dsh-ops 0.0.0-stage → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,189 @@
+# Changelog
+
+All notable changes to this package are recorded here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
+this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.1] — Windows payload packaging
+
+- Assemble complete digest-verified PortableGit/bash and PowerShell 7 runtime packages instead of metadata-only pins; inject all three Windows x64 runtime dependencies in the publish artifact.
+- Add explicit-profile install/status/uninstall delegation to the official DSH manager; map tui to dsh-tui and use Desktop's installation-owned CLI.
+- Resolve the pwsh dependency from the plugin package under pnpm isolation.
+- Make the default README Chinese and add a concise English translation.
+- Correct the npm credential selection: the initial E403 used an old local token, not the maintainer-provided bypass token. The explicitly selected bypass token was accepted for publication. Local payload builds are not license-compliance evidence.
+
+## [Unreleased] — additive tool surface
+
+### Changed
+
+- Replace the execution ladder and duplicate prompt sections with one compact routing table.
+- Preserve `ops_bash` as the preferred general command executor in the tools → bash → PowerShell 7 design; publish it in full-access agent scopes with the host subprocess service. Keep the compact routing table and use pwsh only for necessary Windows-native operations.
+- Publish command/job tools only in plugin-owned agent fibers under authoritative per-session `danger-full-access`; reconcile `sandbox/mode` changes and recheck calls. No env/preset fallback.
+- Reject image inspection explicitly and advertise PDF text only; preserve batch text ranges, encodings, hex, search filtering, and batch replacement.
+- Shorten published schema descriptions and advertise only symmetric grep context. Forward ordinary arguments unchanged.
+- Track background-job ownership per session/connection; reject foreign output/kill, filter background footers, and project owned job listings/counts/pagination.
+- Withdraw tools on disconnect. Scope all definitions/disposers to plugin ownership, with no shared registry rewrite or host value imports.
+- Declare read-only sibling concurrency through the host's function API. Do not assert host timeout quiescence; preserve the existing transport deadline.
+
+### Measurement and validation
+
+- Add a standalone schema measurement command and pre-change baseline, not a test gate.
+- Document manual acceptance and limits. No regression tests/CI added, existing tests neither updated nor run for this change.
+- Filesystem confinement of FastCtx file tools, per-command approval escalation, and cancellation quiescence remain outside this pass.
+
+## [0.2.0] - Unreleased
+
+The command-execution ladder, the plugin's own shells, the runtime package and the
+two shell pins that bring them, and the end of the MCP bridge dependency. Not
+published either: the repository still has no remote and no release tags, and this
+entry is where `package.json` / `dsh-plugin.json` move to `0.2.0`; no tag has been
+cut from it.
+
+### Added
+
+- **The command-execution ladder.** `lib/policy.js` renders the repository-tooling
+  section as an explicit ladder — FastCtx (`ops_*`), then `ops_bash`, then
+  PowerShell 7, then the host's own shell tools as the last resort — naming only the
+  rungs the model can actually reach and renumbering the rest, so the text the model
+  reads has no gaps. Preference is wording: the plugin never retries a failed call
+  on another rung and never cascades at run time.
+- **`ops_bash`** — the plugin's own bash, published as an ordinary tool through
+  `ctx.tools.register` (only while the host's subprocess service is mounted) and
+  executed through `ctx.get('subprocess')`, so commands run under the harness's own
+  credential scrub, output spilling, and process termination. Its environment is the
+  terminal overrides (`NO_COLOR`, `TERM`, `PAGER`, `GIT_PAGER`) and nothing else: it
+  forwards no credential-shaped name and no `DSH_*` fact, and it never writes
+  `process.env`, `PATH`, or the working directory.
+- **PowerShell 7 as rung 3.** The bundle patch re-points the host's `pwsh-sandbox`
+  row at the plugin's own pwsh through a `!!js` `pwshPath` — Windows-gated,
+  `lstat`-based usability checks over both bundled layouts in one order (the
+  installed `@dsh-ops/pwsh-<platform>-<arch>` package first, then the vendored copy),
+  and a wrapping `try`/`catch`. A deployment whose package carries neither copy gets
+  `undefined`, which is the row's own default, so the host's PowerShell resolution is
+  untouched. A profile overrides the entry in its own `cordis.patch.yml`, which
+  applies after every bundle layer.
+- **Per-agent visibility under `deny-host-shell`.** On `agent/created` the plugin
+  masks the configured host shell tools out of that agent's view with
+  `agent.ctx.tools.restrict({ deny })` — only while a rung of its own is live; the
+  fence at `tools/pre-execute` stays the guarantee, and the mask's disposer is owned
+  by the plugin as well, so unloading lifts it. With no rung of the plugin's own, the
+  fence is kept, visibility is left alone, and the reason is reported once.
+- Three config keys: `bashPath` (an explicit bash for rung 2, authoritative),
+  `publishBashTool` (default `true`), and `allowSystemShellFallback` (default
+  `true`, to confine rung 2 to plugin-provided shells).
+- **One runtime package, and two pins instead of two redistributions.**
+  `@dsh-ops/fastctx-<platform>-<arch>` carries this fork's slimmed FastCtx build
+  (`bin/fastctx.exe`), built here. `@dsh-ops/bash-<platform>-<arch>` and
+  `@dsh-ops/pwsh-<platform>-<arch>` carry **metadata only** — the upstream URL,
+  release, version, byte count, and SHA-256 of Git for Windows PortableGit and of
+  PowerShell 7. Neither upstream binary is repackaged, forwarded, or redistributed
+  by this distribution; the tag's GitHub Release carries this distribution's own
+  tarballs and a `SHA256SUMS`, and nothing upstream's. `PROVENANCE.md` records every
+  pin and licence.
+- **`dsh-ops provision-shells [--bash|--pwsh]`.** Reads a pin, downloads that
+  upstream archive on the user's own machine, verifies it against the pinned
+  SHA-256, and unpacks it under `<DSH_HOME>/dsh-ops/shells/<name>/<version>/`, which
+  is the first place both shell rungs resolve from. Nothing is downloaded at plugin
+  load time, and nothing is downloaded unless the command is run.
+- **`dsh-ops ladder`.** The CLI prints each rung's availability and the executable it
+  came from, together with the rungs the prompt text renders for that answer, so a
+  deployment can confirm which shells took effect without opening a session.
+- **The shell resolution gained a provisioned tier, and so did the runtime chain.**
+  Rung 2 resolves `config.bashPath`, then the provisioned copy, then a packaged copy,
+  then `PATH`, then the well-known installs; rung 3 and the bundle patch that
+  re-points the host's `pwsh-sandbox` row walk the same layouts in the same order. On
+  the runtime side, the FastCtx chain tries `@dsh-ops/fastctx-<platform>-<arch>` ahead
+  of the upstream `@fastctx/<platform>-<arch>` step, so an install gets this fork's
+  build by default while a deployment without it still falls through to the vendored
+  source build, the upstream package, or `fastctx` on `PATH`.
+
+### Changed
+
+- The repository-tooling section is no longer a flat tool list; it is the ladder
+  above, rendered from the rungs the model can actually reach.
+- `dsh-plugin.json` declares a second tool namespace for the tools the plugin
+  registers itself (`ops_bash`, `transport: in-process`), and the manifest gate
+  checks it against the fully-open ladder text.
+- **This distribution's own platform packages are injected into
+  `optionalDependencies` at release time, not committed.** Before the first release
+  those names resolve nowhere, so listing them in the repository would put a failed
+  optional fetch into every contributor's install log for no gain; the release step
+  writes them, and the tarball it publishes is the one that declares them. The two
+  shell pins cost an install nothing to declare, because they hold metadata and no
+  binaries.
+- The package version moves to `0.2.0` in `package.json` and `dsh-plugin.json`.
+
+### Removed
+
+- `pwshPath` and `overridePwshExecutor` are not config keys and now fail as unknown
+  keys. A bundle patch is evaluated before any `dsh-ops` row is mounted, so a key
+  could never reach the `pwsh-sandbox` override; rung 3 follows the executable
+  instead, and the override is the patch entry documented above.
+- `@deepseek-ai/dsh-mcp-client`, along with the `BRIDGE_PACKAGE` declaration and the
+  manifest check that required it. The plugin holds the MCP stdio connection to the
+  FastCtx server it spawns and publishes the tools itself (`lib/handshake.js`,
+  `lib/tools.js`); it no longer mounts a bridge, and the 0.1.0 entry's
+  registry-boundary renaming is gone with it.
+
+### Fixed
+
+- **`ops_bash` registers on the real host.** Its output schema used type arrays
+  (`['integer', 'null']`), which the harness's schema gate rejects outright, so the
+  tool could not be registered at all. Every `type` is now a single type and
+  `exitCode`/`signal` are optional properties: an unknown exit fact omits the key
+  rather than sending `null`.
+- **Rung 3 and the host row are one fact.** The bundle patch's expression and the
+  plugin's own probe now walk the same two bundled layouts
+  (`BUNDLED_LAYOUT_ORDER`) in the same order with the same `lstat` test, so the
+  ladder cannot advertise a PowerShell rung the host row does not run — or miss one
+  it would.
+- **The visibility mask follows the rungs that are live.** `deny-host-shell` used to
+  hide the host shell tools whenever a bash merely resolved. The question is now
+  asked of the ladder the model can reach — `ops_bash` published, or the PowerShell
+  rung live — and asked again as each agent appears. With no rung of the plugin's
+  own, visibility is left alone and the reason is reported once; the
+  `tools/pre-execute` fence is unchanged and is installed by the mode alone.
+
+## [0.1.0] - Unreleased
+
+The first version. Not published: the repository has no remote and no release
+tags, and `package.json` still carries `"private": true`.
+
+### Added
+
+- The plugin itself: one bundle that mounts the FastCtx MCP runtime as the
+  profile's repository tool surface, publishes its tools under a namespace of the
+  plugin's own, and injects two prompt sections that steer repository work away
+  from the host shell.
+- `shellPolicy: deny-host-shell` — an opt-in `tools/pre-execute` fence that
+  refuses the configured host shell tools by name. FastCtx's own tools are never
+  refused, so command execution stays available.
+- The `dsh-ops` CLI: `resolve`, `status`, `build`, and `provision`. `provision`
+  installs the built runtime into `<DSH_HOME>/dsh-ops/bin/` and writes a receipt
+  recording its origin, version, and SHA-256.
+- Composite licensing — MIT for the plugin, Apache-2.0 for `vendor/fastctx/` —
+  with FastCtx's required notice reproduced verbatim in `README.md`,
+  `README.zh.md`, and `NOTICE`.
+
+### Changed
+
+- **The FastCtx tools are published as `ops_*`.** The bridge's own
+  `mcp__<serverName>__<rawName>` naming is transport vocabulary in every
+  transcript, so registrations inside this plugin's bridge namespace are renamed
+  at the registry boundary: the model calls `ops_grep`, and a transcript shows
+  `ops_grep`. The `mcp__fastctx__*` names never reach the model.
+- **The vendored FastCtx is stripped to its MCP server.** Upstream's control
+  terminal (`src/tui/`), self-updater and upstream-version check (`src/update/`),
+  and Codex integration — including `control/i18n.rs` and the other locale
+  catalogs — are deleted rather than left unreachable, along with the
+  distribution and CI machinery. 57 files changed, 285 insertions and 24,715
+  deletions. The binary now carries `serve` plus the internal entry points the
+  shell and session machinery spawn.
+- `PROVENANCE.md` now records what was read from the readable `0.2.0-rc.2`
+  source, with file and line, next to what a suite actually ran.
+
+### Removed
+
+- Upstream's `.github/`, `packages/` (the npm launcher, `codex-fastctx`, and the
+  five `@fastctx/<platform>` binary packages), and `scripts/`.

package/LICENSE

@@ -0,0 +1,30 @@
+MIT License
+
+Copyright (c) 2026 T-Auto and the dsh-ops contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+-------------------------------------------------------------------------------
+
+This MIT license covers the dsh-ops plugin: everything in this repository
+except `vendor/fastctx/`, which is FastCtx under the Apache License 2.0. The
+distribution as a whole is therefore licensed under the composite
+`MIT AND Apache-2.0`. See `NOTICE` for the full statement and the attribution
+FastCtx requires, and `vendor/fastctx/LICENSE-APACHE` for the Apache License
+2.0 text.

package/NOTICE

@@ -0,0 +1,106 @@
+dsh-ops
+Copyright (c) 2026 T-Auto and the dsh-ops contributors
+
+================================================================
+COMPOSITE LICENSE
+================================================================
+
+This distribution is licensed under the composite expression
+
+    MIT AND Apache-2.0
+
+because it contains two bodies of work under two licenses:
+
+1. The dsh-ops plugin — everything in this repository except
+   `vendor/fastctx/`. Licensed MIT. The license text is in `LICENSE`.
+
+2. The vendored FastCtx source in `vendor/fastctx/`. Licensed
+   Apache-2.0 by its author. The license text is in
+   `vendor/fastctx/LICENSE-APACHE`, upstream's notice is in
+   `vendor/fastctx/NOTICE`, and the exact upstream revision and every
+   difference from it are recorded in `vendor/fastctx/UPSTREAM.md` and
+   `vendor/fastctx/FORK.md`.
+
+The installed npm package additionally depends on the published FastCtx
+platform packages `@fastctx/<platform>` (Apache-2.0), which are separate
+works distributed under their own terms; `vendor/fastctx/THIRD_PARTY_LICENSES.md`
+lists the third-party components inside FastCtx itself. Bundled Pdfium
+notices are in `vendor/fastctx/third-party/pdfium-7763/`.
+
+The published package also declares this distribution's own platform
+packages as OPTIONAL dependencies, and the same packages — this
+distribution's own tarballs, and nothing upstream's — are the assets
+attached to the GitHub Release for a tag. They are optional in the
+dependency sense, and two of them are not payloads at all: no upstream
+binary travels in this distribution.
+
+  * `@dsh-ops/fastctx-<platform>-<arch>` — this fork's build of FastCtx,
+    a payload built by this distribution from `vendor/fastctx/`.
+    Apache-2.0, by FastCtx's author, with the removals this distribution
+    made: the notice upstream requires is reproduced in this file and in
+    both READMEs, every source file this distribution touched carries its
+    own Apache-2.0 section 4(b) notice, and the complete enumeration is
+    in `vendor/fastctx/FORK.md`. `PROVENANCE.md` records this package's
+    upstream revision, upstream version, and payload SHA-256.
+
+  * `@dsh-ops/bash-<platform>-<arch>` — a PIN, not a redistribution.
+    This distribution does not contain, forward, repackage, or
+    redistribute Git for Windows. The pin records the upstream release
+    the shell is taken from (`PortableGit-2.56.0.2-64-bit.7z.exe`, Git
+    for Windows `v2.56.0.windows.2`), the official URL that publishes it,
+    and its SHA-256; `dsh-ops provision-shells` reads the pin, downloads
+    that asset on the user's own machine, verifies the digest there, and
+    unpacks it there. Git for Windows is distributed under the GNU
+    General Public License version 2, so the bytes a user obtains that
+    way are GPL-2.0 and are used under that licence; its terms, its
+    copyright, and the corresponding source belong to the Git for
+    Windows project (https://github.com/git-for-windows/git) and to the
+    Git project (https://github.com/git/git). No GPL-2.0-covered
+    component is part of this distribution.
+
+  * `@dsh-ops/pwsh-<platform>-<arch>` — a PIN, not a redistribution.
+    This distribution does not contain, forward, repackage, or
+    redistribute PowerShell. The pin records the upstream release
+    (`PowerShell-7.6.6-win-x64.zip`, PowerShell `v7.6.6`), the official
+    URL that publishes it, and its SHA-256; `dsh-ops provision-shells
+    --pwsh` reads the pin, downloads that asset on the user's own
+    machine, and verifies the digest there. PowerShell is distributed by
+    Microsoft under the MIT licence; that licence text, its copyright,
+    and the corresponding source belong to Microsoft and to the
+    PowerShell project (https://github.com/PowerShell/PowerShell).
+
+Nothing in this distribution is relicensed. The MIT grant covers only the
+work this repository authored.
+
+================================================================
+ATTRIBUTION NOTICE — FastCtx
+================================================================
+
+FastCtx's NOTICE requires that a derivative work carry the following
+notice verbatim in its documentation. It is reproduced here and in the
+repository README, as required.
+
+    This product includes FastCtx
+    (https://github.com/yc-duan/fastctx), Copyright (c) 2026 yc-duan,
+    used under the Apache License 2.0.
+
+    FastCtx is redistributed and/or modified here by the maintainer of
+    this distribution. Any such change is that maintainer's own work
+    and their sole responsibility. It is not endorsed by, not
+    supported by, and not attributable to the author of FastCtx, who
+    accepts no liability of any kind arising from this distribution or
+    from anything built on top of it.
+
+The changes this distribution makes to FastCtx are removals — of
+distribution and CI machinery, and of the code that existed only for
+upstream's standalone product (the control terminal, the self-updater and
+its upstream update detection, and the Codex integration) — together with
+the edits those removals forced in the files that remain. Every source
+file this distribution touched carries its own Apache-2.0 section 4(b)
+notice at the top, and the complete enumeration is in
+`vendor/fastctx/FORK.md`.
+
+================================================================
+
+FastCtx is developed and maintained at
+https://github.com/yc-duan/fastctx