dsh-image-gen 0.6.10 → 0.7.0

package/lib/index.js

@@ -5,861 +5,7 @@ import { lstat, mkdir, readFile, readdir, realpath, rename, stat, unlink, writeF
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import http from "node:http";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-util-value_005f00f2ec004257b269f27fd5e936b4/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
-/** Duplicate-install-safe JSON and immutable-value helpers. @module @deepseek-ai/dsh-util-values */
-/**
-* Mark an unreachable closed-union branch.
-* @param value - impossible value; an unhandled typed variant fails at the call site.
-* @param context - optional switch-site label included in the failure message.
-* @returns never; a runtime value that escaped its type always throws.
-*/
-function assertNever(value, context) {
-	const rendered = JSON.stringify(value) ?? String(value);
-	throw new Error(`unreachable variant${context ? ` in ${context}` : ""}: ${rendered}`);
-}
-/** Whether a realm-owned intrinsic prototype is backed by its native constructor. */
-function hasIntrinsicConstructor$1(prototype, name) {
-	const constructor = Object.getOwnPropertyDescriptor(prototype, "constructor")?.value;
-	if (typeof constructor !== "function") return false;
-	try {
-		return constructor.name === name && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === `function ${name}() { [native code] }`;
-	} catch {
-		return false;
-	}
-}
-/** Whether a candidate is one realm's intrinsic `Object.prototype`. */
-function isIntrinsicObjectPrototype$1(value) {
-	return Object.getPrototypeOf(value) === null && hasIntrinsicConstructor$1(value, "Object");
-}
-/** Whether an array uses one realm's intrinsic `Array.prototype`, not a subclass or forged prototype. */
-function hasPlainArrayPrototype$1(value) {
-	const prototype = Object.getPrototypeOf(value);
-	if (!Array.isArray(prototype) || !hasIntrinsicConstructor$1(prototype, "Array")) return false;
-	const objectPrototype = Object.getPrototypeOf(prototype);
-	return typeof objectPrototype === "object" && objectPrototype !== null && isIntrinsicObjectPrototype$1(objectPrototype);
-}
-/** Whether an object is a plain or null-prototype record from any JavaScript realm. */
-function hasPlainObjectPrototype(value) {
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === null || typeof prototype === "object" && isIntrinsicObjectPrototype$1(prototype);
-}
-/** Return every JSON-visible object key, or reject own data JSON would discard. */
-function enumerableStringKeys(value) {
-	const keys = Reflect.ownKeys(value);
-	if (keys.some((key) => typeof key !== "string" || !Object.prototype.propertyIsEnumerable.call(value, key))) return void 0;
-	return keys;
-}
-/** Validate lossless JSON iteratively, optionally materializing a detached snapshot. */
-function walkJsonValue(value, detach) {
-	const ancestors = /* @__PURE__ */ new Set();
-	let root;
-	const assign = (destination, item) => {
-		if (destination === void 0) return;
-		if (destination.kind === "root") root = item;
-		else if (destination.kind === "array") destination.target[destination.index] = item;
-		else Object.defineProperty(destination.target, destination.key, {
-			value: item,
-			enumerable: true,
-			configurable: true,
-			writable: true
-		});
-	};
-	const tasks = [{
-		kind: "visit",
-		value,
-		...detach ? { destination: { kind: "root" } } : {}
-	}];
-	for (let task = tasks.pop(); task !== void 0; task = tasks.pop()) {
-		if (task.kind === "leave") {
-			ancestors.delete(task.source);
-			continue;
-		}
-		if (task.kind === "array-item") {
-			if (!Object.prototype.hasOwnProperty.call(task.source, task.index)) return void 0;
-			tasks.push({
-				kind: "visit",
-				value: task.source[task.index],
-				...task.target === void 0 ? {} : { destination: {
-					kind: "array",
-					target: task.target,
-					index: task.index
-				} }
-			});
-			continue;
-		}
-		if (task.kind === "object-property") {
-			tasks.push({
-				kind: "visit",
-				value: task.source[task.key],
-				...task.target === void 0 ? {} : { destination: {
-					kind: "object",
-					target: task.target,
-					key: task.key
-				} }
-			});
-			continue;
-		}
-		const current = task.value;
-		if (current === null) {
-			assign(task.destination, null);
-			continue;
-		}
-		if (typeof current === "boolean" || typeof current === "string") {
-			assign(task.destination, current);
-			continue;
-		}
-		if (typeof current === "number") {
-			if (!Number.isFinite(current) || Object.is(current, -0)) return void 0;
-			assign(task.destination, current);
-			continue;
-		}
-		if (typeof current !== "object") return void 0;
-		if (ancestors.has(current)) return void 0;
-		if (Array.isArray(current)) {
-			if (!hasPlainArrayPrototype$1(current)) return void 0;
-			const length = current.length;
-			if (Reflect.ownKeys(current).length !== length + 1) return void 0;
-			const target = detach ? [] : void 0;
-			if (target !== void 0) assign(task.destination, target);
-			ancestors.add(current);
-			tasks.push({
-				kind: "leave",
-				source: current
-			});
-			for (let index = length - 1; index >= 0; index--) tasks.push({
-				kind: "array-item",
-				source: current,
-				index,
-				...target === void 0 ? {} : { target }
-			});
-			continue;
-		}
-		if (!hasPlainObjectPrototype(current)) return void 0;
-		const keys = enumerableStringKeys(current);
-		if (keys === void 0) return void 0;
-		const target = detach ? {} : void 0;
-		if (target !== void 0) assign(task.destination, target);
-		ancestors.add(current);
-		tasks.push({
-			kind: "leave",
-			source: current
-		});
-		for (let index = keys.length - 1; index >= 0; index--) {
-			const key = keys[index];
-			/* v8 ignore next -- the loop is bounded by the captured key count. */
-			if (key === void 0) return void 0;
-			tasks.push({
-				kind: "object-property",
-				source: current,
-				key,
-				...target === void 0 ? {} : { target }
-			});
-		}
-	}
-	return detach ? root : true;
-}
-/**
-* Validate and detach lossless JSON in one read per property.
-* @param value - candidate value to validate and detach.
-* @returns the detached snapshot, or `undefined` when the value is not losslessly JSON-serializable.
-*/
-function snapshotJsonValue(value) {
-	return walkJsonValue(value, true);
-}
-/**
-* Test the same lossless JSON rules as {@link snapshotJsonValue} without detaching the value.
-* @param value - candidate value to test.
-* @returns whether the value survives a JSON round trip without loss.
-*/
-function isJsonValue(value) {
-	return walkJsonValue(value, false) === true;
-}
-/**
-* Compare JSON-compatible values structurally.
-* @param a - one JSON-compatible value.
-* @param b - the other JSON-compatible value.
-* @returns whether both values contain the same JSON data.
-*/
-function deepEqualJson(a, b) {
-	if (a === b) return true;
-	if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((entry, index) => deepEqualJson(entry, b[index]));
-	}
-	const left = a;
-	const right = b;
-	const keys = Object.keys(left);
-	if (keys.length !== Object.keys(right).length) return false;
-	return keys.every((key) => key in right && deepEqualJson(left[key], right[key]));
-}
-/**
-* Deep-freeze an object graph in place while leaving live AbortSignal objects mutable.
-* @param value - value to freeze.
-* @returns the same value after every reachable enumerable child is frozen.
-*/
-function deepFreeze(value) {
-	const seen = /* @__PURE__ */ new WeakSet();
-	const pending = [{
-		kind: "visit",
-		node: value
-	}];
-	while (pending.length > 0) {
-		const task = pending.pop();
-		/* v8 ignore next -- the loop condition guarantees one pending task. */
-		if (task === void 0) continue;
-		if (task.kind === "property") {
-			pending.push({
-				kind: "visit",
-				node: task.source[task.key]
-			});
-			continue;
-		}
-		const node = task.node;
-		if (node === null || typeof node !== "object") continue;
-		if (node instanceof AbortSignal) continue;
-		if (seen.has(node)) continue;
-		seen.add(node);
-		Object.freeze(node);
-		const keys = Object.keys(node);
-		for (let index = keys.length - 1; index >= 0; index--) {
-			const key = keys[index];
-			/* v8 ignore next -- the loop is bounded by the captured key count. */
-			if (key === void 0) continue;
-			pending.push({
-				kind: "property",
-				source: node,
-				key
-			});
-		}
-	}
-	return value;
-}
-//#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-settings@0_935f3a2ac52a1f8e83ba61ff4169507a/node_modules/@deepseek-ai/dsh-settings/lib/index.js
-var lib_exports = /* @__PURE__ */ __exportAll({
-	SettingsConflictError: () => SettingsConflictError,
-	SettingsProvider: () => SettingsProvider,
-	default: () => SettingsProvider,
-	redactSecrets: () => redactSecrets$1
-});
-/**
-* Structural secret redaction for settings values. `role('secret')` fields are
-* removed from a value before it crosses a wire boundary; a sidecar records
-* each schema-declared secret position and whether it currently holds a value,
-* so a configuration surface can render a write-only input without ever
-* receiving the secret itself.
-* @module @deepseek-ai/dsh-settings/redact
-*/
-/** Whether a value is a plain data object the walker may recurse into. */
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function walk(node, value, path, secrets) {
-	if (node === void 0) return value;
-	if (node.meta?.role === "secret") {
-		secrets.push({
-			path,
-			set: value !== void 0
-		});
-		return;
-	}
-	switch (node.type) {
-		case "object": {
-			const properties = node.dict ?? {};
-			const source = isRecord$1(value) ? value : void 0;
-			const rebuilt = {};
-			if (source !== void 0) for (const [key, entry] of Object.entries(source)) {
-				if (key in properties) continue;
-				rebuilt[key] = entry;
-			}
-			for (const [key, child] of Object.entries(properties)) {
-				const stripped = walk(child, source?.[key], [...path, key], secrets);
-				if (stripped !== void 0) rebuilt[key] = stripped;
-			}
-			return source === void 0 && Object.keys(rebuilt).length === 0 ? value : rebuilt;
-		}
-		case "dict": {
-			if (!isRecord$1(value)) return value;
-			const rebuilt = {};
-			for (const [key, entry] of Object.entries(value)) {
-				const stripped = walk(node.inner, entry, [...path, key], secrets);
-				if (stripped !== void 0) rebuilt[key] = stripped;
-			}
-			return rebuilt;
-		}
-		case "array":
-			if (!Array.isArray(value)) return value;
-			return value.map((entry, index) => walk(node.inner, entry, [...path, String(index)], secrets));
-		default: return value;
-	}
-}
-/**
-* Remove every `role('secret')` field a schema declares from a value. The
-* walker follows `object`, `dict`, and `array` containers; a secret must be
-* declared directly on a field reachable through those containers (a secret
-* buried inside a union branch or transform is not reachable and must not be
-* modeled that way). The input is never mutated.
-* @param schema - live schemastery schema describing the value.
-* @param value - the value to strip; `undefined` yields an empty record with
-*   object-property secret slots still enumerated.
-* @returns the stripped detached value and the ordered secret positions.
-*/
-function redactSecrets$1(schema, value) {
-	const secrets = [];
-	return {
-		value: walk(schema, value, [], secrets),
-		secrets
-	};
-}
-/**
-* Service Definition for the user-settings capability seam (`ctx.settings`). Providers store one raw document of
-* per-namespace sections; plugins register a namespace schema and read the
-* resolved value, which layers schema defaults, the registrant's composition
-* `base`, and the user document section, in that order.
-* @module @deepseek-ai/dsh-settings
-*/
-const NAMESPACE_PATTERN = /^[a-z][a-z0-9-]*$/;
-function parseSettingsNamespace(value) {
-	if (!NAMESPACE_PATTERN.test(value)) throw new TypeError(`settings namespace "${value}" must match ${String(NAMESPACE_PATTERN)}`);
-	return value;
-}
-/**
-* A write refused because the namespace moved since the caller read it. The
-* Service Definition's serialized write queue orders writes; it cannot tell a fresh writer
-* from one holding a stale snapshot, which is what this reports.
-*/
-var SettingsConflictError = class extends Error {
-	/** Stable machine code for wire layers mapping this to their own taxonomy. */
-	code = "SETTINGS_CONFLICT";
-	/** The revision the write expected. */
-	expected;
-	/** The revision the namespace actually stands at. */
-	actual;
-	/**
-	* @param ns - the namespace whose write was refused.
-	* @param expected - the revision the caller sent.
-	* @param actual - the revision now stored.
-	*/
-	constructor(ns, expected, actual) {
-		super(`settings namespace "${ns}" changed since it was read (expected revision ${String(expected)}, now ${String(actual)})`);
-		this.name = "SettingsConflictError";
-		this.expected = expected;
-		this.actual = actual;
-	}
-};
-/** Whether a value is a plain data object (not an array, null, or class instance). */
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/** Apply one path op to a detached section, returning the next section. */
-function applyPathOp(section, op) {
-	const [head, ...rest] = op.path;
-	if (head === void 0) {
-		if (op.op === "unset") return {};
-		if (!isPlainObject(op.value)) throw new TypeError("settings mutate: setting the section root requires a plain object");
-		return { ...op.value };
-	}
-	if (rest.length === 0) {
-		if (op.op === "set") return {
-			...section,
-			[head]: op.value
-		};
-		const { [head]: _removed, ...kept } = section;
-		return kept;
-	}
-	const child = section[head];
-	if (!isPlainObject(child)) {
-		if (op.op === "unset") return section;
-		return {
-			...section,
-			[head]: applyPathOp({}, {
-				...op,
-				path: rest
-			})
-		};
-	}
-	return {
-		...section,
-		[head]: applyPathOp(child, {
-			...op,
-			path: rest
-		})
-	};
-}
-/** Human label for a value that lossless JSON cannot represent (numbers reject inline). */
-function describeRejected(value) {
-	if (value === void 0) return "undefined";
-	if (typeof value === "object" && value !== null) {
-		const name = Object.getPrototypeOf(value)?.constructor?.name;
-		return name === void 0 || name === "Object" ? "a non-plain object" : `a ${name}`;
-	}
-	return `a ${typeof value}`;
-}
-/**
-* Detach and validate one write input in a single walk before persistence:
-* only JSON data (plain objects, arrays, strings, finite numbers,
-* booleans, `null`) may reach a provider document. `structuredClone` alone
-* would admit Dates, Maps, BigInts, and cycles that YAML/JSON storage then
-* silently distorts on the reload round-trip. `undefined` entries in objects
-* are skipped — the same sparse-patch semantics as {@link mergeLayers} — while
-* an `undefined` array entry is rejected rather than coerced.
-* @param root - plain-object write input (caller-checked).
-* @param reject - builds the validation error from a value label and its `$`-rooted path.
-* @returns the detached JSON-compatible clone.
-*/
-function cloneJsonShaped(root, reject) {
-	const visiting = /* @__PURE__ */ new WeakSet();
-	const clone = (value, path) => {
-		if (value === null || typeof value === "string" || typeof value === "boolean") return value;
-		if (typeof value === "number") {
-			if (!Number.isFinite(value)) throw reject("a non-finite number", path);
-			return value;
-		}
-		if (Array.isArray(value)) {
-			if (visiting.has(value)) throw reject("a circular reference", path);
-			visiting.add(value);
-			const entries = value.map((entry, index) => clone(entry, `${path}[${index}]`));
-			visiting.delete(value);
-			return entries;
-		}
-		if (isPlainObject(value)) {
-			if (visiting.has(value)) throw reject("a circular reference", path);
-			visiting.add(value);
-			const out = {};
-			for (const [key, entry] of Object.entries(value)) {
-				if (entry === void 0) continue;
-				out[key] = clone(entry, `${path}.${key}`);
-			}
-			visiting.delete(value);
-			return out;
-		}
-		throw reject(describeRejected(value), path);
-	};
-	return clone(root, "$");
-}
-/**
-* Layer `over` onto `under`: plain objects merge recursively, every other
-* value (arrays included) replaces the lower layer wholesale. `over` never
-* carries `undefined` entries — sections come from parsed documents and write
-* snapshots pass {@link cloneJsonShaped}, which strips them so a sparse patch
-* cannot erase lower keys.
-*/
-function mergeLayers(under, over) {
-	if (over === void 0) return under;
-	if (!isPlainObject(under) || !isPlainObject(over)) return over;
-	const merged = { ...under };
-	for (const [key, value] of Object.entries(over)) merged[key] = key in merged ? mergeLayers(merged[key], value) : value;
-	return merged;
-}
-/**
-* Abstract settings service. Providers implement raw-document storage
-* (`load`/`persist`) and push external changes through {@link Settings.publish};
-* the base class owns namespace registration, resolution, validation, change
-* detection, and the `settings/updated` commit event.
-*/
-var SettingsProvider = class extends Service {
-	registrations = /* @__PURE__ */ new Map();
-	/** Latest published raw document; empty until the provider's first publish. */
-	document = {};
-	/** Per-namespace write chains; settled tails, so a failure never poisons the queue. */
-	writeQueues = /* @__PURE__ */ new Map();
-	/** In-flight watcher invocation segments, drained by the dispose teardown. */
-	pendingTails = /* @__PURE__ */ new Set();
-	/** Set at service dispose: refuse new writes while queued ones drain. */
-	stopped = false;
-	/** Opaque read of {@link stopped}: control flow cannot narrow it across awaits. */
-	isStopped() {
-		return this.stopped;
-	}
-	constructor(ctx) {
-		super(ctx, "settings");
-	}
-	/**
-	* Load the provider's document once and publish it before the service
-	* becomes injectable, and register the write-drain teardown. Providers with
-	* their own init (watchers, connections) delegate here first via
-	* `yield* super[Service.init]()`; their disposers then run before the drain.
-	*/
-	async *[Service.init]() {
-		yield async () => {
-			this.stopped = true;
-			await Promise.allSettled([...this.writeQueues.values(), ...this.pendingTails]);
-		};
-		this.publish(await this.load());
-	}
-	/**
-	* Absolute path of the provider's user-editable document, when its storage
-	* is one local file. Configuration surfaces use this only as availability
-	* metadata; the guarded open operation resolves the path again Host-side.
-	* Non-file providers leave it undefined and expose no open-document affordance.
-	* @returns the absolute local document path, or undefined for non-file storage.
-	*/
-	get documentPath() {}
-	/**
-	* Prepare the provider's user-editable document for a native editor. File
-	* providers may materialize an absent document before returning its path;
-	* non-file providers return undefined.
-	* @returns the absolute local document path, or undefined for non-file storage.
-	*/
-	prepareDocument() {
-		return Promise.resolve(this.documentPath);
-	}
-	/**
-	* Register a namespace schema and receive its owner scope. The registration
-	* is an effect on the calling plugin's fiber: disposing that fiber removes
-	* the namespace and its observers. An invalid stored section fails the
-	* registration itself — the earliest point where the schema can judge it.
-	* @param ns - unique namespace; duplicate registration fails loud.
-	* @param schema - schemastery schema resolving this namespace's value.
-	* @param options - composition `base` layer and effect timing.
-	* @returns the owner scope for reads, observation, and updates.
-	* @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-	*/
-	register(ns, schema, options) {
-		const parsedNs = parseSettingsNamespace(ns);
-		if (this.registrations.has(parsedNs)) throw new Error(`settings namespace "${parsedNs}" is already registered`);
-		const registration = {
-			ns: parsedNs,
-			schema,
-			base: options?.base,
-			applies: options?.applies ?? "live",
-			...options?.validate === void 0 ? {} : { validate: options.validate },
-			resolved: deepFreeze(this.resolve(schema, options?.base, this.section(parsedNs), options?.validate)),
-			revision: 0,
-			watchers: /* @__PURE__ */ new Set()
-		};
-		this.ctx.effect(() => {
-			this.registrations.set(parsedNs, registration);
-			return () => this.registrations.delete(parsedNs);
-		}, `settings.register(${JSON.stringify(String(parsedNs))})`);
-		return {
-			get: () => registration.resolved,
-			watch: (callback) => {
-				const watcher = {
-					callback,
-					tail: Promise.resolve(),
-					active: true
-				};
-				registration.watchers.add(watcher);
-				return () => {
-					watcher.active = false;
-					registration.watchers.delete(watcher);
-				};
-			},
-			update: (patch) => this.update(parsedNs, patch),
-			replace: (section) => this.replace(parsedNs, section)
-		};
-	}
-	/**
-	* Attach one optional-settings consumer to this provider. The consumer
-	* registers its composition entry as the base layer while this provider is
-	* present, then falls back to that entry if the provider detaches.
-	* @param owner - consumer context whose unload suppresses fallback work.
-	* @param ns - consumer-owned settings namespace.
-	* @param schema - schema resolving the namespace.
-	* @param entry - composition entry used as the base and fallback value.
-	* @param hooks - source sink, change notification, and optional validation.
-	* @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-	*/
-	installSection(owner, ns, schema, entry, hooks) {
-		const scope = this.register(ns, schema, {
-			base: entry,
-			...hooks.validate === void 0 ? {} : { validate: hooks.validate }
-		});
-		hooks.setSource(() => scope.get());
-		this.ctx.effect(() => () => {
-			if (isUnloading(owner)) return;
-			hooks.setSource(() => entry);
-			hooks.onChange();
-		});
-		hooks.onChange();
-		scope.watch(() => {
-			if (isUnloading(owner)) return;
-			hooks.onChange();
-		});
-	}
-	/**
-	* Describe every registered namespace for configuration surfaces, including
-	* the composition `base` and raw user layers so a form can mark which fields
-	* the user overrode (presence in `user`) and what a reset returns to.
-	* @param options - redaction switch; wire surfaces must redact.
-	* @returns one descriptor per registered namespace, in registration order.
-	*/
-	describe(options) {
-		return [...this.registrations.values()].map((registration) => {
-			let user;
-			try {
-				user = this.section(registration.ns);
-			} catch {
-				user = void 0;
-			}
-			const base = registration.base === void 0 ? void 0 : structuredClone(registration.base);
-			const detachedUser = user === void 0 ? void 0 : structuredClone(user);
-			const descriptor = {
-				ns: registration.ns,
-				schema: registration.schema.toJSON(),
-				value: registration.resolved,
-				revision: registration.revision,
-				...base === void 0 ? {} : { base },
-				...detachedUser === void 0 ? {} : { user: detachedUser },
-				applies: registration.applies
-			};
-			if (options?.redactSecrets !== true) return descriptor;
-			const schema = registration.schema;
-			const redacted = redactSecrets$1(schema, registration.resolved);
-			return {
-				...descriptor,
-				value: redacted.value,
-				...base === void 0 ? {} : { base: redactSecrets$1(schema, base).value },
-				...detachedUser === void 0 ? {} : { user: redactSecrets$1(schema, detachedUser).value },
-				secrets: redacted.secrets
-			};
-		});
-	}
-	/**
-	* Read one registered namespace's resolved value.
-	* @param ns - the namespace to read.
-	* @returns the resolved value, or `undefined` while unregistered.
-	* @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-	*/
-	get(ns) {
-		return this.registrations.get(parseSettingsNamespace(ns))?.resolved;
-	}
-	/**
-	* Merge a patch into one registered namespace's user layer, validate the
-	* resolved candidate, persist through the provider, then commit and emit.
-	* A validation failure rejects before anything is persisted. Writes to one
-	* namespace are serialized: concurrent updates apply in call order, each
-	* merging over the previous write's committed section.
-	* @param ns - the registered namespace to update.
-	* @param patch - plain-object patch over the user section.
-	* @param expectedRevision - the descriptor `revision` the caller read; a
-	*   namespace that moved past it rejects with {@link SettingsConflictError}.
-	* @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-	*/
-	async update(ns, patch, expectedRevision) {
-		return this.write(parseSettingsNamespace(ns), patch, "merge", expectedRevision);
-	}
-	/**
-	* Replace one registered namespace's user section wholesale, validate,
-	* persist, then commit and emit. Keys absent from `section` fall back to the
-	* composition `base` and schema defaults — this is the removal/reset path a
-	* merge-only patch cannot express (`replace({})` re-inherits everything).
-	* @param ns - the registered namespace to replace.
-	* @param section - the complete next user section.
-	* @param expectedRevision - the descriptor `revision` the caller read; a
-	*   namespace that moved past it rejects with {@link SettingsConflictError}.
-	* @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-	*/
-	async replace(ns, section, expectedRevision) {
-		return this.write(parseSettingsNamespace(ns), section, "replace", expectedRevision);
-	}
-	/**
-	* Apply path-addressed edits to one registered namespace's user section,
-	* validate, persist, then commit and emit. The ops are applied to the
-	* section as it stands when the write reaches the front of the queue, so a
-	* caller never has to restate fields it did not touch — and, crucially,
-	* cannot delete fields it never saw. This is the write path for any caller
-	* holding a redacted view; `replace` remains the wholesale reset.
-	* @param ns - the registered namespace to edit.
-	* @param ops - ordered path edits; later ops observe earlier ones.
-	* @param expectedRevision - the descriptor `revision` the caller read; a
-	*   namespace that moved past it rejects with {@link SettingsConflictError}.
-	* @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-	*/
-	async mutate(ns, ops, expectedRevision) {
-		const parsedNs = parseSettingsNamespace(ns);
-		if (!Array.isArray(ops)) throw new TypeError(`settings mutate for "${parsedNs}" must be an array of path ops`);
-		for (const op of ops) {
-			if (!isPlainObject(op) || op["op"] !== "set" && op["op"] !== "unset") throw new TypeError(`settings mutate for "${parsedNs}" ops must be {op:'set'|'unset', path}`);
-			if (!Array.isArray(op["path"]) || op["path"].some((part) => typeof part !== "string")) throw new TypeError(`settings mutate for "${parsedNs}" op paths must be arrays of strings`);
-		}
-		return this.write(parsedNs, ops, "mutate", expectedRevision);
-	}
-	/** Validate a write, then queue it on the namespace's serialized write chain. */
-	write(ns, input, mode, expectedRevision) {
-		const verb = mode === "merge" ? "update" : mode === "replace" ? "replace" : "mutate";
-		const registration = this.registrations.get(ns);
-		if (registration === void 0) throw new Error(`settings namespace "${ns}" is not registered`);
-		if (this.isStopped()) throw new Error(`settings service is disposed: "${ns}" cannot be written`);
-		if (!this.writable) throw new Error(`settings provider is read-only: "${ns}" cannot be updated in-process`);
-		let payload;
-		if (mode === "mutate") payload = { ops: input };
-		else {
-			if (!isPlainObject(input)) throw new TypeError(`settings ${verb} for "${ns}" must be a plain object`);
-			payload = input;
-		}
-		const snapshot = cloneJsonShaped(payload, (label, path) => /* @__PURE__ */ new TypeError(`settings ${verb} for "${ns}" must contain only JSON-compatible data (found ${label} at ${path})`));
-		const run = (this.writeQueues.get(ns) ?? Promise.resolve()).catch(() => void 0).then(async () => {
-			if (this.isStopped()) throw new Error(`settings service was disposed before the queued "${ns}" ${verb} ran`);
-			if (this.registrations.get(ns) !== registration) throw new Error(`settings namespace "${ns}" registration was disposed before the queued ${verb} ran`);
-			const current = this.section(ns) ?? {};
-			if (expectedRevision !== void 0 && expectedRevision !== registration.revision) throw new SettingsConflictError(ns, expectedRevision, registration.revision);
-			const section = mode === "merge" ? mergeLayers(current, snapshot) : mode === "replace" ? snapshot : snapshot["ops"].reduce(applyPathOp, current);
-			const next = deepFreeze(this.resolve(registration.schema, registration.base, section, registration.validate));
-			await this.persist(ns, section);
-			this.document[ns] = section;
-			if (this.registrations.get(ns) === registration && !this.isStopped()) {
-				this.bumpRevision(registration, current, section);
-				this.commit(registration, next, "update");
-			}
-		});
-		this.writeQueues.set(ns, run);
-		return run;
-	}
-	/**
-	* Provider hook: commit a complete raw document observed in storage. Each
-	* registered namespace re-resolves; an invalid section keeps that
-	* namespace's last good value and warns, other namespaces still commit.
-	* @param doc - the detached raw document (unregistered sections preserved).
-	* @param source - change origin; defaults to `provider`.
-	*/
-	publish(doc, source = "provider") {
-		const before = /* @__PURE__ */ new Map();
-		for (const registration of this.registrations.values()) try {
-			before.set(registration.ns, this.section(registration.ns));
-		} catch {
-			before.set(registration.ns, void 0);
-		}
-		this.document = doc;
-		for (const registration of this.registrations.values()) {
-			let next;
-			try {
-				next = deepFreeze(this.resolve(registration.schema, registration.base, this.section(registration.ns), registration.validate));
-			} catch (error) {
-				this.ctx.logger.warn("settings: keeping last good \"%s\" after invalid stored section", registration.ns);
-				this.ctx.logger.warn(error);
-				continue;
-			}
-			this.bumpRevision(registration, before.get(registration.ns), this.section(registration.ns));
-			this.commit(registration, next, source);
-		}
-	}
-	/** Read one namespace's raw user section, rejecting non-object sections. */
-	section(ns) {
-		const section = this.document[ns];
-		if (section === void 0) return void 0;
-		if (!isPlainObject(section)) throw new TypeError(`settings section "${ns}" must be an object of keys`);
-		return section;
-	}
-	/** Resolve one namespace value: schema defaults, then `base`, then the user layer. */
-	resolve(schema, base, section, validate) {
-		const value = schema(mergeLayers(base, section));
-		validate?.(value);
-		return value;
-	}
-	/**
-	* Advance a namespace's revision when its RAW section changed, and announce
-	* it. Deliberately independent of {@link commit}'s resolved-value equality:
-	* storing an override equal to the composition base leaves the resolved
-	* value alone but changes what the document says, which is exactly what a
-	* configuration surface must re-read.
-	*/
-	bumpRevision(registration, before, after) {
-		if (deepEqualJson(before, after)) return;
-		registration.revision += 1;
-		this.emitDocumentUpdated(registration.ns, registration.revision);
-	}
-	/** Contained fan-out of `settings/document-updated`, mirroring {@link commit}'s. */
-	emitDocumentUpdated(ns, revision) {
-		let invariantFailure;
-		const args = [
-			"settings/document-updated",
-			ns,
-			revision
-		];
-		for (const listener of this.ctx.events.dispatch("emit", args)) try {
-			const returned = listener(ns, revision);
-			if (returned != null && typeof returned.then === "function") Promise.resolve(returned).then(void 0, (error) => {
-				this.warnListenerFailure(ns, error);
-			});
-		} catch (error) {
-			if (error?.code === "INVARIANT") {
-				invariantFailure ??= error;
-				continue;
-			}
-			this.warnListenerFailure(ns, error);
-		}
-		if (invariantFailure !== void 0) throw invariantFailure;
-	}
-	/** Commit a resolved value when changed: swap, notify watchers, emit the event. */
-	commit(registration, next, source) {
-		const prev = registration.resolved;
-		if (deepEqualJson(next, prev)) return;
-		registration.resolved = next;
-		for (const watcher of [...registration.watchers]) {
-			const segment = watcher.tail.then(() => {
-				if (!watcher.active || this.isStopped()) return;
-				return watcher.callback(next, prev);
-			}).then(() => void 0, (error) => {
-				this.warnWatcherFailure(registration.ns, error);
-			});
-			watcher.tail = segment;
-			this.pendingTails.add(segment);
-			segment.then(() => this.pendingTails.delete(segment));
-		}
-		let invariantFailure;
-		const args = [
-			"settings/updated",
-			registration.ns,
-			next,
-			prev,
-			source
-		];
-		for (const listener of this.ctx.events.dispatch("emit", args)) try {
-			const returned = listener(registration.ns, next, prev, source);
-			if (returned != null && typeof returned.then === "function") Promise.resolve(returned).then(void 0, (error) => {
-				this.warnListenerFailure(registration.ns, error);
-			});
-		} catch (error) {
-			if (error?.code === "INVARIANT") {
-				invariantFailure ??= error;
-				continue;
-			}
-			this.warnListenerFailure(registration.ns, error);
-		}
-		if (invariantFailure !== void 0) throw invariantFailure;
-	}
-	/** Contained-watcher diagnostic shared by the sync and async failure paths. */
-	warnWatcherFailure(ns, error) {
-		this.ctx.logger.warn("settings: watcher for \"%s\" failed", ns);
-		this.ctx.logger.warn(error);
-	}
-	/** Contained-listener diagnostic shared by the sync and async failure paths. */
-	warnListenerFailure(ns, error) {
-		this.ctx.logger.warn("settings: a settings/updated listener for \"%s\" failed", ns);
-		this.ctx.logger.warn(error);
-	}
-};
-/**
-* Value mirror of the `FiberState` members {@link isUnloading} compares
-* against: a const enum has no runtime object to import, and the value is
-* needed at runtime (same rationale as the CLI boot driver's mirror).
-*/
-const FIBER_DISPOSED = 4;
-const FIBER_UNLOADING = 5;
-/** Whether the consumer's own fiber is tearing down (not just losing the settings service). */
-function isUnloading(ctx) {
-	const state = ctx.fiber.state;
-	return state === FIBER_UNLOADING || state === FIBER_DISPOSED;
-}
-//#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1._7f15c7653b2619acc206cea5c06e49b3/node_modules/@deepseek-ai/dsh-scope/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1._0271d3a82adfe807020938592f267574/node_modules/@deepseek-ai/dsh-scope/lib/index.js
 /**
 * Shared insertion-ordered storage and effect ownership for scope-aware registries.
 *
@@ -1138,7 +284,7 @@ function scopeTarget(base, key) {
 	return carrier;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-typert-pro_32eafa0ce53608e9afb5dafcec019560/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-typert-pro_3c0b69ae3886dc169eb7f5273170dc50/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
 /** The one Remote failure class shared by owners, the Gateway, and consumers. */
 /**
 * One Remote call failure: a real Error carrying its stable code and typed
@@ -1182,7 +328,10 @@ function isTypertRemoteSegment(value) {
 }
 const REMOTE_METHOD_DESCRIPTOR = "@deepseek-ai/dsh-typert-protocol/remote-methods";
 /**
-* Bind one visible Service field to a Cordis key and Remote namespace.
+* Bind one visible Service field to a Cordis key and Remote namespace. A
+* service that owns a Cordis Context also gives its tree `ctx.invocation`,
+* `undefined` outside a Remote call, so no `TypertRemoteService` is needed for
+* a Host composition to read it.
 * @param service - owning Service instance, normally `this`.
 * @param serviceKey - exact Cordis service key.
 * @param options - optional distinct wire namespace.
@@ -1192,6 +341,8 @@ function bindTypertRemote(service, serviceKey, options = {}) {
 	validateName("service key", serviceKey);
 	const namespace = options.namespace ?? serviceKey;
 	validateName("namespace", namespace);
+	const ctx = Reflect.get(service, "ctx");
+	if (ctx instanceof Context) provideInvocationAccessor(ctx);
 	return Object.freeze({
 		service,
 		serviceKey,
@@ -1213,6 +364,16 @@ var TypertRemoteService = class extends Service {
 		this.typertRemote = bindTypertRemote(this, this.name, options);
 	}
 };
+/**
+* Make `ctx.invocation` read as `undefined` outside a Remote call instead of the
+* reflect service's "cannot get property" error; a call-derived Context shadows
+* the accessor with its own property. The first Remote Service constructed in a
+* tree registers it on the root, where it outlives any one Service.
+*/
+function provideInvocationAccessor(ctx) {
+	if (Object.hasOwn(ctx.root.reflect.props, "invocation")) return;
+	ctx.root.accessor("invocation", { get: () => void 0 });
+}
 function Remote(methodExportOrOptions, context) {
 	if (typeof methodExportOrOptions === "string") {
 		validateName("Remote export name", methodExportOrOptions);
@@ -1222,68 +383,280 @@ function Remote(methodExportOrOptions, context) {
 		if (remoteOptionMode(methodExportOrOptions) !== "stream" || Reflect.ownKeys(methodExportOrOptions).length !== 1) throw new TypeError("typert-protocol: Remote options must contain exactly mode: \"stream\"");
 		return remoteDecorator({ kind: "direct" }, "stream");
 	}
-	if (context === void 0) throw new TypeError("typert-protocol: Remote decorator context is missing");
-	addMarkerInitializer(context, { kind: "direct" });
-}
-function remoteOptionMode(options) {
-	return Reflect.get(options, "mode");
-}
-function remoteDecorator(invocation, mode, exportName) {
-	return function(_method, context) {
-		addMarkerInitializer(context, invocation, mode, exportName);
-	};
+	if (context === void 0) throw new TypeError("typert-protocol: Remote decorator context is missing");
+	addMarkerInitializer(context, { kind: "direct" });
+}
+function remoteOptionMode(options) {
+	return Reflect.get(options, "mode");
+}
+function remoteDecorator(invocation, mode, exportName) {
+	return function(_method, context) {
+		addMarkerInitializer(context, invocation, mode, exportName);
+	};
+}
+function readRemoteMethodDescriptor(prototype) {
+	const property = Object.getOwnPropertyDescriptor(prototype, REMOTE_METHOD_DESCRIPTOR);
+	if (property === void 0) return void 0;
+	const descriptor = property.value;
+	if (descriptor === null || typeof descriptor !== "object") throw new TypeError("typert-protocol: Remote method descriptor must be an object");
+	const version = Reflect.get(descriptor, "version");
+	if (version !== 1) throw new TypeError(`typert-protocol: unsupported Remote method descriptor version ${String(version)}`);
+	const methods = Reflect.get(descriptor, "methods");
+	if (!Array.isArray(methods)) throw new TypeError("typert-protocol: Remote method descriptor methods must be an array");
+	return descriptor;
+}
+function addMarkerInitializer(context, invocation, mode, exportName) {
+	if (context.private || context.static || typeof context.name !== "string") throw new TypeError("typert-protocol: Remote decorators require a public instance method with a string name");
+	const method = context.name;
+	context.addInitializer(function() {
+		const prototype = Object.getPrototypeOf(this);
+		if (prototype === null) throw new TypeError(`typert-protocol: cannot mark Remote method "${method}" on an object without a prototype`);
+		mark(prototype, method, invocation, mode, exportName);
+	});
+}
+function mark(prototype, method, invocation, mode, exportName) {
+	const descriptor = readRemoteMethodDescriptor(prototype);
+	const marker = Object.freeze({
+		method,
+		...exportName === void 0 || exportName === method ? {} : { exportName },
+		...mode === void 0 ? {} : { mode },
+		invocation: Object.freeze(invocation)
+	});
+	const current = descriptor?.methods.find((candidate) => candidate.method === method);
+	if (current !== void 0) {
+		if (current.exportName === marker.exportName && current.mode === marker.mode && sameInvocation(current.invocation, invocation)) return;
+		throw new Error(`typert-protocol: Remote method "${method}" has conflicting invocation markers`);
+	}
+	Object.defineProperty(prototype, REMOTE_METHOD_DESCRIPTOR, {
+		configurable: true,
+		value: Object.freeze({
+			version: 1,
+			methods: Object.freeze([...descriptor?.methods ?? [], marker])
+		})
+	});
+}
+function sameInvocation(left, right) {
+	if (left.kind === "direct") return right.kind === "direct";
+	if (right.kind === "direct") return false;
+	return left.context === right.context;
+}
+function validateName(subject, value) {
+	if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
+}
+//#endregion
+//#region node_modules/.pnpm/@deepseek-ai+dsh-util-value_1dc92f68acf2742e77b3d5d44dd1e11b/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
+/** Duplicate-install-safe JSON and immutable-value helpers. @module @deepseek-ai/dsh-util-values */
+/**
+* Mark an unreachable closed-union branch.
+* @param value - impossible value; an unhandled typed variant fails at the call site.
+* @param context - optional switch-site label included in the failure message.
+* @returns never; a runtime value that escaped its type always throws.
+*/
+function assertNever(value, context) {
+	const rendered = JSON.stringify(value) ?? String(value);
+	throw new Error(`unreachable variant${context ? ` in ${context}` : ""}: ${rendered}`);
+}
+/** Whether a realm-owned intrinsic prototype is backed by its native constructor. */
+function hasIntrinsicConstructor$1(prototype, name) {
+	const constructor = Object.getOwnPropertyDescriptor(prototype, "constructor")?.value;
+	if (typeof constructor !== "function") return false;
+	try {
+		return constructor.name === name && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === `function ${name}() { [native code] }`;
+	} catch {
+		return false;
+	}
+}
+/** Whether a candidate is one realm's intrinsic `Object.prototype`. */
+function isIntrinsicObjectPrototype$1(value) {
+	return Object.getPrototypeOf(value) === null && hasIntrinsicConstructor$1(value, "Object");
+}
+/** Whether an array uses one realm's intrinsic `Array.prototype`, not a subclass or forged prototype. */
+function hasPlainArrayPrototype$1(value) {
+	const prototype = Object.getPrototypeOf(value);
+	if (!Array.isArray(prototype) || !hasIntrinsicConstructor$1(prototype, "Array")) return false;
+	const objectPrototype = Object.getPrototypeOf(prototype);
+	return typeof objectPrototype === "object" && objectPrototype !== null && isIntrinsicObjectPrototype$1(objectPrototype);
+}
+/** Whether an object is a plain or null-prototype record from any JavaScript realm. */
+function hasPlainObjectPrototype(value) {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === null || typeof prototype === "object" && isIntrinsicObjectPrototype$1(prototype);
+}
+/** Return every JSON-visible object key, or reject own data JSON would discard. */
+function enumerableStringKeys(value) {
+	const keys = Reflect.ownKeys(value);
+	if (keys.some((key) => typeof key !== "string" || !Object.prototype.propertyIsEnumerable.call(value, key))) return void 0;
+	return keys;
+}
+/** Validate lossless JSON iteratively, optionally materializing a detached snapshot. */
+function walkJsonValue(value, detach) {
+	const ancestors = /* @__PURE__ */ new Set();
+	let root;
+	const assign = (destination, item) => {
+		if (destination === void 0) return;
+		if (destination.kind === "root") root = item;
+		else if (destination.kind === "array") destination.target[destination.index] = item;
+		else Object.defineProperty(destination.target, destination.key, {
+			value: item,
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+	};
+	const tasks = [{
+		kind: "visit",
+		value,
+		...detach ? { destination: { kind: "root" } } : {}
+	}];
+	for (let task = tasks.pop(); task !== void 0; task = tasks.pop()) {
+		if (task.kind === "leave") {
+			ancestors.delete(task.source);
+			continue;
+		}
+		if (task.kind === "array-item") {
+			if (!Object.prototype.hasOwnProperty.call(task.source, task.index)) return void 0;
+			tasks.push({
+				kind: "visit",
+				value: task.source[task.index],
+				...task.target === void 0 ? {} : { destination: {
+					kind: "array",
+					target: task.target,
+					index: task.index
+				} }
+			});
+			continue;
+		}
+		if (task.kind === "object-property") {
+			tasks.push({
+				kind: "visit",
+				value: task.source[task.key],
+				...task.target === void 0 ? {} : { destination: {
+					kind: "object",
+					target: task.target,
+					key: task.key
+				} }
+			});
+			continue;
+		}
+		const current = task.value;
+		if (current === null) {
+			assign(task.destination, null);
+			continue;
+		}
+		if (typeof current === "boolean" || typeof current === "string") {
+			assign(task.destination, current);
+			continue;
+		}
+		if (typeof current === "number") {
+			if (!Number.isFinite(current) || Object.is(current, -0)) return void 0;
+			assign(task.destination, current);
+			continue;
+		}
+		if (typeof current !== "object") return void 0;
+		if (ancestors.has(current)) return void 0;
+		if (Array.isArray(current)) {
+			if (!hasPlainArrayPrototype$1(current)) return void 0;
+			const length = current.length;
+			if (Reflect.ownKeys(current).length !== length + 1) return void 0;
+			const target = detach ? [] : void 0;
+			if (target !== void 0) assign(task.destination, target);
+			ancestors.add(current);
+			tasks.push({
+				kind: "leave",
+				source: current
+			});
+			for (let index = length - 1; index >= 0; index--) tasks.push({
+				kind: "array-item",
+				source: current,
+				index,
+				...target === void 0 ? {} : { target }
+			});
+			continue;
+		}
+		if (!hasPlainObjectPrototype(current)) return void 0;
+		const keys = enumerableStringKeys(current);
+		if (keys === void 0) return void 0;
+		const target = detach ? {} : void 0;
+		if (target !== void 0) assign(task.destination, target);
+		ancestors.add(current);
+		tasks.push({
+			kind: "leave",
+			source: current
+		});
+		for (let index = keys.length - 1; index >= 0; index--) {
+			const key = keys[index];
+			/* v8 ignore next -- the loop is bounded by the captured key count. */
+			if (key === void 0) return void 0;
+			tasks.push({
+				kind: "object-property",
+				source: current,
+				key,
+				...target === void 0 ? {} : { target }
+			});
+		}
+	}
+	return detach ? root : true;
 }
-function readRemoteMethodDescriptor(prototype) {
-	const property = Object.getOwnPropertyDescriptor(prototype, REMOTE_METHOD_DESCRIPTOR);
-	if (property === void 0) return void 0;
-	const descriptor = property.value;
-	if (descriptor === null || typeof descriptor !== "object") throw new TypeError("typert-protocol: Remote method descriptor must be an object");
-	const version = Reflect.get(descriptor, "version");
-	if (version !== 1) throw new TypeError(`typert-protocol: unsupported Remote method descriptor version ${String(version)}`);
-	const methods = Reflect.get(descriptor, "methods");
-	if (!Array.isArray(methods)) throw new TypeError("typert-protocol: Remote method descriptor methods must be an array");
-	return descriptor;
+/**
+* Validate and detach lossless JSON in one read per property.
+* @param value - candidate value to validate and detach.
+* @returns the detached snapshot, or `undefined` when the value is not losslessly JSON-serializable.
+*/
+function snapshotJsonValue(value) {
+	return walkJsonValue(value, true);
 }
-function addMarkerInitializer(context, invocation, mode, exportName) {
-	if (context.private || context.static || typeof context.name !== "string") throw new TypeError("typert-protocol: Remote decorators require a public instance method with a string name");
-	const method = context.name;
-	context.addInitializer(function() {
-		const prototype = Object.getPrototypeOf(this);
-		if (prototype === null) throw new TypeError(`typert-protocol: cannot mark Remote method "${method}" on an object without a prototype`);
-		mark(prototype, method, invocation, mode, exportName);
-	});
+/**
+* Test the same lossless JSON rules as {@link snapshotJsonValue} without detaching the value.
+* @param value - candidate value to test.
+* @returns whether the value survives a JSON round trip without loss.
+*/
+function isJsonValue(value) {
+	return walkJsonValue(value, false) === true;
 }
-function mark(prototype, method, invocation, mode, exportName) {
-	const descriptor = readRemoteMethodDescriptor(prototype);
-	const marker = Object.freeze({
-		method,
-		...exportName === void 0 || exportName === method ? {} : { exportName },
-		...mode === void 0 ? {} : { mode },
-		invocation: Object.freeze(invocation)
-	});
-	const current = descriptor?.methods.find((candidate) => candidate.method === method);
-	if (current !== void 0) {
-		if (current.exportName === marker.exportName && current.mode === marker.mode && sameInvocation(current.invocation, invocation)) return;
-		throw new Error(`typert-protocol: Remote method "${method}" has conflicting invocation markers`);
+/**
+* Deep-freeze an object graph in place while leaving live AbortSignal objects mutable.
+* @param value - value to freeze.
+* @returns the same value after every reachable enumerable child is frozen.
+*/
+function deepFreeze(value) {
+	const seen = /* @__PURE__ */ new WeakSet();
+	const pending = [{
+		kind: "visit",
+		node: value
+	}];
+	while (pending.length > 0) {
+		const task = pending.pop();
+		/* v8 ignore next -- the loop condition guarantees one pending task. */
+		if (task === void 0) continue;
+		if (task.kind === "property") {
+			pending.push({
+				kind: "visit",
+				node: task.source[task.key]
+			});
+			continue;
+		}
+		const node = task.node;
+		if (node === null || typeof node !== "object") continue;
+		if (node instanceof AbortSignal) continue;
+		if (seen.has(node)) continue;
+		seen.add(node);
+		Object.freeze(node);
+		const keys = Object.keys(node);
+		for (let index = keys.length - 1; index >= 0; index--) {
+			const key = keys[index];
+			/* v8 ignore next -- the loop is bounded by the captured key count. */
+			if (key === void 0) continue;
+			pending.push({
+				kind: "property",
+				source: node,
+				key
+			});
+		}
 	}
-	Object.defineProperty(prototype, REMOTE_METHOD_DESCRIPTOR, {
-		configurable: true,
-		value: Object.freeze({
-			version: 1,
-			methods: Object.freeze([...descriptor?.methods ?? [], marker])
-		})
-	});
-}
-function sameInvocation(left, right) {
-	if (left.kind === "direct") return right.kind === "direct";
-	if (right.kind === "direct") return false;
-	return left.context === right.context;
-}
-function validateName(subject, value) {
-	if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
+	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-util-crypt_66ec5f64228d8b6b846c0e0318a734f3/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-util-crypt_fa1ca4579d1c8036d3a90fef6a53e902/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
 /**
 * Random v4 UUID, minted from `crypto.getRandomValues`.
 * @returns the UUID string.
@@ -1296,7 +669,7 @@ function randomUUID$1() {
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.5-rc.1_@deepseek-ai+cordis@4.0.1/node_modules/@deepseek-ai/dsh-brand/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
 /**
 * Duplicate-install-safe nominal primitive helpers.
 *
@@ -1319,11 +692,11 @@ function brandString(value) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-timeout@0._5b95bb48758e6032066aa142c5fbb450/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-timeout@0._c2aac02a97d68b3ee31a2a9dae07960b/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
 /** Largest delay Node schedules without clamping it to one millisecond. */
 const MAX_TIMER_DELAY_MS = 2147483647;
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.5-rc.1_@deepseek-ai+cordis@4.0.1/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
 /**
 * Detach and deep-freeze a message whose identity already exists.
 * @param message - complete message, including its stable identity.
@@ -1338,10 +711,10 @@ function freezeMessage(message) {
 * @returns an immutable message with a fresh stable identity.
 */
 function createMessage(input) {
-	return freezeMessage({
+	return deepFreeze(structuredClone({
 		...input,
 		id: brandString(randomUUID$1())
-	});
+	}));
 }
 /**
 * Create one identified user-role message and freeze it before publication.
@@ -1565,13 +938,15 @@ function failureSnapshot(value) {
 		const status = candidate.status;
 		const providerRetryAfterMs = candidate.providerRetryAfterMs;
 		const requestId = candidate.requestId;
-		if (typeof message !== "string" || message.length === 0 || typeof code !== "string" || code.length === 0 || status !== void 0 && (!Number.isInteger(status) || status < 100 || status > 599) || providerRetryAfterMs !== void 0 && (!Number.isFinite(providerRetryAfterMs) || providerRetryAfterMs <= 0) || requestId !== void 0 && (typeof requestId !== "string" || requestId.length === 0)) return void 0;
+		const offloadImages = candidate.offloadImages;
+		if (typeof message !== "string" || message.length === 0 || typeof code !== "string" || code.length === 0 || status !== void 0 && (!Number.isInteger(status) || status < 100 || status > 599) || providerRetryAfterMs !== void 0 && (!Number.isFinite(providerRetryAfterMs) || providerRetryAfterMs <= 0) || requestId !== void 0 && (typeof requestId !== "string" || requestId.length === 0) || offloadImages !== void 0 && (!Number.isSafeInteger(offloadImages) || offloadImages <= 0)) return void 0;
 		return Object.freeze({
 			message,
 			code,
 			...status === void 0 ? {} : { status },
 			...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs },
-			...requestId === void 0 ? {} : { requestId }
+			...requestId === void 0 ? {} : { requestId },
+			...offloadImages === void 0 ? {} : { offloadImages }
 		});
 	} catch (_sdkFailureGetter) {
 		return;
@@ -1601,25 +976,23 @@ function textOnlyImageText(ref) {
 	return `[image omitted because this model accepts text only; attachment sha256:${String(ref.attachmentId).slice(7, 15)}]`;
 }
 /**
-* True when typed model content contains an image block, walking nested
-* tool-result content. This is the one recursive image walk shared by every
-* image policy (capability gating, text-only serialization, compaction
-* survey), so a consumer cannot silently diverge on nesting depth.
+* True when typed model content contains an image block. This is the one image
+* walk shared by every image policy (capability gating, text-only
+* serialization, compaction survey), so a consumer cannot silently diverge.
 * @param content - typed model content blocks.
-* @returns whether any nested block is an image.
+* @returns whether any block is an image.
 */
 function contentHasImage(content) {
-	return content.some((block) => block.type === "image" || block.type === "tool-result" && contentHasImage(block.content));
+	return content.some((block) => block.type === "image");
 }
 /**
-* True when typed model content contains a file block, walking nested
-* tool-result content on the same recursion every file policy shares.
+* True when typed model content contains a file block.
 * Reads current content on every call without retaining scan results.
 * @param content - typed model content blocks.
-* @returns whether any nested block is a file.
+* @returns whether any block is a file.
 */
 function contentHasFile(content) {
-	for (const block of content) if (block.type === "file" || block.type === "tool-result" && contentHasFile(block.content)) return true;
+	for (const block of content) if (block.type === "file") return true;
 	return false;
 }
 /**
@@ -1636,7 +1009,7 @@ function fileHandleText(ref, readonlyPath) {
 	if (readonlyPath === void 0) return `[${identity} was uploaded, but the current execution environment cannot access a readable path. Report that limitation if its contents are needed; do not claim to have read it.]`;
 	return `[${identity}: verbatim read-only copy saved at ${quoted(readonlyPath)}. Read that path with your file tools when its contents are needed; copy it to a writable location before modifying it. When delegating file work, include this saved path in the delegation prompt; only subagents sharing this execution environment can read it.]`;
 }
-/** Replace every file occurrence, including nested tool results, with handle text. */
+/** Replace every file occurrence with handle text. */
 function replaceFilesWithHandles(blocks, resolvePath) {
 	let next;
 	for (const [index, block] of blocks.entries()) {
@@ -1648,29 +1021,10 @@ function replaceFilesWithHandles(blocks, resolvePath) {
 			});
 			continue;
 		}
-		if (block.type === "tool-result") {
-			const content = replaceFilesWithHandles(block.content, resolvePath);
-			if (content !== block.content) {
-				next ??= blocks.slice(0, index);
-				next.push({
-					...block,
-					content
-				});
-				continue;
-			}
-		}
 		next?.push(block);
 	}
 	return next ?? blocks;
 }
-/**
-* Project durable file history into deterministic handle text for every model
-* route. Unlike images, no provider receives file blocks natively, so this
-* projection is unconditional in request assembly.
-* @param messages - complete request history.
-* @param resolvePath - resolve one reference's current execution-world read path.
-* @returns the original list without files, otherwise shallow message copies with handle text.
-*/
 function projectFilesToText(messages, resolvePath) {
 	if (!messages.some((message) => contentHasFile(message.content))) return messages;
 	return messages.map((message) => {
@@ -1681,7 +1035,7 @@ function projectFilesToText(messages, resolvePath) {
 		};
 	});
 }
-/** Replace every image occurrence, including nested tool results, for a text-only model. */
+/** Replace every image occurrence for a text-only model. */
 function replaceImagesForTextModel(blocks) {
 	let next;
 	for (const [index, block] of blocks.entries()) {
@@ -1693,26 +1047,10 @@ function replaceImagesForTextModel(blocks) {
 			});
 			continue;
 		}
-		if (block.type === "tool-result") {
-			const content = replaceImagesForTextModel(block.content);
-			if (content !== block.content) {
-				next ??= blocks.slice(0, index);
-				next.push({
-					...block,
-					content
-				});
-				continue;
-			}
-		}
 		next?.push(block);
 	}
 	return next ?? blocks;
 }
-/**
-* Project durable image history into deterministic text for an exact text-only model.
-* @param messages - complete request history.
-* @returns the original list without images, otherwise shallow message copies with stable placeholders.
-*/
 function projectImagesForTextModel(messages) {
 	if (!messages.some((message) => contentHasImage(message.content))) return messages;
 	return messages.map((message) => {
@@ -1723,6 +1061,89 @@ function projectImagesForTextModel(messages) {
 		};
 	});
 }
+function withoutDeveloperMessages(messages) {
+	const retained = messages.filter((message) => message.role !== "developer");
+	return retained.length === messages.length ? messages : retained;
+}
+function toolDeclarations(tools, mode, history) {
+	const declarations = new Map(history.tools.map((tool) => [tool.name, tool]));
+	for (const update of history.updates) for (const tool of update.additions) if (!declarations.has(tool.name)) declarations.set(tool.name, {
+		...tool,
+		deferLoading: true
+	});
+	switch (mode) {
+		case "in-history": return declarations;
+		case "addition-only": {
+			const activeNames = new Set(tools?.map((tool) => tool.name));
+			for (const name of declarations.keys()) if (!activeNames.has(name)) declarations.delete(name);
+			return declarations;
+		}
+		/* v8 ignore next 2 -- closed-union exhaustiveness guard */
+		default: return assertNever(mode);
+	}
+}
+/**
+* Construct provider declarations from session-folded history without changing logged active tools.
+* Unsupported routes and incomplete history use current declarations without developer updates.
+* Explicitly deferred baseline tools become available only after their first retained addition.
+* @param messages - complete request inputs, or the prefix selected for an auxiliary call.
+* @param tools - currently active tool schemas.
+* @param toolUpdate - the resolved route's update mode.
+* @param history - immutable state folded from committed headers and developer messages.
+* @returns provider declarations and the corresponding filtered history.
+*/
+function projectToolUpdates(messages, tools, toolUpdate, history) {
+	if (toolUpdate === void 0) {
+		let immediateTools = tools;
+		if (tools?.some((tool) => tool.deferLoading === true)) immediateTools = tools.map(({ deferLoading: _loading, ...tool }) => tool);
+		return {
+			messages: withoutDeveloperMessages(messages),
+			tools: immediateTools
+		};
+	}
+	if (history === void 0) return {
+		messages: withoutDeveloperMessages(messages),
+		tools
+	};
+	const messageIds = new Set(messages.flatMap((message) => message.role === "developer" ? [message.id] : []));
+	if (history.updates.some((update) => !messageIds.has(update.messageId))) return {
+		messages: withoutDeveloperMessages(messages),
+		tools
+	};
+	const declarations = toolDeclarations(tools, toolUpdate, history);
+	const updateIds = new Set(history.updates.map((update) => update.messageId));
+	const offered = new Set(history.tools.filter((tool) => !tool.deferLoading).map((tool) => tool.name));
+	const projectedMessages = [];
+	for (const message of messages) {
+		if (message.role !== "developer") {
+			projectedMessages.push(message);
+			continue;
+		}
+		if (!updateIds.has(message.id)) continue;
+		const content = message.content.filter((block) => {
+			switch (block.type) {
+				case "tool-addition":
+					if (!declarations.has(block.toolName) || offered.has(block.toolName)) return false;
+					offered.add(block.toolName);
+					return true;
+				case "tool-removal":
+					if (toolUpdate !== "in-history") return false;
+					return offered.delete(block.toolName);
+				default: return true;
+			}
+		});
+		if (content.length === 0) continue;
+		if (content.length === message.content.length) projectedMessages.push(message);
+		else projectedMessages.push({
+			...message,
+			content
+		});
+	}
+	return {
+		messages: projectedMessages.length === messages.length && projectedMessages.every((message, index) => message === messages[index]) ? messages : projectedMessages,
+		tools: [...declarations.values()]
+	};
+}
 /**
 * Centralize the non-secret product identity every provider request sends as `User-Agent`, keeping
 * adapters from drifting. See
@@ -1802,7 +1223,8 @@ var LlmError = class extends HarnessError {
 			code,
 			...options?.status === void 0 ? {} : { status: options.status },
 			...options?.providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs: options.providerRetryAfterMs },
-			...options?.requestId === void 0 ? {} : { requestId: options.requestId }
+			...options?.requestId === void 0 ? {} : { requestId: options.requestId },
+			...options?.offloadImages === void 0 ? {} : { offloadImages: options.offloadImages }
 		});
 	}
 };
@@ -2070,7 +1492,8 @@ var LlmError = class extends HarnessError {
 					id: model.id,
 					...model.name === void 0 ? {} : { name: model.name },
 					...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
-					...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens }
+					...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens },
+					...model.inputModalities === void 0 ? {} : { inputModalities: [...model.inputModalities] }
 				});
 			}
 			return models;
@@ -2128,7 +1551,8 @@ var LlmError = class extends HarnessError {
 		}
 		/**
 		* Discover models advertised by one registered provider. Catalog membership
-		* is advisory and never changes routing or request validation.
+		* does not constrain core routing. Catalog-driven entry points may restrict
+		* selection and submission to the advertised models.
 		* @param provider - registered provider route to inspect.
 		* @returns detached model metadata in adapter-preferred order.
 		*/
@@ -2173,6 +1597,8 @@ var LlmError = class extends HarnessError {
 			const inputModalities = this.detachedModalities(resolved.inputModalities);
 			const systemPromptUpdate = resolved.systemPromptUpdate;
 			if (systemPromptUpdate !== void 0 && systemPromptUpdate !== "in-history") throw new LlmError(`adapter returned invalid system prompt update mode for provider "${provider}" model "${model}"`, "INVALID_MODEL_INFO");
+			const toolUpdate = resolved.toolUpdate;
+			if (toolUpdate !== void 0 && toolUpdate !== "in-history" && toolUpdate !== "addition-only") throw new LlmError(`adapter returned invalid tool update mode for provider "${provider}" model "${model}"`, "INVALID_MODEL_INFO");
 			const defaultMaxTokens = resolved.defaultMaxTokens;
 			if (defaultMaxTokens !== void 0 && (!Number.isSafeInteger(defaultMaxTokens) || defaultMaxTokens <= 0)) throw new LlmError(`adapter returned invalid default maxTokens for provider "${provider}" model "${model}"`, "INVALID_MODEL_MAX_TOKENS");
 			const info = {
@@ -2183,7 +1609,8 @@ var LlmError = class extends HarnessError {
 				...inputModalities === void 0 ? {} : { inputModalities },
 				...context === void 0 ? {} : { context: { contextWindow: context.contextWindow } },
 				...defaultMaxTokens === void 0 ? {} : { defaultMaxTokens },
-				...resolved.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: resolved.systemPromptUpdate }
+				...resolved.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: resolved.systemPromptUpdate },
+				...resolved.toolUpdate === void 0 ? {} : { toolUpdate: resolved.toolUpdate }
 			};
 			const reasoning = resolved.reasoning;
 			if (reasoning === void 0) return info;
@@ -2278,6 +1705,7 @@ var LlmError = class extends HarnessError {
 				...context === void 0 ? {} : { context },
 				...modelInfo.inputModalities === void 0 ? {} : { inputModalities: Object.freeze([...modelInfo.inputModalities]) },
 				...modelInfo.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: modelInfo.systemPromptUpdate },
+				...modelInfo.toolUpdate === void 0 ? {} : { toolUpdate: modelInfo.toolUpdate },
 				stream: (options) => {
 					if (dispatched) throw new LlmError("a prepared LLM call can only be dispatched once", "INVALID_PREPARED_CALL");
 					if (!callConfigEquals(options, resolvedConfig)) throw new LlmError("prepared LLM call config changed before adapter dispatch", "INVALID_PREPARED_CALL");
@@ -2299,8 +1727,9 @@ var LlmError = class extends HarnessError {
 		/** Remove replay state whose historical route is owned by another adapter. */
 		forAdapter(options, adapter) {
 			const messages = options.messages.map((message) => {
+				if (message.role !== "assistant") return message;
 				const source = message.source;
-				if (message.role !== "assistant" || source.kind !== "model" || source.replayState === void 0) return message;
+				if (source.replayState === void 0) return message;
 				if (this.adapters.get(source.provider)?.adapter === adapter) return message;
 				return freezeMessage({
 					...message,
@@ -2366,13 +1795,17 @@ var LlmError = class extends HarnessError {
 				let projectedMessages = resolvedOptions.messages;
 				if (projectedMessages.some((message) => contentHasFile(message.content))) projectedMessages = projectFilesToText(projectedMessages, (ref) => this.fileReadPath(ref));
 				if (modelInfo.inputModalities !== void 0 && !modelInfo.inputModalities.includes("image") && projectedMessages.some((message) => contentHasImage(message.content))) projectedMessages = projectImagesForTextModel(projectedMessages);
-				const projectedOptions = projectedMessages === resolvedOptions.messages ? resolvedOptions : Object.isFrozen(resolvedOptions) ? deepFreeze({
-					...resolvedOptions,
-					messages: projectedMessages
-				}) : {
-					...resolvedOptions,
-					messages: projectedMessages
-				};
+				const projectedTools = projectToolUpdates(projectedMessages, resolvedOptions.tools, modelInfo.toolUpdate, resolvedOptions.toolHistory);
+				projectedMessages = projectedTools.messages;
+				let projectedOptions = resolvedOptions;
+				if (projectedMessages !== resolvedOptions.messages || projectedTools.tools !== resolvedOptions.tools) {
+					projectedOptions = {
+						...resolvedOptions,
+						messages: projectedMessages,
+						...projectedTools.tools === void 0 ? {} : { tools: projectedTools.tools }
+					};
+					if (Object.isFrozen(resolvedOptions)) deepFreeze(projectedOptions);
+				}
 				iterator = dispatch(this.forAdapter(projectedOptions, adapter))[Symbol.asyncIterator]();
 			} catch (error) {
 				yield adapterFailureChunk(error, options.signal);
@@ -2440,7 +1873,93 @@ function adapterFailureChunk(error, signal) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-tools@0.1._aaa8ad560a1b4ea9b6e9490b78b8a32d/node_modules/@deepseek-ai/dsh-tools/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-sandbox@0._a8c9906be8c926809212c5fbb3bc7c61/node_modules/@deepseek-ai/dsh-sandbox/lib/index.js
+/**
+* The escalation vocabulary and choreography shared by every sandbox-enforcing
+* tool family (`@deepseek-ai/dsh-tool-bash`, `@deepseek-ai/dsh-tool-fs`): the
+* strictly-wider ladder, the argument-pairing validation, the model-facing
+* denial/hint markers, and {@link approveEscalation} — the ordered fail-closed
+* sequence that resolves a `sandbox_permissions` request through a
+* user-approval channel BEFORE anything executes. One home keeps the two
+* families' approval ordering and verbatim error texts from drifting apart.
+*
+* The channel is a minimal STRUCTURAL function shape ({@link EscalationAsk}),
+* not the approval service type: the tool layer — which owns the agent, the
+* call id, and the tool name — closes over `ctx.approval.request(...)` and
+* hands the closure down, so this package never depends on the approval or
+* agent packages.
+*
+* @module dsh-sandbox/escalation
+*/
+/**
+* The strictly-wider table: what a call whose effective mode is the key may
+* escalate TO. Checked at EXECUTION, never baked into a tool schema — the
+* schema's enum is {@link ESCALATION_TARGETS}, because schemas are
+* registry-global while the effective mode is per-call truth.
+*/
+const WIDER_MODES = {
+	"read-only": ["workspace-write", "danger-full-access"],
+	"workspace-write": ["danger-full-access"]
+};
+/**
+* The closed escalation-target vocabulary — every mode a call could ever
+* escalate TO (`read-only` is the floor; nothing escalates to it). Advertised
+* whenever the mounted capability confines: cutting the enum down to the modes
+* wider than the composition's DEFAULT would strand a session whose effective
+* mode sits below it (a `danger-full-access` default would advertise nothing
+* while a narrower-switched session stays confined with no lever).
+*/
+const ESCALATION_TARGETS = ["workspace-write", "danger-full-access"];
+/**
+* Validate the escalation argument pairing a tool schema cannot express:
+* `sandbox_permissions` and `justification` travel together — an approval
+* prompt without a reason, or a reason driving nothing, is a malformed ask —
+* and the justification must be a non-empty sentence.
+* @param sandboxPermissions - the raw `sandbox_permissions` argument, if given.
+* @param justification - the raw `justification` argument, if given.
+*/
+function validateEscalationArgs(sandboxPermissions, justification) {
+	if (sandboxPermissions !== void 0 && justification === void 0) throw new Error("invalid escalation: sandbox_permissions requires a justification");
+	if (justification !== void 0 && sandboxPermissions === void 0) throw new Error("invalid escalation: justification is only valid together with sandbox_permissions");
+	if (justification !== void 0 && justification.trim().length === 0) throw new Error("invalid justification: expected a non-empty sentence");
+}
+/**
+* Resolve a sandbox permission request before execution. Repeating the call's
+* effective mode returns it without approval. A strictly wider mode requires
+* approval and applies only to this call. Narrower or unsupported targets,
+* missing approval services or agents for widening, and non-grant outcomes
+* throw before execution.
+* @param request - the escalation to judge (see {@link EscalationRequest}).
+* @param approval - the approval ingredients the tool holds (see {@link EscalationApproval}).
+* @returns the granted mode, consumed by the one call that asked.
+*/
+async function approveEscalation(request, approval) {
+	const { requestedMode: mode, effectiveMode, justification, subject } = request;
+	if (mode === effectiveMode) return effectiveMode;
+	if (!(WIDER_MODES[effectiveMode] ?? []).includes(mode)) throw new Error(`sandbox escalation to "${mode}" is not strictly wider than this call's current "${effectiveMode}" mode`);
+	if (approval.approver === void 0) throw new Error(`sandbox escalation to "${mode}" requires approval, but no approval service is composed`);
+	if (approval.agent === void 0) throw new Error(`sandbox escalation to "${mode}" requires approval, but the call has no agent to route it through`);
+	const outcome = await approval.approver.request({
+		agent: approval.agent,
+		toolName: approval.toolName,
+		callId: approval.callId,
+		reason: `escalate sandbox to ${mode}: ${justification}`,
+		displayReason: {
+			en: `Allow this operation with ${mode} permissions: ${justification}`,
+			zh: `允许本次操作使用 ${mode} 权限：${justification}`
+		},
+		...approval.signal ? { signal: approval.signal } : {}
+	});
+	switch (outcome) {
+		case "allowed-once": return mode;
+		case "rejected": throw new Error(`the user rejected escalating this ${subject} to "${mode}"; it stays denied, so stop and explain instead of working around it`);
+		case "cancelled": throw new Error(`approval for escalating to "${mode}" was cancelled`);
+		case "unavailable": throw new Error(`sandbox escalation to "${mode}" requires approval, but no approval channel is available`);
+		default: return assertNever(outcome, "EscalationOutcome");
+	}
+}
+//#endregion
+//#region node_modules/.pnpm/@deepseek-ai+dsh-tools@0.1._97968258e5effb0cd09174fd979b65a8/node_modules/@deepseek-ai/dsh-tools/lib/index.js
 /**
 * Enforced JSON Schema subset shared by tool outputs, generated PTC mode
 * types, subagents, and workflows. The subset accepts any JSON root, an
@@ -3248,6 +2767,7 @@ var ToolArgsError = class extends HarnessError {
 function defineTool(options) {
 	const userExecute = options.execute;
 	const userFinalizeContent = options.finalizeContent;
+	const userProjectContent = options.projectContent;
 	const userRender = options.output.render;
 	const userPresentationMeta = options.output.presentationMeta;
 	const userPresentCall = options.presentCall;
@@ -3270,6 +2790,7 @@ function defineTool(options) {
 				return userPresentationMeta(args, value);
 			} } : {}
 		},
+		...options.deferLoading === true ? { deferLoading: options.deferLoading } : {},
 		...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
 		async execute(args, exec) {
 			const violations = validate(args);
@@ -3277,6 +2798,7 @@ function defineTool(options) {
 			return userExecute(args, exec);
 		}
 	};
+	if (userProjectContent) tool.projectContent = (exec, result) => userProjectContent(exec, result);
 	if (userFinalizeContent) tool.finalizeContent = (exec, result) => userFinalizeContent(exec, result);
 	if (userPresentCall) tool.presentCall = (args) => {
 		if (validate(args).length > 0) return void 0;
@@ -3311,7 +2833,7 @@ const TYPESCRIPT_FLAVOR = {
 	description: "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run.",
 	codeDescription: "The program: the body of an async TypeScript function."
 };
-/** Per-language `run_code` schema flavors (see {@link RunCodeFlavor}); one entry per {@link CodeSdkLanguage}. */
+/** Per-language `run_code` schema flavors (see {@link RunCodeFlavor}); one entry per {@link PtcSdkLanguage}. */
 const RUN_CODE_FLAVORS = {
 	typescript: TYPESCRIPT_FLAVOR,
 	python: {
@@ -3326,17 +2848,48 @@ const RUN_CODE_FLAVORS = {
 * can never drift.
 */
 const RUN_CODE_DESCRIPTION_PARAM_DESCRIPTION = "Clear, concise description of what this program does in active voice, 5-10 words (shown in the UI). Examples: \"Count TODO markers across packages\"; \"Read failing test and its fixture\"; \"Rename config key in every cordis.yml\".";
+const RUN_CODE_CONTROLS = {
+	timeoutMs: {
+		type: "number",
+		description: "Positive elapsed-time budget in milliseconds, capped by the deployment maximum."
+	},
+	sandbox_permissions: {
+		type: "string",
+		enum: [...ESCALATION_TARGETS],
+		description: "Wider sandbox mode for this complete program execution; requires justification and approval."
+	},
+	justification: {
+		type: "string",
+		description: "Reason this complete program needs wider access, shown to the user for approval. Use the language of the user’s current request."
+	}
+};
+function controlParameters(runtime) {
+	if (runtime === void 0) return RUN_CODE_CONTROLS;
+	return {
+		...runtime.timeout === void 0 ? {} : { timeoutMs: {
+			...RUN_CODE_CONTROLS.timeoutMs,
+			description: `Positive elapsed-time budget in milliseconds, including nested tool and approval waits. Default ${runtime.timeout.defaultMs}; capped at ${runtime.timeout.maxMs}. Zero does not disable the deadline.`
+		} },
+		...runtime.sandboxMode === void 0 ? {} : {
+			sandbox_permissions: RUN_CODE_CONTROLS.sandbox_permissions,
+			justification: RUN_CODE_CONTROLS.justification
+		}
+	};
+}
+function escalationGuidance(runtime) {
+	return runtime?.sandboxMode === void 0 ? "" : " A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.";
+}
 /**
 * Resolve the {@link RunCodeFlavor} for the loaded runtime's language, read at
 * schema-emission time so the model-visible `run_code` schema always matches
 * the SDK section's language. `peekRuntime` returns `undefined` only when no
 * runtime is mounted, which reaches this function through definition readers
 * and `schemas()` — the doc-catalog harvest is the only shipped one, and none
-* of them feeds a model, because `wireSchemas` calls `requireCodeRuntime`
+* of them feeds a model, because `wireSchemas` calls `requirePtcRuntime`
 * before projecting — so that path degrades to {@link TYPESCRIPT_FLAVOR}. A
 * mounted runtime whose language has no flavor entry fails loud, exactly as
-* `requireCodeRuntime` rejects it at assembly. Keeping this table in step with
-* `SDK_RENDERERS` is the compiler's job ({@link CodeSdkLanguage}); what this
+* `requirePtcRuntime` rejects it at assembly. Keeping this table in step with
+* `SDK_RENDERERS` is the compiler's job ({@link PtcSdkLanguage}); what this
 * guard owns is the runtime-supplied language neither table knows, which never
 * yields a wrong-language schema for a real runtime.
 */
@@ -3505,7 +3058,8 @@ function createRunCodeTool(registry, options) {
 				type: "string",
 				required: true,
 				description: RUN_CODE_DESCRIPTION_PARAM_DESCRIPTION
-			}
+			},
+			...RUN_CODE_CONTROLS
 		},
 		output: {
 			schema: {
@@ -3517,12 +3071,37 @@ function createRunCodeTool(registry, options) {
 						required: true,
 						items: { type: "string" }
 					},
-					result: { type: "json" }
+					result: { type: "json" },
+					sandbox: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							mode: {
+								type: "string",
+								required: true,
+								enum: [
+									"read-only",
+									"workspace-write",
+									"danger-full-access"
+								]
+							},
+							denied: {
+								type: "boolean",
+								required: true
+							},
+							enforcement: {
+								type: "string",
+								enum: ["full", "partial"]
+							}
+						}
+					}
 				}
 			},
 			render: (_args, value) => {
 				const rendered = value.result === void 0 ? "" : renderValue(value.result);
 				const parts = [value.logs.join("\n"), rendered].filter((part) => part.length > 0);
+				if (value.sandbox?.enforcement === "partial") parts.push("File sandbox enforcement is partial on this host.");
+				if (value.sandbox?.denied) parts.push(`The ${value.sandbox.mode} file sandbox denied an operation.${escalationGuidance(peekRuntime())}`);
 				return [{
 					type: "text",
 					text: parts.length > 0 ? parts.join("\n") : "(run_code completed with no output)"
@@ -3532,6 +3111,31 @@ function createRunCodeTool(registry, options) {
 		async execute(args, exec) {
 			if (args.description.trim().length === 0) throw new Error("invalid description: expected a non-empty string");
 			const runtime = requireRuntime();
+			validateEscalationArgs(args.sandbox_permissions, args.justification);
+			if (args.timeoutMs !== void 0 && runtime.timeout === void 0) throw new Error("timeoutMs is not available for this PTC runtime");
+			if (args.timeoutMs !== void 0 && (!Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) throw new Error("invalid timeoutMs: expected a positive finite number");
+			const standingPolicy = runtime.sandboxMode === void 0 ? void 0 : options.resolveSandboxPolicy(exec);
+			let policy = standingPolicy;
+			if (args.sandbox_permissions !== void 0 && args.justification !== void 0) {
+				if (standingPolicy === void 0) throw new Error("sandbox_permissions is not available for this PTC runtime");
+				const approvedMode = await approveEscalation({
+					requestedMode: args.sandbox_permissions,
+					justification: args.justification,
+					effectiveMode: standingPolicy.mode,
+					subject: "program"
+				}, {
+					approver: options.peekApprover(),
+					agent: exec.agent,
+					callId: exec.callId,
+					toolName: RUN_CODE_NAME,
+					signal: exec.signal
+				});
+				policy = {
+					...standingPolicy,
+					mode: approvedMode
+				};
+			}
+			exec.signal.throwIfAborted();
 			const runController = new AbortController();
 			const onOuterAbort = () => {
 				runController.abort(exec.signal.reason);
@@ -3613,7 +3217,8 @@ function createRunCodeTool(registry, options) {
 				while (logWork.size > 0) await Promise.allSettled([...logWork]);
 			};
 			const runOver = () => runController.signal.aborted;
-			const binding = (name) => async (rawArgs) => {
+			const binding = (schema) => async (rawArgs) => {
+				const { name } = schema;
 				if (runOver()) throw new Error(`run_code run is over (${String(runController.signal.reason)}); ${name} not dispatched`);
 				const normalized = jsonNormalizeArgs(rawArgs);
 				const n = ++dispatches;
@@ -3622,6 +3227,7 @@ function createRunCodeTool(registry, options) {
 					callId: subCallId,
 					rootCallId: exec.rootCallId,
 					name,
+					schema,
 					arguments: normalized.dispatched,
 					...exec.agent ? { agent: exec.agent } : {},
 					parent: exec.token,
@@ -3656,6 +3262,7 @@ function createRunCodeTool(registry, options) {
 								name,
 								arguments: normalized.logged,
 								isError: result.isError,
+								...result.error?.info === void 0 ? {} : { error: result.error.info },
 								content: logged
 							});
 						})().finally(() => {
@@ -3703,10 +3310,7 @@ function createRunCodeTool(registry, options) {
 							const result = parked.kind === "post-result" ? await scheduler.finalize(parked.exec, parked.result) : scheduler.finish(parked.exec, parked.result);
 							if (!result.isError && result.content.some((block) => block.type === "image")) exec.deferContext(createUserMessage({
 								content: result.content,
-								source: {
-									kind: "plugin",
-									plugin: "tools-ptc"
-								}
+								source: { kind: "ptc-mode" }
 							}));
 							for (const context of result.additionalContexts ?? []) exec.deferContext(context);
 							if (result.concludesTurn) exec.concludeTurn();
@@ -3726,13 +3330,13 @@ function createRunCodeTool(registry, options) {
 				if (schema.name === "run_code") continue;
 				Object.defineProperty(functions, schema.name, {
 					enumerable: true,
-					value: binding(schema.name)
+					value: binding(deepFreeze(schema))
 				});
 			}
 			try {
 				let result;
 				try {
-					result = await runtime.run({
+					result = await runtime.run(runtime.resolve({
 						program: args.code,
 						bindings: [{
 							global: "tools",
@@ -3742,18 +3346,23 @@ function createRunCodeTool(registry, options) {
 								memberNameProperty: "toolName"
 							}
 						}],
-						signal: runController.signal
-					});
+						signal: runController.signal,
+						...exec.agent?.session.header.cwd !== void 0 ? { cwd: exec.agent.session.header.cwd } : {},
+						...policy !== void 0 ? { sandboxPolicy: policy } : {},
+						...args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {}
+					}));
 				} finally {
 					runController.abort("run_code settled");
 					await drainDispatches();
 				}
 				if (result.error) {
 					const logsText = result.logs.length > 0 ? `\nCaptured output:\n${result.logs.join("\n")}` : "";
-					throw new CodeRunFailedError(`code run failed (${result.error.kind}): ${result.error.message}${logsText}`);
+					const sandboxText = result.sandbox === void 0 ? "" : `\nFile sandbox: ${result.sandbox.mode}${result.sandbox.enforcement === void 0 ? "" : `; enforcement: ${result.sandbox.enforcement}`}${result.sandbox.denied ? "; operation denied" : ""}.`;
+					throw new CodeRunFailedError(`code run failed (${result.error.kind}): ${result.error.message}${logsText}${sandboxText}${result.sandbox?.denied ? escalationGuidance(runtime) : ""}`);
 				}
 				return {
 					logs: result.logs,
+					...result.sandbox === void 0 ? {} : { sandbox: result.sandbox },
 					...result.value !== void 0 ? { result: result.value } : {}
 				};
 			} finally {
@@ -3769,7 +3378,11 @@ function createRunCodeTool(registry, options) {
 	});
 	Object.defineProperty(definition, "description", {
 		enumerable: true,
-		get: () => resolveFlavor(peekRuntime).description
+		get: () => {
+			const runtime = peekRuntime();
+			const instructions = runtime?.executionInstructions;
+			return resolveFlavor(peekRuntime).description + (instructions ? ` ${instructions}` : "") + (runtime === void 0 ? "" : " The working directory is the Session's current directory.") + escalationGuidance(runtime);
+		}
 	});
 	Object.defineProperty(definition, "parameters", {
 		enumerable: true,
@@ -3783,7 +3396,8 @@ function createRunCodeTool(registry, options) {
 				type: "string",
 				required: true,
 				description: RUN_CODE_DESCRIPTION_PARAM_DESCRIPTION
-			}
+			},
+			...controlParameters(peekRuntime())
 		})
 	});
 	return definition;
@@ -4068,7 +3682,7 @@ function renderToolsSdk(schemas) {
 * PTC mode codegen — Python flavor. The pure projection from registered tool schemas to the
 * Python SDK text the model programs against under `runtime.language === 'python'`. Sibling of
 * {@link ./ts-types.ts | ts-types.ts}; the two files are two projections of the same registry
-* store, keyed by the loaded {@link @deepseek-ai/dsh-code-runtime#CodeRuntime.language | code
+* store, keyed by the loaded {@link @deepseek-ai/dsh-ptc-runtime#PtcRuntime.language | PTC
 * runtime's language}.
 *
 * Under `mode: 'ptc'` the native tool schemas are omitted from the request, so this generated
@@ -4755,17 +4369,17 @@ function renderToolsSdkPy(schemas) {
 */
 /**
 * Language → SDK-section renderer. The registry looks up the loaded
-* `ctx.codeRuntime.language` in this table when assembling the `tools:sdk`
+* `ctx.ptcRuntime.language` in this table when assembling the `tools:sdk`
 * section under a non-native mode; a runtime whose language is not a key
 * fails the assembly loudly (same idiom as `toolOrder` violations). Adding a
-* new backend language is three parallel edits — a {@link CodeSdkLanguage}
+* new backend language is three parallel edits — a {@link PtcSdkLanguage}
 * member, an entry here, and a `RUN_CODE_FLAVORS` entry in `ptc.ts` for
 * its `run_code` schema strings — plus the renderer function this table points
 * at. The `satisfies` clause pins this table's key set to that union, which
 * the flavor table is checked against too, so any of the three left out is a
 * typecheck failure. What no check reaches is the prose that names the values
-* instead of deriving them: the seam's `dsh-code-runtime` README pair, its
-* `CodeRuntime.language` JSDoc, and `docs/subsystems/code-runtime.md`
+* instead of deriving them: the seam's `dsh-ptc-runtime` README pair, its
+* `PtcRuntime.language` JSDoc, and `docs/subsystems/ptc-runtime.md`
 * with its zh pair, plus this package's own README pair and the
 * {@link Config.mode} JSDoc.
 */
@@ -4941,6 +4555,8 @@ function resolveMaxParallelSubCalls(value) {
 	cancellationStates = /* @__PURE__ */ new WeakMap();
 	/** Definition-owned final content transform snapshotted before policy begins. */
 	contentFinalizers = /* @__PURE__ */ new WeakMap();
+	/** Execution-prepared content installed before post-execute policy. */
+	contentProjectors = /* @__PURE__ */ new WeakMap();
 	layers = new ScopedLayers((scope) => new ToolLayer(scope), () => {
 		this.ctx.emit("tools/change");
 	});
@@ -5000,12 +4616,13 @@ function resolveMaxParallelSubCalls(value) {
 		return {
 			name: "tools:sdk",
 			order: this.ctx.systemPrompt.getSectionOrder("TOOLS_SDK"),
+			interpolate: false,
 			text: (context) => {
 				const mode = this.modeFor(context.scope);
 				if (mode === "native") return "";
-				const runtime = this.requireCodeRuntime(mode);
+				const runtime = this.requirePtcRuntime(mode);
 				const render = SDK_RENDERERS[runtime.language];
-				/* v8 ignore next -- requireCodeRuntime rejects an unknown language before this runs. */
+				/* v8 ignore next -- requirePtcRuntime rejects an unknown language before this runs. */
 				if (render === void 0) throw new Error(`dsh-tools: no SDK renderer for ${runtime.language}`);
 				return render(this.sdkSchemas(context.scope));
 			}
@@ -5034,10 +4651,16 @@ function resolveMaxParallelSubCalls(value) {
 	* and only for scopes whose mode actually presents it.
 	* @returns the shared transport definition.
 	*/
-	requireCodeTransport() {
+	requirePtcTransport() {
 		this.ptcTransport ??= createRunCodeTool(this, {
-			requireRuntime: () => this.requireCodeRuntime(this.defaultMode),
-			peekRuntime: () => this.ctx.get("codeRuntime"),
+			requireRuntime: () => this.requirePtcRuntime(this.defaultMode),
+			peekApprover: () => this.ctx.get("approval"),
+			resolveSandboxPolicy: (exec) => {
+				const policy = this.ctx.get("sandboxPolicy");
+				if (policy === void 0) throw new Error("dsh-tools: confined PTC runtime requires sandboxPolicy");
+				return policy.resolve(exec.agent === void 0 ? {} : { session: exec.agent.session });
+			},
+			peekRuntime: () => this.ctx.get("ptcRuntime"),
 			maxParallel: this.maxParallelSubCalls,
 			shapeDispatchLog: (dispatch) => this.shapeDispatchLog(dispatch)
 		});
@@ -5082,7 +4705,7 @@ function resolveMaxParallelSubCalls(value) {
 			schemas: [...view.visible.values()].map((definition) => this.schemaOf(definition, false)),
 			knownNames: [...view.knownNames]
 		};
-		this.requireCodeRuntime(mode);
+		this.requirePtcRuntime(mode);
 		const schemas = [...view.visible.values()].map((definition) => this.schemaOf(definition, false));
 		if (mode === "ptc") return {
 			schemas: schemas.filter((schema) => schema.name === RUN_CODE_NAME),
@@ -5094,10 +4717,10 @@ function resolveMaxParallelSubCalls(value) {
 		};
 	}
 	/**
-	* Resolve the code runtime or throw the actionable misconfiguration error.
+	* Resolve the PTC runtime or throw the actionable misconfiguration error.
 	* Read at use time (assembly / run_code execution), NOT via static
 	* `inject`: an inject entry would hold `ctx.tools` — and every tool plugin
-	* behind it — hostage to a code runtime existing even under `mode:
+	* behind it — hostage to a PTC runtime existing even under `mode:
 	* 'native'`.
 	*
 	* Assembly and `run_code` execution read separately, so the language is not
@@ -5107,9 +4730,9 @@ function resolveMaxParallelSubCalls(value) {
 	* other. Binding it is deferred until a second backend ships (the first
 	* point it is testable).
 	*/
-	requireCodeRuntime(mode) {
-		const runtime = this.ctx.get("codeRuntime");
-		if (!runtime) throw new Error(`dsh-tools: mode "${mode}" requires a code runtime — load a ctx.codeRuntime implementation (e.g. @deepseek-ai/dsh-code-runtime-worker-thread) or set tools mode to "native"`);
+	requirePtcRuntime(mode) {
+		const runtime = this.ctx.get("ptcRuntime");
+		if (!runtime) throw new Error(`dsh-tools: mode "${mode}" requires a PTC runtime — load a ctx.ptcRuntime implementation (e.g. @deepseek-ai/dsh-ptc-runtime-node) or set tools mode to "native"`);
 		if (!Object.hasOwn(SDK_RENDERERS, runtime.language)) {
 			const known = Object.keys(SDK_RENDERERS).map((name) => JSON.stringify(name)).join(", ");
 			throw new Error(`dsh-tools: no SDK renderer registered for runtime language ${JSON.stringify(runtime.language)} (known: ${known})`);
@@ -5223,7 +4846,7 @@ function resolveMaxParallelSubCalls(value) {
 			knownNames.add(name);
 			visible.set(name, definition);
 		}
-		if (this.modeFor(scope) !== "native") visible.set(RUN_CODE_NAME, this.requireCodeTransport());
+		if (this.modeFor(scope) !== "native") visible.set(RUN_CODE_NAME, this.requirePtcTransport());
 		return {
 			visible,
 			knownNames,
@@ -5284,13 +4907,14 @@ function resolveMaxParallelSubCalls(value) {
 	}
 	/** Project one definition onto the model-facing schema fields. */
 	schemaOf(definition, detachParameters) {
-		const { name, description, parameters } = definition;
+		const { name, description, parameters, deferLoading } = definition;
 		const detached = detachParameters ? snapshotJsonValue(parameters) : parameters;
 		if (detached === void 0) throw new Error(`tool "${name}" parameters must be lossless JSON before schema projection`);
 		return {
 			name,
 			description,
-			parameters: detached
+			parameters: detached,
+			...deferLoading === true ? { deferLoading } : {}
 		};
 	}
 	/**
@@ -5394,6 +5018,7 @@ function resolveMaxParallelSubCalls(value) {
 			signal,
 			...agent !== void 0 ? { agent } : {},
 			...parent !== void 0 ? { parent } : {},
+			...exec.schema !== void 0 ? { schema: exec.schema } : {},
 			deferContext(context) {
 				deferredContexts.push(context);
 			},
@@ -5402,6 +5027,7 @@ function resolveMaxParallelSubCalls(value) {
 			}
 		};
 		const capturedFinalizer = visible?.finalizeContent?.bind(visible);
+		const capturedProjector = visible?.projectContent?.bind(visible);
 		const finalizerFor = () => collapsed && !signal.aborted ? void 0 : capturedFinalizer;
 		try {
 			const detached = snapshotJsonValue(exec.arguments);
@@ -5412,6 +5038,7 @@ function resolveMaxParallelSubCalls(value) {
 			};
 			this.deferredContexts.set(execution, deferredContexts);
 			this.contentFinalizers.set(execution, finalizerFor());
+			if (!collapsed) this.contentProjectors.set(execution, capturedProjector);
 			this.cancellationStates.set(execution, {
 				callerSignal: signal,
 				bodyInvoked: false
@@ -5476,7 +5103,13 @@ function resolveMaxParallelSubCalls(value) {
 				exec,
 				result: toolAbortedBeforeDispatchResult()
 			});
+			if (decision.kind === "cancel") return await next({
+				kind: "post-result",
+				exec,
+				result: toolAbortedBeforeDispatchResult()
+			});
 			const denialReason = decision.kind === "allow" ? this.guardReason(exec) : decision.reason;
+			const denialInfo = decision.kind === "deny" ? decision.info : void 0;
 			if (denialReason !== void 0) return await next({
 				kind: "post-result",
 				exec,
@@ -5486,7 +5119,10 @@ function resolveMaxParallelSubCalls(value) {
 						text: `Error: ${denialReason}`
 					}],
 					isError: true,
-					error: { message: denialReason }
+					error: {
+						message: denialReason,
+						...denialInfo === void 0 ? {} : { info: denialInfo }
+					}
 				})
 			});
 			if (this.callerCancelled(exec)) return await next({
@@ -5592,7 +5228,14 @@ function resolveMaxParallelSubCalls(value) {
 	*/
 	async finalizeScheduledExecution(exec, result) {
 		try {
-			const postResult = await this.postExecute(exec, result);
+			const project = this.contentProjectors.get(exec);
+			this.contentProjectors.delete(exec);
+			const content = project?.(exec, result);
+			const projected = content === void 0 ? result : this.markCanonical(exec, this.materializeFinalResult({
+				...result,
+				content
+			}));
+			const postResult = await this.postExecute(exec, projected);
 			return this.finishScheduledExecution(exec, this.callerCancelled(exec) && !postResult.isError ? this.cancellationResult(exec, postResult) : postResult);
 		} catch (error) {
 			return this.finishScheduledExecution(exec, toolErrorResult(error));
@@ -5684,6 +5327,7 @@ function resolveMaxParallelSubCalls(value) {
 			toolName: exec.name,
 			callId: exec.callId,
 			...ask.reason !== void 0 ? { reason: ask.reason } : {},
+			...ask.displayReason !== void 0 ? { displayReason: ask.displayReason } : {},
 			signal: exec.signal
 		});
 		switch (outcome) {
@@ -6186,40 +5830,56 @@ const IMAGE_SIZES = [
 	"2K",
 	"4K"
 ];
-/** Cordis configuration schema. */
+/**
+* Mark a schema field live for DSH 0.1.7+: the host serves a plugin's settings
+* form only for `.volatile()` fields and hands `apply` a `Volatile` box per
+* field (unwrapped in `src/index.ts`). Hosts ≤0.1.6 ship a schemastery without
+* the method, so marking is conditional — an unmarked schema stays plain there
+* and the old settings relay keeps working.
+*/
+function volatile(schema) {
+	const mark = schema.volatile;
+	return typeof mark === "function" ? mark.call(schema) : schema;
+}
+/**
+* Cordis configuration schema. Volatile marking happens per field (see
+* `volatile`); the `z<Config>` annotation keeps the plain output type for the
+* rest of the codebase because the wrapping is unwrapped at the entry.
+*/
 const Config = z.object({
-	provider: z.union(IMAGE_PROVIDERS).default("google"),
-	googleModel: z.string().default(DEFAULT_GOOGLE_MODEL),
-	googleEndpoint: z.string().default(DEFAULT_GOOGLE_ENDPOINT),
-	openaiBaseURL: z.string().default(DEFAULT_OPENAI_BASE_URL),
-	openaiModel: z.string().default(DEFAULT_OPENAI_MODEL),
-	openaiCompatBaseURL: z.string().default(""),
-	openaiCompatModel: z.string().default(""),
-	openaiCompatEditFormat: z.union([z.const("multipart"), z.const("jsonImageUrlArray")]).default("multipart"),
-	openaiCompatEditExtra: z.dict(z.any()).default({}),
-	seedreamBaseURL: z.string().default(DEFAULT_SEEDREAM_BASE_URL),
-	seedreamModel: z.string().default(DEFAULT_SEEDREAM_MODEL),
-	seedreamOutputFormat: z.union(ARK_OUTPUT_FORMATS).default("jpeg"),
-	seedreamWatermark: z.boolean().default(true),
-	seedreamBackground: z.union(ARK_BACKGROUND_MODES).default("opaque"),
-	dashscopeEndpoint: z.string().default(DEFAULT_DASHSCOPE_ENDPOINT),
-	dashscopeModel: z.string().default(DEFAULT_DASHSCOPE_MODEL),
-	xaiBaseURL: z.string().default(DEFAULT_XAI_BASE_URL),
-	xaiModel: z.string().default(DEFAULT_XAI_MODEL),
-	zhipuBaseURL: z.string().default(DEFAULT_ZHIPU_BASE_URL),
-	zhipuModel: z.string().default(DEFAULT_ZHIPU_MODEL),
-	comfyuiBaseURL: z.string().default(DEFAULT_COMFYUI_BASE_URL),
-	comfyuiWorkflows: z.array(z.object({
+	provider: volatile(z.union(IMAGE_PROVIDERS).default("google")),
+	googleModel: volatile(z.string().default(DEFAULT_GOOGLE_MODEL)),
+	googleEndpoint: volatile(z.string().default(DEFAULT_GOOGLE_ENDPOINT)),
+	openaiBaseURL: volatile(z.string().default(DEFAULT_OPENAI_BASE_URL)),
+	openaiModel: volatile(z.string().default(DEFAULT_OPENAI_MODEL)),
+	openaiCompatBaseURL: volatile(z.string().default("")),
+	openaiCompatModel: volatile(z.string().default("")),
+	openaiCompatEditFormat: volatile(z.union([z.const("multipart"), z.const("jsonImageUrlArray")]).default("multipart")),
+	openaiCompatEditExtra: volatile(z.dict(z.any()).default({})),
+	seedreamBaseURL: volatile(z.string().default(DEFAULT_SEEDREAM_BASE_URL)),
+	seedreamModel: volatile(z.string().default(DEFAULT_SEEDREAM_MODEL)),
+	seedreamOutputFormat: volatile(z.union(ARK_OUTPUT_FORMATS).default("jpeg")),
+	seedreamWatermark: volatile(z.boolean().default(true)),
+	seedreamBackground: volatile(z.union(ARK_BACKGROUND_MODES).default("opaque")),
+	dashscopeEndpoint: volatile(z.string().default(DEFAULT_DASHSCOPE_ENDPOINT)),
+	dashscopeModel: volatile(z.string().default(DEFAULT_DASHSCOPE_MODEL)),
+	xaiBaseURL: volatile(z.string().default(DEFAULT_XAI_BASE_URL)),
+	xaiModel: volatile(z.string().default(DEFAULT_XAI_MODEL)),
+	zhipuBaseURL: volatile(z.string().default(DEFAULT_ZHIPU_BASE_URL)),
+	zhipuModel: volatile(z.string().default(DEFAULT_ZHIPU_MODEL)),
+	comfyuiBaseURL: volatile(z.string().default(DEFAULT_COMFYUI_BASE_URL)),
+	comfyuiWorkflows: volatile(z.array(z.object({
 		name: z.string(),
 		json: z.string(),
 		presetPrompt: z.string().default("")
-	})).default([]),
-	comfyuiActiveWorkflow: z.string().default(""),
-	comfyuiWorkflowJson: z.string().default(""),
-	comfyuiWorkflowName: z.string().default(""),
-	comfyuiTimeoutMs: z.number().min(1e3).max(36e5).default(DEFAULT_COMFYUI_TIMEOUT_MS),
-	saveToWorkspace: z.boolean().default(true),
-	workspaceFolder: z.string().default(DEFAULT_WORKSPACE_FOLDER)
+	})).default([])),
+	comfyuiActiveWorkflow: volatile(z.string().default("")),
+	comfyuiWorkflowJson: volatile(z.string().default("")),
+	comfyuiWorkflowName: volatile(z.string().default("")),
+	comfyuiTimeoutMs: volatile(z.number().min(1e3).max(36e5).default(DEFAULT_COMFYUI_TIMEOUT_MS)),
+	saveToWorkspace: volatile(z.boolean().default(true)),
+	workspaceFolder: volatile(z.string().default(DEFAULT_WORKSPACE_FOLDER)),
+	showProviderPill: volatile(z.boolean().default(false))
 });
 /** Resolve exactly one provider profile for a tool call. */
 function resolveProvider(config) {
@@ -6400,7 +6060,7 @@ function selectComfyUIWorkflow(active, requested) {
 	return workflow;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-credential_bc2d3e5c9a179df7ac53b40c354d894e/node_modules/@deepseek-ai/dsh-credentials/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-credential_98fa173416f048996704a605a96a2b0e/node_modules/@deepseek-ai/dsh-credentials/lib/index.js
 /**
 * Service Definition for the credential-reference capability seam (`ctx.credentials`). Settings and composition files carry
 * *references* to secrets — environment-variable names — while providers own
@@ -6722,6 +6382,13 @@ function parseImageAttachmentRef(value) {
 		...originalDimensions === void 0 ? {} : { originalDimensions }
 	};
 }
+/**
+* Newest matching image in one message's blocks. Tool results arrive in two
+* shapes: 0.1.7 promotes them to first-class `role: 'tool'` messages (walked
+* by the message-level callers below), while <=0.1.6 nests them as blocks with
+* a `content` array inside a message. The 0.1.7 `ContentBlock` union declares
+* no nested `content`, so recurse only when a block actually carries one.
+*/
 function findInBlocks(blocks, sourceAttachmentId) {
 	for (let index = blocks.length - 1; index >= 0; index -= 1) {
 		const block = blocks[index];
@@ -6730,9 +6397,10 @@ function findInBlocks(blocks, sourceAttachmentId) {
 			if (sourceAttachmentId === void 0 || attachmentIdsEqual(String(block.attachment.attachmentId), sourceAttachmentId)) return block.attachment;
 			continue;
 		}
-		if (block.type === "tool-result") {
-			const nested = findInBlocks(block.content, sourceAttachmentId);
-			if (nested !== void 0) return nested;
+		const nested = block.content;
+		if (Array.isArray(nested)) {
+			const found = findInBlocks(nested, sourceAttachmentId);
+			if (found !== void 0) return found;
 		}
 	}
 }
@@ -6751,7 +6419,8 @@ function collectInBlocks(blocks) {
 	const refs = [];
 	for (const block of blocks) {
 		if (block.type === "image") refs.push(block.attachment);
-		if (block.type === "tool-result") refs.push(...collectInBlocks(block.content));
+		const nested = block.content;
+		if (Array.isArray(nested)) refs.push(...collectInBlocks(nested));
 	}
 	return refs;
 }
@@ -8609,6 +8278,16 @@ async function formTokenRequest(url, params, fetchImpl) {
 const OK_HTML = "<!doctype html><meta charset=\"utf-8\"><title>dsh-image-gen</title><p>登录成功，可以关闭此页返回设置。</p>";
 const ERR_HTML = "<!doctype html><meta charset=\"utf-8\"><title>dsh-image-gen</title><p>登录失败，请返回设置重试。</p>";
 /**
+* Loopback addresses accepted by the request handler. On dual-stack systems
+* Node reports IPv4-mapped IPv6 addresses as `::ffff:127.0.0.1`, so we must
+* accept that form in addition to the canonical IPv4 and IPv6 loopback.
+*/
+const LOOPBACK_ADDRESSES = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"::1",
+	"::ffff:127.0.0.1"
+]);
+/**
 * Listen on the redirect_uri's port and resolve when the provider calls back.
 * Rejects on port conflicts, network errors, or when nothing arrives in time.
 */
@@ -8621,6 +8300,12 @@ function startLoopback(options) {
 	const state = { done: false };
 	return new Promise((resolve, reject) => {
 		const server = http.createServer((req, res) => {
+			const remote = req.socket.remoteAddress ?? "";
+			if (!LOOPBACK_ADDRESSES.has(remote)) {
+				res.writeHead(403);
+				res.end();
+				return;
+			}
 			const url = new URL(req.url ?? "/", `http://127.0.0.1:${String(port)}`);
 			if (!url.pathname.startsWith(path)) {
 				res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
@@ -8652,7 +8337,7 @@ function startLoopback(options) {
 			server.close();
 			reject(/* @__PURE__ */ new Error("loopback timeout: no callback received"));
 		}, timeoutMs);
-		server.listen(port, parsed.hostname);
+		server.listen(port);
 	});
 }
 //#endregion
@@ -21554,14 +21239,19 @@ function providerOverrideOf(value) {
 	return value;
 }
 function apply(ctx, config = {}) {
-	let current = () => migrateOpenAICompatConfig(config);
+	const plainConfig = (source) => {
+		const out = {};
+		for (const [key, value] of Object.entries(source)) out[key] = value !== null && typeof value === "object" && typeof value.get === "function" ? value.get() : value;
+		return out;
+	};
+	let current = () => migrateOpenAICompatConfig(plainConfig(config));
 	const knownWorkspaceRoots = /* @__PURE__ */ new Set();
 	const canvasMirror = new CanvasMirror();
 	const subscriptionManager = new SubscriptionManager(ctx);
 	registerSubscriptionRoutes(ctx, subscriptionManager);
-	installImageSettings(ctx, config, {
+	installImageSettings(ctx, current(), {
 		setSource: (source) => {
-			current = () => migrateOpenAICompatConfig(source());
+			current = () => migrateOpenAICompatConfig(plainConfig(source()));
 		},
 		onChange: () => {}
 	});
@@ -22145,26 +21835,21 @@ function imagePresentation(result) {
 }
 /**
 * Wire the settings namespace across both dsh-settings API generations.
-* A namespace import keeps module loading safe on either version; the branch
-* picks the service method (0.1.2+) or the legacy top-level relay (<= rc.2),
-* and falls back to the composition entry with a warning when neither exists
-* so an incompatible host degrades the settings UI instead of failing boot.
+* The probe reads the HOST's `settings` service, never the bundled
+* dsh-settings module: the build inlines that module, so its exports always
+* look like the compile-time generation while only the service handed to this
+* fiber reflects the running host. dsh-settings 0.1.2–0.1.6 put `installSection`
+* on the service, so the namespace registers through it; DSH 0.1.7 replaced it
+* with schema-derived forms served by the loader itself (keyed by entry id),
+* so its service carries no installer and a host without any settings service
+* simply never runs the callback — both stay silent instead of warning.
 */
 function installImageSettings(ctx, config, hooks) {
-	const namespace = lib_exports;
-	if (typeof namespace.SettingsProvider?.prototype?.installSection === "function") {
-		ctx.inject(["settings"], (settingsCtx) => {
-			settingsCtx.settings.installSection(ctx, IMAGE_GENERATION_NAMESPACE, Config, config, hooks);
-		});
-		return;
-	}
-	const legacyInstall = namespace.installSettingsSection;
-	const legacyNamespace = namespace.settingsNamespace;
-	if (typeof legacyInstall === "function" && typeof legacyNamespace === "function") {
-		legacyInstall(ctx, legacyNamespace(IMAGE_GENERATION_NAMESPACE), Config, config, hooks);
-		return;
-	}
-	ctx.logger.warn("dsh-image-gen: this DSH exposes neither settings API generation; settings UI stays on the composition entry");
+	ctx.inject(["settings"], (settingsCtx) => {
+		const settings = settingsCtx.settings;
+		if (typeof settings.installSection !== "function") return;
+		settings.installSection(ctx, IMAGE_GENERATION_NAMESPACE, Config, config, hooks);
+	});
 }
 //#endregion
 export { CANVAS_STATE_ROUTE, Config, DELETE_ROUTE, IMAGE_ROUTE, INSPIRATION_ROUTE, SAVE_WORKSPACE_ROUTE, STUDIO_ROUTE, TEST_CONNECTION_ROUTE, apply, imageAttachmentFromMeta, inject, name };