dsh-creator-mode-plus 0.3.8 → 0.3.12

package/src/runner.js

@@ -63,7 +63,7 @@ function isAllowedArgs(args) {
   }
   if (args.length === 6 && args[0] === 'activate-new-client' && PLUGIN_ID.test(args[1])) {
     return args[2] === '--profile'
-      && args[3] === 'web'
+      && ['web', 'desktop'].includes(args[3])
       && args[4] === '--port'
       && /^\d{1,5}$/.test(args[5])
       && Number(args[5]) >= 1
@@ -71,7 +71,7 @@ function isAllowedArgs(args) {
   }
   if (args.length === 7 && args[0] === 'hot-reload' && PLUGIN_ID.test(args[1])) {
     return args[2] === '--profile'
-      && args[3] === 'web'
+      && ['web', 'desktop'].includes(args[3])
       && args[4] === '--port'
       && /^\d{1,5}$/.test(args[5])
       && Number(args[5]) >= 1
@@ -97,7 +97,7 @@ export function currentWebPort(argv = process.argv) {
   return value
 }
 
-function contextFromExecution(exec, hostPort) {
+function contextFromExecution(exec, hostPort, options = {}) {
   const sessionId = exec?.agent?.id
   if (typeof sessionId !== 'string' || sessionId.length === 0) {
     throw new Error('dsh-creator-mode-plus: bridge v2 requires the calling DSH session identity')
@@ -120,6 +120,7 @@ function contextFromExecution(exec, hostPort) {
     hostPid: process.pid,
     hostParentPid: process.ppid,
     hostPort,
+    ...(options.hostProfile === 'desktop' ? { hostProfile: 'desktop', hostRoot: options.hostRoot, hostHome: options.hostHome } : {}),
     bridgeVersion: CREATOR_BRIDGE_VERSION,
     ...workspaceRoot === undefined ? {} : { workspaceRoot: resolve(workspaceRoot) },
   }
@@ -232,14 +233,32 @@ function executeDshx(args, exec, options = {}) {
     throw new Error('dsh-creator-mode-plus: refusing an operation outside bridge v2')
   }
   const runtime = resolveDshxRuntime(options)
+  if (options.hostProfile === 'desktop') args = args.map((value, index) => index > 0 && args[index - 1] === '--profile' ? 'desktop' : value)
+  const signal = exec?.signal
+  const result = (code, stdout = '', stderr = '', startup = '') => ({
+    command: `dshx ${args.join(' ')}`,
+    exitCode: code ?? 1,
+    stdout: redactStartupOutput(stdout.trim(), startup),
+    stderr: redactStartupOutput(stderr.trim(), startup),
+    dshxVersion: runtime.dshxVersion,
+    creatorBridgeVersion: runtime.bridgeVersion,
+    dshxContract: runtime.contractId,
+    dshxCapabilities: runtime.capabilities,
+    ...((args[0] === 'activate-new-client' || args[0] === 'hot-reload')
+      ? { hostPid: process.pid, hostPort: Number(args[5]) }
+      : {}),
+  })
+  const aborted = () => result(1, '', 'dshx operation aborted before spawn')
+  // An already-cancelled invocation must never start a child, even briefly.
+  if (signal?.aborted) return Promise.resolve(aborted())
   const argv = ['--import', runtime.loader, runtime.cli, ...args, ...args[0] === 'activation-plan' ? ['--json'] : [], '--harness', runtime.root]
   const spawnProcess = options.spawnProcess ?? spawn
   const hostPort = options.hostPort ?? currentWebPort()
-  const creatorContext = contextFromExecution(exec, hostPort)
+  const creatorContext = contextFromExecution(exec, hostPort, options)
   const startup = privateStartupUrl(options.getWebStartupUrl, hostPort)
-  const signal = exec?.signal
+  const profileAccess = options.createProfileAccess?.(args, exec, runtime.root)
   return new Promise((resolveResult, reject) => {
-    const child = spawnProcess(process.execPath, argv, {
+    const spawnOptions = {
       cwd: runtime.root,
       env: {
         ...process.env,
@@ -247,9 +266,15 @@ function executeDshx(args, exec, options = {}) {
         DSHX_CREATOR_CONTEXT: JSON.stringify(creatorContext),
         DSHX_CREATOR_TAKEOVER_GRANT: args[0] === 'creator' && args[1] === 'takeover' && options.takeoverGrant ? JSON.stringify(options.takeoverGrant) : '',
         DSHX_WEB_STARTUP_URL: startup,
+        ...profileAccess?.env,
+        DSHX_DESKTOP_PLUGIN_ID: args[0] === 'creator' ? args[2] ?? '' : args[1] ?? '',
       },
       stdio: ['ignore', 'pipe', 'pipe'],
-    })
+    }
+    // Trusted option callbacks above can synchronously cancel the invocation.
+    if (signal?.aborted) { profileAccess?.dispose(); resolveResult(aborted()); return }
+    let child
+    try { child = spawnProcess(process.execPath, argv, spawnOptions) } catch (error) { profileAccess?.dispose(); reject(error); return }
     let stdout = ''
     let stderr = ''
     child.stdout.on('data', chunk => { stdout = appendBounded(stdout, chunk) })
@@ -258,22 +283,11 @@ function executeDshx(args, exec, options = {}) {
     const abort = () => { child.kill('SIGTERM') }
     if (signal?.aborted) abort()
     else signal?.addEventListener('abort', abort, { once: true })
-    child.once('error', reject)
+    child.once('error', error => { profileAccess?.dispose(); reject(error) })
     child.once('close', (code) => {
+      profileAccess?.dispose();
       signal?.removeEventListener('abort', abort)
-      resolveResult({
-        command: `dshx ${args.join(' ')}`,
-        exitCode: code ?? 1,
-        stdout: redactStartupOutput(stdout.trim(), startup),
-        stderr: redactStartupOutput(stderr.trim(), startup),
-        dshxVersion: runtime.dshxVersion,
-        creatorBridgeVersion: runtime.bridgeVersion,
-        dshxContract: runtime.contractId,
-        dshxCapabilities: runtime.capabilities,
-        ...((args[0] === 'activate-new-client' || args[0] === 'hot-reload')
-          ? { hostPid: process.pid, hostPort: Number(args[5]) }
-          : {}),
-      })
+      resolveResult(result(code, stdout, stderr, startup))
     })
   })
 }
@@ -292,7 +306,7 @@ export function runDshx(args, exec, options = {}) {
     const port = options.hostPort ?? currentWebPort()
     const receipt = readDelivery(root, exec.agent.id)
     const delivery = deliveryStatus(receipt, { port })
-    if (args[0] === 'status' && delivery?.state === 'RUNTIME_VERIFICATION_REQUIRED') {
+    if (!exec?.signal?.aborted && args[0] === 'status' && delivery?.state === 'RUNTIME_VERIFICATION_REQUIRED') {
       try { delivery.runtimeProof = await verifyDeliveryClient(receipt, port, options.getWebStartupUrl?.(port)) }
       catch { delivery.runtimeProof = { state: 'RUNTIME_PROOF_FAILED', behavior: 'UNVERIFIED' } }
     }
@@ -401,7 +415,7 @@ function pluginMessage(text) {
     id: randomUUID(),
     role: 'user',
     content: Object.freeze([{ type: 'text', text }]),
-    source: Object.freeze({ kind: 'plugin', plugin: 'dsh-creator-mode-plus' }),
+    source: Object.freeze({ kind: 'plugin:dsh-creator-mode-plus' }),
   })
 }
 
@@ -444,10 +458,14 @@ export async function releaseCreatorClaim(agent, options = {}) {
   forgetCreatorClaim({ agent })
 }
 
-/** Register fail-contained recovery delivery on the preset-scoped Agent lifecycle. */
+/**
+ * Register fail-contained recovery delivery on the preset-scoped Agent lifecycle.
+ * `agent/created` replaced `agent/session-start`. The listener stays synchronous:
+ * a recovery failure must not reject serial session creation.
+ */
 export function installCreatorRecovery(ctx, options = {}) {
   if (typeof ctx.on !== 'function') return
-  ctx.on('agent/session-start', ({ agent }) => {
+  ctx.on('agent/created', ({ agent }) => {
     void deliverCreatorRecovery(agent, options).catch((error) => {
       const message = `dsh-creator-mode-plus: recovery delivery failed: ${error instanceof Error ? error.message : String(error)}`
       if (ctx.logger?.warn) ctx.logger.warn(message)

package/src/safety.js

@@ -1,3 +1,4 @@
+import { CORE_SOURCE_IMMUTABLE, PLUGIN_ONLY_RULE, creatorCoreMutationReason } from './core-boundary.js'
 /** Creator Mode+ claim tracking and last-mile destructive-shell guard. */
 
 const claimedPlugins = new WeakMap()
@@ -72,8 +73,53 @@ export function creatorDestructiveCommandReason(exec, explicitPluginId) {
   return undefined
 }
 
-/** Install the preset-scoped monotonic guard when the Host exposes it. */
-export function installCreatorSafetyGuard(ctx) {
-  if (typeof ctx?.tools?.guard !== 'function') return
-  ctx.tools.guard(exec => creatorDestructiveCommandReason(exec))
+/** Install the required preset-scoped monotonic guard through public Host APIs. */
+export function installCreatorSafetyGuard(ctx, resolveHarness = () => process.env.DSHX_HARNESS) {
+  if (typeof ctx?.tools?.guard !== 'function') throw new Error(`${CORE_SOURCE_IMMUTABLE}: public tools.guard is required for Creator Mode+`)
+  // Keep the guard installed even while a dependency is unavailable. Only
+  // declared, live dependency scopes may read services; agent.ctx has no such
+  // declarations. Re-read each service per call so replacement and per-session
+  // policy changes are observed without retaining an old service generation.
+  function serviceReader(name) {
+    let binding
+    ctx.inject?.([name], scope => {
+      const current = { scope, active: true }
+      binding = current
+      scope.effect(() => () => {
+        current.active = false
+        if (binding === current) binding = undefined
+      })
+    })
+    return () => {
+      if (!binding?.active) throw new Error(`${name} service is unavailable`)
+      binding.scope.fiber.assertActive()
+      return binding.scope[name]
+    }
+  }
+  const sandboxPolicy = serviceReader('sandboxPolicy')
+  const shell = serviceReader('shell')
+  ctx.tools.guard(exec => {
+    const destructive = creatorDestructiveCommandReason(exec)
+    if (destructive) return destructive
+    if (!['write', 'edit', 'write_file', 'edit_file', 'delete_file', 'move_file', 'copy_file', 'apply_patch', 'bash', 'terminal_open', 'terminal_send'].includes(exec?.name)) return undefined
+    try {
+      const root = resolveHarness()
+      if (!root) return `${CORE_SOURCE_IMMUTABLE}: cannot identify the Harness before a write operation`
+      let policy
+      if (['bash', 'terminal_open', 'terminal_send'].includes(exec.name)) {
+        try {
+          policy = sandboxPolicy().resolve(exec.agent ? { session: exec.agent.session } : {})
+          if (policy && exec.name === 'bash') policy = { ...policy, shellConfined: shell().sandboxMode !== undefined }
+        } catch (error) {
+          policy = { unavailableReason: error instanceof Error ? error.message : String(error) }
+        }
+      }
+      return creatorCoreMutationReason(exec, root, policy)
+    } catch (error) {
+      return `${CORE_SOURCE_IMMUTABLE}: cannot validate write boundary: ${error.message}`
+    }
+  })
+  ctx.inject?.(['systemPrompt'], scope => {
+    scope.systemPrompt.section({ name: 'creator:plugin-only', order: 1000, text: PLUGIN_ONLY_RULE })
+  })
 }

package/src/takeover.js

@@ -76,7 +76,7 @@ function titleOf(session) {
   for (let i = events.length - 1; i >= 0; i--) if (events[i].type === 'session/title' && typeof events[i].data?.title === 'string') return events[i].data.title
   return '未命名对话'
 }
-function ownedJobs(jobs, agent) { return jobs?.list(agent).filter(job => job.ownerSession === agent.id && liveJob(job)) ?? [] }
+function ownedJobs(jobs, agent) { return jobs?.list(agent.id).filter(job => job.owner === agent.id && liveJob(job)) ?? [] }
 function busy(ctx, agents, broker) {
   const jobs = get(ctx, 'jobs'), terminals = get(ctx, 'terminals')
   return agents.some(agent => agent.status !== 'idle' || broker.active.has(agent.id) || ownedJobs(jobs, agent).length || terminals?.hasOwned(agent))
@@ -100,8 +100,8 @@ async function drain(ctx, owner, broker, signal) {
     const waits = []
     for (const agent of group) {
       for (const job of ownedJobs(jobs, agent)) {
-        jobs.kill(job.id, agent, 'Creator+ user-confirmed takeover')
-        waits.push(jobs.wait(job.id, 20_000, agent, signal).then(result => { if (liveJob(result)) throw new Error('CREATOR_BACKGROUND_JOB_STILL_RUNNING') }))
+        jobs.kill(job.id, agent.id, 'Creator+ user-confirmed takeover')
+        waits.push(jobs.wait(job.id, 20_000, agent.id, signal).then(result => { if (liveJob(result)) throw new Error('CREATOR_BACKGROUND_JOB_STILL_RUNNING') }))
       }
       for (const terminal of terminals?.list(agent) ?? []) waits.push(terminals.kill(agent, terminal.id, 'Creator+ user-confirmed takeover'))
       waits.push(agent.whenIdle())