dsh-hashline-edit 0.2.0 → 0.2.1

package/README.md

@@ -2,7 +2,7 @@
 
 Hash-anchored file editing for [DeepSeek Harness](https://github.com/deepseek-ai) (dsh) on Windows.
 
-`dsh-hashline-edit` is a dsh bundle that shadows the host's built-in `read` with hash-anchored output, registers `apply_patch` as the only file-mutation entry point, and adds `undo_last_edit`. There is no `edit` tool and no pi host support: this package target is DeepSeek Harness only. Every line a served read shows carries a stable 4-character base62 anchor (`A–Z`, `a–z`, `0–9`) derived from the file's canonical path and the line's content. An `apply_patch` hunk either names served anchors or matches file content; the model never re-types existing code. Anchors for unchanged lines stay stable across edits, and every successful `apply_patch` call returns fresh anchors for the changed lines, so chained calls need no re-read.
+`dsh-hashline-edit` is a dsh bundle that shadows the host's built-in `read` with hash-anchored output, registers `apply_patch` as the only file-mutation entry point, and adds `undo_last_edit`. The native `write`/`edit`/`str_replace_editor` surface is hidden; there is no pi host support, because this package targets DeepSeek Harness only. Every line a served read shows carries a stable 4-character base62 anchor (`A–Z`, `a–z`, `0–9`) derived from the file's canonical path and the line's content. An `apply_patch` hunk either names served anchors or matches file content; the model never re-types existing code. Anchors for unchanged lines stay stable across edits, and every successful `apply_patch` call returns fresh anchors for the changed lines, so chained calls need no re-read.
 
 The semantic core is the [pi-better-edit](https://github.com/Rianico/pi-better-edit) v2.16.0 hashline engine (MIT), carried as an internal engine; the pi host integration has been removed. The `dsh/` tree is this repository's DeepSeek Harness host layer: tool registration, filesystem bridge, UTF-8-only admission, prompt guidance, shell integration, write integration and telemetry. See [`dsh/README.md`](dsh/README.md) for the host-layer map.
 
@@ -13,7 +13,7 @@ The semantic core is the [pi-better-edit](https://github.com/Rianico/pi-better-e
 | OS | Windows — this branch targets Windows only (see [`dsh/UPSTREAM.md`](dsh/UPSTREAM.md)) |
 | Node.js | ≥ 24.0.0 |
 | pnpm | 12.x |
-| DeepSeek Harness | plugin-capable build; the repository is developed against `@deepseek-ai/dsh-*@0.2.2-alpha.3` |
+| DeepSeek Harness | plugin-capable build; the repository is developed against `@deepseek-ai/dsh-*@0.2.2-rc.1` (host packages are declared as peer dependencies) |
 
 ## Install
 
@@ -36,7 +36,7 @@ For a tarball, pack first and add the archive:
 
 ```sh
 pnpm pack
-dsh plugin add ./dsh-hashline-edit-0.2.0.tgz
+dsh plugin add ./dsh-hashline-edit-0.2.1.tgz
 ```
 
 The bundle ships `lib/index.js` plus `lib/types/**`; `prompts/` must sit next to `lib/` in the installed package (it is in `files`). Guidance override files are materialized under `<DSH_HOME>/plugins/dsh-hashline-edit/guidance/` and are shared between profiles.
@@ -124,7 +124,7 @@ Addressing works in two modes, and one patch may mix them:
 characters is identity mode. Any rejection leaves every file byte-identical and reports every
 independent problem with its patch line number and `[E_*`] code. Success returns a file-level summary
 (A/M/R/D) followed by fresh `HASH│content` anchors for every changed line, so the next call can chain
-without a `read`. The host's built-in `write` remains for whole-file rewrites.
+without a `read`. To replace a whole file, use one `*** Update File:` identity hunk spanning every served line.
 ### `undo_last_edit`
 
 ```ts
@@ -158,7 +158,7 @@ The dsh host reads and writes UTF-8. Read admission is one rule with one exempti
 
 A file that is not valid UTF-8 is refused with `[E_UNSUPPORTED_FILE]` naming the file path and telling the model to ask the user how to handle it — for example a GBK-encoded source file or a BOM-less UTF-16LE file. The host does not guess a code page, offers no reopen-with-encoding parameter, keeps no encoding/BOM memo, and does not re-encode on save. UTF-16/UTF-32 BOMs are still recognized by kind detection: they are named in the refusal (e.g. `UTF-16LE encoded text`) instead of being decoded. Convert a non-UTF-8 file with an external tool before editing it here.
 
-The built-in `write` integration and `undo_last_edit` speak the same contract: they write UTF-8, and every file this plugin serves is UTF-8.
+`apply_patch` and `undo_last_edit` speak the same contract: they write UTF-8, and every file this plugin serves is UTF-8. The built-in `write` integration keeps the same contract for a profile that deliberately keeps `write` visible.
 ## Sandbox behavior
 
 `apply_patch` and `undo_last_edit` carry the host's optional escalation fields `sandbox_permissions` and `justification` only when a confining filesystem backend is mounted. `dsh/sandbox.ts` mirrors the built-in `@deepseek-ai/dsh-tool-fs` controller: it validates the field pairing, repeats the standing mode without approval, and resolves a strictly wider mode through the host's approval channel before touching the filesystem. A provider `FS_SANDBOX_DENIED` error is mapped to the standard model-facing denial marker plus escalation hint; other errors pass through unchanged.

package/cordis.patch.yml

@@ -1,8 +1,8 @@
 # dsh-hashline-edit bundle patch: mount the host-plane plugin row.
 # Installed via `dsh plugin --profile <name> add dsh-hashline-edit` (or a
-# profile's bundle list). The plugin hooks agent/created and shadows the
-# built-in read tool and hides its native edit surface on each agent's own scope layer, so no preset
-# editing or user config is needed.
+# profile's bundle list). The plugin hooks agent/created, shadows the built-in
+# read tool, and hides the native write/edit/str_replace_editor surface on each
+# agent's own scope layer, so no preset editing or user config is needed.
 - insert:
     - id: dsh-hashline-edit
       name: dsh-hashline-edit

package/lib/index.js

@@ -1373,8 +1373,8 @@ function assertRange(offset, length) {
 }
 
 // dsh/hide.ts
-var NATIVE_WRITE_TOOLS = ["edit", "str_replace_editor"];
-var GUIDANCE_SECTIONS = /* @__PURE__ */ new Set(["tool:edit"]);
+var NATIVE_WRITE_TOOLS = ["write", "edit", "str_replace_editor"];
+var GUIDANCE_SECTIONS = /* @__PURE__ */ new Set(["tool:write", "tool:edit"]);
 function readBooleanSource(value, fallback) {
   if (typeof value === "boolean") return value;
   if (typeof value === "function") {
@@ -1412,7 +1412,7 @@ function hiddenNames(config) {
   return names.filter((name2) => name2 !== config.toolName);
 }
 function nativeWriteDenial(toolName, name2) {
-  return `\`${name2}\` is disabled in this profile: precise and batch text changes go through \`${toolName}\` operations. Collect every planned file change into one call. Reading stays with \`read\`, \`glob\`, and \`grep\`; whole-file replacement stays with \`write\`.`;
+  return `\`${name2}\` is disabled in this profile: precise and batch text changes go through \`${toolName}\` operations. Collect every planned file change into one call. Reading stays with \`read\`, \`glob\`, and \`grep\`; whole-file replacement is one \`*** Update File:\` identity hunk spanning every served line.`;
 }
 function transformAssembly(assembly, hidden) {
   if (hidden.size === 0) return;
@@ -1509,14 +1509,24 @@ function registerNativeToolHiding(rootCtx, agentCtx, config) {
     configured.filter((name2) => toolExists(rootCtx, agentCtx, name2, config.scope))
   );
   const disposers = [];
-  if (restrictable.size > 0) {
-    try {
-      const dispose = agent.tools?.restrict?.({ deny: [...restrictable] });
-      if (dispose !== void 0) disposers.push(dispose);
-    } catch (error) {
+  if (restrictable.size > 0 || configured.length > 0) {
+    let restrictError;
+    const attemptRestrict = (names) => {
+      if (names.length === 0) return void 0;
+      try {
+        const dispose2 = agent.tools?.restrict?.({ deny: [...names] });
+        return dispose2 === void 0 ? void 0 : dispose2;
+      } catch (error) {
+        restrictError = error;
+        return void 0;
+      }
+    };
+    const dispose = attemptRestrict([...restrictable, config.toolName]) ?? attemptRestrict([...restrictable]);
+    if (dispose !== void 0) disposers.push(dispose);
+    else if (restrictable.size > 0) {
       warn(
         rootCtx,
-        `could not restrict native tools (${restrictable.size}): ${error instanceof Error ? error.message : String(error)}`
+        `could not restrict native tools (${restrictable.size}): ${restrictError instanceof Error ? restrictError.message : String(restrictError)}`
       );
     }
   }

package/lib/types/dsh/hide.d.ts

@@ -1,8 +1,8 @@
 /**
- * Hide the native edit-class tools so every precise text change goes through
+ * Hide the native file-mutation tools so every text change goes through
  * `apply_patch` — the one mutation entry point of the v4 surface.
  *
- * DSH 0.2.2-alpha.3 owns tool declarations in the tool registry, not in the
+ * DSH 0.2.2-rc.1 owns tool declarations in the tool registry, not in the
  * `system-prompt/assemble` waterfall: the waterfall receives sections, contexts
  * and variables only. The authoritative schema filter is therefore the
  * per-agent registry restriction (`tools.restrict({ deny })`), which removes a
@@ -20,14 +20,15 @@
  * 3. `tools.guard` is the monotonic execution backstop for a stale schema or
  *    any residual binding.
  *
- * `write` stays visible on purpose: whole-file replacement has no operation in
- * `apply_patch` (`*** Add File:` refuses to overwrite), so hiding it would leave
- * a rewrite with nowhere to go. Callers that want it gone can list it in
- * `hiddenToolNames`.
+ * `write` is hidden with `edit`/`str_replace_editor`. A whole-file replacement
+ * is one `*** Update File:` identity hunk spanning every served line with `+`
+ * lines for the new content, so no native mutation tool has to stay visible.
+ * The native `apply_patch` name is also denied in the inherited/preset layer
+ * when it exists; the plugin's own scoped registration shadows it otherwise.
  *
  * The layer is installed only when `apply_patch` actually registered: hiding
- * the native editors while owning no replacement would leave the profile with
- * no way to change a file.
+ * the native mutation tools while owning no replacement would leave the
+ * profile with no way to change a file.
  *
  * @module dsh-hashline-edit/hide
  */
@@ -37,7 +38,7 @@ type BooleanSource = boolean | (() => boolean);
 export interface NativeHideConfig {
     /** The registered replacement tool name, protected from `hiddenToolNames`. */
     readonly toolName: string;
-    /** Hide `edit`/`str_replace_editor`; defaults to true. */
+    /** Hide `write`/`edit`/`str_replace_editor`; defaults to true. */
     readonly hideNativeWriteTools?: BooleanSource;
     /** Extra global tool names to hide alongside the native set. */
     readonly hiddenToolNames?: readonly string[];

package/lib/types/dsh/index.d.ts

@@ -4,8 +4,10 @@
  * On every `agent/created`, install the hashline tools on the AGENT's
  * own scope layer so they shadow the preset's built-in `read` for that
  * agent (nearest layer wins in dsh's tool registry) and unwind automatically
- * when the agent is disposed. The built-in `write` stays in place; the
- * platform lane's write hook integrates with it.
+ * when the agent is disposed. The native `write`, `edit` and
+ * `str_replace_editor` schemas are hidden on the same scope so `apply_patch`
+ * is the only file-mutation entry point; the write hook still integrates a
+ * built-in `write` when a profile chooses to keep it visible.
  *
  * `inject` deliberately lists only `tools` and `systemPrompt`: the read-path
  * `ctx.fs` bridge is optional and resolved with `ctx.get`, so a minimal
@@ -26,9 +28,9 @@ export declare const inject: string[];
 /** The plugin configuration the loader passes as the second `apply` argument. */
 export interface PluginConfig {
     /**
-     * Hide the native `edit`/`str_replace_editor` tools so every precise text
-     * change goes through `apply_patch`. Defaults to true. `write` is not in
-     * that set on purpose: whole-file replacement has no apply_patch operation.
+     * Hide the native `write`/`edit`/`str_replace_editor` tools so every file
+     * mutation goes through `apply_patch`. Defaults to true. A whole-file
+     * replacement is one `*** Update File:` identity hunk over the served range.
      */
     hideNativeWriteTools?: boolean;
     /** Extra global tool names to hide alongside the native write set. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-hashline-edit",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Hash-anchored read/apply_patch tools for DeepSeek Harness (dsh). Every line gets a unique 4-char hash (A-Za-z0-9) that stays stable across edits; apply_patch is the only file-mutation entry point and commits one patch batch per transaction. Undo persists across restarts.",
   "keywords": [
     "anchors",
@@ -72,12 +72,12 @@
     "@babel/parser": "7.29.8",
     "@commitlint/cli": "^21.2.2",
     "@commitlint/config-conventional": "^21.2.2",
-    "@deepseek-ai/cordis": "4.0.6-alpha.2",
-    "@deepseek-ai/dsh-agent": "0.2.2-alpha.3",
-    "@deepseek-ai/dsh-fs": "0.2.2-alpha.3",
-    "@deepseek-ai/dsh-home-paths": "0.2.2-alpha.3",
-    "@deepseek-ai/dsh-sandbox": "0.2.2-alpha.3",
-    "@deepseek-ai/dsh-tools": "0.2.2-alpha.3",
+    "@deepseek-ai/cordis": "4.1.0",
+    "@deepseek-ai/dsh-agent": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.2-rc.1",
     "@semantic-release/git": "^11.0.1",
     "@semantic-release/github": "^12.0.9",
     "@semantic-release/npm": "^13.1.5",
@@ -93,11 +93,19 @@
     "vite": "^8.3.5",
     "vitest": "^4.1.8"
   },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.1.0",
+    "@deepseek-ai/dsh-agent": ">=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-fs": ">=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-home-paths": ">=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-sandbox": ">=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-tools": ">=0.2.2-rc.1 <0.2.3-0"
+  },
   "optionalDependencies": {
     "web-tree-sitter": "0.27.1"
   },
   "engines": {
-    "dsh": ">=0.2.2-alpha.3 <0.2.3-0",
+    "dsh": ">=0.2.2-rc.1 <0.2.3-0",
     "node": ">=24.0.0"
   },
   "packageManager": "pnpm@12.0.0",

package/prompts/apply-patch-guidelines.md

@@ -7,4 +7,4 @@
 - apply_patch: lifecycle joins the same transaction and undo. `*** Add File:` content lines all start with `+`; `*** Delete File:` removes the file; `*** Move to:` must immediately follow `*** Update File:` and renames before its hunks apply; an existing move target rejects.
 - apply_patch: a rejection writes nothing. Read the `- patch line N ([E_*], path): ...` lines, then use the immediately following `HASH│content` block — those are the current rows and anchors; retry directly without issuing a separate `read`.
 - apply_patch: a success starts with `Updated N files:` and ends with the changed lines' fresh anchors per file; use those anchors directly in the next identity hunk. `[W_*]` lines are informational.
-- apply_patch: paths are workspace-relative or workspace-absolute; `..`, `.git`, and symlink targets reject. Whole-file replacement stays with `write`.
+- apply_patch: paths are workspace-relative or workspace-absolute; `..`, `.git`, and symlink targets reject. Whole-file replacement is one `*** Update File:` identity hunk spanning every served line with `+` lines for the new content.

package/prompts/apply-patch.md

@@ -1 +1 @@
-Apply one Codex-format patch to one or more files in a single transaction: `{ input: string }`. `input` is the complete patch text: `*** Begin Patch` ... `*** End Patch`, with `*** Add File:`, `*** Delete File:`, `*** Update File:` (plus optional `*** Move to:`) and hunks addressed either by content (`@@` or `@@ <context>` with ` `/`-`/`+` lines) or by served anchors (`@@<a>` / `@@<a>-<b>` with `+` lines only). `*** Copy From:` / `*** Cut From:` copy or move a served span from another file. Every target validates before anything is written; a rejection changes nothing and returns the current rows with anchors. On success the result lists the changed files and the new anchors for the changed lines, so a follow-up call needs no `read`. `write` stays for whole-file replacement.
+Apply one Codex-format patch to one or more files in a single transaction: `{ input: string }`. `input` is the complete patch text: `*** Begin Patch` ... `*** End Patch`, with `*** Add File:`, `*** Delete File:`, `*** Update File:` (plus optional `*** Move to:`) and hunks addressed either by content (`@@` or `@@ <context>` with ` `/`-`/`+` lines) or by served anchors (`@@<a>` / `@@<a>-<b>` with `+` lines only). `*** Copy From:` / `*** Cut From:` copy or move a served span from another file. Every target validates before anything is written; a rejection changes nothing and returns the current rows with anchors. On success the result lists the changed files and the new anchors for the changed lines, so a follow-up call needs no `read`. To replace a whole file, use `*** Update File:` with one identity hunk spanning every served line and `+` lines for the new content.