dsh-model-switch 0.4.31 → 0.4.32

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## v0.4.32
+
+A hot install could still break every tool call: replacing the plugin (disable → remove → install → enable, **without a DSH restart**) leaves the official `auto-review` row serving while this row's takeover is still trying to displace it, and its unshielded probe fails each call. This release makes that window non-fatal and shortens it.
+
+- **P0: a broken reviewer seam no longer fails tool calls (`src/auto-review.ts`).** `installToolCallSafetyNet` registers a `{ prepend: true }` `tools/pre-execute` listener on this row's **own context**, so it is live even when the gate could not mount — the one window the defensive `permissionPresets` shadow cannot cover, because that shadow lives in the review scope while the serving official gate resolves the real service from the profile. It catches only seam failures (`inactive context`, `cannot get required service`, `cannot get property`, `without inject`, `TRANSPORT`), returns `{ kind: 'allow' }` so the body dispatches, and reports once with the fiber-chain dump. It is **inert while this row holds the route** (`isDegraded: () => !presets.registered`), so another plugin's broken listener keeps failing closed; reviewer transport/quota errors (`RATE_LIMIT`, `PI_AI_ERROR`) keep failing closed too — "the reviewer declined" and "the reviewer could not talk" are not broken seams. The waterfall only decides whether the body runs, so allowing here never masks a tool failure.
+- **The takeover budget matches a real disposal (`src/auto-review-takeover.ts`).** 20×10 ms (~200 ms) → 60×50 ms (~3 s), plus `TAKEOVER_LATE_RETRY_DELAYS_MS` = 500/1000/1500 ms: three bounded re-claims after the loop gives up, because `Entry.update({ disabled: true })` starts the displaced fiber's teardown and the loader does not await it. A disposal that unmounts a gate, restores permission presets and unwinds fibers outlasted the old budget, which is exactly the reported hot-swap window. Timers are cleared with the row.
+- **Actionable failure log.** The lost-seam error now says both what happens next ("the reviewer path is shielded instead of failing tool calls") and what the human can do ("Restart DSH to converge the reviewer row — a hot install cannot always displace the official row in time").
+- **Docs.** `docs/seam-gap.md` records the two remaining gaps: no public seam lets a plugin **replace a bundled capability row at runtime** (only disable-and-reclaim through the loader), and the loader cannot address a row nested in a preset's `config.plugins` — the official bundle row is top-level today, but a future nesting would need a config-level bridge like 0.4.27's preset bridge.
+- **Verification.** `pnpm run check` green (55 test files / 494 tests + pack gate). New coverage: the net allows the call and reports exactly once when the seam is broken, stays inert while this row holds the route, rethrows a reviewer quota error, and classifies an inject failure apart from a denial. The late-retry schedule is bounded by the row's lifetime. **Not yet reproduced end-to-end**: the disable → remove → install → enable sequence on the lab plane — this machine cannot reach the GitHub remote, so the release itself is still pending.
+
 ## v0.4.31
 
 The recurring tool-call outage is closed at both ends it can be closed from: this plugin now **takes the Auto-reviewer seam over** from the official `auto-review` row (yield-then-claim, the session-title pattern), and its own gate's preset probe can no longer fail a tool call even while the preset service is broken — with a fiber-chain dump in the one degradation log so the upstream half of the failure names itself next time.

package/README.md

@@ -183,7 +183,7 @@ Release-aligned search regression: `DSH_RELEASE_ANCHOR=/path/to/official/install
 
 If `dsh-composer-picker` is installed, remove it from the profile before enabling Model Switch. Model Switch already owns the Composer Picker and Plan Review seat; two owners produce duplicate or competing UI.
 
-Production profiles must use a released registry version or GitHub tag rather than workspace-local dependencies. Restart the selected DSH profile after installation or route changes.
+Production profiles must use a released registry version or GitHub tag rather than workspace-local dependencies. Restart the selected DSH profile after installation or route changes. **Restart once after installing, updating, enabling or disabling this plugin**: it owns Host rows and takes the official Auto-review row over at runtime (`permissionPresets.registerAuto` is a single registration slot); when a hot enable skips the restart, the official row may still be serving, so the takeover only shields the reviewer path — tools keep running, that call's review is skipped with one log line — and the seam converges on the next start.
 
 ## Compatibility
 

package/README.zh.md

@@ -181,7 +181,7 @@ DeepSeek 薄适配器调用官方公开 `DeepSeekSearchProvider`，复用用户
 
 如果 profile 已安装 `dsh-composer-picker`，请先移除它。Model Switch 已经拥有 Composer Picker 和 Plan Review 席位；同时安装会产生重复或竞争 UI。
 
-生产 profile 必须使用已发布的注册表版本或 GitHub tag，不能使用工作区本地依赖。安装或修改路由后重启对应的 DSH profile。
+生产 profile 必须使用已发布的注册表版本或 GitHub tag，不能使用工作区本地依赖。安装或修改路由后重启对应的 DSH profile。**安装、更新、启用或禁用本插件后都要重启一次**：它持有 Host 侧的行，并在运行时接管官方的自动审查行（`permissionPresets.registerAuto` 只有一个注册位）；不重启直接热启用时，官方行可能仍在服务，接管只能先把审查路径屏蔽掉——工具照常运行、本次审查跳过并留一条日志——重启后才会真正收敛。
 
 ## 兼容性
 

package/lib/auto-review.js

@@ -6,6 +6,20 @@ import { AsyncLocalStorage } from "node:async_hooks";
 * a matched row is disabled (its fiber disposed).
 */
 const OFFICIAL_AUTO_REVIEW_PACKAGE = "@deepseek-ai/dsh-experimental-auto-review";
+/**
+* Delays for the late re-claims after the attempt loop gave up (ms).
+*
+* `Entry.update({ disabled: true })` starts the displaced fiber's disposal but
+* the loader does not await it, and a disposal that tears down a mounted gate,
+* restores permission presets and unwinds fibers can take longer than the
+* attempt loop's budget. These re-claims keep trying for a few more seconds so a
+* hot-swapped install converges instead of needing a restart.
+*/
+const TAKEOVER_LATE_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	1500
+];
 /** Whether one loader entry is the official Auto-review row (strict package identity). */
 function isOfficialAutoReviewRow(entry) {
 	if (entry === void 0) return false;
@@ -42,23 +56,69 @@ function alreadyDisabled(entry) {
 * @returns a promise settling once the takeover attempt loop finished.
 */
 async function reclaimOfficialAutoReviewRow(ctx, entry, seam) {
+	const label = String(leafId(entry) ?? "auto-review");
+	/** One disable-then-claim step; true once this row holds the registration. */
+	const attempt = async () => {
+		try {
+			await entry.update({ disabled: true });
+			ctx.logger.info(`model-switch: disabled the official auto-review row ${label} (${OFFICIAL_AUTO_REVIEW_PACKAGE}); Model Switch's auto-review row owns the reviewer seam (configurable reviewer route)`);
+		} catch (cause) {
+			ctx.logger.info("model-switch: the displaced auto-review row could not be persisted as disabled; the takeover repeats next startup");
+			ctx.logger.info(String(cause));
+		}
+		return await seam.claim();
+	};
 	await seam.preserveAuto(async () => {
-		for (let attempt = 0; attempt < 20; attempt += 1) {
-			await new Promise((resolve) => setTimeout(resolve, attempt === 0 ? 0 : 10));
-			try {
-				await entry.update({ disabled: true });
-				ctx.logger.info(`model-switch: disabled the official auto-review row ${String(leafId(entry) ?? "auto-review")} (${OFFICIAL_AUTO_REVIEW_PACKAGE}); Model Switch's auto-review row owns the reviewer seam (configurable reviewer route)`);
-			} catch (cause) {
-				ctx.logger.info("model-switch: the displaced auto-review row could not be persisted as disabled; the takeover repeats next startup");
-				ctx.logger.info(String(cause));
-			}
-			if (await seam.claim()) {
-				ctx.logger.info(`model-switch: displaced the official auto-review row ${String(leafId(entry) ?? "auto-review")}; Auto review runs under the configurable reviewer route`);
+		for (let index = 0; index < 60; index += 1) {
+			await new Promise((resolve) => setTimeout(resolve, index === 0 ? 0 : 50));
+			if (await attempt()) {
+				ctx.logger.info(`model-switch: displaced the official auto-review row ${label}; Auto review runs under the configurable reviewer route`);
 				return;
 			}
 		}
-		ctx.logger.error(`model-switch: the official auto-review row ${String(leafId(entry) ?? "auto-review")} kept the Auto registration; the reviewer route override is unavailable this session`);
+		ctx.logger.error(`model-switch: the official auto-review row ${label} kept the Auto registration; the reviewer route override is unavailable this session`);
 	});
+	scheduleLateReclaims(ctx, label, seam);
+}
+/**
+* Keep re-claiming for a few seconds after the attempt loop gave up.
+*
+* The displaced fiber's disposal starts on `Entry.update` but is not awaited by
+* the loader, so it can outlast the attempt loop — which is exactly the hot-swap
+* window where the official (unshielded) gate keeps serving. These bounded
+* re-claims converge that window instead of leaving it to a restart. Timers are
+* cleared when this row unloads.
+*
+* @param ctx - this row's context, used for logging and timer disposal.
+* @param label - the official row's id, for diagnostics.
+* @param seam - the Auto-registration seam to reclaim.
+*/
+function scheduleLateReclaims(ctx, label, seam) {
+	let stopped = false;
+	const timers = [];
+	const stop = () => {
+		stopped = true;
+		for (const timer of timers.splice(0)) clearTimeout(timer);
+	};
+	ctx.effect(function* () {
+		yield stop;
+	}, "model-switch: auto-review late takeover retries");
+	const run = (index) => {
+		if (stopped || index >= TAKEOVER_LATE_RETRY_DELAYS_MS.length) return;
+		const timer = setTimeout(() => {
+			(async () => {
+				if (stopped) return;
+				if (await seam.claim()) {
+					ctx.logger.info(`model-switch: reclaimed the Auto registration late from the official auto-review row ${label}; Auto review runs under the configurable reviewer route`);
+					stop();
+					return;
+				}
+				run(index + 1);
+			})();
+		}, TAKEOVER_LATE_RETRY_DELAYS_MS[index]);
+		timers.push(timer);
+	};
+	run(0);
 }
 /**
 * Install the takeover choreography for an official row that activates later.
@@ -272,6 +332,69 @@ function bindAutoReviewSessionCorrelation(scope, activeSession) {
 		yield scope.on("tools/pre-execute", (exec, next) => activeSession.run(exec.agent?.session, next), { prepend: true });
 	}, "model-switch: auto-review session correlation");
 }
+/**
+* Signatures of a broken reviewer seam, never of a real denial.
+*
+* The official gate's `tools/pre-execute` probe resolves its own
+* `sessionProjections` injection before anything can catch it; when that fiber
+* chain breaks it throws `cannot get required service ... in inactive context`
+* (or, on older lines, `cannot get property ... without inject`) straight into
+* the tool call. `TRANSPORT` covers a reviewer that cannot reach its route at
+* all. A denial is a *return* (`{ kind: 'deny' }`), so it never matches.
+*/
+const REVIEWER_INFRA_FAILURE_SIGNATURES = [
+	"inactive context",
+	"cannot get required service",
+	"cannot get property",
+	"without inject",
+	"TRANSPORT"
+];
+/**
+* Whether a reviewer-path throw is a broken seam rather than a real decision.
+* @param cause - whatever the waterfall threw.
+* @returns true when the reviewer itself could not run.
+*/
+function isReviewerInfrastructureFailure(cause) {
+	const text = cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+	return REVIEWER_INFRA_FAILURE_SIGNATURES.some((signature) => text.includes(signature));
+}
+/**
+* Keep a broken reviewer seam from failing tool calls.
+*
+* Registered on this row's own context through `{ prepend: true }`, so it sits
+* ahead of the official gate's listener and stays live even when the gate could
+* not be mounted (the takeover lost `registerAuto`, or the displaced row has
+* not released it yet). That is the one window the defensive
+* `permissionPresets` shadow cannot cover: the shadow lives in this row's review
+* scope, while the serving gate resolves the real service from the profile.
+*
+* The waterfall only decides whether the body runs; the body dispatches after
+* it returns, so allowing here never masks a tool failure. Reviewer transport
+* and quota errors keep failing closed — only seam breakage is allowed through.
+*
+* @param ctx - this row's context (the listener lives and dies with the plugin).
+* @param options - diagnostics plus the degraded-state predicate.
+*/
+function installToolCallSafetyNet(ctx, options = {}) {
+	let reported = false;
+	const handler = async (_exec, next) => {
+		try {
+			return await next();
+		} catch (cause) {
+			if (!isReviewerInfrastructureFailure(cause)) throw cause;
+			if (options.isDegraded !== void 0 && !options.isDegraded()) throw cause;
+			if (!reported) {
+				reported = true;
+				const detail = options.fiberChain === void 0 ? "" : `; fiber chain: ${options.fiberChain()}`;
+				ctx.logger.warn(`model-switch: the Auto reviewer path is broken (${String(cause)}); tool calls run unreviewed instead of failing${detail}`);
+			}
+			return { kind: "allow" };
+		}
+	};
+	ctx.effect(function* () {
+		yield ctx.on("tools/pre-execute", handler, { prepend: true });
+	}, "model-switch: reviewer-path safety net");
+}
 /** The preset name the service reports when no configured preset matches. */
 const CUSTOM_PRESET = "custom";
 /** Read the live permission-preset service without requiring an injection. */
@@ -490,6 +613,10 @@ async function apply(ctx) {
 	const presets = defensivePermissionPresets(() => permissionPresetsOf(ctx), ctx.logger, () => fiberChainOf(ctx));
 	const activeSession = new AsyncLocalStorage();
 	const scope = reviewScope(ctx, activeSession, presets);
+	installToolCallSafetyNet(ctx, {
+		fiberChain: () => fiberChainOf(ctx),
+		isDegraded: () => !presets.registered
+	});
 	let gateReady = false;
 	let mountInFlight;
 	/** Sessions currently on the Auto preset (best-effort). */
@@ -585,7 +712,7 @@ async function apply(ctx) {
 	const entry = officialAutoReviewEntry(loaderOf(ctx));
 	if (entry !== void 0 && entry.disabled !== true) await reclaim(entry);
 	else await claim();
-	if (!presets.registered) ctx.logger.error("model-switch: the Auto registration is not held by this row; Auto review runs without the configurable reviewer route");
+	if (!presets.registered) ctx.logger.error("model-switch: the Auto registration is not held by this row, so Auto review runs without the configurable reviewer route; the reviewer path is shielded instead of failing tool calls. Restart DSH to converge the reviewer row — a hot install cannot always displace the official row in time");
 }
 //#endregion
-export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };
+export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, installToolCallSafetyNet, isReviewerInfrastructureFailure, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/types/auto-review-takeover.d.ts

@@ -36,9 +36,19 @@ export declare const OFFICIAL_AUTO_REVIEW_ROW = "auto-review";
  */
 export declare const OFFICIAL_AUTO_REVIEW_PACKAGE = "@deepseek-ai/dsh-experimental-auto-review";
 /** Bounded takeover attempts before the seam is reported lost. */
-export declare const TAKEOVER_MAX_ATTEMPTS = 20;
+export declare const TAKEOVER_MAX_ATTEMPTS = 60;
 /** Delay between takeover attempts; the first attempt is immediate. */
-export declare const TAKEOVER_RETRY_DELAY_MS = 10;
+export declare const TAKEOVER_RETRY_DELAY_MS = 50;
+/**
+ * Delays for the late re-claims after the attempt loop gave up (ms).
+ *
+ * `Entry.update({ disabled: true })` starts the displaced fiber's disposal but
+ * the loader does not await it, and a disposal that tears down a mounted gate,
+ * restores permission presets and unwinds fibers can take longer than the
+ * attempt loop's budget. These re-claims keep trying for a few more seconds so a
+ * hot-swapped install converges instead of needing a restart.
+ */
+export declare const TAKEOVER_LATE_RETRY_DELAYS_MS: readonly [500, 1000, 1500];
 /** The seam this row's gate owns; the takeover drives it around the official row. */
 export interface AutoReviewSeam {
     /**

package/lib/types/auto-review.d.ts

@@ -102,6 +102,41 @@ export declare function resolveSessionAutoReviewRoute(ctx: Context, session?: Se
  * @param activeSession - AsyncLocalStorage holding the session under review.
  */
 export declare function bindAutoReviewSessionCorrelation(scope: Context, activeSession: AsyncLocalStorage<Session | undefined>): void;
+/**
+ * Whether a reviewer-path throw is a broken seam rather than a real decision.
+ * @param cause - whatever the waterfall threw.
+ * @returns true when the reviewer itself could not run.
+ */
+export declare function isReviewerInfrastructureFailure(cause: unknown): boolean;
+/**
+ * Keep a broken reviewer seam from failing tool calls.
+ *
+ * Registered on this row's own context through `{ prepend: true }`, so it sits
+ * ahead of the official gate's listener and stays live even when the gate could
+ * not be mounted (the takeover lost `registerAuto`, or the displaced row has
+ * not released it yet). That is the one window the defensive
+ * `permissionPresets` shadow cannot cover: the shadow lives in this row's review
+ * scope, while the serving gate resolves the real service from the profile.
+ *
+ * The waterfall only decides whether the body runs; the body dispatches after
+ * it returns, so allowing here never masks a tool failure. Reviewer transport
+ * and quota errors keep failing closed — only seam breakage is allowed through.
+ *
+ * @param ctx - this row's context (the listener lives and dies with the plugin).
+ * @param options - diagnostics plus the degraded-state predicate.
+ */
+export declare function installToolCallSafetyNet(ctx: Context, options?: {
+    /** Diagnostic fiber dump appended to the first report. */
+    fiberChain?: (() => string) | undefined;
+    /**
+     * Whether this row currently knows the reviewer route is not held.
+     *
+     * The net only fails open in that state: another plugin's broken listener
+     * must keep failing closed, and a held route already has the defensive
+     * shadow in front of it. Defaults to always degraded (direct callers).
+     */
+    isDegraded?: (() => boolean) | undefined;
+}): void;
 /** The permission-preset face the official gate reads; structural so a missing package never breaks a build. */
 export interface PermissionPresetsFace {
     current(session: Session): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.31",
+  "version": "0.4.32",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",