dsh-loop-engine 0.1.5-rc1 → 0.1.5-rc2

package/lib/types/engine-codex/loop.d.ts

@@ -9,11 +9,13 @@
  *
  * @module dsh-loop-engine/engine-codex
  */
-import { Service } from '@deepseek-ai/cordis';
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-import type { AgentFactory, AgentHandle, CreateAgentOptions, ResumeAgentOptions } from '@deepseek-ai/dsh-agent';
+import type { AgentOptions } from '@deepseek-ai/dsh-agent';
+import type { Session, SessionId } from '@deepseek-ai/dsh-session';
+import { CodexAgent } from './agent.ts';
 import type { CodexApprovalPolicy, CodexSandboxMode, ResolvedConfig } from './types.ts';
+import { HostedLoopFactory } from '../driver-core/hosted-loop-factory.ts';
 /** Codex CLI sandbox modes a deployment may pin. */
 export declare const CODEX_SANDBOX_MODES: readonly CodexSandboxMode[];
 /** Codex CLI approval policies a deployment may pin. */
@@ -53,62 +55,11 @@ declare module '@deepseek-ai/cordis' {
  * transaction: prepare, run setup, then publish through both registries,
  * announce, and emit `agent/session-start`.
  */
-export declare class CodexLoop extends Service implements AgentFactory {
+export declare class CodexLoop extends HostedLoopFactory<ResolvedConfig, CodexAgent> {
     /** Services the loop resolves through its own fiber; blessed identically to the package-level entry inject. */
     static inject: string[];
-    /** Validated configuration owned by the loop plugin. */
-    readonly config: ResolvedConfig;
-    private readonly ownership;
-    /** Plain holder prevents Cordis from re-tracing the factory's dependency context through a caller shadow. */
-    private readonly runtime;
     constructor(ctx: Context, config: Config);
-    /**
-     * Construct the driver, scope, and one memoized reverse teardown for a new
-     * agent. The teardown is registered with the factory and the owner fiber
-     * BEFORE publication, so a mid-setup unload rolls everything back; `signal`
-     * fuses caller cancellation with lifecycle teardown for setup awaits.
-     */
-    private prepare;
-    /** Prepare one Agent around an acquired Session, run setup, and publish it. */
-    private setupAndPublish;
-    /**
-     * Create an agent and session under one caller-supplied identity, owned by
-     * the accessing fiber. When a persistence backend is mounted, the session's
-     * durable identity is stored before publication.
-     * @param ownerCtx - caller context that structurally owns the lifecycle.
-     * @param options - identities, optional live parent, session seed/metadata, loop options, setup, and cancellation.
-     * @returns the published handle.
-     */
-    createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>;
-    /**
-     * Take a fresh session's write ownership when persistence is mounted.
-     * Nothing is appended here: the constructor seed (which never re-emits
-     * through `session/event`) is stored by {@link appendUnstoredSuffix} at the
-     * publication commit point, so a failed or cancelled setup closes an
-     * unmaterialized handle and leaves no stored residue — the same id can be
-     * created again.
-     * @param session - the unpublished session to store.
-     * @param signal - optional cancellation forwarded to the backend create.
-     * @returns the owned handle and stored cursor, or `undefined` without a backend.
-     */
-    private createStoredSession;
-    /**
-     * Durably store the session events appended since the last stored cursor.
-     * Pre-publication appends (constructor seed markers, setup-window events)
-     * never re-emit through `session/event`, so publication must flush them
-     * through the handle before live events start routing into it.
-     * @param stored - the session's owned handle and stored cursor, if any.
-     * @param session - the unpublished session whose suffix is stored.
-     */
-    private appendUnstoredSuffix;
-    /**
-     * Resume an owned agent from the configured persistence service.
-     * @param ownerCtx - caller context that owns load, setup, and the live lifecycle.
-     * @param options - persisted identity, optional live parent, loop options, setup, and cancellation.
-     * @returns the published handle.
-     */
-    resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>;
-    /** Resume through an explicit persistence service. */
-    private resumeWith;
+    /** Construct the Codex driver for one prepared session. */
+    protected buildAgent(loopCtx: Context, id: SessionId, options: AgentOptions, session: Session): CodexAgent;
 }
 //# sourceMappingURL=loop.d.ts.map

package/lib/types/engine-codex/permission.d.ts

@@ -1,14 +1,23 @@
 /**
  * Mapping from the dsh session's durable permission knobs to one Codex query's
- * declarative permission stance. Codex has no interactive approval callback:
- * permissions are the `sandboxMode` + `approvalPolicy` pair chosen when the
- * thread starts, so the fold maps the session's `sandbox/mode` and
- * `approval/policy` events directly, mirroring the web surface's presets:
+ * declarative permission stance, plus the replies to every server-initiated
+ * interaction Codex can raise. Codex surfaces interactive approval as
+ * server-initiated JSON-RPC requests answered through the dsh approval seam
+ * (see `approvalReason` / `resolveApprovalRequest` below), while the thread
+ * still starts with the `sandboxMode` + `approvalPolicy` pair chosen at
+ * creation. The fold maps the session's `sandbox/mode` and `approval/policy`
+ * events directly, mirroring the web surface's presets:
  *   - full access → `danger-full-access` + `never` (no native checks at all),
- *   - an `ask` policy → `workspace-write` + `on-request` (the CLI's own
- *     interactive prompt degrades to a denial in the unattended dsh runtime),
+ *   - an `ask` policy → `workspace-write` + `on-request` (approvals are then
+ *     routed to the dsh approval seam, failing closed when it is absent),
  *   - anything else fails closed → `read-only` + `never`.
  *
+ * The other two interactions (`item/tool/requestUserInput` and
+ * `mcpServer/elicitation/request`) have no approval to grant: one asks the human
+ * a question, the other asks for MCP input. Both are mapped here so the driver
+ * answers them in-vocabulary instead of failing them with a protocol error that
+ * the model reads as a broken tool.
+ *
  * @module dsh-loop-engine/engine-codex/permission
  */
 import type { PermissionEvent } from '../driver-core/permission-knobs.ts';
@@ -20,6 +29,69 @@ export interface CodexPermission {
 }
 /** Conservative unattended default: read-only sandbox, never ask. */
 export declare const DEFAULT_CODEX_PERMISSION: CodexPermission;
+/**
+ * One question to put to the human, in the shape the dsh user-questions seam
+ * accepts. Declared inline (a structural subset) to avoid a peer dep on
+ * `@deepseek-ai/dsh-user-questions`, matching the approval seam's treatment.
+ */
+export interface UserQuestionItem {
+    /** Stable question id, echoed back by the answer and by our reply. */
+    readonly id: string;
+    /** The question to display. */
+    readonly question: string;
+    /** Optional short heading/group label. */
+    readonly header?: string;
+    /** Optional choices a UI renders as a menu. */
+    readonly options?: readonly {
+        readonly label: string;
+        readonly description?: string;
+    }[];
+}
+/** The human's answer, in the shape the dsh user-questions seam returns. */
+export interface UserQuestionAnswer {
+    /** One entry per answered question; unanswered questions are simply absent. */
+    readonly answers: readonly {
+        readonly id: string;
+        readonly selected: readonly string[];
+        /** Optional free-text answer, carried alongside `selected`. */
+        readonly custom?: string;
+    }[];
+}
+/** The `item/tool/requestUserInput` result Codex expects. */
+export interface CodexUserInputResponse {
+    /** Answer lists keyed by question id; an empty map means "no answers given". */
+    readonly answers: Record<string, {
+        readonly answers: string[];
+    }>;
+}
+/**
+ * Read the answerable questions of one `item/tool/requestUserInput` request. The
+ * wire is untrusted, so an entry with no usable id or wording is dropped: the
+ * reply is keyed by question id, and a synthesized key would answer a question
+ * Codex never asked.
+ * @param params - the request params.
+ * @returns the questions to put to the human, possibly none.
+ */
+export declare function userInputQuestions(params: unknown): UserQuestionItem[];
+/**
+ * Project one human answer onto Codex's response shape. A free-text answer rides
+ * along as a further entry of the question's answer list, and no answer at all
+ * (no seam, or the human dismissed it) becomes an empty map — the honest "asked,
+ * answered nothing", never an invented answer.
+ * @param answer - the seam's answer, or undefined when none was obtained.
+ * @returns the response payload.
+ */
+export declare function userInputResponse(answer: UserQuestionAnswer | undefined): CodexUserInputResponse;
+/**
+ * The reply to one `mcpServer/elicitation/request`. An unattended driver cannot
+ * render an elicitation form, so it declines — the same stance the Claude Code
+ * driver takes for the equivalent callback, and the one answer that never
+ * fabricates input the user did not give.
+ * @returns the response payload.
+ */
+export declare function elicitationResponse(): {
+    action: 'decline';
+};
 /**
  * Resolve the session's effective Codex permission stance. Full access wins
  * outright; otherwise an `ask` policy maps to the CLI's on-request approval
@@ -29,4 +101,26 @@ export declare const DEFAULT_CODEX_PERMISSION: CodexPermission;
  * @returns the stance one query should run under.
  */
 export declare function resolveSessionPermission(events: readonly PermissionEvent[]): CodexPermission;
+/** The closed outcome of one dsh approval request (mirrors the dsh-user-approval seam). */
+export type ApprovalOutcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';
+/** Short tool identity for the dsh approval request carrying one native Codex approval. */
+export declare function approvalToolName(method: string): string;
+/** Human-readable reason for one native Codex approval request. */
+export declare function approvalReason(method: string, params: unknown): string;
+/** The native decision a command/file-change approval resolves to. */
+export declare function approvalDecision(outcome: ApprovalOutcome): 'accept' | 'decline';
+/** The native permissions-request response for one approval outcome. */
+export declare function permissionsGrant(outcome: ApprovalOutcome, requested: unknown): {
+    permissions: unknown;
+    scope: 'turn';
+};
+/** Build the JSON-RPC reply payload for one inbound Codex approval request. */
+export declare function resolveApprovalRequest(method: string, params: unknown, outcome: ApprovalOutcome): {
+    result: unknown;
+} | {
+    error: {
+        code: number;
+        message: string;
+    };
+};
 //# sourceMappingURL=permission.d.ts.map

package/lib/types/engine-codex/skills.d.ts

@@ -9,21 +9,20 @@
  * contents, so the dsh skill-injection seam (`/name` gestures) can carry it
  * into the prompt.
  *
+ * The discovery algorithm itself lives in {@link AgentsMdSkillProvider}; this
+ * module supplies only Codex's locations and ranks — and, having no skills
+ * catalog, no `skills` entry.
+ *
  * @module dsh-loop-engine/engine-codex/skills
  */
-import type { SkillCandidate, SkillDefinition, SkillLookupOptions, SkillProvider, SkillProviderControl } from '../skills.ts';
+import { AgentsMdSkillProvider } from '../driver-core/agents-md-skill-provider.ts';
+import type { SkillProviderControl } from '../skills.ts';
 /**
  * Skill provider that discovers `AGENTS.md` from every directory between the
  * project cwd and the git root, plus the user home `~/.codex/AGENTS.md`.
  */
-export declare class CodexSkillProvider implements SkillProvider {
-    private readonly control;
-    readonly name = "codex";
+export declare class CodexSkillProvider extends AgentsMdSkillProvider {
     constructor(control: SkillProviderControl);
-    list(options: SkillLookupOptions): Promise<readonly SkillCandidate[]>;
-    get(candidate: SkillCandidate, _options: SkillLookupOptions): Promise<SkillDefinition | undefined>;
-    /** One merged `agents-md` candidate for a ranked file set. */
-    private agentsCandidate;
 }
 export default CodexSkillProvider;
 //# sourceMappingURL=skills.d.ts.map

package/lib/types/engine-kimi/acp/client.d.ts

@@ -13,9 +13,35 @@
  * @module dsh-loop-engine/engine-kimi/acp/client
  */
 import type { KimiProcess, KimiSpawnCapability, KimiSpawnSpec } from '../process.ts';
-import { type AcpFrame, type AcpUpdate } from './types.ts';
+import { type AcpFrame, type AcpPermissionOption, type AcpPermissionResponse, type AcpUpdate } from './types.ts';
 /** How the client answers one `session/request_permission`. */
 export type AcpPermissionHandler = (request: AcpFrame) => boolean | Promise<boolean>;
+/**
+ * The answerable options of one `session/request_permission` frame. The wire is
+ * untrusted, so entries without a usable `optionId` are dropped rather than
+ * echoed back.
+ * @param frame - the reverse-RPC request frame.
+ * @returns the options the client may answer with.
+ */
+export declare function permissionOptionsOf(frame: AcpFrame): readonly AcpPermissionOption[];
+/**
+ * Encode one approval decision as the ACP `RequestPermissionResponse` the agent
+ * correlates against the options it advertised. The agent reads a terminal
+ * *option*, never a boolean: an outcome it cannot resolve (or a response that
+ * fails to parse at all) is reported to the model as a user rejection, so a
+ * decision that no single option expresses becomes `cancelled` — the honest
+ * "this client has no answer". Kimi re-uses this RPC for its question and
+ * plan-review bridges, which offer one `allow_once` option per choice; picking
+ * one of those would answer a question no human was asked, so any ambiguous
+ * set (zero or several `allow_once`/`reject_once` candidates) cancels instead.
+ * `allow_once` is preferred over `allow_always` because the decision is re-read
+ * from the session knobs on every request: letting the agent cache a session
+ * grant would outlive a mid-session switch back to `ask`.
+ * @param approved - whether the driver approves the request.
+ * @param options - the options the agent advertised for this request.
+ * @returns the result payload to send back.
+ */
+export declare function permissionResponse(approved: boolean, options: readonly AcpPermissionOption[]): AcpPermissionResponse;
 /** Callback receiving every non-response event line. */
 export type AcpUpdateHandler = (update: AcpUpdate) => void;
 /**
@@ -61,8 +87,12 @@ export declare class AcpClient {
     prompt(sessionId: string, text: string): Promise<unknown>;
     /** Cancel the active turn in a session (fire-and-forget). */
     cancel(sessionId: string): void;
-    /** Answer a pending `session/request_permission`. */
-    respondPermission(id: number, approved: boolean): void;
+    /**
+     * Answer a pending `session/request_permission`.
+     * @param id - the reverse-RPC request id.
+     * @param response - the ACP outcome to answer with.
+     */
+    respondPermission(id: number, response: AcpPermissionResponse): void;
     /** Consume every buffered update as an async generator. */
     updates(): AsyncGenerator<AcpUpdate, void, void>;
     /** Seal the client and request child termination. */

package/lib/types/engine-kimi/acp/mapping.d.ts

@@ -3,11 +3,15 @@
  *
  * Kimi streams incremental assistant text (`agent_message_chunk`), incremental
  * thinking (`agent_thought_chunk`), a tool-call announcement (`tool_call`) and its
- * progress/result stream (`tool_call_update`). This module is pure: it classifies
- * an update, extracts chunk deltas, and projects the tool-call identity/result so
- * the agent can fold them into the durable log. Content blocks use the observed
- * kimi `{ type: 'content', content: { type: 'text', text } }` nesting; unknown
- * block types are ignored.
+ * progress/result updates (`tool_call_update`). Assistant text and thinking are
+ * Deltas; a tool update's content is a whole Snapshot that replaces the previous
+ * one. A tool call's identity arrives on the announcement but its input
+ * (`rawInput`) does not — only a later update carries it. This module is pure: it
+ * classifies an update, extracts chunk deltas, and projects the tool-call
+ * identity/input/content/result so the agent can fold them into the durable log.
+ * Content blocks use the observed kimi
+ * `{ type: 'content', content: { type: 'text', text } }` nesting; unknown block
+ * types are ignored.
  *
  * @module dsh-loop-engine/engine-kimi/acp/mapping
  */
@@ -33,12 +37,37 @@ export declare function chunkDelta(update: AcpUpdate): string;
 export declare function toolCallIdOf(update: AcpUpdate): string;
 /** The tool display name (`title`). */
 export declare function toolCallName(update: AcpUpdate): string;
+/**
+ * The tool call's real input as the JSON `arguments` string the durable
+ * `tool/call` carries, when the frame supplies it.
+ *
+ * The `tool_call` announcement never carries `rawInput`; a later
+ * `tool_call_update` does (measured against kimi 0.28.x: the execution-start
+ * frame, `status: 'in_progress'`). A call's arguments are therefore unknowable
+ * at announce time, and the driver logs the call only once an update supplies
+ * them — or when the call settles, whichever comes first.
+ * @param update - one tool-call announcement or update.
+ * @returns the arguments string, or `undefined` when the frame omits the field.
+ */
+export declare function toolRawInput(update: AcpToolCallExt | AcpToolCallStreamExt): string | undefined;
 /** Whether a tool stream status is settled (no longer streaming). */
 export declare function isToolSettledStatus(status: string): boolean;
 /** Whether a tool stream status denotes a failure. */
 export declare function isToolErrorStatus(status: string): boolean;
-/** Join the observed `{ type: 'content', content: { type: 'text', text } }` blocks. */
-export declare function toolContentText(update: AcpToolCallExt | AcpToolCallStreamExt): string;
+/**
+ * The tool call's content as ONE update carries it: the joined text of its
+ * observed `{ type: 'content', content: { type: 'text', text } }` blocks.
+ *
+ * Kimi re-sends the call's whole content on every `tool_call_update` rather than
+ * streaming deltas (measured against 0.28.1: the string grows from the tool
+ * input's rendering to the final output), so this is a *snapshot* — callers
+ * replace with it, never append. `undefined` means the update carried no
+ * content field at all (nothing to replace), which is distinct from a present
+ * but empty one.
+ * @param update - one tool-call announcement or update.
+ * @returns the content snapshot, or `undefined` when the field is absent.
+ */
+export declare function toolContentText(update: AcpToolCallExt | AcpToolCallStreamExt): string | undefined;
 /** Project a completed tool call to a durable tool/result message. */
 export declare function toolResult(callId: string, text: string, isError: boolean): ToolResultMessage;
 //# sourceMappingURL=mapping.d.ts.map

package/lib/types/engine-kimi/acp/types.d.ts

@@ -33,7 +33,14 @@ export interface AcpUpdate {
     readonly sessionUpdate: string;
     readonly [key: string]: unknown;
 }
-/** A tool-call announcement (`sessionUpdate: 'tool_call'`). */
+/**
+ * A tool-call announcement (`sessionUpdate: 'tool_call'`).
+ *
+ * Measured against kimi 0.28.x: an announcement carries the call's identity
+ * (`toolCallId`/`title`/`kind`) and an empty content card, but **never** its
+ * input — `rawInput` only ever arrives on a later `tool_call_update` (the
+ * execution-start frame).
+ */
 export interface AcpToolCallExt extends AcpUpdate {
     readonly sessionUpdate: 'tool_call';
     readonly toolCallId: string;
@@ -41,6 +48,8 @@ export interface AcpToolCallExt extends AcpUpdate {
     readonly kind: string;
     readonly status: string;
     readonly content?: readonly AcpToolContentBlock[];
+    /** The call's real input; absent on the announcement (see above). */
+    readonly rawInput?: unknown;
 }
 /** A tool-call progress/result stream (`sessionUpdate: 'tool_call_update'`). */
 export interface AcpToolCallStreamExt extends AcpUpdate {
@@ -48,11 +57,41 @@ export interface AcpToolCallStreamExt extends AcpUpdate {
     readonly toolCallId: string;
     readonly status: string;
     readonly content?: readonly AcpToolContentBlock[];
+    /** The call's real input, first present on the execution-start frame. */
+    readonly rawInput?: unknown;
+    /** The tool's raw structured output, present once the call settles. */
+    readonly rawOutput?: unknown;
+}
+/** One option the agent offers for a `session/request_permission`. */
+export interface AcpPermissionOption {
+    /** Opaque id the client sends back in `outcome.optionId` (the only field the agent reads). */
+    readonly optionId: string;
+    /** Human-readable label for the option. */
+    readonly name?: string;
+    /** Option class: `allow_once` / `allow_always` / `reject_once` / `reject_always`. */
+    readonly kind?: string;
 }
 /** The `session/request_permission` reverse-RPC params. */
 export interface AcpPermissionRequest {
     readonly sessionId?: string;
-    readonly request?: unknown;
+    /** Every option the agent will accept an answer for; empty means no answerable choice. */
+    readonly options?: readonly AcpPermissionOption[];
+    /** The tool call the prompt belongs to (presentation/correlation only). */
+    readonly toolCall?: unknown;
+}
+/**
+ * Terminal outcome of a permission request: the option the client picked, or
+ * `cancelled` when it had no answer to give.
+ */
+export type AcpPermissionOutcome = {
+    readonly outcome: 'selected';
+    readonly optionId: string;
+} | {
+    readonly outcome: 'cancelled';
+};
+/** The `session/request_permission` result the agent expects (ACP `RequestPermissionResponse`). */
+export interface AcpPermissionResponse {
+    readonly outcome: AcpPermissionOutcome;
 }
 /** Result of a completed `session/prompt` request (opaque; the turn ended). */
 export interface AcpPromptResult {

package/lib/types/engine-kimi/agent.d.ts

@@ -111,19 +111,76 @@ export declare class KimiAgent implements Agent {
     private step;
     /** Per-step accumulation state for streamed assistant blocks and tool calls. */
     private blocks;
-    private emittedToolCalls;
-    private toolText;
+    /**
+     * Announced calls still waiting for the update that carries their input,
+     * keyed by call id, holding the latest content snapshot seen meanwhile (a
+     * frame can report output before it reports input). `toolContent` holds the
+     * calls already logged, so a call is in exactly one of the two.
+     */
+    private pendingCalls;
+    /** Whether the current step published any assistant message at all. */
+    private producedOutput;
+    /**
+     * Tool results logged into the currently open step. A result means the
+     * segment that requested the call is finished, so the next assistant content
+     * opens the next step (see {@link beginSegment}).
+     */
+    private stepSettledTools;
+    /**
+     * Tool calls the current segment has already received input for, awaiting the
+     * segment's single assistant message. A model turn that announces several
+     * calls before any result must land them all in ONE message — the chat node
+     * keys by `${turn}:${step}` and replaces blocks on every message, so a second
+     * message would overwrite the first one's reasoning/text (and tool-call head).
+     * The list is flushed once, when the segment closes (its first settled result).
+     */
+    private segmentCalls;
+    /** Latest content snapshot per logged tool call (see {@link applyUpdate}). */
+    private toolContent;
+    /** The live attempt framing the assistant message being assembled right now. */
+    private live;
     private blockRef;
     private ensureBlock;
-    /** Apply one streamed update to the current step's blocks and stream. */
+    /**
+     * Rotate to the next step when the segment that ran a tool has finished, so
+     * each assistant segment lands in its own step.
+     *
+     * Called as new assistant content begins. A step holding a settled tool
+     * result means the previous segment is complete, and the content about to be
+     * applied belongs to the next one. Rotating here (rather than when a call is
+     * announced) keeps calls that were announced before any result — one model
+     * turn — in a single step.
+     */
+    private beginSegment;
+    /** Apply one streamed update to the open step's blocks and stream. */
     private applyUpdate;
+    /** The live attempt framing the current segment, opened on its first chunk. */
+    private currentStream;
+    /**
+     * Flush the open segment's single assistant message and every `tool/call` it
+     * accumulated, in the load-bearing order assistant/message → tool/call. One
+     * segment produces exactly ONE message even when the model announced several
+     * calls before any result, because the chat view keys an assistant node by
+     * `${turn}:${step}` and replaces its blocks on every message — a second
+     * message in the same step would overwrite the first one's reasoning/text and
+     * leave only the last bare tool-call head visible.
+     * @param phase - the open step the segment belongs to.
+     */
+    private flushSegment;
     /**
      * Flush the accumulated assistant blocks into one durable assistant/message
-     * carrying the exact stream the attempt published live.
-     * @param turn - durable turn owning the message.
-     * @param step - durable step owning the message.
-     * @param currentStream - the step's live attempt accessor; a step whose
-     *   blocks streamed always has one open, while a tool-only step has none.
+     * carrying the exact stream the attempt published live, optionally closing it
+     * with the tool-call block(s) that ended the segment.
+     *
+     * Every flush settles its own attempt (and so its own live `end` frame): a
+     * step emits one message per assistant segment, and the client pairs a durable
+     * message with the attempt whose `end` cites it, so two messages may not share
+     * one attempt.
+     * @param phase - the open step the message belongs to.
+     * @param toolCalls - the calls that closed this segment, rendered as trailing
+     *   `tool-call` content blocks. A segment with no blocks of its own — a step
+     *   whose only activity was a tool call — still emits this message, so its
+     *   `tool/call` and `tool/result` events have a parent to pair with.
      */
     private flushAssistant;
 }

package/lib/types/engine-kimi/loop.d.ts

@@ -14,12 +14,14 @@
  *
  * @module dsh-loop-engine/engine-kimi
  */
-import { Service } from '@deepseek-ai/cordis';
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-import type { AgentFactory, AgentHandle, CreateAgentOptions, ResumeAgentOptions } from '@deepseek-ai/dsh-agent';
+import type { AgentOptions } from '@deepseek-ai/dsh-agent';
+import type { Session, SessionId } from '@deepseek-ai/dsh-session';
+import { KimiAgent } from './agent.ts';
 import type { KimiSpawnCapability } from './process.ts';
 import type { ResolvedConfig } from './types.ts';
+import { HostedLoopFactory } from '../driver-core/hosted-loop-factory.ts';
 /** Grace in milliseconds for Kimi process-tree termination. */
 export declare const KIMI_DISPOSE_GRACE_MS = 3000;
 /** Deployment-owned configuration for the Kimi loop plugin. */
@@ -45,64 +47,13 @@ declare module '@deepseek-ai/cordis' {
  * transaction: prepare, run setup, then publish through both registries,
  * announce, and emit `agent/session-start`.
  */
-export declare class KimiLoop extends Service implements AgentFactory {
+export declare class KimiLoop extends HostedLoopFactory<ResolvedConfig, KimiAgent> {
     /** Services the loop resolves through its own fiber; blessed identically to the package-level entry inject. */
     static inject: string[];
-    /** Validated configuration owned by the loop plugin. */
-    readonly config: ResolvedConfig;
-    private readonly ownership;
-    /** Plain holder prevents Cordis from re-tracing the factory's dependency context through a caller shadow. */
-    private readonly runtime;
     /** One-shot spawn capability handed to every agent, sandboxed by the subprocess seam. */
     readonly spawn: KimiSpawnCapability;
     constructor(ctx: Context, config: Config);
-    /**
-     * Construct the driver, scope, and one memoized reverse teardown for a new
-     * agent. The teardown is registered with the factory and the owner fiber
-     * BEFORE publication, so a mid-setup unload rolls everything back; `signal`
-     * fuses caller cancellation with lifecycle teardown for setup awaits.
-     */
-    private prepare;
-    /** Prepare one Agent around an acquired Session, run setup, and publish it. */
-    private setupAndPublish;
-    /**
-     * Create an agent and session under one caller-supplied identity, owned by
-     * the accessing fiber. When a persistence backend is mounted, the session's
-     * durable identity is stored before publication.
-     * @param ownerCtx - caller context that structurally owns the lifecycle.
-     * @param options - identities, optional live parent, session seed/metadata, loop options, setup, and cancellation.
-     * @returns the published handle.
-     */
-    createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>;
-    /**
-     * Take a fresh session's write ownership when persistence is mounted.
-     * Nothing is appended here: the constructor seed (which never re-emits
-     * through `session/event`) is stored by {@link appendUnstoredSuffix} at the
-     * publication commit point, so a failed or cancelled setup closes an
-     * unmaterialized handle and leaves no stored residue — the same id can be
-     * created again.
-     * @param session - the unpublished session to store.
-     * @param signal - optional cancellation forwarded to the backend create.
-     * @returns the owned handle and stored cursor, or `undefined` without a backend.
-     */
-    private createStoredSession;
-    /**
-     * Durably store the session events appended since the last stored cursor.
-     * Pre-publication appends (constructor seed markers, setup-window events)
-     * never re-emit through `session/event`, so publication must flush them
-     * through the handle before live events start routing into it.
-     * @param stored - the session's owned handle and stored cursor, if any.
-     * @param session - the unpublished session whose suffix is stored.
-     */
-    private appendUnstoredSuffix;
-    /**
-     * Resume an owned agent from the configured persistence service.
-     * @param ownerCtx - caller context that owns load, setup, and the live lifecycle.
-     * @param options - persisted identity, optional live parent, loop options, setup, and cancellation.
-     * @returns the published handle.
-     */
-    resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>;
-    /** Resume through an explicit persistence service. */
-    private resumeWith;
+    /** Construct the Kimi ACP driver for one prepared session. */
+    protected buildAgent(loopCtx: Context, id: SessionId, options: AgentOptions, session: Session): KimiAgent;
 }
 //# sourceMappingURL=loop.d.ts.map

package/lib/types/engine-kimi/skills.d.ts

@@ -11,6 +11,9 @@
  * is surfaced under its own name, so the dsh skill-injection seam (`/name`
  * gestures) can carry them into the prompt.
  *
+ * Unlike pi and Codex, Kimi has no user-level instruction file: its user
+ * install root holds only the skills catalog.
+ *
  * The generic `~/.agents/skills/` and `.agents/skills/` roots are deliberately
  * not scanned here: dsh's own `skill-filesystem` provider already exposes them
  * through the same registry in the web profile. Kimi built-in Skills are
@@ -21,9 +24,13 @@
  * `disableModelInvocation`/`type` fields are not translated, so a `type: flow`
  * skill is surfaced as model-invocable.
  *
+ * The discovery algorithm itself lives in {@link AgentsMdSkillProvider}; this
+ * module supplies only Kimi's locations and ranks.
+ *
  * @module dsh-loop-engine/engine-kimi/skills
  */
-import type { SkillCandidate, SkillDefinition, SkillLookupOptions, SkillProvider, SkillProviderControl } from '../skills.ts';
+import { AgentsMdSkillProvider } from '../driver-core/agents-md-skill-provider.ts';
+import type { SkillProviderControl } from '../skills.ts';
 /**
  * Resolve the Kimi config directory, honoring the `KIMI_CODE_HOME` environment
  * override and falling back to `~/.kimi-code`.
@@ -38,20 +45,8 @@ export declare function kimiAgentDir(): string;
  *   - project `.kimi-code/skills/` and user `~/.kimi-code/skills/` — each
  *     `SKILL.md` entry surfaced under its own name.
  */
-export declare class KimiSkillProvider implements SkillProvider {
-    private readonly control;
-    readonly name = "kimi";
+export declare class KimiSkillProvider extends AgentsMdSkillProvider {
     constructor(control: SkillProviderControl);
-    list(options: SkillLookupOptions): Promise<readonly SkillCandidate[]>;
-    get(candidate: SkillCandidate, _options: SkillLookupOptions): Promise<SkillDefinition | undefined>;
-    /** One merged `agents-md` candidate for a ranked file set. */
-    private agentsCandidate;
-    /** Collect every skill in one skills directory, both kimi layouts. */
-    private collectSkillsDir;
-    /** One parsed skill as a ranked candidate. */
-    private skillCandidate;
-    /** Parse one SKILL.md file, or `undefined` when it is unreadable or invalid. */
-    private tryParse;
 }
 export default KimiSkillProvider;
 //# sourceMappingURL=skills.d.ts.map