dsh-plugin-inspector 0.6.0 → 0.8.0

package/lib/knowledge.js

@@ -11,9 +11,17 @@
  */
 /**
  * Harness version these tables were transcribed from — the version string in
- * the checkout's own `packages/bundle/*/package.json`.
+ * the shipped bundles' own `package.json`, which is `dsh`'s own version.
+ *
+ * Re-verified against `0.1.2-rc.1`, the release npm tags `latest`, by
+ * extracting each table from the published packages and diffing it against the
+ * one here. What moved: thirteen row ids the bundles gained against three they
+ * dropped, four rows the base layer inserts that only the web bundle carried,
+ * eleven seam keys against one dropped, and two waterfall events against one
+ * dropped. What did not: the sandbox trap table, the teardown surfaces, and
+ * every `DECISION_EVENT_DEFAULTS` citation, all re-read at this release.
  */
-export const HARNESS_REFERENCE = '0.1.0-rc.5';
+export const HARNESS_REFERENCE = '0.1.2-rc.1';
 /**
  * The three profile bundles the harness ships, mapped to what each one is.
  * A package that *is* one of these composes the core rows rather than modifying
@@ -45,13 +53,11 @@ export const CORE_ROWS = new Map([
     ['agent-instructions', { module: '@deepseek-ai/dsh-agent-instructions', bundles: ['base'] }],
     ['agent-loop', { module: '@deepseek-ai/dsh-agent-loop', bundles: ['base'] }],
     ['agent-presets', { module: '@deepseek-ai/dsh-agent-presets', bundles: ['web-app'] }],
-    ['api-gateway', { module: '@deepseek-ai/dsh-host-apiproxy', bundles: ['web-app'] }],
     ['api-remotes', { module: '@deepseek-ai/dsh-api-remotes', bundles: ['web-app'] }],
     ['approval', { module: '@deepseek-ai/dsh-user-approval', bundles: ['base'] }],
     ['attachment-local', { module: '@deepseek-ai/dsh-attachment-local', bundles: ['base'] }],
     ['bash-sandbox', { module: '@deepseek-ai/dsh-bash-sandbox', bundles: ['base'] }],
     ['client-hmr', { module: '@deepseek-ai/dsh-client-hmr', bundles: ['web-app'] }],
-    ['client-runtime', { module: '@deepseek-ai/dsh-client-runtime', bundles: ['web-app'] }],
     ['code-runtime', { module: '@deepseek-ai/dsh-code-runtime-worker-thread', bundles: ['headless', 'web-app'] }],
     ['command-compact', { module: '@deepseek-ai/dsh-command-compact', bundles: ['base'] }],
     ['command-feedback', { module: '@deepseek-ai/dsh-command-feedback', bundles: ['base'] }],
@@ -62,7 +68,9 @@ export const CORE_ROWS = new Map([
     ['cordis-client-runner', { module: '@deepseek-ai/dsh-cordis-client-runner', bundles: ['web-app'] }],
     ['cordis-host-runner', { module: '@deepseek-ai/dsh-cordis-host-runner', bundles: ['web-app'] }],
     ['credentials', { module: '@deepseek-ai/dsh-credentials-local', bundles: ['base'] }],
+    ['deepseek-llm-api-extensions', { module: '@deepseek-ai/dsh-deepseek-llm-api-extensions', bundles: ['base'] }],
     ['directory-picker', { module: '@deepseek-ai/dsh-host-directory-picker-auto', bundles: ['web-app'] }],
+    ['file-reference-local', { module: '@deepseek-ai/dsh-file-reference-local', bundles: ['web-app'] }],
     ['fs-observation-policy', { module: '@deepseek-ai/dsh-fs-observation-policy', bundles: ['base'] }],
     ['fs-sandbox', { module: '@deepseek-ai/dsh-fs-sandbox', bundles: ['base'] }],
     ['goal', { module: '@deepseek-ai/dsh-goal', bundles: ['base'] }],
@@ -81,33 +89,40 @@ export const CORE_ROWS = new Map([
     ['permission', { module: '@deepseek-ai/dsh-permission-presets', bundles: ['base'] }],
     ['plan-mode', { module: '@deepseek-ai/dsh-plan-mode', bundles: ['base'] }],
     ['plugin-inventory', { module: '@deepseek-ai/dsh-host-plugin-inventory', bundles: ['web-app'] }],
+    ['plugin-package-inventory-deepseek', { module: '@deepseek-ai/dsh-plugin-package-inventory-deepseek', bundles: ['base'] }],
     ['pwsh-sandbox', { module: '@deepseek-ai/dsh-pwsh-sandbox', bundles: ['base'] }],
     ['repeat-tool-reminder', { module: '@deepseek-ai/dsh-repeat-tool-reminder', bundles: ['base'] }],
     ['sandbox', { module: '@deepseek-ai/dsh-sandbox-local', bundles: ['base'] }],
     ['sandbox-policy', { module: '@deepseek-ai/dsh-sandbox-policy', bundles: ['base'] }],
     ['session', { module: '@deepseek-ai/dsh-session', bundles: ['base'] }],
     ['session-checkpoint-policy', { module: '@deepseek-ai/dsh-session-checkpoint-policy', bundles: ['base'] }],
+    ['session-controller', { module: '@deepseek-ai/dsh-api-session-controller', bundles: ['web-app'] }],
+    ['session-log-deepseek', { module: '@deepseek-ai/dsh-session-log-deepseek', bundles: ['base'] }],
     ['session-log-download', { module: '@deepseek-ai/dsh-session-log-export', bundles: ['web-app'] }],
     ['session-persistence-jsonl', { module: '@deepseek-ai/dsh-session-persistence-jsonl', bundles: ['base'] }],
     ['session-projection', { module: '@deepseek-ai/dsh-session-projection', bundles: ['base'] }],
-    ['session-projection-cache', { module: '@deepseek-ai/dsh-session-projection-cache', bundles: ['web-app'] }],
+    ['session-projection-cache', { module: '@deepseek-ai/dsh-session-projection-cache', bundles: ['base'] }],
     ['session-query-sqlite', { module: '@deepseek-ai/dsh-session-query-sqlite', bundles: ['base'] }],
+    ['session-reference', { module: '@deepseek-ai/dsh-session-reference', bundles: ['web-app'] }],
     ['session-stats', { module: '@deepseek-ai/dsh-session-stats', bundles: ['web-app'] }],
     ['session-telemetry-otel', { module: '@deepseek-ai/dsh-session-telemetry-otel', bundles: ['base'] }],
     ['session-title', { module: '@deepseek-ai/dsh-session-title', bundles: ['base'] }],
     ['session-title-llm', { module: '@deepseek-ai/dsh-session-title-first-prompt-llm', bundles: ['base'] }],
+    ['session-turn-outline', { module: '@deepseek-ai/dsh-session-turn-outline', bundles: ['web-app'] }],
     ['settings', { module: '@deepseek-ai/dsh-settings-file', bundles: ['base'] }],
+    ['settings-controller', { module: '@deepseek-ai/dsh-api-settings-controller', bundles: ['web-app'] }],
     ['shell-env', { module: '@deepseek-ai/dsh-shell-env', bundles: ['base'] }],
     ['skill', { module: '@deepseek-ai/dsh-skill', bundles: ['base'] }],
     ['skill-badge', { module: '@deepseek-ai/dsh-skill-badge', bundles: ['base'] }],
     ['skill-filesystem', { module: '@deepseek-ai/dsh-skill-filesystem', bundles: ['base'] }],
     ['spill-local', { module: '@deepseek-ai/dsh-spill-local', bundles: ['base'] }],
     ['spill-policy', { module: '@deepseek-ai/dsh-spill-policy', bundles: ['base'] }],
-    ['storage', { module: '@deepseek-ai/dsh-storage', bundles: ['web-app'] }],
-    ['storage-domain', { module: '@deepseek-ai/dsh-storage-domain', bundles: ['web-app'] }],
-    ['storage-json', { module: '@deepseek-ai/dsh-storage-json', bundles: ['web-app'] }],
+    ['storage', { module: '@deepseek-ai/dsh-storage', bundles: ['base'] }],
+    ['storage-domain', { module: '@deepseek-ai/dsh-storage-domain', bundles: ['base'] }],
+    ['storage-json', { module: '@deepseek-ai/dsh-storage-json', bundles: ['base'] }],
     ['subagent', { module: '@deepseek-ai/dsh-subagent', bundles: ['base'] }],
     ['subagent-fork-in-process', { module: '@deepseek-ai/dsh-subagent-fork-in-process', bundles: ['base'] }],
+    ['subagent-model-selection-settings', { module: '@deepseek-ai/dsh-tool-subagent/model-selection-settings', bundles: ['web-app'] }],
     ['subagent-spawn-in-process', { module: '@deepseek-ai/dsh-subagent-spawn-in-process', bundles: ['base'] }],
     ['subprocess', { module: '@deepseek-ai/dsh-subprocess-local', bundles: ['base'] }],
     ['system-prompt', { module: '@deepseek-ai/dsh-system-prompt', bundles: ['base'] }],
@@ -128,7 +143,6 @@ export const CORE_ROWS = new Map([
     ['tool-subagent-control', { module: '@deepseek-ai/dsh-tool-subagent-control', bundles: ['base'] }],
     ['tool-subagent-fork', { module: '@deepseek-ai/dsh-tool-subagent', bundles: ['base'] }],
     ['tool-subagent-list-agents', { module: '@deepseek-ai/dsh-tool-subagent-control/list-agents', bundles: ['base'] }],
-    ['tool-subagent-report', { module: '@deepseek-ai/dsh-tool-subagent-report', bundles: ['base'] }],
     ['tool-todo', { module: '@deepseek-ai/dsh-tool-todo', bundles: ['base'] }],
     ['tool-web', { module: '@deepseek-ai/dsh-tool-web', bundles: ['base'] }],
     ['tool-workflow', { module: '@deepseek-ai/dsh-tool-workflow', bundles: ['base'] }],
@@ -137,6 +151,10 @@ export const CORE_ROWS = new Map([
     ['typert-gateway', { module: '@deepseek-ai/dsh-api-gateway', bundles: ['base'] }],
     ['typert-loader', { module: '@deepseek-ai/dsh-typert-loader', bundles: ['base'] }],
     ['ui-agent-preset', { module: '@deepseek-ai/dsh-client-ui-agent-preset', bundles: ['web-app'] }],
+    ['ui-approval', { module: '@deepseek-ai/dsh-client-ui-approval', bundles: ['web-app'] }],
+    ['ui-attachment', { module: '@deepseek-ai/dsh-client-ui-attachment', bundles: ['web-app'] }],
+    ['ui-brand-official', { module: '@deepseek-ai/dsh-client-ui-brand-official', bundles: ['web-app'] }],
+    ['ui-chat', { module: '@deepseek-ai/dsh-client-ui-chat', bundles: ['web-app'] }],
     ['ui-commands', { module: '@deepseek-ai/dsh-client-ui-commands', bundles: ['web-app'] }],
     ['ui-conversation', { module: '@deepseek-ai/dsh-client-ui-conversation', bundles: ['web-app'] }],
     ['ui-cordis', { module: '@deepseek-ai/dsh-client-ui-cordis', bundles: ['web-app'] }],
@@ -149,6 +167,10 @@ export const CORE_ROWS = new Map([
     ['ui-model-selection', { module: '@deepseek-ai/dsh-client-ui-model-selection', bundles: ['web-app'] }],
     ['ui-permission', { module: '@deepseek-ai/dsh-client-ui-permission-presets', bundles: ['web-app'] }],
     ['ui-plan', { module: '@deepseek-ai/dsh-client-ui-plan', bundles: ['web-app'] }],
+    ['ui-reference', { module: '@deepseek-ai/dsh-client-ui-reference', bundles: ['web-app'] }],
+    ['ui-renderer', { module: '@deepseek-ai/dsh-client-ui-renderer', bundles: ['web-app'] }],
+    ['ui-schedule', { module: '@deepseek-ai/dsh-client-ui-schedule', bundles: ['web-app'] }],
+    ['ui-session', { module: '@deepseek-ai/dsh-client-ui-session', bundles: ['web-app'] }],
     ['ui-settings', { module: '@deepseek-ai/dsh-client-ui-settings', bundles: ['web-app'] }],
     ['ui-settings-general', { module: '@deepseek-ai/dsh-client-ui-settings-general', bundles: ['web-app'] }],
     ['ui-settings-models', { module: '@deepseek-ai/dsh-client-ui-settings-models', bundles: ['web-app'] }],
@@ -165,12 +187,14 @@ export const CORE_ROWS = new Map([
     ['ui-workspace', { module: '@deepseek-ai/dsh-client-ui-workspace', bundles: ['web-app'] }],
     ['user-questions', { module: '@deepseek-ai/dsh-user-questions', bundles: ['base'] }],
     ['web', { module: '@deepseek-ai/dsh-web', bundles: ['base'] }],
+    ['web-fetch-http', { module: '@deepseek-ai/dsh-web-fetch-http', bundles: ['base'] }],
     ['web-runtime', { module: '@deepseek-ai/dsh-web-app', bundles: ['web-app'] }],
     ['web-search-deepseek', { module: '@deepseek-ai/dsh-web-search-deepseek', bundles: ['base'] }],
     ['web-startup', { module: '@deepseek-ai/dsh-web-app/startup', bundles: ['web-app'] }],
     ['webserver', { module: '@deepseek-ai/dsh-host-webserver', bundles: ['web-app'] }],
     ['workflow-worker-thread', { module: '@deepseek-ai/dsh-workflow-worker-thread', bundles: ['base'] }],
     ['workspace', { module: '@deepseek-ai/dsh-workspace', bundles: ['web-app'] }],
+    ['workspace-controller', { module: '@deepseek-ai/dsh-api-workspace-controller', bundles: ['web-app'] }],
 ]);
 /** Row ids the shipped bundles define. */
 export const CORE_ROW_IDS = new Set(CORE_ROWS.keys());
@@ -207,21 +231,116 @@ export const SECURITY_ROW_IDS = new Map([
  * replaces a core service for every consumer in its scope.
  */
 export const SEAM_KEYS = new Set([
-    'agentDefaultModel', 'agentLoop', 'agentPresets', 'agents', 'apiProxy', 'approval',
-    'attachments', 'clientModules', 'codeRuntime', 'commands', 'compaction', 'credentials',
-    'directoryPicker', 'e2b', 'fs', 'goals', 'invariants', 'jobs', 'llm', 'lsp',
-    'messageFeedback', 'permissionPresets', 'planMode', 'sandbox', 'sandboxPolicy',
-    'sessionPersistence', 'sessionProjectionCache', 'sessionProjections', 'sessionQuery',
-    'sessionReferenceResolver', 'sessions', 'sessionTelemetry', 'sessionTitle', 'settings',
-    'shell', 'shellEnv', 'skills', 'spillStore', 'storage', 'storageDomain', 'subagents',
-    'subprocess', 'systemPrompt', 'terminals', 'timer', 'tokenMeter', 'toolResultPruner',
-    'tools', 'typert', 'typertGateway', 'userQuestions', 'web', 'webServer', 'workflowEngine',
-    'workspaceRegistry',
+    'agentDefaultModel', 'agentLoop', 'agentPresets', 'agents', 'agentTeams', 'approval', 'attachments',
+    'authorization', 'clientModules', 'codeRuntime', 'commands', 'compaction', 'credentials',
+    'credentialsController', 'deepseekLlmApiExtensions', 'directoryPicker', 'directoryPickerController',
+    'e2b', 'fileReferences', 'fs', 'goals', 'inspector', 'invariants', 'jobs', 'llm', 'lsp',
+    'messageFeedback', 'permissionPresets', 'planMode', 'sandbox', 'sandboxPolicy', 'sessionController',
+    'sessionFileReferences', 'sessionPersistence', 'sessionProjectionCache', 'sessionProjections',
+    'sessionQuery', 'sessionReferenceResolver', 'sessions', 'sessionSkillCatalog', 'sessionTelemetry',
+    'sessionTitle', 'settings', 'settingsController', 'shell', 'shellEnv', 'skills', 'spillStore', 'storage',
+    'storageDomain', 'subagentModelSelection', 'subagents', 'subprocess', 'systemPrompt', 'terminals',
+    'timer', 'tokenMeter', 'toolResultPruner', 'tools', 'typert', 'typertGateway', 'userQuestions', 'web',
+    'webhookRuntime', 'webServer', 'workflowEngine', 'workspaceController', 'workspaceRegistry',
 ]);
-/** The subset of {@link SEAM_KEYS} whose replacement removes a constraint. */
+/**
+ * The subset of {@link SEAM_KEYS} whose replacement removes a constraint.
+ *
+ * `authorization` is the registry of flows that obtain a credential through a
+ * conversation with the user, so providing it means owning that conversation.
+ * That is the same class of substitution as `credentials`, which this set
+ * already holds. `fileReferences` decides which paths are offered for
+ * completion and `agentTeams` is the team form of `subagents`, which is
+ * deliberately not here either, so neither of those is in this set.
+ *
+ * Seven of the eleven keys `0.1.2-rc.1` adds are Remote controllers: host
+ * services that own one `ctx.remote.*` namespace the browser client calls
+ * across the wire. A controller belongs here only when the traffic a
+ * substitution redirects to it carries a secret, an execution boundary, or a
+ * decision. A controller that forwards its seam's own verbs and adds a wire
+ * failure vocabulary does not, because the seam it fronts is reachable from
+ * `ctx` without substituting anything.
+ *
+ * Included:
+ * - `credentialsController` is what a browser configuration page calls to store
+ *   a credential. `set(ref, value)` receives the plaintext secret and hands it
+ *   to `ctx.credentials`
+ *   (`@deepseek-ai/dsh-api-settings-controller/lib/index.js:171`), and
+ *   `projectCredentialInfo` at `lib/index.js:78` is what holds a `describe`
+ *   answer to the three fields `CredentialInfo` declares. A layer that provides
+ *   it takes both halves: every secret typed into the settings page, and the
+ *   freedom to answer a read with the stored value.
+ * - `settingsController` passes `redactSecrets: true` on every remote read
+ *   (`@deepseek-ai/dsh-api-settings-controller/lib/index.js:429` and `:544`),
+ *   which is what keeps a `role('secret')` field out of a settings response;
+ *   `@deepseek-ai/dsh-web-search-deepseek/lib/index.js:245` declares one, an
+ *   `apiKey`. Its `update`, `replace` and `mutate` verbs carry that same field's
+ *   value in plaintext from the configuration page. Providing it puts the layer
+ *   on both directions of a secret's path.
+ * - `sessionController` resolves each new Session's cwd from the wire request
+ *   and hands it to `ensureSession`
+ *   (`@deepseek-ai/dsh-api-session-controller/lib/index.js:574`), and
+ *   `@deepseek-ai/dsh-sandbox-policy` resolves that immutable cwd as the
+ *   `workspace-write` root the enforcing filesystem, bash and terminal backends
+ *   fence against. Its `prompt` verb builds the message admitted to the agent
+ *   under `source.kind: 'user'` (`lib/index.js:731`). Providing it chooses the
+ *   sandbox root for every session created from the client, and the text that
+ *   reaches the model under the user's own source label.
+ * - `webhookRuntime` is what a provider adapter such as
+ *   `@deepseek-ai/dsh-webhook-github` dispatches verified deliveries into. Its
+ *   one built-in action creates a Session from a rule result whose fields
+ *   include `workspacePath`, `permissionPreset` and `prompt`
+ *   (`@deepseek-ai/dsh-webhook/lib/types/types.d.ts`), and
+ *   `createWebhookSession` applies that preset through
+ *   `ctx.permissionPresets.set` before admitting the prompt
+ *   (`@deepseek-ai/dsh-webhook/lib/types/session.js:94`, `:117`, `:120`).
+ *   Providing it picks the approval and sandbox preset for an agent started by
+ *   a remote delivery with no user present.
+ *
+ * Excluded:
+ * - `workspaceController` forwards `request.path` to
+ *   `ctx.workspaceRegistry.create` unchanged and adds an ordering queue and
+ *   error mapping (`@deepseek-ai/dsh-api-workspace-controller/lib/index.js:196`
+ *   to `:212`). The registry it fronts is `workspaceRegistry`, which is not
+ *   here, so the substitution reaches nothing the seam does not already offer.
+ * - `directoryPickerController` is three delegations to
+ *   `ctx.directoryPicker.capability()` behind a check that refuses a verb the
+ *   composed backend does not serve
+ *   (`@deepseek-ai/dsh-api-workspace-controller/lib/index.js:423` to `:470`).
+ *   Path fencing lives in the backend, and `directoryPicker` is not here.
+ * - `sessionFileReferences` is the Remote adapter over `fileReferences`, which
+ *   is excluded above for the same reason: the traffic is path candidates
+ *   offered for completion.
+ * - `sessionSkillCatalog` answers with `SkillListValue`, declared as the list
+ *   for one Session's human-facing composer
+ *   (`@deepseek-ai/dsh-api-session-controller/lib/types/types.d.ts:213` to
+ *   `:227`), and its only consumer in this release is the client skill picker
+ *   (`@deepseek-ai/dsh-client-ui-skill/lib/client.js:236`). Skill text reaches a
+ *   model through `ctx.skills.list()` in
+ *   `@deepseek-ai/dsh-tool-skill/lib/index.js:145`, which is the `skills` seam.
+ * - `subagentModelSelection` is a settings owner answering `{ enabled,
+ *   allowedModels }`, sampled when an Agent receives its delegation tools. Model
+ *   routing is `llm` and delegation is `subagents`; neither is here.
+ * - `deepseekLlmApiExtensions` hands a substitute the serialized request body
+ *   and merges the fields it returns, but
+ *   `@deepseek-ai/dsh-llm-deepseek/lib/index.js:1748` rejects any extension
+ *   field colliding with the base request, so `messages`, `tools` and `model`
+ *   are not writable through it. The constraint is in the adapter, not the
+ *   registry the substitution replaces.
+ * - `inspector` is declared by the catalogue and implemented by no shipped
+ *   package: in `0.1.2-rc.1` the key, `InspectorJsonValue` and
+ *   `CordisRuntimeTreeReader` occur only in
+ *   `@deepseek-ai/dsh-tool-cordis/lib/index.js`, and nothing provides or reads
+ *   `ctx.inspector`. No composed row enforces anything through it, so a
+ *   substitution displaces nothing. This is the one entry decided from the
+ *   catalogue rather than from an implementation; a release that ships one is a
+ *   reason to decide it again.
+ */
 export const SECURITY_SEAM_KEYS = new Set([
-    'approval', 'sandbox', 'sandboxPolicy', 'permissionPresets', 'credentials', 'subprocess',
-    'shell', 'fs', 'tools', 'agentLoop', 'sessionPersistence', 'sessionTelemetry', 'invariants',
+    'approval', 'authorization', 'sandbox', 'sandboxPolicy', 'permissionPresets', 'credentials',
+    'credentialsController', 'settingsController', 'sessionController', 'webhookRuntime',
+    'subprocess', 'shell', 'fs', 'tools', 'agentLoop', 'sessionPersistence', 'sessionTelemetry',
+    'invariants',
 ]);
 /**
  * Waterfall events, from `EVENT_API` in the api-catalog. A listener on one of
@@ -229,16 +348,32 @@ export const SECURITY_SEAM_KEYS = new Set([
  * without calling it short-circuits the chain including the built-in behavior.
  *
  * Note there is no `fs/read-intent` — the intent family is write and edit only.
+ *
+ * `0.1.2-rc.1` renames `tools/code-dispatch-log` to `tools/ptc-dispatch-log`
+ * and adds `user-questions/request`. Both replace content in a durable log copy
+ * or answer a pending request; neither is an `emit` event, so both hand a
+ * listener the trailing `next`.
  */
 export const WATERFALL_EVENTS = new Set([
     'agent/pre-step', 'agent/request', 'agent/request-error', 'approval/request',
     'fs/edit-intent', 'fs/write-intent', 'llm/stream', 'session-telemetry/record',
-    'system-prompt/assemble', 'tools/code-dispatch-log', 'tools/execute',
-    'tools/post-execute', 'tools/pre-execute',
+    'system-prompt/assemble', 'tools/execute', 'tools/post-execute',
+    'tools/pre-execute', 'tools/ptc-dispatch-log', 'user-questions/request',
 ]);
-/** Waterfall events whose short-circuit removes a decision the user would otherwise make. */
+/**
+ * Waterfall events whose short-circuit removes a decision the user would
+ * otherwise make.
+ *
+ * `user-questions/request` is here for the same reason `approval/request` is:
+ * `ctx.userQuestions` pauses a tool call until a human answers, and the
+ * answerers that put the question on a screen are listeners in the chain rather
+ * than the inner callback (`@deepseek-ai/dsh-user-questions/lib/index.js:69`).
+ * A listener that returns an answer without calling `next()` answers on the
+ * user's behalf and the question is never shown.
+ */
 export const DECISION_EVENTS = new Set([
     'approval/request', 'tools/pre-execute', 'tools/execute', 'fs/write-intent', 'fs/edit-intent',
+    'user-questions/request',
 ]);
 /**
  * Globals the dynamic-package sandbox (`cordis-host-runner/src/sandbox.ts`)
@@ -252,6 +387,8 @@ export const SANDBOX_DENIED_GLOBALS = new Map([
     ['setTimeout', "redirected to the cordis timer service (inject: ['timer'])"],
     ['setInterval', "redirected to the cordis timer service (inject: ['timer'])"],
     ['setImmediate', "redirected to the cordis timer service (inject: ['timer'])"],
+    ['clearTimeout', "redirected to the cordis timer service (inject: ['timer'])"],
+    ['clearInterval', "redirected to the cordis timer service (inject: ['timer'])"],
 ]);
 /**
  * Node builtins that start or evaluate code off the mediated path. A mounted
@@ -389,3 +526,130 @@ export const HARNESS_INERT_CALLS = new Set([
  * in code, and it is plain YAML.
  */
 export const SERVICE_REMAPPING_FIELDS = ['isolate', 'intercept'];
+/**
+ * How a Cordis waterfall listener delegates, and what happens when it does not.
+ *
+ * Read out of the installed `@deepseek-ai/cordis@4.0.2` build,
+ * `lib/index.js:317-327`:
+ *
+ * ```js
+ * waterfall(...args) {
+ *   const cbs = this.dispatch("waterfall", args);
+ *   const inner = args.pop();
+ *   const next = () => { return (cbs.shift() ?? inner)(...args); };
+ *   args.push(next);
+ *   return next();
+ * }
+ * ```
+ *
+ * `next` is the trailing argument every listener receives, and `inner` is the
+ * harness's own built-in behavior. A listener that returns without calling
+ * `next()` therefore ends the chain: neither the listeners still in `cbs` nor
+ * `inner` run.
+ *
+ * The scope of that is one dispatch, not the registry. `dispatch()` builds
+ * `cbs` with `.filter(…).map(…)`, which allocates, so `this._hooks[name]` is
+ * never touched and every skipped listener is registered and runs normally on
+ * the next dispatch. The precise word is veto, not removal — Cordis's own
+ * JSDoc at `lib/index.js:311-313` says "vetoes the rest of the chain, including
+ * the built-in behavior". Removal is a different capability with a different
+ * reach, and it has its own table below.
+ */
+export const WATERFALL_NEXT_PARAMETER = 'next';
+/**
+ * What each decision waterfall's built-in `next` settles on when no listener
+ * claims the dispatch, transcribed from the installed harness `0.1.2-rc.1`.
+ *
+ * This is what a listener that never calls `next()` replaces. The inner
+ * callback is the last argument at each site:
+ * - `tools/pre-execute` — `@deepseek-ai/dsh-tools/lib/index.js:3117`,
+ *   `() => Promise.resolve({ kind: "allow" })`
+ * - `tools/execute` — `dsh-tools/lib/index.js:3214`,
+ *   `() => this.dispatchToolBody(mutableExec)`, so vetoing it substitutes the
+ *   body of the tool call itself
+ * - `approval/request` — `@deepseek-ai/dsh-user-approval/lib/index.js:179`,
+ *   `() => Promise.resolve("unavailable")`, and the surface that would ask the
+ *   user is one of the listeners in the chain rather than the inner callback
+ * - `user-questions/request` —
+ *   `@deepseek-ai/dsh-user-questions/lib/index.js:67`, the `noAnswerer`
+ *   callback passed at `:69`, which rejects with a `UserQuestionError` carrying
+ *   code `NO_PROVIDER`
+ *
+ * The three tables in this module that name events (`WATERFALL_EVENTS`,
+ * `DECISION_EVENTS`, and this one) are keyed to {@link HARNESS_REFERENCE}.
+ */
+export const DECISION_EVENT_DEFAULTS = new Map([
+    ['approval/request', 'the request falls through to `"unavailable"` only after every composed answerer — '
+            + 'including the surface that would ask the user — has had the dispatch'],
+    ['tools/pre-execute', 'the gate settles on `{ kind: "allow" }` after every other listener, and only then are '
+            + '`ctx.tools.guard()` denials consulted'],
+    ['tools/execute', 'the tool body itself runs'],
+    ['fs/write-intent', 'the write intent reaches the policy rows that decide it'],
+    ['fs/edit-intent', 'the edit intent reaches the policy rows that decide it'],
+    ['user-questions/request', 'the request rejects with `NO_PROVIDER` only after every composed answerer — '
+            + 'including the one that puts the question on the user\'s screen — has had the dispatch'],
+]);
+/**
+ * Receivers whose members name a plugin context.
+ *
+ * The same set the Tier C detached-member check guards on, minus `process`:
+ * a seam is read off the context, never off `process`.
+ */
+export const CONTEXT_RECEIVERS = new Set([
+    'ctx', 'context', 'globalThis', 'global',
+]);
+/**
+ * Array and collection methods that change the receiver rather than reading it.
+ *
+ * Used to tell a write into a service's internals from a read of them. The
+ * distinction is not academic: `dsh-dlp` reads
+ * `ctx.events._hooks['approval/request']?.length` to decide whether an ask
+ * would reach a human, which is an honest use of the same property a hostile
+ * layer splices.
+ */
+export const MUTATING_METHODS = new Set([
+    'splice', 'push', 'pop', 'shift', 'unshift', 'fill', 'sort', 'reverse', 'copyWithin',
+    'clear', 'delete', 'set', 'add',
+]);
+/**
+ * Cordis internals through which one plugin removes another plugin's
+ * registrations. Read from the installed `@deepseek-ai/cordis@4.0.2` build.
+ *
+ * None of these is guarded by ownership. `ctx.events`, `ctx.registry` and
+ * `ctx.reflect` are own properties of the root context inherited by every
+ * child, so no `inject` declaration is needed to reach any of them.
+ */
+export const TEARDOWN_SURFACES = [
+    {
+        service: 'events',
+        member: '_hooks',
+        readIsEnough: false,
+        effect: 'the listener table every layer\'s `ctx.on()` registration is stored in (`lib/index.js:230`, '
+            + '`_hooks = {}`, appended to by `register` at `lib/index.js:336-345`). Splicing an entry out removes that '
+            + 'listener permanently, and the owning layer\'s own disposer then silently does nothing. This is a stronger '
+            + 'reach than a waterfall veto, which only skips listeners for one dispatch',
+    },
+    {
+        service: 'events',
+        member: 'unregister',
+        readIsEnough: true,
+        effect: 'the public removal path for one listener, by callback identity (`lib/index.js:353-359`). It takes the '
+            + 'listener list and a callback and splices, with no check that the caller owns either',
+    },
+    {
+        service: 'registry',
+        member: 'delete',
+        readIsEnough: true,
+        effect: 'disposal of every fiber a plugin owns (`lib/index.js:1564-1571`: `for (const fiber of runtime.fibers) '
+            + 'fiber.dispose();`). It takes no ownership check, so one layer can unload another layer outright — '
+            + 'including a security layer whose guards and listeners then stop existing',
+    },
+    {
+        service: 'reflect',
+        member: 'store',
+        readIsEnough: false,
+        effect: 'the service implementation table keyed by isolate symbol (`lib/index.js:726`, written by `provide` at '
+            + '`lib/index.js:813`). `provide` throws when a key is already taken and `set` throws across fibers; writing '
+            + 'this object directly is the path around both throws',
+    },
+];

package/lib/npm.js

@@ -7,16 +7,27 @@
  * fixed and their order is the guarantee:
  *
  * 1. read the version document (~3 KB) — which already answers
- *    `hasInstallScript`, the install lifecycle scripts, and `dsh.bundle`;
+ *    `hasInstallScript`, the install lifecycle scripts, `dsh.bundle`, and
+ *    whether the registry holds a provenance attestation at all;
  * 2. download the tarball into memory;
  * 3. verify `dist.integrity` **before** anything parses a byte of it;
- * 4. decode in memory and analyse, exactly as the tarball path does.
+ * 4. read the provenance attestation, when step 1 said there is one, and check
+ *    it against the bytes step 3 vouched for;
+ * 5. decode in memory and analyse, exactly as the tarball path does.
+ *
+ * Step 4 is the only request this module makes that is not unconditional, and
+ * it is skipped for every package the version document says has no attestation
+ * — which on the measured corpus is 28 packages in 40. It never fails an
+ * analysis: an endpoint that is down or a bundle that does not decode leaves
+ * the provenance fact in state `unreadable`, which is a different answer from
+ * `absent` and is printed as one.
  *
  * No subprocess, no disk write, no lifecycle script, and no `npm pack`.
  * @module dsh-plugin-inspector/npm
  */
+import { provenanceAbsent, provenanceUnreadable, readProvenance, } from "./attestation.js";
 import { analyze } from "./inspect.js";
-import { DEFAULT_REGISTRY, fetchVerifiedTarball, parseSpec, resolvePackage, } from "./registry.js";
+import { attestationUrl, DEFAULT_REGISTRY, fetchAttestation, fetchVerifiedTarball, parseSpec, RegistryError, resolvePackage, } from "./registry.js";
 import { loadTarballBuffer } from "./source.js";
 /**
  * The metadata pre-check, which needs no tarball.
@@ -31,6 +42,46 @@ import { loadTarballBuffer } from "./source.js";
 export async function precheck(spec, options = {}) {
     return resolvePackage(parseSpec(spec), options);
 }
+/**
+ * Read the registry's provenance attestation for a resolved package, when it
+ * has one, and check it against the bytes that were downloaded.
+ *
+ * Every failure on this path becomes a fact rather than a refusal. The tarball
+ * has already been checked against `dist.integrity`, so the analysis is sound
+ * whatever the attestation endpoint does, and turning a registry outage into
+ * exit code 2 would make provenance a precondition for reading a package
+ * instead of something reported about it.
+ * @param resolved - the packument reading for the version.
+ * @param registry - the registry base URL, without a trailing slash.
+ * @param tarball - the verified tarball bytes.
+ * @param options - where to fetch from.
+ * @returns what the registry says about the build origin, and what was checked.
+ */
+async function readRegistryProvenance(resolved, registry, tarball, options) {
+    if (resolved.provenancePredicateType === null)
+        return provenanceAbsent();
+    let url;
+    try {
+        url = attestationUrl(registry, resolved.name, resolved.version);
+    }
+    catch (error) {
+        /* v8 ignore next -- `attestationUrl` refuses a name or version only with a RegistryError. */
+        if (!(error instanceof RegistryError))
+            throw error;
+        return provenanceUnreadable(null, error.message);
+    }
+    let body;
+    try {
+        body = await fetchAttestation(url, options);
+    }
+    catch (error) {
+        /* v8 ignore next -- `fetchAttestation` reports every refusal as a RegistryError. */
+        if (!(error instanceof RegistryError))
+            throw error;
+        return provenanceUnreadable(url, error.message);
+    }
+    return readProvenance(body, { name: resolved.name, version: resolved.version, tarball, url });
+}
 /**
  * Fetch a published package and inspect it in memory.
  * @param spec - `<name>` or `<name>@<version>`; no version means the `latest` tag.
@@ -42,9 +93,11 @@ export async function precheck(spec, options = {}) {
 export async function inspectFromNpm(spec, options = {}) {
     const resolved = await precheck(spec, options);
     const verified = await fetchVerifiedTarball(resolved, options);
+    const registry = (options.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, '');
+    const attestation = await readRegistryProvenance(resolved, registry, verified.bytes, options);
     const provenance = {
         spec,
-        registry: (options.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, ''),
+        registry,
         resolvedVersion: resolved.version,
         tarball: resolved.tarball,
         digest: verified.digest,
@@ -54,5 +107,5 @@ export async function inspectFromNpm(spec, options = {}) {
         tarballBytes: verified.bytes.byteLength,
     };
     const source = await loadTarballBuffer(verified.bytes, `npm:${resolved.name}@${resolved.version}`);
-    return analyze(source, provenance);
+    return analyze(source, provenance, attestation);
 }

package/lib/registry.js

@@ -19,6 +19,7 @@
  * @module dsh-plugin-inspector/registry
  */
 import { createHash } from 'node:crypto';
+import { MAX_ATTESTATION_BYTES } from "./attestation.js";
 import { INSTALL_LIFECYCLE_SCRIPTS } from "./knowledge.js";
 import { MAX_TOTAL_BYTES } from "./source.js";
 /** The public npm registry, used when no other is named. */
@@ -146,6 +147,7 @@ export async function resolvePackage(spec, options = {}) {
         integrity: typeof dist.integrity === 'string' ? dist.integrity : null,
         shasum: typeof dist.shasum === 'string' ? dist.shasum : null,
         hasInstallScript: record.hasInstallScript === true,
+        provenancePredicateType: asString(asRecord(asRecord(dist.attestations).provenance), 'predicateType'),
         lifecycleScripts: INSTALL_LIFECYCLE_SCRIPTS.filter(name => typeof scripts[name] === 'string'),
         bundlePatch: typeof bundle.patch === 'string' ? bundle.patch : null,
         metadataBytes: body.byteLength,
@@ -162,6 +164,16 @@ function asRecord(value) {
         ? value
         : {};
 }
+/**
+ * Read a string field, or `null` when it is absent or of another type.
+ * @param record - the containing record.
+ * @param key - the field name.
+ * @returns the string, or `null`.
+ */
+function asString(record, key) {
+    const value = record[key];
+    return typeof value === 'string' ? value : null;
+}
 /**
  * Refuse a tarball URL that points somewhere other than the registry that
  * described it.
@@ -260,3 +272,45 @@ export async function fetchVerifiedTarball(resolved, options = {}) {
     const bytes = await readCapped(response, MAX_TARBALL_BYTES, `tarball ${resolved.tarball}`);
     return verifyIntegrity(bytes, resolved);
 }
+/**
+ * The endpoint an npm-compatible registry serves a version's attestation
+ * bundle from.
+ *
+ * Built from the registry base URL rather than read out of
+ * `dist.attestations.url`, which is the opposite of how the tarball URL is
+ * handled and is deliberate: the tarball has to come from wherever the registry
+ * says because there is no other way to name it, so that URL is taken from the
+ * document and then refused unless it is same-origin. An attestation needs no
+ * such freedom. Constructing the path here means a doctored packument cannot
+ * redirect the request at all, not even to another path on the same host.
+ *
+ * The name and version are re-validated because both come out of the version
+ * document, which is registry-controlled: `name` is not necessarily the name
+ * that was asked for, and it is interpolated into a URL.
+ * @param registry - the registry base URL, without a trailing slash.
+ * @param name - the resolved package name.
+ * @param version - the resolved version.
+ * @returns the absolute URL.
+ * @throws RegistryError when the document's name or version would not address this endpoint.
+ */
+export function attestationUrl(registry, name, version) {
+    if (!PACKAGE_NAME.test(name))
+        throw new RegistryError(`the version document names no npm package: ${name}`);
+    if (!VERSION_OR_TAG.test(version))
+        throw new RegistryError(`the version document names no version: ${version}`);
+    return `${registry}/-/npm/v1/attestations/${name}@${version}`;
+}
+/**
+ * Download an attestation document.
+ *
+ * Only ever called when the version document said there is one, so a package
+ * without provenance costs no request at all.
+ * @param url - the endpoint, from {@link attestationUrl}.
+ * @param options - where to fetch from.
+ * @returns the document as served.
+ * @throws RegistryError on a transport failure, a non-2xx status, or an oversized body.
+ */
+export async function fetchAttestation(url, options = {}) {
+    const response = await get(url, 'application/json', options);
+    return readCapped(response, MAX_ATTESTATION_BYTES, 'attestation document');
+}