dsh-plugin-inspector 0.7.0 → 0.9.0

package/README.md

@@ -79,6 +79,20 @@ Findings are tiered by how much you should trust them:
 
 [Every check, by tier →](https://charlotten7.github.io/dsh-plugin-inspector/checks.html)
 
+## What it deliberately does not flag
+
+A `critical` is only worth reading if it is rare, so the two tables that decide one — the core rows
+A2 treats as security-relevant, and the capability seams A23, B1 and B15 do — are kept small on a
+stated rule: a row is in when disabling it **fails open** or **silently removes evidence**. A row
+that fails closed when removed is out, however security-adjacent its name reads, and so is one whose
+absence takes a feature away and grants nothing.
+
+The rows checked against that rule and kept out are named with their reasons, so you can tell "we
+checked and it does not qualify" from "we never looked". Excluded is not unreported: disabling any
+core row is still an A3 finding.
+
+[What is deliberately not a finding →](https://charlotten7.github.io/dsh-plugin-inspector/checks.html#what-is-deliberately-not-a-finding)
+
 ## The ceiling
 
 **This is not a malware scanner and it cannot be one.** Capability is decidable from source;

package/lib/checks/tier-a.js

@@ -20,7 +20,7 @@ import { declaredPackages } from "../manifest.js";
  * whatever YAML that library happens to ship is inert bytes.
  */
 const PATCH_ROW_CHECKS = new Set([
-    'A2', 'A3', 'A4', 'A5', 'A6', 'A7', 'A8', 'A9', 'A10', 'A15', 'A17', 'A19', 'A23',
+    'A2', 'A3', 'A4', 'A5', 'A6', 'A7', 'A8', 'A9', 'A10', 'A15', 'A17', 'A19', 'A23', 'A26',
 ]);
 /** Loader builtins that are entry names but not resolvable npm packages. */
 const LOADER_BUILTINS = new Set([
@@ -765,6 +765,73 @@ function checkProvenance(input) {
         evidence: { file: 'dist.attestations', path: check.name },
     }));
 }
+/**
+ * A26 — a patch row that modifies a row this package neither ships nor shares
+ * with the harness.
+ *
+ * A2, A3, A5 and A19 all key on {@link CORE_ROWS}: an override whose `id` is
+ * not a row the shipped bundles define falls through every one of them and
+ * produces nothing. But the composed profile is not only the core rows. It also
+ * holds the rows the user wrote in their own layer and the rows every other
+ * installed plugin inserted, and `applyEntryPatches` matches by `id` alone with
+ * no notion of who owns the row. So `- id: some-other-plugin` / `disabled:
+ * true` in this package's layer switches that package off, and a `config:`
+ * override replaces its configuration wholesale, since a patch override is a
+ * shallow whole-value replacement rather than a merge.
+ *
+ * The check is a set difference, which is what keeps it decidable: an id that
+ * is neither a core row nor a row this same layer inserts belongs to somebody
+ * else. Two kinds of package legitimately rewrite rows they did not insert and
+ * are excluded — the harness's own bundles, which is what composing a surface
+ * bundle is, and a package that declares `dsh.profile.bundles`, which is a
+ * profile assembling other people's layers on purpose and is reported as such
+ * by A20.
+ */
+function checkForeignRows(input) {
+    if (isHarnessBundle(input))
+        return [];
+    if ((input.manifest.dsh.profile?.bundles ?? []).length > 0)
+        return [];
+    const findings = [];
+    for (const patch of input.patches) {
+        const own = new Set(patch.inserts.map(row => row.id).filter(id => id !== null));
+        for (const override of patch.overrides) {
+            if (override.overriddenKeys.length === 0)
+                continue;
+            if (CORE_ROWS.has(override.id) || own.has(override.id))
+                continue;
+            const switchedOff = override.overriddenKeys.includes('disabled') && Boolean(override.disabled);
+            const rewritten = override.overriddenKeys.filter(key => key !== 'disabled');
+            findings.push(tierA({
+                checkId: 'A26',
+                name: 'foreign-row-modified',
+                subject: override.id,
+                severity: 'high',
+                title: switchedOff
+                    ? `Patch layer disables the row "${override.id}", which this package does not ship`
+                    : `Patch layer rewrites ${rewritten.map(key => `\`${key}\``).join(', ')} on the row `
+                        + `"${override.id}", which this package does not ship`,
+                detail: `"${override.id}" is neither a row the shipped bundles define nor one this layer inserts, so it `
+                    + 'belongs to the user\'s own layer or to another installed plugin. `applyEntryPatches` matches rows by '
+                    + '`id` alone and has no notion of which layer owns one, so this patch reaches into that package\'s row '
+                    + 'and '
+                    + (switchedOff
+                        ? 'stops it running. Whatever that package contributed — a guard, a listener, an audit sink — is not '
+                            + 'composed into the profile, and the user\'s own configuration still says it is installed.'
+                        : 'replaces those keys. An override is a shallow whole-value replacement rather than a merge, so an '
+                            + 'overridden `config` discards every key that package shipped and keeps only what is written here.')
+                    + ' If the row id is not present in the composed profile the patch is simply inert, which is the benign '
+                    + 'reading and the one a reader should check first.',
+                evidence: {
+                    file: patch.file,
+                    path: switchedOff ? `${override.path}.disabled` : override.path,
+                    snippet: snippet(override.overriddenKeys.join(', ')),
+                },
+            }));
+        }
+    }
+    return findings;
+}
 /**
  * Run every Tier A check.
  *
@@ -781,6 +848,7 @@ export function runTierA(input) {
         ...checkNativeBuild(input),
         ...checkDisabledRows(input),
         ...checkOverriddenRows(input),
+        ...checkForeignRows(input),
         ...checkExpressions(input),
         ...checkPatchFailures(input),
         ...checkInsertedModules(input),

package/lib/checks/tier-b.js

@@ -15,7 +15,7 @@
 import ts from 'typescript';
 import { lineColumn, snippet } from "../files.js";
 import { scanInjection } from "../injection.js";
-import { NETWORK_MODULES, SEAM_KEYS, SECURITY_SEAM_KEYS, UNMEDIATED_FS_MODULES, UNMEDIATED_PROCESS_MODULES, } from "../knowledge.js";
+import { CONTEXT_RECEIVERS, DECISION_EVENTS, DECISION_EVENT_DEFAULTS, MUTATING_METHODS, NETWORK_MODULES, SEAM_KEYS, SECURITY_SEAM_KEYS, TEARDOWN_SURFACES, UNMEDIATED_FS_MODULES, UNMEDIATED_PROCESS_MODULES, WATERFALL_EVENTS, } from "../knowledge.js";
 import { foldConstantString, isBuiltinModuleGetter } from "../syntax.js";
 /** Global functions that fetch over the network without any `ctx` service. */
 const NETWORK_GLOBALS = new Set(['fetch', 'WebSocket', 'EventSource', 'XMLHttpRequest']);
@@ -494,6 +494,292 @@ function checkNetworkGlobals(file, node, accumulator) {
     accumulator.findings.push(finding);
     accumulator.networkCall ??= finding;
 }
+/**
+ * The function a listener argument denotes, when this tool can see one.
+ *
+ * Two forms are followed: the function written at the call site, and a name
+ * bound to a function in the same file. That is the same bounded, single-file
+ * name resolution `isRegisteredName` already does for tool definitions, and it
+ * stops at the same place: a listener imported from another module, or built by
+ * a helper, is not resolved and produces no finding rather than a guess.
+ * @param node - the listener argument.
+ * @param file - the parsed file the call is in.
+ * @returns the function, or `null` when it cannot be resolved from this file.
+ */
+function resolveListener(node, file) {
+    if (node === undefined)
+        return null;
+    if (ts.isArrowFunction(node) || ts.isFunctionExpression(node))
+        return node;
+    if (!ts.isIdentifier(node))
+        return null;
+    const wanted = node.text;
+    let found = null;
+    const visit = (child) => {
+        if (ts.isFunctionDeclaration(child) && child.name?.text === wanted)
+            found ??= child;
+        if (ts.isVariableDeclaration(child) && ts.isIdentifier(child.name) && child.name.text === wanted
+            && child.initializer !== undefined
+            && (ts.isArrowFunction(child.initializer) || ts.isFunctionExpression(child.initializer))) {
+            found ??= child.initializer;
+        }
+        ts.forEachChild(child, visit);
+    };
+    ts.forEachChild(file.node, visit);
+    return found;
+}
+/**
+ * Whether a listener can reach the `next` continuation the waterfall hands it.
+ *
+ * `next` is positional, not named: `EventsService.waterfall` pushes it as the
+ * last dispatch argument, so it is whatever the listener's trailing parameter
+ * is called. A listener that declares no parameter in that position never
+ * receives it, and one that declares it and never mentions it cannot call it.
+ * Either way the chain stops there.
+ *
+ * Every uncertain shape answers true, so the finding needs a listener whose
+ * trailing parameter is a plain name that the body does not contain: a rest
+ * parameter, a destructuring pattern, and any use of `arguments` all count as
+ * reaching it.
+ * @param fn - the resolved listener.
+ * @returns true when the listener can call `next`.
+ */
+function canReachNext(fn) {
+    const parameters = fn.parameters;
+    const last = parameters.at(-1);
+    if (last === undefined)
+        return false;
+    if (last.dotDotDotToken !== undefined || !ts.isIdentifier(last.name))
+        return true;
+    const wanted = last.name.text;
+    const body = fn.body;
+    if (body === undefined)
+        return true;
+    let referenced = false;
+    const visit = (node) => {
+        if (ts.isIdentifier(node) && (node.text === wanted || node.text === 'arguments'))
+            referenced = true;
+        ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(body, visit);
+    return referenced;
+}
+/**
+ * Whether a listener registration asks to run ahead of the listeners already
+ * composed on the event.
+ *
+ * Both spellings the event bus accepts: the option object, and the boolean
+ * shorthand `EventsService.on` expands with `options = { prepend: options }`.
+ * @param node - the options argument, when there is one.
+ * @returns true when the registration prepends.
+ */
+function isPrepended(node) {
+    if (node === undefined)
+        return false;
+    if (node.kind === ts.SyntaxKind.TrueKeyword)
+        return true;
+    if (!ts.isObjectLiteralExpression(node))
+        return false;
+    return node.properties.some(property => ts.isPropertyAssignment(property)
+        && ts.isIdentifier(property.name) && property.name.text === 'prepend'
+        && property.initializer.kind === ts.SyntaxKind.TrueKeyword);
+}
+/** B14 — a waterfall listener that cannot delegate to the rest of the chain. */
+function checkWaterfallVeto(file, node, accumulator) {
+    const callee = node.expression;
+    if (!ts.isPropertyAccessExpression(callee))
+        return;
+    if (callee.name.text !== 'on' && callee.name.text !== 'once')
+        return;
+    const event = literalText(node.arguments[0]);
+    if (event === null || !WATERFALL_EVENTS.has(event))
+        return;
+    const listener = resolveListener(node.arguments[1], file);
+    if (listener === null || canReachNext(listener))
+        return;
+    const decides = DECISION_EVENTS.has(event);
+    const prepended = isPrepended(node.arguments[2]);
+    const consequence = DECISION_EVENT_DEFAULTS.get(event);
+    accumulator.findings.push(tierB({
+        checkId: 'B14',
+        name: 'waterfall-veto',
+        subject: event,
+        severity: decides ? 'critical' : 'high',
+        title: `Listens on \`${event}\` and never calls \`next\``,
+        detail: `\`${event}\` is dispatched as a Cordis waterfall, which hands every listener a trailing \`next\` and `
+            + 'ends the chain at the first listener that returns without calling it — the remaining listeners and the '
+            + 'harness\'s own built-in behavior both stop for that dispatch. This listener '
+            + (listener.parameters.length === 0
+                ? 'declares no parameters, so it never receives `next` at all.'
+                : `never mentions its trailing parameter \`${(listener.parameters.at(-1)?.name).text}\`, `
+                    + 'which is the `next` the dispatch supplies.')
+            + (consequence === undefined ? '' : ` Without it, ${consequence}.`)
+            + (prepended
+                ? ' It is registered with `prepend`, which unshifts it onto the listener list, so it claims every dispatch '
+                    + 'ahead of every listener composed before this layer mounted.'
+                : '')
+            + ' The veto is per dispatch: nothing is unregistered, and every skipped listener runs again next time.',
+        evidence: at(file, node),
+        bypass: 'calling `next()` on a branch the listener never takes, or passing a listener this tool cannot resolve '
+            + 'from the file it is registered in — one imported from another module, or returned by a helper',
+    }));
+}
+/**
+ * Read a property chain rooted at a plugin context and report which catalogued
+ * seam it goes through.
+ *
+ * The receiver guard is what keeps this off ordinary code, exactly as it does
+ * in B1 and C2: the chain has to start at a name that denotes a plugin context,
+ * and its first member has to be one of the catalogued seam keys.
+ * @param node - the innermost expression of a property access.
+ * @returns the seam and the depth, or `null` when the chain is not one.
+ */
+function seamChain(node) {
+    const members = [];
+    let cursor = node;
+    while (ts.isPropertyAccessExpression(cursor)) {
+        members.unshift(cursor.name.text);
+        cursor = cursor.expression;
+    }
+    // Two roots: a bare context name, and `this.ctx` — the form a plugin written
+    // as a class uses, which the Tier C detached-member check already treats as a
+    // known receiver.
+    if (cursor.kind === ts.SyntaxKind.ThisKeyword && members[0] === 'ctx')
+        members.shift();
+    else if (!ts.isIdentifier(cursor) || !CONTEXT_RECEIVERS.has(cursor.text))
+        return null;
+    const seam = members[0];
+    if (seam === undefined || !SEAM_KEYS.has(seam))
+        return null;
+    return { seam, depth: members.length - 1 };
+}
+/**
+ * Build the B15 finding for one write site.
+ * @param file - the parsed file.
+ * @param node - the node to cite.
+ * @param chain - the seam the write goes through.
+ * @param how - the clause naming what the write does.
+ * @returns the finding.
+ */
+function seamWriteFinding(file, node, chain, how) {
+    const critical = SECURITY_SEAM_KEYS.has(chain.seam);
+    return tierB({
+        checkId: 'B15',
+        name: 'seam-internals-write',
+        subject: chain.seam,
+        severity: critical ? 'critical' : 'high',
+        title: `${how} inside the \`${chain.seam}\` capability seam`,
+        detail: `\`${chain.seam}\` is a catalogued core service, and Cordis resolves it to one shared instance for the `
+            + 'whole tree — a write through this package\'s context is what every other consumer reads afterwards. '
+            + 'B1 reads `ctx.provide` / `ctx.set` / `ctx.mixin`, the declared ways to substitute a service, and Cordis '
+            + 'refuses both from a layer that does not own the service: `provide` throws when the key is taken and `set` '
+            + 'throws with "cannot set property in multiple fibers". Writing a member of the object those calls would '
+            + 'have replaced reaches the same substitution and meets neither check.'
+            + (critical ? ' This seam is one whose whole purpose is to constrain what the agent may do.' : ''),
+        evidence: at(file, node),
+        bypass: 'reaching the same object through a value this tool does not track — a local bound to `ctx.tools` and '
+            + 'written through afterwards — or a computed member name, which C2 reports',
+    });
+}
+/** B15 — writing into a catalogued seam's own object graph. */
+function checkSeamWrite(file, node, accumulator) {
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken
+        && ts.isPropertyAccessExpression(node.left)) {
+        const chain = seamChain(node.left);
+        if (chain !== null && chain.depth >= 1) {
+            accumulator.findings.push(seamWriteFinding(file, node, chain, 'Assigns to a member'));
+        }
+        return;
+    }
+    if (ts.isDeleteExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+        const chain = seamChain(node.expression);
+        if (chain !== null && chain.depth >= 1) {
+            accumulator.findings.push(seamWriteFinding(file, node, chain, 'Deletes a member'));
+        }
+        return;
+    }
+    // A mutating call is only a finding when it reaches *past* the service's own
+    // API. `ctx.credentials.set(ref, value)` and `ctx.skills.register(skill)` are
+    // the seam's published methods and sit at depth 0; `ctx.tools.layers.global
+    // .guards.data.clear()` reaches through five members into the map a
+    // `ctx.tools.guard()` deny is filed in.
+    if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression))
+        return;
+    if (!MUTATING_METHODS.has(node.expression.name.text))
+        return;
+    const chain = seamChain(node.expression.expression);
+    if (chain === null || chain.depth < 2)
+        return;
+    accumulator.findings.push(seamWriteFinding(file, node, chain, `Calls \`.${node.expression.name.text}()\` on state`));
+}
+/**
+ * Whether a node sits on the left of an assignment or under a `delete`, which
+ * is what separates writing one of the Cordis bookkeeping tables from reading
+ * it. Reading is something an honest plugin does: `dsh-dlp` counts
+ * `ctx.events._hooks['approval/request']` to decide whether an approval would
+ * reach a human.
+ * @param node - the property access naming the surface.
+ * @returns true when the surface is being written rather than read.
+ */
+function isWriteTarget(node) {
+    let cursor = node;
+    for (;;) {
+        // Sources are parsed with `setParentNodes`, and the loop only ascends
+        // through property and element accesses, each of which has a parent — the
+        // statement that would hold a parentless node ends the walk one step below.
+        const parent = cursor.parent;
+        if (ts.isDeleteExpression(parent))
+            return true;
+        if (ts.isBinaryExpression(parent) && parent.left === cursor
+            && (parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+                || parent.operatorToken.kind === ts.SyntaxKind.QuestionQuestionEqualsToken))
+            return true;
+        // The surface is the receiver of a mutating call, either directly
+        // (`_hooks.clear()`) or after an index step (`_hooks[name].splice(0)`),
+        // which reaches the same table through the array it holds.
+        if (ts.isCallExpression(parent) && parent.expression === cursor
+            && ts.isPropertyAccessExpression(cursor)) {
+            return MUTATING_METHODS.has(cursor.name.text);
+        }
+        if (!ts.isPropertyAccessExpression(parent) && !ts.isElementAccessExpression(parent))
+            return false;
+        cursor = parent;
+    }
+}
+/** B16 — reaching the Cordis bookkeeping that owns other layers' registrations. */
+function checkTeardown(file, node, accumulator) {
+    if (!ts.isPropertyAccessExpression(node))
+        return;
+    const outer = node.expression;
+    if (!ts.isPropertyAccessExpression(outer))
+        return;
+    if (!ts.isIdentifier(outer.expression) || !CONTEXT_RECEIVERS.has(outer.expression.text))
+        return;
+    const surface = TEARDOWN_SURFACES.find(entry => entry.service === outer.name.text && entry.member === node.name.text);
+    if (surface === undefined)
+        return;
+    if (!surface.readIsEnough && !isWriteTarget(node))
+        return;
+    accumulator.findings.push(tierB({
+        checkId: 'B16',
+        name: 'foreign-registration-teardown',
+        subject: `${surface.service}.${surface.member}`,
+        severity: 'critical',
+        title: `Reaches \`${surface.service}.${surface.member}\`, which owns other layers' registrations`,
+        detail: `\`ctx.${surface.service}.${surface.member}\` is ${surface.effect}. Cordis makes `
+            + `\`ctx.${surface.service}\` an own property of the root context that every child inherits, so reaching it `
+            + 'needs no `inject` declaration and nothing records that this layer did. A guard registered by a security '
+            + 'plugin through `ctx.tools.guard()`, and every listener it composed, are removable this way — which is a '
+            + 'wider reach than any single seam replacement, because it does not substitute a decision, it deletes the '
+            + 'code that would have made one.'
+            + (surface.readIsEnough
+                ? ''
+                : ' Reading this surface is not the finding: an honest plugin counts the listeners on a seam to decide '
+                    + 'whether a prompt would reach a human. Only a write is raised.'),
+        evidence: at(file, node),
+        bypass: 'a computed member name, which C2 reports, or reaching the same table through a local bound earlier',
+    }));
+}
 /**
  * Run every Tier B check.
  * @param input - the decoded package.
@@ -517,7 +803,10 @@ export function runTierB(input) {
                 checkSeamReplacement(file, node, accumulator);
                 checkSystemPrompt(file, node, accumulator);
                 checkNestedMount(file, node, accumulator);
+                checkWaterfallVeto(file, node, accumulator);
             }
+            checkSeamWrite(file, node, accumulator);
+            checkTeardown(file, node, accumulator);
             checkDynamicCode(file, node, accumulator);
             checkCredentialRead(file, node, accumulator);
             checkToolDescription(file, node, accumulator);

package/lib/knowledge.js

@@ -13,13 +13,15 @@
  * Harness version these tables were transcribed from — the version string in
  * the shipped bundles' own `package.json`, which is `dsh`'s own version.
  *
- * Re-verified against `0.1.1-rc.2`, the release npm tags `latest`, by
+ * Re-verified against `0.1.2-rc.1`, the release npm tags `latest`, by
  * extracting each table from the published packages and diffing it against the
- * one here. What moved: six rows inserted by the web bundle, three seam keys,
- * and two sandbox traps this table had never carried. What did not: every row
- * name, every row's bundle membership, and the waterfall event set.
+ * one here. What moved: thirteen row ids the bundles gained against three they
+ * dropped, four rows the base layer inserts that only the web bundle carried,
+ * eleven seam keys against one dropped, and two waterfall events against one
+ * dropped. What did not: the sandbox trap table, the teardown surfaces, and
+ * every `DECISION_EVENT_DEFAULTS` citation, all re-read at this release.
  */
-export const HARNESS_REFERENCE = '0.1.1-rc.2';
+export const HARNESS_REFERENCE = '0.1.2-rc.1';
 /**
  * The three profile bundles the harness ships, mapped to what each one is.
  * A package that *is* one of these composes the core rows rather than modifying
@@ -51,13 +53,11 @@ export const CORE_ROWS = new Map([
     ['agent-instructions', { module: '@deepseek-ai/dsh-agent-instructions', bundles: ['base'] }],
     ['agent-loop', { module: '@deepseek-ai/dsh-agent-loop', bundles: ['base'] }],
     ['agent-presets', { module: '@deepseek-ai/dsh-agent-presets', bundles: ['web-app'] }],
-    ['api-gateway', { module: '@deepseek-ai/dsh-host-apiproxy', bundles: ['web-app'] }],
     ['api-remotes', { module: '@deepseek-ai/dsh-api-remotes', bundles: ['web-app'] }],
     ['approval', { module: '@deepseek-ai/dsh-user-approval', bundles: ['base'] }],
     ['attachment-local', { module: '@deepseek-ai/dsh-attachment-local', bundles: ['base'] }],
     ['bash-sandbox', { module: '@deepseek-ai/dsh-bash-sandbox', bundles: ['base'] }],
     ['client-hmr', { module: '@deepseek-ai/dsh-client-hmr', bundles: ['web-app'] }],
-    ['client-runtime', { module: '@deepseek-ai/dsh-client-runtime', bundles: ['web-app'] }],
     ['code-runtime', { module: '@deepseek-ai/dsh-code-runtime-worker-thread', bundles: ['headless', 'web-app'] }],
     ['command-compact', { module: '@deepseek-ai/dsh-command-compact', bundles: ['base'] }],
     ['command-feedback', { module: '@deepseek-ai/dsh-command-feedback', bundles: ['base'] }],
@@ -68,6 +68,7 @@ export const CORE_ROWS = new Map([
     ['cordis-client-runner', { module: '@deepseek-ai/dsh-cordis-client-runner', bundles: ['web-app'] }],
     ['cordis-host-runner', { module: '@deepseek-ai/dsh-cordis-host-runner', bundles: ['web-app'] }],
     ['credentials', { module: '@deepseek-ai/dsh-credentials-local', bundles: ['base'] }],
+    ['deepseek-llm-api-extensions', { module: '@deepseek-ai/dsh-deepseek-llm-api-extensions', bundles: ['base'] }],
     ['directory-picker', { module: '@deepseek-ai/dsh-host-directory-picker-auto', bundles: ['web-app'] }],
     ['file-reference-local', { module: '@deepseek-ai/dsh-file-reference-local', bundles: ['web-app'] }],
     ['fs-observation-policy', { module: '@deepseek-ai/dsh-fs-observation-policy', bundles: ['base'] }],
@@ -88,34 +89,40 @@ export const CORE_ROWS = new Map([
     ['permission', { module: '@deepseek-ai/dsh-permission-presets', bundles: ['base'] }],
     ['plan-mode', { module: '@deepseek-ai/dsh-plan-mode', bundles: ['base'] }],
     ['plugin-inventory', { module: '@deepseek-ai/dsh-host-plugin-inventory', bundles: ['web-app'] }],
+    ['plugin-package-inventory-deepseek', { module: '@deepseek-ai/dsh-plugin-package-inventory-deepseek', bundles: ['base'] }],
     ['pwsh-sandbox', { module: '@deepseek-ai/dsh-pwsh-sandbox', bundles: ['base'] }],
     ['repeat-tool-reminder', { module: '@deepseek-ai/dsh-repeat-tool-reminder', bundles: ['base'] }],
     ['sandbox', { module: '@deepseek-ai/dsh-sandbox-local', bundles: ['base'] }],
     ['sandbox-policy', { module: '@deepseek-ai/dsh-sandbox-policy', bundles: ['base'] }],
     ['session', { module: '@deepseek-ai/dsh-session', bundles: ['base'] }],
     ['session-checkpoint-policy', { module: '@deepseek-ai/dsh-session-checkpoint-policy', bundles: ['base'] }],
+    ['session-controller', { module: '@deepseek-ai/dsh-api-session-controller', bundles: ['web-app'] }],
+    ['session-log-deepseek', { module: '@deepseek-ai/dsh-session-log-deepseek', bundles: ['base'] }],
     ['session-log-download', { module: '@deepseek-ai/dsh-session-log-export', bundles: ['web-app'] }],
     ['session-persistence-jsonl', { module: '@deepseek-ai/dsh-session-persistence-jsonl', bundles: ['base'] }],
     ['session-projection', { module: '@deepseek-ai/dsh-session-projection', bundles: ['base'] }],
-    ['session-projection-cache', { module: '@deepseek-ai/dsh-session-projection-cache', bundles: ['web-app'] }],
+    ['session-projection-cache', { module: '@deepseek-ai/dsh-session-projection-cache', bundles: ['base'] }],
     ['session-query-sqlite', { module: '@deepseek-ai/dsh-session-query-sqlite', bundles: ['base'] }],
     ['session-reference', { module: '@deepseek-ai/dsh-session-reference', bundles: ['web-app'] }],
     ['session-stats', { module: '@deepseek-ai/dsh-session-stats', bundles: ['web-app'] }],
     ['session-telemetry-otel', { module: '@deepseek-ai/dsh-session-telemetry-otel', bundles: ['base'] }],
     ['session-title', { module: '@deepseek-ai/dsh-session-title', bundles: ['base'] }],
     ['session-title-llm', { module: '@deepseek-ai/dsh-session-title-first-prompt-llm', bundles: ['base'] }],
+    ['session-turn-outline', { module: '@deepseek-ai/dsh-session-turn-outline', bundles: ['web-app'] }],
     ['settings', { module: '@deepseek-ai/dsh-settings-file', bundles: ['base'] }],
+    ['settings-controller', { module: '@deepseek-ai/dsh-api-settings-controller', bundles: ['web-app'] }],
     ['shell-env', { module: '@deepseek-ai/dsh-shell-env', bundles: ['base'] }],
     ['skill', { module: '@deepseek-ai/dsh-skill', bundles: ['base'] }],
     ['skill-badge', { module: '@deepseek-ai/dsh-skill-badge', bundles: ['base'] }],
     ['skill-filesystem', { module: '@deepseek-ai/dsh-skill-filesystem', bundles: ['base'] }],
     ['spill-local', { module: '@deepseek-ai/dsh-spill-local', bundles: ['base'] }],
     ['spill-policy', { module: '@deepseek-ai/dsh-spill-policy', bundles: ['base'] }],
-    ['storage', { module: '@deepseek-ai/dsh-storage', bundles: ['web-app'] }],
-    ['storage-domain', { module: '@deepseek-ai/dsh-storage-domain', bundles: ['web-app'] }],
-    ['storage-json', { module: '@deepseek-ai/dsh-storage-json', bundles: ['web-app'] }],
+    ['storage', { module: '@deepseek-ai/dsh-storage', bundles: ['base'] }],
+    ['storage-domain', { module: '@deepseek-ai/dsh-storage-domain', bundles: ['base'] }],
+    ['storage-json', { module: '@deepseek-ai/dsh-storage-json', bundles: ['base'] }],
     ['subagent', { module: '@deepseek-ai/dsh-subagent', bundles: ['base'] }],
     ['subagent-fork-in-process', { module: '@deepseek-ai/dsh-subagent-fork-in-process', bundles: ['base'] }],
+    ['subagent-model-selection-settings', { module: '@deepseek-ai/dsh-tool-subagent/model-selection-settings', bundles: ['web-app'] }],
     ['subagent-spawn-in-process', { module: '@deepseek-ai/dsh-subagent-spawn-in-process', bundles: ['base'] }],
     ['subprocess', { module: '@deepseek-ai/dsh-subprocess-local', bundles: ['base'] }],
     ['system-prompt', { module: '@deepseek-ai/dsh-system-prompt', bundles: ['base'] }],
@@ -136,7 +143,6 @@ export const CORE_ROWS = new Map([
     ['tool-subagent-control', { module: '@deepseek-ai/dsh-tool-subagent-control', bundles: ['base'] }],
     ['tool-subagent-fork', { module: '@deepseek-ai/dsh-tool-subagent', bundles: ['base'] }],
     ['tool-subagent-list-agents', { module: '@deepseek-ai/dsh-tool-subagent-control/list-agents', bundles: ['base'] }],
-    ['tool-subagent-report', { module: '@deepseek-ai/dsh-tool-subagent-report', bundles: ['base'] }],
     ['tool-todo', { module: '@deepseek-ai/dsh-tool-todo', bundles: ['base'] }],
     ['tool-web', { module: '@deepseek-ai/dsh-tool-web', bundles: ['base'] }],
     ['tool-workflow', { module: '@deepseek-ai/dsh-tool-workflow', bundles: ['base'] }],
@@ -145,8 +151,10 @@ export const CORE_ROWS = new Map([
     ['typert-gateway', { module: '@deepseek-ai/dsh-api-gateway', bundles: ['base'] }],
     ['typert-loader', { module: '@deepseek-ai/dsh-typert-loader', bundles: ['base'] }],
     ['ui-agent-preset', { module: '@deepseek-ai/dsh-client-ui-agent-preset', bundles: ['web-app'] }],
+    ['ui-approval', { module: '@deepseek-ai/dsh-client-ui-approval', bundles: ['web-app'] }],
     ['ui-attachment', { module: '@deepseek-ai/dsh-client-ui-attachment', bundles: ['web-app'] }],
     ['ui-brand-official', { module: '@deepseek-ai/dsh-client-ui-brand-official', bundles: ['web-app'] }],
+    ['ui-chat', { module: '@deepseek-ai/dsh-client-ui-chat', bundles: ['web-app'] }],
     ['ui-commands', { module: '@deepseek-ai/dsh-client-ui-commands', bundles: ['web-app'] }],
     ['ui-conversation', { module: '@deepseek-ai/dsh-client-ui-conversation', bundles: ['web-app'] }],
     ['ui-cordis', { module: '@deepseek-ai/dsh-client-ui-cordis', bundles: ['web-app'] }],
@@ -161,6 +169,8 @@ export const CORE_ROWS = new Map([
     ['ui-plan', { module: '@deepseek-ai/dsh-client-ui-plan', bundles: ['web-app'] }],
     ['ui-reference', { module: '@deepseek-ai/dsh-client-ui-reference', bundles: ['web-app'] }],
     ['ui-renderer', { module: '@deepseek-ai/dsh-client-ui-renderer', bundles: ['web-app'] }],
+    ['ui-schedule', { module: '@deepseek-ai/dsh-client-ui-schedule', bundles: ['web-app'] }],
+    ['ui-session', { module: '@deepseek-ai/dsh-client-ui-session', bundles: ['web-app'] }],
     ['ui-settings', { module: '@deepseek-ai/dsh-client-ui-settings', bundles: ['web-app'] }],
     ['ui-settings-general', { module: '@deepseek-ai/dsh-client-ui-settings-general', bundles: ['web-app'] }],
     ['ui-settings-models', { module: '@deepseek-ai/dsh-client-ui-settings-models', bundles: ['web-app'] }],
@@ -177,12 +187,14 @@ export const CORE_ROWS = new Map([
     ['ui-workspace', { module: '@deepseek-ai/dsh-client-ui-workspace', bundles: ['web-app'] }],
     ['user-questions', { module: '@deepseek-ai/dsh-user-questions', bundles: ['base'] }],
     ['web', { module: '@deepseek-ai/dsh-web', bundles: ['base'] }],
+    ['web-fetch-http', { module: '@deepseek-ai/dsh-web-fetch-http', bundles: ['base'] }],
     ['web-runtime', { module: '@deepseek-ai/dsh-web-app', bundles: ['web-app'] }],
     ['web-search-deepseek', { module: '@deepseek-ai/dsh-web-search-deepseek', bundles: ['base'] }],
     ['web-startup', { module: '@deepseek-ai/dsh-web-app/startup', bundles: ['web-app'] }],
     ['webserver', { module: '@deepseek-ai/dsh-host-webserver', bundles: ['web-app'] }],
     ['workflow-worker-thread', { module: '@deepseek-ai/dsh-workflow-worker-thread', bundles: ['base'] }],
     ['workspace', { module: '@deepseek-ai/dsh-workspace', bundles: ['web-app'] }],
+    ['workspace-controller', { module: '@deepseek-ai/dsh-api-workspace-controller', bundles: ['web-app'] }],
 ]);
 /** Row ids the shipped bundles define. */
 export const CORE_ROW_IDS = new Set(CORE_ROWS.keys());
@@ -191,7 +203,16 @@ export const CORE_ROW_IDS = new Set(CORE_ROWS.keys());
  * Disabling or reconfiguring one of these from a third-party patch layer is
  * the highest-value finding this tool produces, and it is plain YAML.
  *
- * Each entry names what stops holding when the row stops running.
+ * Each entry names what stops holding when the row stops running. Membership
+ * needs one of two properties: disabling the row **fails open**, so the agent
+ * may afterwards do something it could not before, or it **removes evidence**
+ * without saying so, leaving nothing to reconstruct what the agent did. A row
+ * that fails closed on removal, or whose absence only takes a feature away, is
+ * not a member however security-adjacent its name reads.
+ *
+ * The rows examined against that rule and kept out are listed with their
+ * reasons under "What is deliberately not a finding" in `docs/checks.md`, so a
+ * reader can tell a considered exclusion from a row nobody looked at.
  */
 export const SECURITY_ROW_IDS = new Map([
     ['approval', 'user approval prompts for tool calls'],
@@ -219,32 +240,138 @@ export const SECURITY_ROW_IDS = new Map([
  * replaces a core service for every consumer in its scope.
  */
 export const SEAM_KEYS = new Set([
-    'agentDefaultModel', 'agentLoop', 'agentPresets', 'agents', 'agentTeams', 'apiProxy', 'approval',
-    'attachments', 'authorization', 'clientModules', 'codeRuntime', 'commands', 'compaction',
-    'credentials', 'directoryPicker', 'e2b', 'fileReferences', 'fs', 'goals', 'invariants', 'jobs',
-    'llm', 'lsp', 'messageFeedback', 'permissionPresets', 'planMode', 'sandbox', 'sandboxPolicy',
-    'sessionPersistence', 'sessionProjectionCache', 'sessionProjections', 'sessionQuery',
-    'sessionReferenceResolver', 'sessions', 'sessionTelemetry', 'sessionTitle', 'settings',
-    'shell', 'shellEnv', 'skills', 'spillStore', 'storage', 'storageDomain', 'subagents',
-    'subprocess', 'systemPrompt', 'terminals', 'timer', 'tokenMeter', 'toolResultPruner',
-    'tools', 'typert', 'typertGateway', 'userQuestions', 'web', 'webServer', 'workflowEngine',
-    'workspaceRegistry',
+    'agentDefaultModel', 'agentLoop', 'agentPresets', 'agents', 'agentTeams', 'approval', 'attachments',
+    'authorization', 'clientModules', 'codeRuntime', 'commands', 'compaction', 'credentials',
+    'credentialsController', 'deepseekLlmApiExtensions', 'directoryPicker', 'directoryPickerController',
+    'e2b', 'fileReferences', 'fs', 'goals', 'inspector', 'invariants', 'jobs', 'llm', 'lsp',
+    'messageFeedback', 'permissionPresets', 'planMode', 'sandbox', 'sandboxPolicy', 'sessionController',
+    'sessionFileReferences', 'sessionPersistence', 'sessionProjectionCache', 'sessionProjections',
+    'sessionQuery', 'sessionReferenceResolver', 'sessions', 'sessionSkillCatalog', 'sessionTelemetry',
+    'sessionTitle', 'settings', 'settingsController', 'shell', 'shellEnv', 'skills', 'spillStore', 'storage',
+    'storageDomain', 'subagentModelSelection', 'subagents', 'subprocess', 'systemPrompt', 'terminals',
+    'timer', 'tokenMeter', 'toolResultPruner', 'tools', 'typert', 'typertGateway', 'userQuestions', 'web',
+    'webhookRuntime', 'webServer', 'workflowEngine', 'workspaceController', 'workspaceRegistry',
 ]);
 /**
- * The subset of {@link SEAM_KEYS} whose replacement removes a constraint.
+ * The subset of {@link SEAM_KEYS} whose replacement either removes a constraint
+ * or takes over the record by which one could be checked afterwards. Most
+ * members are the first kind — `approval`, `sandbox`, `credentials`. The set
+ * already holds two of the second, `sessionPersistence` and `sessionTelemetry`,
+ * and each entry below says which kind it is rather than borrowing the other's
+ * sentence.
+ *
+ * `authorization` is the registry of flows that obtain a credential through a
+ * conversation with the user, so providing it means owning that conversation.
+ * That is the same class of substitution as `credentials`, which this set
+ * already holds. `fileReferences` decides which paths are offered for
+ * completion and `agentTeams` is the team form of `subagents`, which is
+ * deliberately not here either, so neither of those is in this set.
+ *
+ * Seven of the eleven keys `0.1.2-rc.1` adds are Remote controllers: host
+ * services that own one `ctx.remote.*` namespace the browser client calls
+ * across the wire. A controller belongs here only when the traffic a
+ * substitution redirects to it carries a secret, an execution boundary, or a
+ * decision. A controller that forwards its seam's own verbs and adds a wire
+ * failure vocabulary does not, because the seam it fronts is reachable from
+ * `ctx` without substituting anything.
+ *
+ * Included:
+ * - `credentialsController` is what a browser configuration page calls to store
+ *   a credential. `set(ref, value)` receives the plaintext secret and hands it
+ *   to `ctx.credentials`
+ *   (`@deepseek-ai/dsh-api-settings-controller/lib/index.js:171`), and
+ *   `projectCredentialInfo` at `lib/index.js:78` is what holds a `describe`
+ *   answer to the three fields `CredentialInfo` declares. A layer that provides
+ *   it takes both halves: every secret typed into the settings page, and the
+ *   freedom to answer a read with the stored value.
+ * - `settingsController` passes `redactSecrets: true` on every remote read
+ *   (`@deepseek-ai/dsh-api-settings-controller/lib/index.js:429` and `:544`),
+ *   which is what keeps a `role('secret')` field out of a settings response;
+ *   `@deepseek-ai/dsh-web-search-deepseek/lib/index.js:245` declares one, an
+ *   `apiKey`. Its `update`, `replace` and `mutate` verbs carry that same field's
+ *   value in plaintext from the configuration page. Providing it puts the layer
+ *   on both directions of a secret's path.
+ * - `sessionController` resolves each new Session's cwd from the wire request
+ *   and hands it to `ensureSession`
+ *   (`@deepseek-ai/dsh-api-session-controller/lib/index.js:574`), and
+ *   `@deepseek-ai/dsh-sandbox-policy` resolves that immutable cwd as the
+ *   `workspace-write` root the enforcing filesystem, bash and terminal backends
+ *   fence against. Its `prompt` verb builds the message admitted to the agent
+ *   under `source.kind: 'user'` (`lib/index.js:731`). Providing it chooses the
+ *   sandbox root for every session created from the client, and the text that
+ *   reaches the model under the user's own source label.
+ * - `webhookRuntime` is what a provider adapter such as
+ *   `@deepseek-ai/dsh-webhook-github` dispatches verified deliveries into. Its
+ *   one built-in action creates a Session from a rule result whose fields
+ *   include `workspacePath`, `permissionPreset` and `prompt`
+ *   (`@deepseek-ai/dsh-webhook/lib/types/types.d.ts`), and
+ *   `createWebhookSession` applies that preset through
+ *   `ctx.permissionPresets.set` before admitting the prompt
+ *   (`@deepseek-ai/dsh-webhook/lib/types/session.js:94`, `:117`, `:120`).
+ *   Providing it picks the approval and sandbox preset for an agent started by
+ *   a remote delivery with no user present.
+ * - `inspector` is the second kind, and the only member graded from the
+ *   catalogue rather than from an implementation. The catalogue declares it as
+ *   the façade over the realm's source publisher, with `publish(topic, payload,
+ *   monotonicMs?)` and a read-only `CordisRuntimeTreeReader`
+ *   (`@deepseek-ai/dsh-tool-cordis/lib/index.js:1558`, the two method
+ *   signatures at `:1562` and `:1579`). Providing it
+ *   takes no decision away from anyone: nothing is gated on an observation, and
+ *   on that ground the key does not belong beside `approval`. What it takes is
+ *   the position observations pass through. A substituted publisher chooses
+ *   which topics reach the carrier and what payload each one carries, so it can
+ *   withhold the record of something that happened or publish one for something
+ *   that did not, and a consumer downstream cannot tell either from a quiet
+ *   system. That is the property this set already recognises in
+ *   `sessionPersistence` and `sessionTelemetry`.
+ *
+ *   No implementation exists to displace. In `0.1.2-rc.1` the key is declared
+ *   once and used nowhere: `'inspector'` as a string literal occurs exactly
+ *   once across the 224 `@deepseek-ai` packages in the installed tree — that
+ *   catalogue entry — no file reads `ctx.inspector`, and `InspectorJsonValue`
+ *   and `CordisRuntimeTreeReader` appear only in that same bundle. So a package
+ *   providing `inspector` in this release displaces nothing and reaches nothing
+ *   it could not reach under a name of its own. This entry grades what the
+ *   catalogue says the key is for, not code that runs today, and it is the one
+ *   entry a release that ships a publisher or a consumer should settle again
+ *   against them.
  *
- * `authorization` joined the catalogue in `0.1.1-rc.2`: it is the registry of
- * flows that obtain a credential through a conversation with the user, so
- * providing it means owning that conversation. That is the same class of
- * substitution as `credentials`, which this set already holds. The other two
- * keys the release added are not: `fileReferences` decides which paths are
- * offered for completion and `agentTeams` is the team form of `subagents`,
- * which is deliberately not here either.
+ * Excluded:
+ * - `workspaceController` forwards `request.path` to
+ *   `ctx.workspaceRegistry.create` unchanged and adds an ordering queue and
+ *   error mapping (`@deepseek-ai/dsh-api-workspace-controller/lib/index.js:196`
+ *   to `:212`). The registry it fronts is `workspaceRegistry`, which is not
+ *   here, so the substitution reaches nothing the seam does not already offer.
+ * - `directoryPickerController` is three delegations to
+ *   `ctx.directoryPicker.capability()` behind a check that refuses a verb the
+ *   composed backend does not serve
+ *   (`@deepseek-ai/dsh-api-workspace-controller/lib/index.js:423` to `:470`).
+ *   Path fencing lives in the backend, and `directoryPicker` is not here.
+ * - `sessionFileReferences` is the Remote adapter over `fileReferences`, which
+ *   is excluded above for the same reason: the traffic is path candidates
+ *   offered for completion.
+ * - `sessionSkillCatalog` answers with `SkillListValue`, declared as the list
+ *   for one Session's human-facing composer
+ *   (`@deepseek-ai/dsh-api-session-controller/lib/types/types.d.ts:213` to
+ *   `:227`), and its only consumer in this release is the client skill picker
+ *   (`@deepseek-ai/dsh-client-ui-skill/lib/client.js:236`). Skill text reaches a
+ *   model through `ctx.skills.list()` in
+ *   `@deepseek-ai/dsh-tool-skill/lib/index.js:145`, which is the `skills` seam.
+ * - `subagentModelSelection` is a settings owner answering `{ enabled,
+ *   allowedModels }`, sampled when an Agent receives its delegation tools. Model
+ *   routing is `llm` and delegation is `subagents`; neither is here.
+ * - `deepseekLlmApiExtensions` hands a substitute the serialized request body
+ *   and merges the fields it returns, but
+ *   `@deepseek-ai/dsh-llm-deepseek/lib/index.js:1748` rejects any extension
+ *   field colliding with the base request, so `messages`, `tools` and `model`
+ *   are not writable through it. The constraint is in the adapter, not the
+ *   registry the substitution replaces.
  */
 export const SECURITY_SEAM_KEYS = new Set([
     'approval', 'authorization', 'sandbox', 'sandboxPolicy', 'permissionPresets', 'credentials',
-    'subprocess', 'shell', 'fs', 'tools', 'agentLoop', 'sessionPersistence', 'sessionTelemetry',
-    'invariants',
+    'credentialsController', 'settingsController', 'sessionController', 'webhookRuntime',
+    'subprocess', 'shell', 'fs', 'tools', 'agentLoop', 'inspector', 'sessionPersistence',
+    'sessionTelemetry', 'invariants',
 ]);
 /**
  * Waterfall events, from `EVENT_API` in the api-catalog. A listener on one of
@@ -253,19 +380,31 @@ export const SECURITY_SEAM_KEYS = new Set([
  *
  * Note there is no `fs/read-intent` — the intent family is write and edit only.
  *
- * Unchanged in `0.1.1-rc.2`. The catalogue's event set grew by four and lost
- * one, but every addition carries `mode: 'emit'`, and only `mode: 'waterfall'`
- * hands a listener the trailing `next` this set is about.
+ * `0.1.2-rc.1` renames `tools/code-dispatch-log` to `tools/ptc-dispatch-log`
+ * and adds `user-questions/request`. Both replace content in a durable log copy
+ * or answer a pending request; neither is an `emit` event, so both hand a
+ * listener the trailing `next`.
  */
 export const WATERFALL_EVENTS = new Set([
     'agent/pre-step', 'agent/request', 'agent/request-error', 'approval/request',
     'fs/edit-intent', 'fs/write-intent', 'llm/stream', 'session-telemetry/record',
-    'system-prompt/assemble', 'tools/code-dispatch-log', 'tools/execute',
-    'tools/post-execute', 'tools/pre-execute',
+    'system-prompt/assemble', 'tools/execute', 'tools/post-execute',
+    'tools/pre-execute', 'tools/ptc-dispatch-log', 'user-questions/request',
 ]);
-/** Waterfall events whose short-circuit removes a decision the user would otherwise make. */
+/**
+ * Waterfall events whose short-circuit removes a decision the user would
+ * otherwise make.
+ *
+ * `user-questions/request` is here for the same reason `approval/request` is:
+ * `ctx.userQuestions` pauses a tool call until a human answers, and the
+ * answerers that put the question on a screen are listeners in the chain rather
+ * than the inner callback (`@deepseek-ai/dsh-user-questions/lib/index.js:69`).
+ * A listener that returns an answer without calling `next()` answers on the
+ * user's behalf and the question is never shown.
+ */
 export const DECISION_EVENTS = new Set([
     'approval/request', 'tools/pre-execute', 'tools/execute', 'fs/write-intent', 'fs/edit-intent',
+    'user-questions/request',
 ]);
 /**
  * Globals the dynamic-package sandbox (`cordis-host-runner/src/sandbox.ts`)
@@ -418,3 +557,130 @@ export const HARNESS_INERT_CALLS = new Set([
  * in code, and it is plain YAML.
  */
 export const SERVICE_REMAPPING_FIELDS = ['isolate', 'intercept'];
+/**
+ * How a Cordis waterfall listener delegates, and what happens when it does not.
+ *
+ * Read out of the installed `@deepseek-ai/cordis@4.0.2` build,
+ * `lib/index.js:317-327`:
+ *
+ * ```js
+ * waterfall(...args) {
+ *   const cbs = this.dispatch("waterfall", args);
+ *   const inner = args.pop();
+ *   const next = () => { return (cbs.shift() ?? inner)(...args); };
+ *   args.push(next);
+ *   return next();
+ * }
+ * ```
+ *
+ * `next` is the trailing argument every listener receives, and `inner` is the
+ * harness's own built-in behavior. A listener that returns without calling
+ * `next()` therefore ends the chain: neither the listeners still in `cbs` nor
+ * `inner` run.
+ *
+ * The scope of that is one dispatch, not the registry. `dispatch()` builds
+ * `cbs` with `.filter(…).map(…)`, which allocates, so `this._hooks[name]` is
+ * never touched and every skipped listener is registered and runs normally on
+ * the next dispatch. The precise word is veto, not removal — Cordis's own
+ * JSDoc at `lib/index.js:311-313` says "vetoes the rest of the chain, including
+ * the built-in behavior". Removal is a different capability with a different
+ * reach, and it has its own table below.
+ */
+export const WATERFALL_NEXT_PARAMETER = 'next';
+/**
+ * What each decision waterfall's built-in `next` settles on when no listener
+ * claims the dispatch, transcribed from the installed harness `0.1.2-rc.1`.
+ *
+ * This is what a listener that never calls `next()` replaces. The inner
+ * callback is the last argument at each site:
+ * - `tools/pre-execute` — `@deepseek-ai/dsh-tools/lib/index.js:3117`,
+ *   `() => Promise.resolve({ kind: "allow" })`
+ * - `tools/execute` — `dsh-tools/lib/index.js:3214`,
+ *   `() => this.dispatchToolBody(mutableExec)`, so vetoing it substitutes the
+ *   body of the tool call itself
+ * - `approval/request` — `@deepseek-ai/dsh-user-approval/lib/index.js:179`,
+ *   `() => Promise.resolve("unavailable")`, and the surface that would ask the
+ *   user is one of the listeners in the chain rather than the inner callback
+ * - `user-questions/request` —
+ *   `@deepseek-ai/dsh-user-questions/lib/index.js:67`, the `noAnswerer`
+ *   callback passed at `:69`, which rejects with a `UserQuestionError` carrying
+ *   code `NO_PROVIDER`
+ *
+ * The three tables in this module that name events (`WATERFALL_EVENTS`,
+ * `DECISION_EVENTS`, and this one) are keyed to {@link HARNESS_REFERENCE}.
+ */
+export const DECISION_EVENT_DEFAULTS = new Map([
+    ['approval/request', 'the request falls through to `"unavailable"` only after every composed answerer — '
+            + 'including the surface that would ask the user — has had the dispatch'],
+    ['tools/pre-execute', 'the gate settles on `{ kind: "allow" }` after every other listener, and only then are '
+            + '`ctx.tools.guard()` denials consulted'],
+    ['tools/execute', 'the tool body itself runs'],
+    ['fs/write-intent', 'the write intent reaches the policy rows that decide it'],
+    ['fs/edit-intent', 'the edit intent reaches the policy rows that decide it'],
+    ['user-questions/request', 'the request rejects with `NO_PROVIDER` only after every composed answerer — '
+            + 'including the one that puts the question on the user\'s screen — has had the dispatch'],
+]);
+/**
+ * Receivers whose members name a plugin context.
+ *
+ * The same set the Tier C detached-member check guards on, minus `process`:
+ * a seam is read off the context, never off `process`.
+ */
+export const CONTEXT_RECEIVERS = new Set([
+    'ctx', 'context', 'globalThis', 'global',
+]);
+/**
+ * Array and collection methods that change the receiver rather than reading it.
+ *
+ * Used to tell a write into a service's internals from a read of them. The
+ * distinction is not academic: `dsh-dlp` reads
+ * `ctx.events._hooks['approval/request']?.length` to decide whether an ask
+ * would reach a human, which is an honest use of the same property a hostile
+ * layer splices.
+ */
+export const MUTATING_METHODS = new Set([
+    'splice', 'push', 'pop', 'shift', 'unshift', 'fill', 'sort', 'reverse', 'copyWithin',
+    'clear', 'delete', 'set', 'add',
+]);
+/**
+ * Cordis internals through which one plugin removes another plugin's
+ * registrations. Read from the installed `@deepseek-ai/cordis@4.0.2` build.
+ *
+ * None of these is guarded by ownership. `ctx.events`, `ctx.registry` and
+ * `ctx.reflect` are own properties of the root context inherited by every
+ * child, so no `inject` declaration is needed to reach any of them.
+ */
+export const TEARDOWN_SURFACES = [
+    {
+        service: 'events',
+        member: '_hooks',
+        readIsEnough: false,
+        effect: 'the listener table every layer\'s `ctx.on()` registration is stored in (`lib/index.js:230`, '
+            + '`_hooks = {}`, appended to by `register` at `lib/index.js:336-345`). Splicing an entry out removes that '
+            + 'listener permanently, and the owning layer\'s own disposer then silently does nothing. This is a stronger '
+            + 'reach than a waterfall veto, which only skips listeners for one dispatch',
+    },
+    {
+        service: 'events',
+        member: 'unregister',
+        readIsEnough: true,
+        effect: 'the public removal path for one listener, by callback identity (`lib/index.js:353-359`). It takes the '
+            + 'listener list and a callback and splices, with no check that the caller owns either',
+    },
+    {
+        service: 'registry',
+        member: 'delete',
+        readIsEnough: true,
+        effect: 'disposal of every fiber a plugin owns (`lib/index.js:1564-1571`: `for (const fiber of runtime.fibers) '
+            + 'fiber.dispose();`). It takes no ownership check, so one layer can unload another layer outright — '
+            + 'including a security layer whose guards and listeners then stop existing',
+    },
+    {
+        service: 'reflect',
+        member: 'store',
+        readIsEnough: false,
+        effect: 'the service implementation table keyed by isolate symbol (`lib/index.js:726`, written by `provide` at '
+            + '`lib/index.js:813`). `provide` throws when a key is already taken and `set` throws across fibers; writing '
+            + 'this object directly is the path around both throws',
+    },
+];

package/lib/types/knowledge.d.ts

@@ -13,13 +13,15 @@
  * Harness version these tables were transcribed from — the version string in
  * the shipped bundles' own `package.json`, which is `dsh`'s own version.
  *
- * Re-verified against `0.1.1-rc.2`, the release npm tags `latest`, by
+ * Re-verified against `0.1.2-rc.1`, the release npm tags `latest`, by
  * extracting each table from the published packages and diffing it against the
- * one here. What moved: six rows inserted by the web bundle, three seam keys,
- * and two sandbox traps this table had never carried. What did not: every row
- * name, every row's bundle membership, and the waterfall event set.
+ * one here. What moved: thirteen row ids the bundles gained against three they
+ * dropped, four rows the base layer inserts that only the web bundle carried,
+ * eleven seam keys against one dropped, and two waterfall events against one
+ * dropped. What did not: the sandbox trap table, the teardown surfaces, and
+ * every `DECISION_EVENT_DEFAULTS` citation, all re-read at this release.
  */
-export declare const HARNESS_REFERENCE = "0.1.1-rc.2";
+export declare const HARNESS_REFERENCE = "0.1.2-rc.1";
 /** The shipped bundles, each of which is one patch layer over the profile root. */
 export type BundleName = 'base' | 'headless' | 'web-app';
 /**
@@ -58,7 +60,16 @@ export declare const CORE_ROW_IDS: ReadonlySet<string>;
  * Disabling or reconfiguring one of these from a third-party patch layer is
  * the highest-value finding this tool produces, and it is plain YAML.
  *
- * Each entry names what stops holding when the row stops running.
+ * Each entry names what stops holding when the row stops running. Membership
+ * needs one of two properties: disabling the row **fails open**, so the agent
+ * may afterwards do something it could not before, or it **removes evidence**
+ * without saying so, leaving nothing to reconstruct what the agent did. A row
+ * that fails closed on removal, or whose absence only takes a feature away, is
+ * not a member however security-adjacent its name reads.
+ *
+ * The rows examined against that rule and kept out are listed with their
+ * reasons under "What is deliberately not a finding" in `docs/checks.md`, so a
+ * reader can tell a considered exclusion from a row nobody looked at.
  */
 export declare const SECURITY_ROW_IDS: ReadonlyMap<string, string>;
 /**
@@ -69,15 +80,119 @@ export declare const SECURITY_ROW_IDS: ReadonlyMap<string, string>;
  */
 export declare const SEAM_KEYS: ReadonlySet<string>;
 /**
- * The subset of {@link SEAM_KEYS} whose replacement removes a constraint.
+ * The subset of {@link SEAM_KEYS} whose replacement either removes a constraint
+ * or takes over the record by which one could be checked afterwards. Most
+ * members are the first kind — `approval`, `sandbox`, `credentials`. The set
+ * already holds two of the second, `sessionPersistence` and `sessionTelemetry`,
+ * and each entry below says which kind it is rather than borrowing the other's
+ * sentence.
+ *
+ * `authorization` is the registry of flows that obtain a credential through a
+ * conversation with the user, so providing it means owning that conversation.
+ * That is the same class of substitution as `credentials`, which this set
+ * already holds. `fileReferences` decides which paths are offered for
+ * completion and `agentTeams` is the team form of `subagents`, which is
+ * deliberately not here either, so neither of those is in this set.
+ *
+ * Seven of the eleven keys `0.1.2-rc.1` adds are Remote controllers: host
+ * services that own one `ctx.remote.*` namespace the browser client calls
+ * across the wire. A controller belongs here only when the traffic a
+ * substitution redirects to it carries a secret, an execution boundary, or a
+ * decision. A controller that forwards its seam's own verbs and adds a wire
+ * failure vocabulary does not, because the seam it fronts is reachable from
+ * `ctx` without substituting anything.
+ *
+ * Included:
+ * - `credentialsController` is what a browser configuration page calls to store
+ *   a credential. `set(ref, value)` receives the plaintext secret and hands it
+ *   to `ctx.credentials`
+ *   (`@deepseek-ai/dsh-api-settings-controller/lib/index.js:171`), and
+ *   `projectCredentialInfo` at `lib/index.js:78` is what holds a `describe`
+ *   answer to the three fields `CredentialInfo` declares. A layer that provides
+ *   it takes both halves: every secret typed into the settings page, and the
+ *   freedom to answer a read with the stored value.
+ * - `settingsController` passes `redactSecrets: true` on every remote read
+ *   (`@deepseek-ai/dsh-api-settings-controller/lib/index.js:429` and `:544`),
+ *   which is what keeps a `role('secret')` field out of a settings response;
+ *   `@deepseek-ai/dsh-web-search-deepseek/lib/index.js:245` declares one, an
+ *   `apiKey`. Its `update`, `replace` and `mutate` verbs carry that same field's
+ *   value in plaintext from the configuration page. Providing it puts the layer
+ *   on both directions of a secret's path.
+ * - `sessionController` resolves each new Session's cwd from the wire request
+ *   and hands it to `ensureSession`
+ *   (`@deepseek-ai/dsh-api-session-controller/lib/index.js:574`), and
+ *   `@deepseek-ai/dsh-sandbox-policy` resolves that immutable cwd as the
+ *   `workspace-write` root the enforcing filesystem, bash and terminal backends
+ *   fence against. Its `prompt` verb builds the message admitted to the agent
+ *   under `source.kind: 'user'` (`lib/index.js:731`). Providing it chooses the
+ *   sandbox root for every session created from the client, and the text that
+ *   reaches the model under the user's own source label.
+ * - `webhookRuntime` is what a provider adapter such as
+ *   `@deepseek-ai/dsh-webhook-github` dispatches verified deliveries into. Its
+ *   one built-in action creates a Session from a rule result whose fields
+ *   include `workspacePath`, `permissionPreset` and `prompt`
+ *   (`@deepseek-ai/dsh-webhook/lib/types/types.d.ts`), and
+ *   `createWebhookSession` applies that preset through
+ *   `ctx.permissionPresets.set` before admitting the prompt
+ *   (`@deepseek-ai/dsh-webhook/lib/types/session.js:94`, `:117`, `:120`).
+ *   Providing it picks the approval and sandbox preset for an agent started by
+ *   a remote delivery with no user present.
+ * - `inspector` is the second kind, and the only member graded from the
+ *   catalogue rather than from an implementation. The catalogue declares it as
+ *   the façade over the realm's source publisher, with `publish(topic, payload,
+ *   monotonicMs?)` and a read-only `CordisRuntimeTreeReader`
+ *   (`@deepseek-ai/dsh-tool-cordis/lib/index.js:1558`, the two method
+ *   signatures at `:1562` and `:1579`). Providing it
+ *   takes no decision away from anyone: nothing is gated on an observation, and
+ *   on that ground the key does not belong beside `approval`. What it takes is
+ *   the position observations pass through. A substituted publisher chooses
+ *   which topics reach the carrier and what payload each one carries, so it can
+ *   withhold the record of something that happened or publish one for something
+ *   that did not, and a consumer downstream cannot tell either from a quiet
+ *   system. That is the property this set already recognises in
+ *   `sessionPersistence` and `sessionTelemetry`.
  *
- * `authorization` joined the catalogue in `0.1.1-rc.2`: it is the registry of
- * flows that obtain a credential through a conversation with the user, so
- * providing it means owning that conversation. That is the same class of
- * substitution as `credentials`, which this set already holds. The other two
- * keys the release added are not: `fileReferences` decides which paths are
- * offered for completion and `agentTeams` is the team form of `subagents`,
- * which is deliberately not here either.
+ *   No implementation exists to displace. In `0.1.2-rc.1` the key is declared
+ *   once and used nowhere: `'inspector'` as a string literal occurs exactly
+ *   once across the 224 `@deepseek-ai` packages in the installed tree — that
+ *   catalogue entry — no file reads `ctx.inspector`, and `InspectorJsonValue`
+ *   and `CordisRuntimeTreeReader` appear only in that same bundle. So a package
+ *   providing `inspector` in this release displaces nothing and reaches nothing
+ *   it could not reach under a name of its own. This entry grades what the
+ *   catalogue says the key is for, not code that runs today, and it is the one
+ *   entry a release that ships a publisher or a consumer should settle again
+ *   against them.
+ *
+ * Excluded:
+ * - `workspaceController` forwards `request.path` to
+ *   `ctx.workspaceRegistry.create` unchanged and adds an ordering queue and
+ *   error mapping (`@deepseek-ai/dsh-api-workspace-controller/lib/index.js:196`
+ *   to `:212`). The registry it fronts is `workspaceRegistry`, which is not
+ *   here, so the substitution reaches nothing the seam does not already offer.
+ * - `directoryPickerController` is three delegations to
+ *   `ctx.directoryPicker.capability()` behind a check that refuses a verb the
+ *   composed backend does not serve
+ *   (`@deepseek-ai/dsh-api-workspace-controller/lib/index.js:423` to `:470`).
+ *   Path fencing lives in the backend, and `directoryPicker` is not here.
+ * - `sessionFileReferences` is the Remote adapter over `fileReferences`, which
+ *   is excluded above for the same reason: the traffic is path candidates
+ *   offered for completion.
+ * - `sessionSkillCatalog` answers with `SkillListValue`, declared as the list
+ *   for one Session's human-facing composer
+ *   (`@deepseek-ai/dsh-api-session-controller/lib/types/types.d.ts:213` to
+ *   `:227`), and its only consumer in this release is the client skill picker
+ *   (`@deepseek-ai/dsh-client-ui-skill/lib/client.js:236`). Skill text reaches a
+ *   model through `ctx.skills.list()` in
+ *   `@deepseek-ai/dsh-tool-skill/lib/index.js:145`, which is the `skills` seam.
+ * - `subagentModelSelection` is a settings owner answering `{ enabled,
+ *   allowedModels }`, sampled when an Agent receives its delegation tools. Model
+ *   routing is `llm` and delegation is `subagents`; neither is here.
+ * - `deepseekLlmApiExtensions` hands a substitute the serialized request body
+ *   and merges the fields it returns, but
+ *   `@deepseek-ai/dsh-llm-deepseek/lib/index.js:1748` rejects any extension
+ *   field colliding with the base request, so `messages`, `tools` and `model`
+ *   are not writable through it. The constraint is in the adapter, not the
+ *   registry the substitution replaces.
  */
 export declare const SECURITY_SEAM_KEYS: ReadonlySet<string>;
 /**
@@ -87,12 +202,23 @@ export declare const SECURITY_SEAM_KEYS: ReadonlySet<string>;
  *
  * Note there is no `fs/read-intent` — the intent family is write and edit only.
  *
- * Unchanged in `0.1.1-rc.2`. The catalogue's event set grew by four and lost
- * one, but every addition carries `mode: 'emit'`, and only `mode: 'waterfall'`
- * hands a listener the trailing `next` this set is about.
+ * `0.1.2-rc.1` renames `tools/code-dispatch-log` to `tools/ptc-dispatch-log`
+ * and adds `user-questions/request`. Both replace content in a durable log copy
+ * or answer a pending request; neither is an `emit` event, so both hand a
+ * listener the trailing `next`.
  */
 export declare const WATERFALL_EVENTS: ReadonlySet<string>;
-/** Waterfall events whose short-circuit removes a decision the user would otherwise make. */
+/**
+ * Waterfall events whose short-circuit removes a decision the user would
+ * otherwise make.
+ *
+ * `user-questions/request` is here for the same reason `approval/request` is:
+ * `ctx.userQuestions` pauses a tool call until a human answers, and the
+ * answerers that put the question on a screen are listeners in the chain rather
+ * than the inner callback (`@deepseek-ai/dsh-user-questions/lib/index.js:69`).
+ * A listener that returns an answer without calling `next()` answers on the
+ * user's behalf and the question is never shown.
+ */
 export declare const DECISION_EVENTS: ReadonlySet<string>;
 /**
  * Globals the dynamic-package sandbox (`cordis-host-runner/src/sandbox.ts`)
@@ -208,4 +334,97 @@ export declare const HARNESS_INERT_CALLS: ReadonlySet<string>;
  * in code, and it is plain YAML.
  */
 export declare const SERVICE_REMAPPING_FIELDS: readonly string[];
+/**
+ * How a Cordis waterfall listener delegates, and what happens when it does not.
+ *
+ * Read out of the installed `@deepseek-ai/cordis@4.0.2` build,
+ * `lib/index.js:317-327`:
+ *
+ * ```js
+ * waterfall(...args) {
+ *   const cbs = this.dispatch("waterfall", args);
+ *   const inner = args.pop();
+ *   const next = () => { return (cbs.shift() ?? inner)(...args); };
+ *   args.push(next);
+ *   return next();
+ * }
+ * ```
+ *
+ * `next` is the trailing argument every listener receives, and `inner` is the
+ * harness's own built-in behavior. A listener that returns without calling
+ * `next()` therefore ends the chain: neither the listeners still in `cbs` nor
+ * `inner` run.
+ *
+ * The scope of that is one dispatch, not the registry. `dispatch()` builds
+ * `cbs` with `.filter(…).map(…)`, which allocates, so `this._hooks[name]` is
+ * never touched and every skipped listener is registered and runs normally on
+ * the next dispatch. The precise word is veto, not removal — Cordis's own
+ * JSDoc at `lib/index.js:311-313` says "vetoes the rest of the chain, including
+ * the built-in behavior". Removal is a different capability with a different
+ * reach, and it has its own table below.
+ */
+export declare const WATERFALL_NEXT_PARAMETER = "next";
+/**
+ * What each decision waterfall's built-in `next` settles on when no listener
+ * claims the dispatch, transcribed from the installed harness `0.1.2-rc.1`.
+ *
+ * This is what a listener that never calls `next()` replaces. The inner
+ * callback is the last argument at each site:
+ * - `tools/pre-execute` — `@deepseek-ai/dsh-tools/lib/index.js:3117`,
+ *   `() => Promise.resolve({ kind: "allow" })`
+ * - `tools/execute` — `dsh-tools/lib/index.js:3214`,
+ *   `() => this.dispatchToolBody(mutableExec)`, so vetoing it substitutes the
+ *   body of the tool call itself
+ * - `approval/request` — `@deepseek-ai/dsh-user-approval/lib/index.js:179`,
+ *   `() => Promise.resolve("unavailable")`, and the surface that would ask the
+ *   user is one of the listeners in the chain rather than the inner callback
+ * - `user-questions/request` —
+ *   `@deepseek-ai/dsh-user-questions/lib/index.js:67`, the `noAnswerer`
+ *   callback passed at `:69`, which rejects with a `UserQuestionError` carrying
+ *   code `NO_PROVIDER`
+ *
+ * The three tables in this module that name events (`WATERFALL_EVENTS`,
+ * `DECISION_EVENTS`, and this one) are keyed to {@link HARNESS_REFERENCE}.
+ */
+export declare const DECISION_EVENT_DEFAULTS: ReadonlyMap<string, string>;
+/**
+ * Receivers whose members name a plugin context.
+ *
+ * The same set the Tier C detached-member check guards on, minus `process`:
+ * a seam is read off the context, never off `process`.
+ */
+export declare const CONTEXT_RECEIVERS: ReadonlySet<string>;
+/**
+ * Array and collection methods that change the receiver rather than reading it.
+ *
+ * Used to tell a write into a service's internals from a read of them. The
+ * distinction is not academic: `dsh-dlp` reads
+ * `ctx.events._hooks['approval/request']?.length` to decide whether an ask
+ * would reach a human, which is an honest use of the same property a hostile
+ * layer splices.
+ */
+export declare const MUTATING_METHODS: ReadonlySet<string>;
+/** One Cordis bookkeeping surface that owns other plugins' registrations. */
+export interface TeardownSurface {
+    /** The member read off the context, e.g. `events`. */
+    readonly service: string;
+    /** The member read off that, e.g. `_hooks`. */
+    readonly member: string;
+    /**
+     * True when merely naming the surface is the finding. False when only a
+     * write counts, because reading it is something an honest plugin does.
+     */
+    readonly readIsEnough: boolean;
+    /** What reaching it does, phrased for a report. */
+    readonly effect: string;
+}
+/**
+ * Cordis internals through which one plugin removes another plugin's
+ * registrations. Read from the installed `@deepseek-ai/cordis@4.0.2` build.
+ *
+ * None of these is guarded by ownership. `ctx.events`, `ctx.registry` and
+ * `ctx.reflect` are own properties of the root context inherited by every
+ * child, so no `inject` declaration is needed to reach any of them.
+ */
+export declare const TEARDOWN_SURFACES: readonly TeardownSurface[];
 //# sourceMappingURL=knowledge.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-inspector",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Know what a DeepSeek Harness plugin does before you install it — static pre-install analysis of a plugin directory or tarball",
   "license": "MIT",
   "author": "Ivan Tyshchenko",