dsh-edit-turn 0.2.14 → 0.2.16

package/README.md

@@ -114,11 +114,13 @@ session.append('developer/message', { turn, step, message: { role: 'developer',
 1. **prompt 编辑保持单节点窗口**：`planRollback` 的 `mode === 'prompt'` 只遮蔽目标那一格（`shadowed = [target.seq]`），不会顺手回退到末尾；
 2. **替换事件与目标同事件类型**：改 `user/message` 落下的就是 `user/message`（回复编辑不换类型就换不了位，见第 5 条）；
 3. **`sourceEventSeqs` 永远列全窗口**：官方校验要求完整覆盖，缺一个节点事件会被拒；
-4. **每个替换都带语义标记**：`source.kind === 'plugin:dsh-edit-turn'` 且 `source.editedBy === 'dsh-edit-turn'`——包括那个不含文本的空 `developer/message` 载体，兄弟插件按 `editedBy` 识别即可，不必靠推断窗口形状；
+4. **每个替换都带语义标记**：`source.editedBy === 'dsh-edit-turn'`——包括那个不含文本的空 `developer/message` 载体，兄弟插件按 `editedBy` 识别即可，不必靠推断窗口形状；
 5. **回复编辑 = 多节点回退 + 追加新回复**，不是就地替换：旧回复行没有入口是**设计如此**（新行自带入口）。不要为了保住旧行的入口往 `assistant/message` 上加 `sourceEventSeqs`——官方校验会直接拒；
 6. **映射已公开**：`GET /dsh-edit-turn/state` 的 `revisions[]` 给出 `{ replacementSeq, startSeq, endSeq, shadowed }`（字段名与 `POST /apply` 响应一致），`hidden[]` 每题一格列出 `{ seq, turn, replacement }`。跨插件不必再从事件流自行推导。
 
-**`source.kind` 的行为（有意为之）**：prompt 编辑落地的那条 `user/message` 的 `source.kind` 是 `plugin:dsh-edit-turn`，**不是 `user`**。因此凡是以 `source.kind === 'user'` 识别"人类提问"的消费者（例如按人类提问划分回复删除窗口的逻辑），会把这条改写后的提问当作**普通内容**。这是刻意的：它是一段插件写入的文本，不是新的用户发话，平台也就不该再回答它；需要识别它的消费者请用上面的 `revisions`/`editedBy`，不要放宽 `source.kind === 'user'` 的判定。
+**`source.kind` 的行为（这里修过一个坑）**：prompt 编辑落地的那条 `user/message` **保持 `source.kind === 'user'`**，来历记在 `source.editedBy` 上。原因：平台里有近二十处按 `source.kind === 'user'` 认定「这是人类提问」——`dsh-session-turn-outline`（轮次导轨与轨迹视图）、`dsh-client-ui-trajectory`、`dsh-client-ui-chat`、inbox 的 steering 过滤、会话列表的 `lastPromptAt`。载体站在用户的位置上，改掉这个 kind 会让这些消费者**看不见这一轮的提问**：导轨空掉、`turnOutline` 的 `prompt` 变成空串、轨迹视图把提问归到「上下文」而不是「用户」。（0.2.15 及更早就是这样。）
+
+保持 `kind === 'user'` **不会**让它变成「被回答的新输入」：入队根本不看 kind——inbox 投影的 reducer 只处理 `agent/inbox/spliced`（`dsh-agent-loop`），而该事件只由显式的 agent splice 写入；跳过新输入的那些扫描判的是 `surfaceOp === 'append'`，而载体是 `surfaceOp: { op: 'replace' }`。
 
 ### 验证状态
 
@@ -213,6 +215,12 @@ ln -s /path/to/dsh-install/node_modules ./node_modules
 
 ### 更新日志
 
+**0.2.15** —— 修一个自己埋的隐患：回复编辑开的合成轮次会让下一次提问撞号。
+
+- **发现**：回复编辑必须在日志里开一个轮次（读路径只在"打开的轮次+步骤"里认 `assistant/message`，修正消息就是 assistant），但 **agent 循环的轮号计数器在 `phase.lastTurn`，是循环构造时播种、只由它自己开的轮推进的**——它看不见我们追加的 `turn/start`。于是下一次提问在同一个会话里会开出**同一个轮号**，两条 `turn/start` 撞号，整份日志在下次加载时报 `turn/start does not open the expected turn`，这正是我们 0.2.4 修掉的那类事故的另一个入口。兄弟插件 dsh-rerun-turn 早踩过并解决了同一问题（其 0.1.1：改用不占轮次的载体 + 事后 `syncLoopTurn`）；我们照做：回复编辑闭合自己的轮次后，**把活循环的 `lastTurn` 推到该轮号**。
+- **形状与降级**：`syncLoopTurn(agent, maxTurn)` 只看 `phase.kind === 'idle'` 且 `phase.lastTurn` 为数字时才动，否则 `'unavailable'` 什么也不碰（冷会话、循环不在场都走这条），并把结果以 `loopTurn` 写进 apply 响应、把 `unavailable` 记进 `/dsh-edit-turn/debug` 的请求环（字段刻意不叫 `code:`——静态检查会把它当宿主错误码去要文案）。
+- 新增/改写 host 测试 2 个：命中的循环被推过消耗掉的轮号（连续两次编辑，计数器只向前），够不着的循环原样留着并留诊断；加单测 1 个（守卫：running / 缺字段 / null 都返回 unavailable）。129 单测 / 80 契约 / 静态 exit0 / verify:live / verify:ui 全绿。
+
 **0.2.14** —— 修「重新 apply 时上一次注入的节点不清理 → 同一条消息行上堆出多个宿主」（互操作契约 I3 / §5）。只修 Bug，交互语义不变。
 
 - **修复：重新 apply（HMR / 现场重载 / 插件开关 / bundle 组重载）会在同一行里再种一个编辑宿主，而不是复用上一次那个**。旧宿主的身份记在模块实例的 WeakMap 里，实例一换就认不出；于是每 apply 一次，那条操作条里就多一个「编辑这条消息」的笔。真机 CDP 探针实测同一 strip 里 `dshet-action-host` 多达 **7 个**、children 一度到 17（页面重载后回到 1、stripKids = 5），用户看到的是「一行上出现 3 个重跑按钮」。现在**每个注入节点都带命名空间属性**（宿主 `data-dshet-action-host="1"`、浮层根 `data-dshet-layer="1"`、编辑框 `data-dshet-editor="1"`、替代气泡 `data-dshet-revision="1"`），注入前先按属性在行内查一次、查到就**复用**——并且把它重新指到**当前**控制器（激活函数挂在按钮元素上、按下时才读，不再是上次那份捕获了旧闭包的监听；否则复用的笔点开的是已退休的控制器，表现就是「点了没反应」）。每趟 DOM pass 结束还会清掉「本次实例没有认领的」同命名空间宿主，正是那 7 个的直接来源；扫描只认自己的命名空间，兄弟插件的按钮永远不在候选里（I3）。
@@ -473,11 +481,13 @@ The transcript only builds rows for **append surface events** (ui-chat's user an
 1. **A prompt edit keeps a single-node window**: `planRollback` for `mode === 'prompt'` shadows exactly the message itself (`shadowed = [target.seq]`) and never rolls back to the tail;
 2. **The replacement event has the type of the target**: a `user/message` edit lands a `user/message` (a reply cannot be swapped in place — see 5);
 3. **`sourceEventSeqs` always lists the whole window**: the official validator demands complete coverage; one missing node and the append is refused;
-4. **Every replacement carries the semantic marker**: `source.kind === 'plugin:dsh-edit-turn'` and `source.editedBy === 'dsh-edit-turn'` — including the empty text-free `developer/message` carrier, so siblings can recognise rewrites by `editedBy` alone instead of inferring from the window shape;
+4. **Every replacement carries the semantic marker**: `source.editedBy === 'dsh-edit-turn'` — including the empty text-free `developer/message` carrier, so siblings can recognise rewrites by `editedBy` alone instead of inferring from the window shape;
 5. **A reply edit is a multi-node rollback plus an appended correction**, not an in-place swap: the old reply row keeping no entry is **by design** (the new row carries it). Do not add `sourceEventSeqs` to an `assistant/message` to keep the old row's entry — the official validator refuses it outright;
 6. **The mapping is published**: `revisions[]` on `GET /dsh-edit-turn/state` gives `{ replacementSeq, startSeq, endSeq, shadowed }` (the field names the `POST /apply` response already used), and `hidden[]` lists `{ seq, turn, replacement }` per shadowed row. No sibling has to re-derive the ledger from the event stream.
 
-**The `source.kind` behaviour, intentionally:** after a prompt edit the landed `user/message` has `source.kind === 'plugin:dsh-edit-turn'`, **not `user`**. Any consumer that detects human prompts by `source.kind === 'user'` (for example, partitioning reply-deletion windows by human turns) will classify the revision as ordinary content. That is deliberate: the text was written by a plugin, it is not a fresh human turn, and the platform must not answer it. Consumers that need to find it should use `revisions`/`editedBy` above rather than loosening the `source.kind === 'user'` test.
+**The `source.kind` behaviour — this one was a bug:** after a prompt edit the landed `user/message` **keeps `source.kind === 'user'`**, with the provenance on `source.editedBy`. About twenty places in DSH detect human prompts with `source.kind === 'user'` — `dsh-session-turn-outline` (the turn rail and the Trajectory view), `dsh-client-ui-trajectory`, `dsh-client-ui-chat`, the inbox steering filter, `lastPromptAt` on the session list. The carrier stands in the user's place, so changing that kind made every one of those consumers stop seeing the turn's prompt: the rail lost it, `turnOutline` reported an empty prompt, and the Trajectory view filed the wording under context rather than under the user. (0.2.15 and earlier did exactly that.)
+
+Keeping `kind === 'user'` does **not** turn the carrier into fresh input that gets answered: queueing never reads `kind` — the inbox projection's reducer handles only `agent/inbox/spliced` (`dsh-agent-loop`), and that event is written solely by an explicit agent splice; the scans that skip past fresh input test `surfaceOp === 'append'`, and this carrier is `surfaceOp: { op: 'replace' }`.
 
 ### Verification status
 

package/lib/client.js

@@ -34,7 +34,7 @@ window.__ModuleLoader__.load({
     const RERUN_PREFIX = '/dsh-rerun-turn'
 
     /** Keep in sync with package.json and lib/index.js. */
-    const PLUGIN_VERSION = '0.2.14'
+    const PLUGIN_VERSION = '0.2.16'
 
     // --- copy -----------------------------------------------------------------
 

package/lib/index.js

@@ -57,7 +57,7 @@ export const PLUGIN_ID = 'dsh-edit-turn'
 export const name = PLUGIN_ID
 
 /** Keep in sync with package.json and lib/client.js. */
-export const PLUGIN_VERSION = '0.2.14'
+export const PLUGIN_VERSION = '0.2.16'
 
 // A ring of the last few requests, answering "did the browser half even ask, and
 // what did it get?" without needing its console. Read-only diagnostics: the
@@ -248,16 +248,34 @@ export function messageIdOf(event) {
  * @param event - raw session event.
  * @returns true for a human prompt.
  */
+export function isEditCarrier(source) {
+  if (!source || typeof source !== 'object') return false
+  // Current shape. `editedBy` is what identifies a carrier now; the prompt carrier
+  // deliberately keeps `kind: 'user'` (see buildCarrier) so the platform still reads
+  // it as the human prompt, and the silent reply carrier keeps a producer-owned kind.
+  if (source.editedBy === PLUGIN_ID) return true
+  // Historical shapes, kept so ledgers and editability stay correct over logs
+  // written by earlier releases: the producer-owned kind without `editedBy`, and
+  // the session-format v3 `{ kind: 'plugin', plugin }`.
+  if (source.kind === `plugin:${PLUGIN_ID}`) return true
+  return source.kind === 'plugin' && source.plugin === PLUGIN_ID
+}
+
 export function isHumanPrompt(event) {
   if (!event || event.type !== 'user/message') return false
   const data = event.data
   if (!data || !data.source) return false
+  // The platform's own test, and the one every consumer applies (`turn-outline`,
+  // the Trajectory view, `ui-chat`, the inbox steering filter, `lastPromptAt`): a
+  // human prompt is a `user/message` whose source kind is `'user'`. A message this
+  // plugin rewrote stands in a human's place and keeps that kind, so it stays
+  // editable (edit it again). Matching a plugin-owned kind instead is what made
+  // the rewrite invisible to the turn outline - the round lost its prompt.
   if (data.source.kind === 'user') return true
-  // A message this plugin rewrote stands in a human's place: it is the wording
-  // the user is asking with now, so it stays editable (edit it again) even though
-  // its source records that the plugin wrote it. The distinct kind also keeps the
-  // platform from treating it as fresh input to answer.
-  return data.source.kind === `plugin:${PLUGIN_ID}` && data.source.editedBy === PLUGIN_ID
+  // Carriers written before that fix carry a producer-owned kind. Same message -
+  // a `user/message` this plugin rewrote - so it must stay editable, or upgrading
+  // would silently make every earlier edit un-editable.
+  return isEditCarrier(data.source)
 }
 
 /**
@@ -304,9 +322,10 @@ export function readMessageText(event) {
 /**
  * Rebuild this plugin's rollback ledger from the log alone.
  *
- * Every rollback is one replacement event whose message source is
- * `{ kind: 'plugin', plugin: 'dsh-edit-turn' }`. A replacement landed by any
- * other producer - compaction, for instance - is ignored.
+ * Every rollback is one replacement event whose message source carries this
+ * plugin's marker (`{ editedBy: 'dsh-edit-turn' }`; see {@link isEditCarrier}).
+ * A replacement landed by any other producer - compaction, for instance - is
+ * ignored.
  *
  * @param events - complete contiguous raw event log.
  * @returns `{ hidden, edits }`: one hidden entry per shadowed seq, and one
@@ -322,7 +341,7 @@ export function rollbackLedger(events) {
     const event = bySeq.get(replacement.seq)
     const data = event && event.data
     const source = data && (data.source || (data.message && data.message.source))
-    if (!(source && (source.kind === `plugin:${PLUGIN_ID}` || (source.kind === 'plugin' && source.plugin === PLUGIN_ID)))) continue
+    if (!isEditCarrier(source)) continue
     for (const seq of replacement.shadowed) {
       const turn = turnOf.get(seq)
       hidden.push({ seq, turn: typeof turn === 'number' ? turn : null, replacement: replacement.seq })
@@ -574,6 +593,23 @@ function findLiveSession(ctx, sessionId) {
 // Resolve the live Session that owns the append. An already-open session is
 // used directly; a cold one is resumed through the official controller, which
 // is exactly what the web UI does when the user opens it.
+/**
+ * The live agent whose loop owns this session's turn counter, when one exists.
+ * @param ctx - plugin context.
+ * @param sessionId - session to resolve.
+ * @returns the agent, or undefined (cold session, or no controller mounted).
+ */
+async function resolveLoopAgent(ctx, sessionId) {
+  const controller = ctx.get('sessionController')
+  if (!controller || typeof controller.resolveAgent !== 'function') return undefined
+  try {
+    const result = await controller.resolveAgent(sessionId)
+    return result && result.agent ? result.agent : undefined
+  } catch {
+    return undefined
+  }
+}
+
 async function resolveSession(ctx, sessionId) {
   const live = findLiveSession(ctx, sessionId)
   if (live) return live
@@ -589,6 +625,44 @@ async function resolveSession(ctx, sessionId) {
   return undefined
 }
 
+/**
+ * Make the live agent loop agree with a turn this plugin opened in the log.
+ *
+ * The loop keeps its own counter in an idle-phase field (`phase.lastTurn`): it
+ * is seeded when the loop is constructed from the projection and advanced only
+ * by turns the loop itself opens. A reply edit has to open a turn - the read
+ * path admits an `assistant/message` only inside an open turn and step - so
+ * afterwards that field still names the turn this plugin consumed, and the
+ * loop's next run would open the same number. That collides: both turn/start
+ * events claim one number and the log fails its next load
+ * (`turn/start does not open the expected turn`), which is the corruption this
+ * plugin already shipped once and repaired.
+ *
+ * The shape guard is deliberate and the failure is soft: if the loop is not
+ * idle, or its shape is not what this expects, nothing is touched and the
+ * caller records why. The sibling plugin dsh-rerun-turn solves the same
+ * problem the same way (`syncLoopTurn`); there is no official seam for it.
+ *
+ * @param agent - the live loop agent, when one exists.
+ * @param maxTurn - the highest turn now in the log.
+ * @returns `'synced' | 'already-current' | 'unavailable'`.
+ */
+export function syncLoopTurn(agent, maxTurn) {
+  try {
+    const phase = agent && agent.phase
+    if (!phase || typeof phase !== 'object' || phase.kind !== 'idle' || typeof phase.lastTurn !== 'number') {
+      return 'unavailable'
+    }
+    if (maxTurn > phase.lastTurn) {
+      phase.lastTurn = maxTurn
+      return 'synced'
+    }
+    return 'already-current'
+  } catch {
+    return 'unavailable'
+  }
+}
+
 function eventsFromLive(session) {
   if (session && typeof session.snapshotEvents === 'function') {
     try {
@@ -734,7 +808,19 @@ export function buildCarrier(plan, lastTurn, config) {
       id: randomUUID(),
       role: 'user',
       content: [{ type: 'text', text: config.markerText }],
-      source: { kind: `plugin:${PLUGIN_ID}`, editedBy: PLUGIN_ID },
+      // `kind: 'user'`, NOT a plugin-owned kind. This carrier stands in a human's
+      // place - it IS the wording the user is asking with now - and the platform
+      // owns that judgement: a human prompt is exactly a `user/message` whose
+      // `source.kind` is `'user'`. Writing anything else here made the turn's
+      // prompt unrecognisable to every consumer that tests it -
+      // `dsh-session-turn-outline` (the turn rail and the Trajectory view),
+      // `dsh-client-ui-trajectory`, `dsh-client-ui-chat`, the inbox steering
+      // filter, and `lastPromptAt` on the session list - so an edited turn
+      // showed no prompt at all and `turnOutline` reported `prompt: ""`. The
+      // format's producer-owned kind (`plugin:<id>`) is for messages a plugin
+      // authors in its own voice; a prompt it merely rewrote is not one.
+      // `editedBy` below carries the provenance that `kind` used to.
+      source: { kind: 'user', editedBy: PLUGIN_ID },
     },
   }
 }
@@ -885,11 +971,25 @@ async function applyEdit(ctx, sessionId, body, config) {
       }
     }
     const corrected = await flushSession(ctx, session)
+    // The synthetic turn this edit opened is invisible to the live loop's own
+    // counter; without the sync its next run reuses that number and the log
+    // fails its next load. Only a reply edit opens a turn - a prompt edit does
+    // not, and needs nothing.
+    const loopAgent = await resolveLoopAgent(ctx, sessionId)
+    const loopTurn = syncLoopTurn(loopAgent, editTurn)
+    // `loopTurn` is the diagnostic the request ring records; the field is DELIBERATELY
+  // not called `code` - the static checks read `code:` as host error codes and
+  // must not start demanding a user-visible message for an internal sync state.
+  const syncNote = loopTurn
+  if (syncNote === 'unavailable') {
+    noteRequest({ kind: 'reply', sessionId, ok: true, loopTurn: syncNote, turn: editTurn })
+  }
     return {
       kind: 'reply',
       replacementSeq: replacement.seq,
       appendedSeq: appended.seq,
       applied: true,
+      loopTurn,
       shadowed: plan.shadowed,
       ...corrected,
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-edit-turn",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Edit any user turn in DeepSeek Harness and re-run it: an inline editor on the message row rolls the conversation back to just before that turn through the official surface-replace contract, then re-prompts the agent with the revised text. The append-only session log is never rewritten.",
   "type": "module",
   "main": "lib/index.js",