shared = { tickets: new Map(), owners: 0 }
+    shared.dispose = server.register({ kind: 'exact', path: PATH, handler: async (req, res) => {
+      const ticket = shared.tickets.get(req.headers['x-dshx-profile-ticket'])
+      if (req.method !== 'POST' || !ticket || ticket.signal?.aborted || Date.now() > ticket.expires) {
+        res.writeHead(403); res.end('desktop profile access expired'); return
+      }
+      try {
+        let bytes = 0; const chunks = []
+        for await (const part of req) {
+          bytes += part.length
+          if (bytes > 4096) throw new Error('profile request too large')
+          chunks.push(part)
+        }
+        const request = JSON.parse(Buffer.concat(chunks).toString())
+        const result = await ticket.run(request)
+        res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' })
+        res.end(JSON.stringify(result))
+      } catch (error) {
+        res.writeHead(400, { 'content-type': 'application/json' })
+        res.end(JSON.stringify({ code: 1, stdout: '', stderr: String(error.message ?? error) }))
+      }
+    } })
+    globalThis[REGISTRY].set(hostKey, shared)
+  }
+  shared.owners++
+  const owned = new Set()
+  ctx.effect(() => () => {
+    for (const token of owned) shared.tickets.delete(token)
+    if (--shared.owners === 0) { shared.dispose(); globalThis[REGISTRY].delete(hostKey) }
+  })
+  return {
+    hostProfile: 'desktop', hostPort: server.port,
+    hostRoot, hostHome: profile.home,
+    createProfileAccess(args, exec, root) {
+      const token = randomBytes(32).toString('hex')
+      let mutationUsed = false
+      const pluginId = args[0] === 'creator' ? args[2] : args[1]
+      const mutation = args[0] === 'activate-new-client' ? 'add'
+        : args[0] === 'creator' && args[1] === 'remove' ? 'remove' : undefined
+      const run = async request => {
+        if (request.operation === 'dump') {
+          const boot = dependencies.boot ?? await import('@deepseek-ai/dsh-app-boot')
+          const rows = boot.composeEntries([boot.readProfilePatches('dshx', profile)])
+          // Configuration values and credential references never leave the Host.
+          return { code: 0, stderr: '', stdout: stringify(rows.map(({ id, name, disabled }) => ({ id, ...name ? { name } : {}, ...disabled ? { disabled } : {} }))) }
+        }
+        if (!mutation || mutationUsed || request.operation !== mutation || request.pluginId !== pluginId || !ID.test(pluginId)) throw new Error('desktop profile operation not granted')
+        const claims = dependencies.claims ?? await import(pathToFileURL(join(root, 'tools/dshx/src/internal/creator-claims.mjs')).href)
+        claims.assertUnfenced(root, exec.agent.id, pluginId)
+        if (!claims.listClaims(root).some(row => row.sessionId === exec.agent.id && row.pluginId === pluginId)) throw new Error('desktop profile claim changed')
+        const source = realpathSync(join(root, 'my-plugins', pluginId))
+        if (source.split(sep).includes('node_modules') || ['apps', 'packages', 'vendor'].some(dir => source === join(root, dir) || source.startsWith(join(root, dir) + sep))) throw new Error('protected plugin source')
+        const pkg = JSON.parse(readFileSync(join(source, 'package.json'), 'utf8'))
+        if (pkg.name !== pluginId || pkg.dsh?.bundle !== undefined) throw new Error('desktop watched operation requires a matching plain plugin')
+        const manifest = JSON.parse(readFileSync(join(profile.dir, 'package.json'), 'utf8'))
+        if (manifest.dsh?.profile?.bundles?.includes(pluginId)) throw new Error('desktop bundle removal is external-only')
+        const existing = manifest.dependencies?.[pluginId]
+        if (existing && (!existing.startsWith('link:') || realpathSync(resolve(profile.dir, existing.slice(5))) !== source)) throw new Error('desktop profile dependency identity changed')
+        mutationUsed = true
+        const operations = dependencies.operations ?? await import('@deepseek-ai/dsh-plugin-manager/operations')
+        const pm = profile.packageManager
+        const result = await operations.runPluginCommand({ profile: profile.name, dir: profile.dir, installAnchor: profile.installAnchor, cwd: source, home: profile.home },
+          mutation === 'add' ? ['add', `link:${source}`] : ['remove', pluginId],
+          { execution: 'service', ...pm, signal: exec.signal, outputBytes: 16384, activateNewBundles: false, lockWaitMs: 30000, idleTimeoutMs: 60000 })
+        return { code: result.exitCode, stdout: result.output, stderr: '' }
+      }
+      shared.tickets.set(token, { run, signal: exec.signal, expires: Date.now() + 120000 })
+      owned.add(token)
+      return { env: { DSHX_DESKTOP_PROFILE_ACCESS: JSON.stringify({ token, port: server.port, hostPid: process.pid }) },
+        dispose() { shared.tickets.delete(token); owned.delete(token) } }
+    },
+  }
+}

package/src/development-execution.js

@@ -0,0 +1,237 @@
+/**
+ * Private Creator execute/request provenance, NOT execution permission.
+ *
+ * TRUSTED WIRING REQUIRED: only reviewed C apply code constructs this object
+ * from its own four definition objects and keeps the authority private. Only
+ * those real execute closures call enter(exec, args). A receives reader only,
+ * through reviewed private wiring, not an arbitrary sourceVerified callback.
+ * This public factory cannot prove who called it; same-process plugin code is
+ * not sandboxed. Tool names merely select the fixed operation vocabulary.
+ * Definition/execute identity, native exec/token identity and closure ownership
+ * are the premises. No name, callId, JSON marker or allowed-once proves them.
+ *
+ * Public seams: ctx.root/fiber.assertActive/effect/on; tools.get(name, agent),
+ * agents.get and sessions.get; Agent.ctx/session; tools/pre-execute, execute,
+ * result/change; agent/disposed and session/disposed. Inject tools/agents/sessions.
+ * Native pre signal is the caller signal. Tools may fuse a wrapper/timeout
+ * signal before the body. We retain BOTH and construct a request signal from
+ * them plus the private owner lifetime; no arbitrary supplied signal is bound.
+ *
+ * enter is single-use per native token. Owners are frozen empty objects, all
+ * state is private. makeApprovalRequest is single-use per owner and binds the
+ * exact frozen request, never its callId. inspect/revalidate/reader lookups are
+ * live reads, not transferable grants; repeat lookup immediately before use.
+ * Native Approval does NOT deduplicate repeated calls with the same request:
+ * question deduplication and one-use grant/ticket consumption belong elsewhere.
+ * Task/target binding is also a separate private C composition, not this API.
+ * Closing dispatch, cancellation, definition replacement or producer disposal
+ * invalidates the owner/request. No rules, approvals, execution method, disk,
+ * CLI or activation here. Even activate-new-client provenance says NOTHING
+ * about sealed-byte support or whether an operation can skip human review.
+ */
+
+const OPERATIONS = Object.freeze({
+  dshx_check: 'check',
+  dshx_activation_plan: 'activation-plan',
+  dshx_hot_reload: 'hot-reload',
+  dshx_activate_new_client: 'activate-new-client',
+})
+const CHANGES = new Set(['patch', 'manifest', 'preset', 'client', 'new-client', 'server', 'artifact'])
+const object = value => value !== null && typeof value === 'object'
+const signal = value => value instanceof AbortSignal
+
+export class DevelopmentExecutionError extends Error {
+  constructor(code) { super(code); this.name = 'DevelopmentExecutionError'; this.code = code; this.eligible = false }
+}
+const fail = code => { throw new DevelopmentExecutionError(code) }
+
+/** ownedDefinitions is a trusted, private Map<fixed tool name, exact definition>. */
+export function createDevelopmentExecutionAuthority(ctx, ownedDefinitions) {
+  if (!ctx?.root || typeof ctx.on !== 'function' || typeof ctx.effect !== 'function'
+    || typeof ctx.fiber?.assertActive !== 'function' || typeof ctx.tools?.get !== 'function'
+    || typeof ctx.agents?.get !== 'function' || typeof ctx.sessions?.get !== 'function') fail('EXECUTION_SERVICES_UNAVAILABLE')
+  if (!(ownedDefinitions instanceof Map) || ownedDefinitions.size !== 4) fail('EXECUTION_DEFINITIONS_INVALID')
+  const definitions = new Map()
+  for (const [name, definition] of ownedDefinitions) {
+    if (!Object.hasOwn(OPERATIONS, name) || !object(definition)
+      || definition.name !== name || typeof definition.execute !== 'function') fail('EXECUTION_DEFINITIONS_INVALID')
+    definitions.set(name, { definition, execute: definition.execute, operation: OPERATIONS[name] })
+  }
+  const root = ctx.root
+  const observations = new WeakMap()
+  const owners = new WeakMap()
+  const requests = new WeakMap()
+  const active = new Set()
+  // Native Tools tokens are non-registered Symbols, valid weak keys in the
+  // current Host. Remember replay without retaining every completed call.
+  const usedTokens = new WeakSet()
+  const disposers = []
+  let disposed = false
+
+  function live(agent, session, agentCtx) {
+    return object(agent) && object(session) && agent.ctx === agentCtx && agentCtx?.root === root
+      && agent.session === session && ctx.agents.get(agent.id) === agent
+      && ctx.sessions.get(session.id) === session && agent.id === session.id
+  }
+  function close(record, code) {
+    if (!record || record.closed) return
+    record.closed = code
+    record.phase = 'closed'
+    active.delete(record)
+    record.callerSignal.removeEventListener('abort', record.onAbort)
+    record.bodySignal?.removeEventListener('abort', record.onAbort)
+    record.controller?.abort(new DevelopmentExecutionError(code))
+  }
+  function current(record) {
+    if (disposed) fail('EXECUTION_PRODUCER_DISPOSED')
+    try { ctx.fiber.assertActive() } catch { dispose(); fail('EXECUTION_PRODUCER_DISPOSED') }
+    if (!record) fail('EXECUTION_UNOBSERVED')
+    if (record.closed) fail(record.closed)
+    const { exec, definition, execute, agent, session, agentCtx } = record
+    let code
+    if (record.phase !== 'dispatch') code = 'EXECUTION_NOT_ACTIVE'
+    else if (!live(agent, session, agentCtx)) code = 'EXECUTION_AGENT_CHANGED'
+    else if (exec.token !== record.token || exec.agent !== agent || exec.name !== record.name
+      || exec.callId !== record.callId || exec.rootCallId !== record.rootCallId || exec.parent !== record.parent
+      || exec.arguments !== record.args) code = 'EXECUTION_IDENTITY_CHANGED'
+    else if (ctx.tools.get(record.name, agent) !== definition || definition.name !== record.name
+      || definition.execute !== execute) code = 'EXECUTION_DEFINITION_CHANGED'
+    else if (record.callerSignal.aborted || !signal(exec.signal) || exec.signal.aborted
+      || record.bodySignal?.aborted || record.controller?.signal.aborted) code = 'EXECUTION_CANCELLED'
+    else if (record.bodySignal && exec.signal !== record.bodySignal) code = 'EXECUTION_BODY_SIGNAL_CHANGED'
+    if (code) { close(record, code); fail(code) }
+    return record
+  }
+  function owned(owner) {
+    const record = object(owner) ? owners.get(owner) : undefined
+    if (!record) fail('EXECUTION_OWNER_UNISSUED')
+    return current(record)
+  }
+  function argumentsFor(record, args) {
+    if (args !== record.args || !object(args) || Array.isArray(args) || !Object.isFrozen(args)) fail('EXECUTION_ARGUMENTS_INVALID')
+    const keys = Reflect.ownKeys(args)
+    const expected = record.operation === 'activation-plan' ? ['name', 'change'] : ['name']
+    if (keys.length !== expected.length || keys.some(key => !expected.includes(key))) fail('EXECUTION_ARGUMENTS_INVALID')
+    for (const key of expected) {
+      const descriptor = Object.getOwnPropertyDescriptor(args, key)
+      if (!descriptor || !Object.hasOwn(descriptor, 'value') || typeof descriptor.value !== 'string') fail('EXECUTION_ARGUMENTS_INVALID')
+    }
+    if (!/^[a-z][a-z0-9-]*$/.test(args.name)
+      || (record.operation === 'activation-plan' && !CHANGES.has(args.change))) fail('EXECUTION_ARGUMENTS_INVALID')
+    return Object.freeze({ operation: record.operation, pluginId: args.name,
+      ...(record.operation === 'activation-plan' ? { change: args.change } : {}),
+    })
+  }
+
+  function enter(exec, args) {
+    const record = current(object(exec) ? observations.get(exec) : undefined)
+    if (record.owner || usedTokens.has(record.token)) fail('EXECUTION_ALREADY_ENTERED')
+    // Burn the native token even if an attempted closure entry has bad args.
+    usedTokens.add(record.token)
+    let operation
+    try { operation = argumentsFor(record, args) }
+    catch (error) { close(record, 'EXECUTION_ARGUMENTS_INVALID'); throw error }
+    record.bodySignal = exec.signal
+    record.bodySignal.addEventListener('abort', record.onAbort, { once: true })
+    record.controller = new AbortController()
+    const owner = Object.freeze(Object.create(null))
+    record.owner = owner
+    record.signal = AbortSignal.any([record.callerSignal, record.bodySignal, record.controller.signal])
+    record.view = Object.freeze({
+      ...operation, owner, agent: record.agent, session: record.session,
+      toolName: record.name, callId: record.callId, rootCallId: record.rootCallId,
+      token: record.token, callerSignal: record.callerSignal, bodySignal: record.bodySignal,
+      signal: record.signal, evidenceBoundary: 'owned-execution-only-no-authorization',
+    })
+    owners.set(owner, record)
+    current(record)
+    return owner
+  }
+  function inspect(owner) { return owned(owner).view }
+  function revalidate(owner) { owned(owner); return owner }
+  // Revoke-only private composition: policy/peer loss can cancel the exact
+  // already-issued request.signal. It cannot mint a new owner or reopen one.
+  function revoke(owner) {
+    const record = object(owner) ? owners.get(owner) : undefined
+    if (!record) fail('EXECUTION_OWNER_UNISSUED')
+    const wasLive = !record.closed
+    close(record, 'EXECUTION_REVOKED')
+    return wasLive
+  }
+  function makeApprovalRequest(owner, reason) {
+    const record = owned(owner)
+    if (record.request) fail('EXECUTION_REQUEST_ALREADY_BOUND')
+    if (reason !== undefined && (typeof reason !== 'string' || reason.length > 4096)) fail('EXECUTION_REQUEST_REASON_INVALID')
+    const request = Object.freeze({
+      agent: record.agent, toolName: record.name, callId: record.callId,
+      signal: record.signal, ...(reason === undefined ? {} : { reason }),
+    })
+    record.request = request
+    requests.set(request, record)
+    return request
+  }
+  function lookupRequest(request) {
+    const record = object(request) ? requests.get(request) : undefined
+    if (!record || record.request !== request) return undefined
+    try {
+      current(record)
+      if (request.agent !== record.agent || request.toolName !== record.name
+        || request.callId !== record.callId || request.signal !== record.signal) return undefined
+      return record.view
+    } catch { return undefined }
+  }
+  function dispose() {
+    if (disposed) return
+    disposed = true
+    for (const record of [...active]) close(record, 'EXECUTION_PRODUCER_DISPOSED')
+    for (const remove of disposers.splice(0).reverse()) remove()
+  }
+
+  try {
+    disposers.push(ctx.on('tools/pre-execute', async (exec, next) => {
+      const selected = definitions.get(exec.name)
+      if (!disposed && selected && object(exec) && !observations.has(exec) && !usedTokens.has(exec.token)
+        && typeof exec.token === 'symbol' && Symbol.keyFor(exec.token) === undefined
+        && signal(exec.signal) && !exec.signal.aborted
+        && live(exec.agent, exec.agent?.session, exec.agent?.ctx)
+        && ctx.tools.get(exec.name, exec.agent) === selected.definition
+        && selected.definition.execute === selected.execute) {
+        const record = {
+          ...selected, exec, name: exec.name, token: exec.token, args: exec.arguments,
+          callId: exec.callId, rootCallId: exec.rootCallId, parent: exec.parent,
+          agent: exec.agent, session: exec.agent.session, agentCtx: exec.agent.ctx,
+          callerSignal: exec.signal, phase: 'pre', closed: undefined,
+        }
+        record.onAbort = () => close(record, 'EXECUTION_CANCELLED')
+        exec.signal.addEventListener('abort', record.onAbort, { once: true })
+        observations.set(exec, record)
+        active.add(record)
+      }
+      return next() // Observation only: never return allow/ask or alter policy.
+    }))
+    disposers.push(ctx.on('tools/execute', async (exec, next) => {
+      const record = observations.get(exec)
+      if (!record || record.closed || record.phase !== 'pre') return next()
+      record.phase = 'dispatch'
+      try { return await next() }
+      finally { close(record, 'EXECUTION_ENDED') }
+    }))
+    disposers.push(ctx.on('tools/result', exec => close(observations.get(exec), 'EXECUTION_ENDED')))
+    disposers.push(ctx.on('tools/change', () => {
+      for (const record of [...active]) {
+        if (ctx.tools.get(record.name, record.agent) !== record.definition
+          || record.definition.execute !== record.execute) close(record, 'EXECUTION_DEFINITION_CHANGED')
+      }
+    }, { global: true }))
+    disposers.push(ctx.on('agent/disposed', ({ agent }) => {
+      for (const record of [...active]) if (record.agent === agent) close(record, 'EXECUTION_AGENT_DISPOSED')
+    }))
+    disposers.push(ctx.on('session/disposed', session => {
+      for (const record of [...active]) if (record.session === session) close(record, 'EXECUTION_SESSION_DISPOSED')
+    }))
+    ctx.effect(() => dispose)
+  } catch (error) { dispose(); throw error }
+  return Object.freeze({ enter, inspect, revalidate, revoke, makeApprovalRequest, lookupRequest,
+    reader: Object.freeze({ lookupRequest }), dispose,
+  })
+}

package/src/development-invocation.js

@@ -0,0 +1,267 @@
+/** Private C execute composition. No model/HTTP owner enrollment, grant writer,
+ * script runner, argv or automatic approval fallback. Optional creatorExecution
+ * is the public Cordis seam; its captured peer is private to one C generation.
+ */
+import { types as utilTypes } from 'node:util'
+import { createDevelopmentTargetResolver } from './development-target.js'
+import { DevelopmentTaskError } from './development-tasks.js'
+
+const object = value => value !== null && typeof value === 'object'
+const signal = value => value instanceof AbortSignal
+const PROTOCOL = 'creator-owned-execution-v1'
+const SYNC = ['lookupTarget', 'readRegisteredTarget', 'prepare', 'release', 'dispose']
+const METHODS = [...SYNC, 'authorize', 'dispatch']
+export class DevelopmentInvocationError extends Error {
+  constructor(code, cause) { super(code, cause ? { cause } : undefined); this.name = 'DevelopmentInvocationError'; this.code = code; this.eligible = false }
+}
+const fail = code => { throw new DevelopmentInvocationError(code) }
+function synchronous(value) {
+  if (utilTypes.isPromise(value)) { void Promise.prototype.then.call(value, undefined, () => {}); fail('INVOCATION_ASYNC_PRIVATE_READER') }
+  if (typeof value?.then === 'function') fail('INVOCATION_ASYNC_PRIVATE_READER')
+  return value
+}
+function waitFor(promise, lifetime) {
+  if (lifetime.aborted) { void Promise.resolve(promise).catch(() => {}); return Promise.reject(new DevelopmentInvocationError('INVOCATION_CANCELLED')) }
+  return new Promise((resolve, reject) => {
+    const abort = () => { detach(); reject(new DevelopmentInvocationError('INVOCATION_CANCELLED')) }
+    const detach = () => lifetime.removeEventListener('abort', abort)
+    lifetime.addEventListener('abort', abort, { once: true })
+    Promise.resolve(promise).then(value => { detach(); resolve(value) }, error => { detach(); reject(error) })
+    if (lifetime.aborted) abort()
+  })
+}
+
+/** Called by real C apply only; exact owner/exec associations never leave here. */
+export function createDevelopmentInvocations(ctx, { authority, tasks, policy, getHarnessRoot } = {}) {
+  if (!ctx?.root || typeof ctx.inject !== 'function' || typeof ctx.effect !== 'function' || typeof ctx.on !== 'function'
+    || typeof getHarnessRoot !== 'function' || typeof authority?.revoke !== 'function'
+    || typeof tasks?.capture !== 'function' || typeof policy?.revalidateFor !== 'function') fail('INVOCATION_SERVICES_UNAVAILABLE')
+  const root = ctx.root, producer = new AbortController(), byOwner = new WeakMap(), byExec = new WeakMap(), preBindings = new WeakMap(), opened = new WeakSet(), active = new Set(), connections = new Set()
+  let binding, disposed = false
+
+  function cleanup(frame) {
+    // May run again if cancellation occurred synchronously INSIDE prepare and
+    // its returned preparation was assigned only afterwards.
+    if (frame.preparation && !frame.released) {
+      frame.released = true
+      try { synchronous(frame.connection.methods.release(frame.owner, frame.preparation)) }
+      catch (error) { frame.cleanupError ??= error }
+    }
+    if (frame.compilation && !frame.inputReleased) {
+      frame.inputReleased = true
+      frame.targets.releaseCompilation(frame.compilation)
+    }
+    frame.targets?.dispose()
+  }
+  function close(frame) {
+    if (!frame.closed) {
+      frame.closed = true
+      active.delete(frame); byOwner.delete(frame.owner); byExec.delete(frame.exec)
+      for (const detach of frame.detach.splice(0)) detach()
+      authority.revoke(frame.owner) // Never abort the shared Agent/body signal.
+    }
+    cleanup(frame)
+  }
+  function watch(frame, lifetime) {
+    if (!signal(lifetime) || lifetime.aborted) { close(frame); fail('INVOCATION_CANCELLED') }
+    const cancel = () => close(frame)
+    lifetime.addEventListener('abort', cancel, { once: true })
+    frame.detach.push(() => lifetime.removeEventListener('abort', cancel))
+  }
+  function connectionLive(connection) {
+    if (!connection || !connection.active || disposed || producer.signal.aborted || !connection.binding.active
+      || connection.signal.aborted || connection.peer.signal !== connection.signal) fail('INVOCATION_PEER_ENDED')
+    connection.binding.scope.fiber.assertActive()
+  }
+  function check(frame, target = true) {
+    if (!frame || frame.closed || disposed || producer.signal.aborted) fail('INVOCATION_CLOSED')
+    ctx.fiber.assertActive()
+    const source = authority.inspect(frame.owner), mode = policy.inspect(frame.policyHandle)
+    // Read-only exact-exec validation consumes no new pre witness. capture
+    // itself remains single-use, including for the same real native exec.
+    if (policy.revalidateFor(frame.policyHandle, frame.exec) !== frame.policyHandle || source.token !== frame.exec.token
+      || source.agent !== frame.exec.agent || source.session !== frame.exec.agent.session
+      || source.operation !== frame.operation || source.pluginId !== frame.pluginId
+      || mode.policyEpoch !== frame.policyEpoch || mode.route !== frame.route || mode.signal !== frame.policySignal
+      || source.signal !== frame.signal || frame.signal.aborted) fail('INVOCATION_BINDING_CHANGED')
+    if (frame.task) tasks.revalidate(frame.task, frame.exec)
+    if (frame.connection) connectionLive(frame.connection)
+    if (target && frame.snapshot) frame.targets.revalidate(frame.snapshot, frame.exec)
+    return source
+  }
+  function inspectOwner(connection, owner) {
+    const frame = object(owner) ? byOwner.get(owner) : undefined
+    if (!frame || frame.connection !== connection || !frame.request || !frame.snapshot) return undefined
+    try {
+      check(frame)
+      return Object.freeze({ exactNativeRequest: frame.request, binding: frame.snapshot.binding,
+        operation: frame.operation, policyEpoch: frame.policyEpoch, signal: frame.signal,
+        ...(frame.task ? { taskHandle: frame.task, taskSignal: frame.task.signal } : {}) })
+    } catch { close(frame); return undefined }
+  }
+  function compilationInput(connection, owner, handle) {
+    const frame = object(owner) ? byOwner.get(owner) : undefined
+    if (!frame || frame.connection !== connection || frame.compilation !== handle || !frame.request) return undefined
+    try { check(frame, false); return frame.targets.compilationInput(handle, frame.exec) }
+    catch { close(frame); return undefined }
+  }
+  function endConnection(connection) {
+    if (!connection.active) return
+    connection.active = false
+    connection.signal?.removeEventListener('abort', connection.cancel)
+    for (const frame of [...active]) if (frame.connection === connection) close(frame)
+    connections.delete(connection)
+    try { synchronous(connection.methods?.dispose()) } catch { /* Its signal already prevents reuse. */ }
+  }
+  function connect(b) {
+    if (!b || !b.active || !b.facade || disposed) fail('INVOCATION_EXECUTOR_UNAVAILABLE')
+    b.scope.fiber.assertActive()
+    if (b.connection?.active && !b.connection.signal.aborted) {
+      connectionLive(b.connection)
+      return b.connection
+    }
+    // Reconnection is allowed only while OPENING A NEW invocation. Existing
+    // frames and their reader closures retain their original connection.
+    const connection = { binding: b, active: true }
+    const reader = Object.freeze({ root, signal: producer.signal,
+      inspectOwner: owner => inspectOwner(connection, owner),
+      compilationInput: (owner, handle) => compilationInput(connection, owner, handle) })
+    let peer
+    try {
+      peer = synchronous(b.connect.call(b.facade, reader))
+      if (!object(peer) || !signal(peer.signal) || peer.signal.aborted
+        || !Array.isArray(peer.supportedOperations) || peer.supportedOperations.length !== 1
+        || peer.supportedOperations[0] !== 'hot-reload') fail('INVOCATION_EXECUTOR_INVALID')
+      const methods = Object.create(null)
+      for (const name of METHODS) {
+        const method = peer[name]
+        if (typeof method !== 'function' || (SYNC.includes(name) && utilTypes.isAsyncFunction(method))) fail('INVOCATION_EXECUTOR_INVALID')
+        methods[name] = (...args) => method.apply(peer, args)
+      }
+      Object.assign(connection, { peer, signal: peer.signal, methods, supportedOperations: Object.freeze([...peer.supportedOperations]) })
+      connection.cancel = () => endConnection(connection)
+      connections.add(connection); b.connection = connection
+      connection.signal.addEventListener('abort', connection.cancel, { once: true })
+      connectionLive(connection)
+      return connection
+    } catch (error) {
+      connection.active = false
+      connections.delete(connection)
+      if (peer && typeof peer.dispose === 'function') { try { synchronous(peer.dispose()) } catch {} }
+      throw error instanceof DevelopmentInvocationError ? error : new DevelopmentInvocationError('INVOCATION_EXECUTOR_UNAVAILABLE', error)
+    }
+  }
+  const dependency = ctx.inject(['creatorExecution'], scope => {
+    if (disposed) return
+    const b = { scope, active: true }
+    try {
+      const facade = scope.creatorExecution
+      if (facade?.protocol === PROTOCOL && facade.root === root && typeof facade.connectProducer === 'function'
+        && !utilTypes.isAsyncFunction(facade.connectProducer)) Object.assign(b, { facade, connect: facade.connectProducer })
+    } catch { /* Invalid optional service closes sealed only, never tool registration. */ }
+    binding = b
+    scope.effect(() => () => {
+      b.active = false
+      if (binding === b) binding = undefined
+      for (const connection of [...connections]) if (connection.binding === b) endConnection(connection)
+    })
+  })
+  // Observe, but never connect/prepare/request, before an earlier A reviewer
+  // unwinds. A body may not borrow a service or existing peer installed while
+  // its original native pre was waiting. These are private activation objects,
+  // not repeatedly-created Cordis service proxies.
+  const stopPre = ctx.on('tools/pre-execute', (exec, next) => {
+    if (!disposed && !preBindings.has(exec)) {
+      const b = binding, connection = b?.connection
+      preBindings.set(exec, { binding: b,
+        connection: connection?.active && !connection.signal.aborted ? connection : undefined })
+    }
+    return next()
+  }, { prepend: true })
+
+  function open(owner, exec, policyHandle) {
+    if (disposed || opened.has(exec) || byOwner.has(owner)) fail('INVOCATION_ALREADY_OPENED')
+    const source = authority.inspect(owner), mode = policy.inspect(policyHandle)
+    if (policy.revalidateFor(policyHandle, exec) !== policyHandle || source.token !== exec.token || source.agent !== exec.agent
+      || source.session !== exec.agent.session) fail('INVOCATION_BINDING_CHANGED')
+    opened.add(exec)
+    const frame = { owner, exec, policyHandle, route: mode.route, operation: source.operation, pluginId: source.pluginId,
+      policyEpoch: mode.policyEpoch, policySignal: mode.signal, signal: source.signal, detach: [], phase: 'open', closed: false }
+    byOwner.set(owner, frame); byExec.set(exec, frame); active.add(frame)
+    try {
+      watch(frame, mode.signal); watch(frame, producer.signal); watch(frame, source.signal)
+      try { frame.task = tasks.capture(exec) }
+      catch (error) { if (!(error instanceof DevelopmentTaskError)) throw error }
+      if (frame.task) watch(frame, frame.task.signal)
+      if (frame.route === 'sealed') {
+        const before = preBindings.get(exec)
+        if (!before || !before.binding || before.binding !== binding || !before.binding.active) fail('INVOCATION_PRE_BINDING_ENDED')
+        frame.connection = before.connection ?? connect(before.binding)
+        connectionLive(frame.connection)
+        watch(frame, frame.connection.signal)
+      } else if (frame.route !== 'legacy') fail('INVOCATION_POLICY_UNSUPPORTED')
+      check(frame, false)
+      return Object.freeze({ route: frame.route,
+        legacyExecution() {
+          check(frame, false)
+          if (frame.route !== 'legacy' || frame.phase !== 'open') fail('INVOCATION_LEGACY_FORBIDDEN')
+          frame.phase = 'legacy'
+          // A signal-replaced exec copy is ONLY an input to the old runner.
+          return Object.freeze({ ...exec, signal: frame.signal })
+        },
+        invokeSealed: () => invokeSealed(frame),
+        close() {
+          close(frame)
+          if (frame.cleanupError) throw new DevelopmentInvocationError('INVOCATION_CLEANUP_FAILED', frame.cleanupError)
+        },
+      })
+    } catch (error) { close(frame); throw error }
+  }
+  async function invokeSealed(frame) {
+    check(frame, false)
+    if (frame.route !== 'sealed' || frame.phase !== 'open') fail('INVOCATION_SEALED_REPLAY')
+    frame.phase = 'preparing'
+    const connection = frame.connection
+    if (!connection.supportedOperations.includes(frame.operation)) fail('INVOCATION_OPERATION_UNSUPPORTED')
+    frame.lease = synchronous(connection.methods.lookupTarget(frame.pluginId))
+    if (!object(frame.lease)) fail('INVOCATION_TARGET_UNREGISTERED')
+    check(frame, false)
+    frame.targets = createDevelopmentTargetResolver({ getHarnessRoot,
+      readRegisteredTarget: lease => {
+        check(frame, false)
+        if (lease !== frame.lease) return undefined
+        return synchronous(connection.methods.readRegisteredTarget(lease))
+      },
+      readCompilationSignals: original => {
+        if (original !== frame.exec || byExec.get(original) !== frame) return undefined
+        const source = check(frame, false)
+        return { ownerSignal: source.signal, policySignal: frame.policySignal }
+      }, producerSignal: producer.signal })
+    frame.compilation = frame.targets.captureCompilation(frame.exec, frame.lease)
+    frame.snapshot = frame.targets.compilationSnapshot(frame.compilation, frame.exec)
+    frame.request = authority.makeApprovalRequest(frame.owner, `Creator ${frame.operation}: ${frame.pluginId}; sealed in-process execution`)
+    check(frame)
+    frame.preparation = synchronous(connection.methods.prepare(frame.owner, frame.lease, frame.compilation))
+    if (!object(frame.preparation)) fail('INVOCATION_PREPARATION_INVALID')
+    check(frame)
+    frame.phase = 'authorizing'
+    const capability = await waitFor(connection.methods.authorize(frame.owner, frame.preparation), frame.signal)
+    check(frame)
+    if (!object(capability)) fail('INVOCATION_CAPABILITY_INVALID')
+    frame.phase = 'dispatching'
+    // The fixed peer performs its own final source/policy/capability consume.
+    // Its result is an explicit in-process managed receipt, never a CLI claim.
+    return await waitFor(connection.methods.dispatch(frame.owner, frame.preparation, capability), frame.signal)
+  }
+  function dispose() {
+    if (disposed) return
+    disposed = true
+    stopPre()
+    producer.abort(new DevelopmentInvocationError('INVOCATION_PRODUCER_DISPOSED'))
+    for (const frame of [...active]) close(frame)
+    for (const connection of [...connections]) endConnection(connection)
+    void Promise.resolve(dependency.dispose()).catch(() => {})
+  }
+  ctx.effect(() => dispose)
+  return Object.freeze({ open, dispose })
+}