dsh-plugin-local-infer 0.1.3 → 0.1.4

package/packages/core/lib/reserve.js

@@ -29,14 +29,16 @@ export function parseNvidiaSmiGpuUsage(output) {
  * signature. The binary marker must appear in the command line (the image
  * name for a docker plan, the engine binary for a local one); a declared port
  * must appear as a standalone number (the `--port N` flag or the docker
- * `-p host:port:port` mapping); a declared env key must be set when the line
- * carries env data, and is neutral when it does not.
+ * `-p host:port:port` mapping) unless `portInArgv` is false, which means the
+ * engine binds its port from a file; a declared env key must be set when the
+ * line carries env data, and is neutral when it does not.
  */
 export function matchLaunchSignature(line, signature) {
     if (!line.command.includes(signature.binary))
         return false;
-    if (signature.port !== undefined && !portAppears(line.command, signature.port))
+    if (signature.portInArgv !== false && signature.port !== undefined && !portAppears(line.command, signature.port)) {
         return false;
+    }
     if (signature.envKeys !== undefined && signature.envKeys.length > 0 && line.env !== undefined) {
         const hit = signature.envKeys.some(key => key in line.env);
         if (!hit)
@@ -90,4 +92,4 @@ export function resolveOsReserve(input) {
     }
     return { reserveMiB: DEFAULT_OS_RESERVE_MIB, source: 'default' };
 }
-//# sourceMappingURL=reserve.js.map
+//# sourceMappingURL=reserve.js.map

package/packages/core/lib/status.d.ts

@@ -10,8 +10,10 @@ export type ProviderStatus = 'running' | 'stopped' | 'unsure';
 /**
  * ProviderRef is the identity side of one saved provider config: the stable
  * id the card renders and the engine and model it serves. The model is
- * optional because a config that names no model cannot be confirmed against
- * a running engine, and reads as unsure rather than a guess. The config is
+ * optional: a config that names no model (an absent or empty value) confirms
+ * against a plugin-launched engine the detector tied to any model on its
+ * port, and reads as unsure only while no running engine carries a model tie.
+ * The config is
  * optional and lets the detector price the provider's own launch signature
  * (the engine binary the build mode runs, the port it binds) rather than the
  * adapter's default-port signature; the port is the resolved bind port the
@@ -60,9 +62,13 @@ export declare function isGpuBusy(usage?: GpuUsageProbe | null): boolean;
  * the detector's answer. The order is the plan's contract:
  * 1. A provider whose engine the process probe confirmed running is running
  *    (green) when the detector tied that engine to the provider's exact model,
- *    and unsure (yellow) when the engine serves an unidentified or a
- *    different model. A running engine using its VRAM does not read as a busy
- *    card, so the dot is green, not the unattributable yellow.
+ *    or when the provider names no model and the detector tied the engine to
+ *    any model: only this plugin's launches and re-links stamp a model tie, so
+ *    a model-tied engine on the provider's port is that provider's own engine.
+ *    A provider reads as unsure (yellow) when the engine serves an
+ *    unidentified or a different model. A running engine using its VRAM does
+ *    not read as a busy card, so the dot is green, not the unattributable
+ *    yellow.
  * 2. A provider whose engine is not running falls back to the card state: a
  *    busy card (a foreign engine holding the VRAM at 75% or more) reads as
  *    unsure, because a full card cannot be attributed to a single model, and
@@ -70,4 +76,4 @@ export declare function isGpuBusy(usage?: GpuUsageProbe | null): boolean;
  *    a saved config whose engine is down is stopped.
  */
 export declare function computeProviderStatuses(input: ProviderStatusInput): Record<string, ProviderStatus>;
-//# sourceMappingURL=status.d.ts.map
+//# sourceMappingURL=status.d.ts.map

package/packages/core/lib/status.js

@@ -11,14 +11,26 @@ export function isGpuBusy(usage) {
         return false;
     return usage.usedMiB / usage.totalMiB >= GPU_USAGE_BUSY_THRESHOLD;
 }
+/**
+ * namesNoModel reports whether one model field names no model: the absent
+ * value or the empty string. The provider side and the engine-ref side of the
+ * status tie both read it, so one rule decides both representations.
+ */
+function namesNoModel(model) {
+    return model === undefined || model === '';
+}
 /**
  * computeProviderStatuses resolves each saved provider's running-state from
  * the detector's answer. The order is the plan's contract:
  * 1. A provider whose engine the process probe confirmed running is running
  *    (green) when the detector tied that engine to the provider's exact model,
- *    and unsure (yellow) when the engine serves an unidentified or a
- *    different model. A running engine using its VRAM does not read as a busy
- *    card, so the dot is green, not the unattributable yellow.
+ *    or when the provider names no model and the detector tied the engine to
+ *    any model: only this plugin's launches and re-links stamp a model tie, so
+ *    a model-tied engine on the provider's port is that provider's own engine.
+ *    A provider reads as unsure (yellow) when the engine serves an
+ *    unidentified or a different model. A running engine using its VRAM does
+ *    not read as a busy card, so the dot is green, not the unattributable
+ *    yellow.
  * 2. A provider whose engine is not running falls back to the card state: a
  *    busy card (a foreign engine holding the VRAM at 75% or more) reads as
  *    unsure, because a full card cannot be attributed to a single model, and
@@ -37,16 +49,15 @@ export function computeProviderStatuses(input) {
         if (matches.length > 0) {
             // The engine is running. The question is which model it serves: the
             // detector's identified model, if it tied one, else unknown.
-            const identified = matches.find((ref) => ref.modelId !== undefined && ref.modelId !== '');
+            const identified = matches.find((ref) => !namesNoModel(ref.modelId));
             if (identified !== undefined &&
-                provider.model !== undefined &&
-                identified.modelId === provider.model) {
+                (namesNoModel(provider.model) || identified.modelId === provider.model)) {
                 statuses[provider.id] = 'running';
                 continue;
             }
-            // The engine is running but the model is not identified, the provider
-            // names no model, or the engine serves a different model: unsure, not
-            // a guess.
+            // The engine is running but the detector could not tie it to a model, or
+            // it serves a different model than the provider names: unsure, not a
+            // guess.
             statuses[provider.id] = 'unsure';
             continue;
         }
@@ -56,4 +67,4 @@ export function computeProviderStatuses(input) {
     }
     return statuses;
 }
-//# sourceMappingURL=status.js.map
+//# sourceMappingURL=status.js.map

package/packages/core/lib/sudo.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The pure half of the sudo-prompt rule. A sudo command run by the plugin
+ * prompts on the terminal that launched the host, where the card user cannot
+ * see it, so the runners announce the prompt and cap how long it may wait.
+ * This module holds the constants and the injected-callback guard both
+ * runners drive; the child-process wiring stays in the service and the
+ * providers, so core never touches node.
+ * @module dsh-plugin-local-infer/core/sudo
+ */
+/**
+ * SUDO_CLI_NOTE is the line the Logs section, the log file, and the streamed
+ * run show when a sudo command is waiting for the user to type the password
+ * on the CLI.
+ */
+export declare const SUDO_CLI_NOTE = "Check your CLI for a sudo prompt";
+/**
+ * SUDO_PASSWORD_TIMEOUT_MS caps how long a sudo command may wait for the user
+ * to type the password on the CLI before the run kills it and fails.
+ */
+export declare const SUDO_PASSWORD_TIMEOUT_MS = 60000;
+/**
+ * SUDO_PROBE_COMMAND is the non-interactive probe that answers whether sudo
+ * already holds cached credentials (exit 0) or is about to prompt on the
+ * terminal (non-zero). The runners execute it; core only declares it.
+ */
+export declare const SUDO_PROBE_COMMAND: readonly string[];
+/**
+ * sudoFailureDetail builds the CommandOutcome.detail text for a command the
+ * sudo deadline killed, naming the CLI note and the timeout seconds so the
+ * Logs section explains what the user missed.
+ */
+export declare function sudoFailureDetail(command: string): string;
+/**
+ * SudoTimer is the injectable set/clear pair a sudo guard arms and disarms.
+ * Tests drive the clock through a fake; the default is setTimeout and
+ * clearTimeout.
+ */
+export interface SudoTimer {
+    set: (callback: () => void, ms: number) => unknown;
+    clear: (handle: unknown) => void;
+}
+/**
+ * SudoGuardOptions tunes one guarded command run. `needsSudo` is the caller's
+ * declaration (SystemDep.requiresSudo on the install path, RunOptions.needsSudo
+ * on the lifecycle path), never inferred from the command text. `probe`
+ * answers whether sudo already holds cached credentials, `notify` announces
+ * the coming prompt once, `kill` stops the command, `timeoutMs` overrides the
+ * deadline, and `timer` swaps the clock.
+ */
+export interface SudoGuardOptions {
+    needsSudo?: boolean;
+    command: string;
+    probe: () => Promise<boolean>;
+    notify: (command: string) => void;
+    kill: () => void;
+    timeoutMs?: number;
+    timer?: SudoTimer;
+}
+/**
+ * SudoGuard is the guard's answer, read by the caller around the command run.
+ * `announced` says the prompt was announced and a deadline is armed;
+ * `disarm` clears the armed deadline once the command finishes; `timedOut`
+ * reads whether the deadline already fired, so a failed run can carry
+ * sudoFailureDetail instead of a bare exit.
+ */
+export interface SudoGuard {
+    announced: boolean;
+    disarm(): void;
+    timedOut(): boolean;
+}
+/**
+ * guardSudoCommand applies the shared sudo-prompt rule for one command, so
+ * the service install runner and the providers lifecycle host drive one rule.
+ * A command the caller does not declare sudo runs through unguarded: no
+ * probe, no announcement, no timer. A declared command probes first; cached
+ * credentials (probe resolves true) run through the same way. Otherwise the
+ * guard calls notify once and arms the timeout whose fire calls kill.
+ */
+export declare function guardSudoCommand(options: SudoGuardOptions): Promise<SudoGuard>;
+//# sourceMappingURL=sudo.d.ts.map

package/packages/core/lib/sudo.js

@@ -0,0 +1,78 @@
+/**
+ * The pure half of the sudo-prompt rule. A sudo command run by the plugin
+ * prompts on the terminal that launched the host, where the card user cannot
+ * see it, so the runners announce the prompt and cap how long it may wait.
+ * This module holds the constants and the injected-callback guard both
+ * runners drive; the child-process wiring stays in the service and the
+ * providers, so core never touches node.
+ * @module dsh-plugin-local-infer/core/sudo
+ */
+/**
+ * SUDO_CLI_NOTE is the line the Logs section, the log file, and the streamed
+ * run show when a sudo command is waiting for the user to type the password
+ * on the CLI.
+ */
+export const SUDO_CLI_NOTE = 'Check your CLI for a sudo prompt';
+/**
+ * SUDO_PASSWORD_TIMEOUT_MS caps how long a sudo command may wait for the user
+ * to type the password on the CLI before the run kills it and fails.
+ */
+export const SUDO_PASSWORD_TIMEOUT_MS = 60_000;
+/**
+ * SUDO_PROBE_COMMAND is the non-interactive probe that answers whether sudo
+ * already holds cached credentials (exit 0) or is about to prompt on the
+ * terminal (non-zero). The runners execute it; core only declares it.
+ */
+export const SUDO_PROBE_COMMAND = ['sudo', '-n', 'true'];
+/**
+ * sudoFailureDetail builds the CommandOutcome.detail text for a command the
+ * sudo deadline killed, naming the CLI note and the timeout seconds so the
+ * Logs section explains what the user missed.
+ */
+export function sudoFailureDetail(command) {
+    return (`${command} was killed: no sudo password was entered within ` +
+        `${SUDO_PASSWORD_TIMEOUT_MS / 1000} seconds. ${SUDO_CLI_NOTE}`);
+}
+/** DEFAULT_SUDO_TIMER is the guard clock when the caller injects none. */
+const DEFAULT_SUDO_TIMER = {
+    set: (callback, ms) => setTimeout(callback, ms),
+    clear: (handle) => clearTimeout(handle),
+};
+/**
+ * guardSudoCommand applies the shared sudo-prompt rule for one command, so
+ * the service install runner and the providers lifecycle host drive one rule.
+ * A command the caller does not declare sudo runs through unguarded: no
+ * probe, no announcement, no timer. A declared command probes first; cached
+ * credentials (probe resolves true) run through the same way. Otherwise the
+ * guard calls notify once and arms the timeout whose fire calls kill.
+ */
+export async function guardSudoCommand(options) {
+    if (options.needsSudo !== true) {
+        return unguarded();
+    }
+    if (await options.probe()) {
+        return unguarded();
+    }
+    options.notify(options.command);
+    const timer = options.timer ?? DEFAULT_SUDO_TIMER;
+    const timeoutMs = options.timeoutMs ?? SUDO_PASSWORD_TIMEOUT_MS;
+    let timedOut = false;
+    const handle = timer.set(() => {
+        timedOut = true;
+        options.kill();
+    }, timeoutMs);
+    return {
+        announced: true,
+        disarm: () => timer.clear(handle),
+        timedOut: () => timedOut,
+    };
+}
+/** unguarded is the pass-through guard for a run nothing was armed for. */
+function unguarded() {
+    return {
+        announced: false,
+        disarm: () => { },
+        timedOut: () => false,
+    };
+}
+//# sourceMappingURL=sudo.js.map

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-local-infer-core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Pure, framework-free domain model for the dsh local-inference plugin: ParameterSpec, HardwareProfile, EngineAdapter, VramEstimator, GuidelineEngine, DefaultsResolver, DshModelRegistrar, and SystemDepProvisioner primitives shared by every engine and model",
   "keywords": [
     "dsh",

package/packages/orchestrator/lib/config.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The Orchestrator prompt store: the saved prompt file under
+ * ~/.dsh/local-infer/orchestrator.json, the shipped prompt.md default, and
+ * the in-memory holder the system-prompt section and the settings routes
+ * share. Every read sanitizes the file, so a by-hand edit never poisons the
+ * injected prompt. Mirrors the sanitize-on-read discipline of
+ * packages/ui/src/config.ts.
+ * @module dsh-plugin-local-infer/orchestrator/config
+ */
+/**
+ * orchestratorConfigPath names the file this package owns. It sits in the
+ * shared local-infer dir beside the ui config so one place holds everything
+ * the plugin persists.
+ */
+export declare function orchestratorConfigPath(): string;
+/**
+ * StoredOrchestratorConfig is the whole persisted shape: the saved prompt,
+ * where an empty string carries "no saved prompt" so the holder falls back
+ * to the shipped default.
+ */
+export interface StoredOrchestratorConfig {
+    prompt: string;
+}
+/**
+ * readOrchestratorConfig reads the saved prompt. A missing or broken file,
+ * or a prompt field that is not a string, reads as no saved prompt (empty),
+ * so a first open and a by-hand edit both land on the default instead of
+ * throwing.
+ */
+export declare function readOrchestratorConfig(): StoredOrchestratorConfig;
+/**
+ * writeOrchestratorConfig persists the prompt, creating the directory tree
+ * on first write the same way the ui config write does.
+ */
+export declare function writeOrchestratorConfig(config: StoredOrchestratorConfig): void;
+/**
+ * defaultOrchestratorPrompt returns the shipped prompt.md text read from the
+ * package root. The URL hop is relative to this module, so src/ and lib/
+ * depths both resolve one level up to the package root. The read is cached;
+ * an unreadable file yields '' without throwing.
+ */
+export declare function defaultOrchestratorPrompt(): string;
+/**
+ * getOrchestratorPrompt returns the effective prompt: the saved value when a
+ * non-empty one exists, otherwise the shipped default. The first call reads
+ * the file once and caches, so the system-prompt section pays no per-message
+ * disk read.
+ */
+export declare function getOrchestratorPrompt(): string;
+/**
+ * setOrchestratorPrompt persists the prompt and refreshes the holder, so the
+ * injected section picks the new text up without another file read. An empty
+ * save means "no saved prompt" and falls back to the default.
+ */
+export declare function setOrchestratorPrompt(prompt: string): void;
+/**
+ * hasSavedOrchestratorPrompt reports whether the file holds a saved prompt
+ * override. The empty string is the store's sentinel for "no saved prompt",
+ * so the settings routes read the flag through here instead of re-deriving
+ * the sentinel rule the holder already applies.
+ */
+export declare function hasSavedOrchestratorPrompt(): boolean;
+//# sourceMappingURL=config.d.ts.map

package/packages/orchestrator/lib/config.js

@@ -0,0 +1,111 @@
+/**
+ * The Orchestrator prompt store: the saved prompt file under
+ * ~/.dsh/local-infer/orchestrator.json, the shipped prompt.md default, and
+ * the in-memory holder the system-prompt section and the settings routes
+ * share. Every read sanitizes the file, so a by-hand edit never poisons the
+ * injected prompt. Mirrors the sanitize-on-read discipline of
+ * packages/ui/src/config.ts.
+ * @module dsh-plugin-local-infer/orchestrator/config
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/**
+ * orchestratorConfigPath names the file this package owns. It sits in the
+ * shared local-infer dir beside the ui config so one place holds everything
+ * the plugin persists.
+ */
+export function orchestratorConfigPath() {
+    return join(homedir(), '.dsh', 'local-infer', 'orchestrator.json');
+}
+/**
+ * readOrchestratorConfig reads the saved prompt. A missing or broken file,
+ * or a prompt field that is not a string, reads as no saved prompt (empty),
+ * so a first open and a by-hand edit both land on the default instead of
+ * throwing.
+ */
+export function readOrchestratorConfig() {
+    const path = orchestratorConfigPath();
+    if (!existsSync(path)) {
+        return { prompt: '' };
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return { prompt: typeof parsed.prompt === 'string' ? parsed.prompt : '' };
+    }
+    catch {
+        return { prompt: '' };
+    }
+}
+/**
+ * writeOrchestratorConfig persists the prompt, creating the directory tree
+ * on first write the same way the ui config write does.
+ */
+export function writeOrchestratorConfig(config) {
+    const path = orchestratorConfigPath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify({ prompt: config.prompt }, null, 2));
+}
+// Cache of the shipped prompt.md text: the file never changes while the
+// process runs, so only a successful read is kept and a failed read retries
+// on the next call instead of locking in the empty fallback.
+let defaultPromptCache;
+/**
+ * defaultOrchestratorPrompt returns the shipped prompt.md text read from the
+ * package root. The URL hop is relative to this module, so src/ and lib/
+ * depths both resolve one level up to the package root. The read is cached;
+ * an unreadable file yields '' without throwing.
+ */
+export function defaultOrchestratorPrompt() {
+    if (defaultPromptCache === undefined) {
+        try {
+            defaultPromptCache = readFileSync(new URL('../prompt.md', import.meta.url), 'utf8');
+        }
+        catch {
+            return '';
+        }
+    }
+    return defaultPromptCache;
+}
+// The effective prompt holder: null until the first read refreshes it from
+// the file, then the saved value or the default until the setter persists a
+// new one.
+let effectivePrompt = null;
+/**
+ * getOrchestratorPrompt returns the effective prompt: the saved value when a
+ * non-empty one exists, otherwise the shipped default. The first call reads
+ * the file once and caches, so the system-prompt section pays no per-message
+ * disk read.
+ */
+export function getOrchestratorPrompt() {
+    if (effectivePrompt === null) {
+        effectivePrompt = toEffective(readOrchestratorConfig().prompt);
+    }
+    return effectivePrompt;
+}
+/**
+ * setOrchestratorPrompt persists the prompt and refreshes the holder, so the
+ * injected section picks the new text up without another file read. An empty
+ * save means "no saved prompt" and falls back to the default.
+ */
+export function setOrchestratorPrompt(prompt) {
+    writeOrchestratorConfig({ prompt });
+    effectivePrompt = toEffective(prompt);
+}
+/**
+ * hasSavedOrchestratorPrompt reports whether the file holds a saved prompt
+ * override. The empty string is the store's sentinel for "no saved prompt",
+ * so the settings routes read the flag through here instead of re-deriving
+ * the sentinel rule the holder already applies.
+ */
+export function hasSavedOrchestratorPrompt() {
+    return readOrchestratorConfig().prompt !== '';
+}
+/**
+ * toEffective resolves one saved value against the default: an empty saved
+ * prompt reads as no saved prompt.
+ */
+function toEffective(saved) {
+    return saved === '' ? defaultOrchestratorPrompt() : saved;
+}
+//# sourceMappingURL=config.js.map

package/packages/orchestrator/lib/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The Orchestrator capability: an editable "Orchestrator Prompt" persisted
+ * under `~/.dsh/local-infer`, defaulted from the shipped `prompt.md`, and
+ * injected into the system prompt while the component is enabled.
+ *
+ * The prompt store (saved file, shipped default, effective-prompt holder)
+ * lives in ./config.js and is re-exported here as the single source of truth
+ * the system-prompt seam (TASK-003) and the settings routes (TASK-004) pull
+ * from.
+ * @module dsh-plugin-local-infer/orchestrator
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export { defaultOrchestratorPrompt, getOrchestratorPrompt, hasSavedOrchestratorPrompt, orchestratorConfigPath, readOrchestratorConfig, setOrchestratorPrompt, writeOrchestratorConfig, } from './config.js';
+export type { StoredOrchestratorConfig } from './config.js';
+export declare const name = "local-infer-orchestrator";
+export declare const inject: string[];
+/**
+ * SystemPromptService narrows the dsh-system-prompt service to the one
+ * member this package uses. That package augments the cordis Context with
+ * `systemPrompt` and is not a dependency here, so the scoped inject casts
+ * the scope locally (same shape as the ui's WebServerService narrowing).
+ */
+export interface SystemPromptService {
+    /**
+     * Registers one ordered prompt section in the calling scope and returns
+     * the Cordis effect disposer. `text` may be a provider re-evaluated at
+     * each assembly.
+     */
+    section(section: {
+        name: string;
+        order: number;
+        text: string | (() => string);
+        interpolate?: boolean;
+    }): () => void;
+}
+/**
+ * Mount the Orchestrator prompt. The scoped `systemPrompt` inject registers
+ * the one global `orchestrator` section where the seam exists; the effect
+ * scope ties the registration to the plugin, so it unregisters with the
+ * plugin. The scoped `webServer` inject registers the /local-infer/
+ * orchestrator settings routes where that seam exists, so a headless profile
+ * keeps no routes.
+ */
+export declare function apply(ctx: Context): void;
+declare const plugin: {
+    name: string;
+    inject: string[];
+    apply: typeof apply;
+};
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/packages/orchestrator/lib/index.js

@@ -0,0 +1,73 @@
+/**
+ * The Orchestrator capability: an editable "Orchestrator Prompt" persisted
+ * under `~/.dsh/local-infer`, defaulted from the shipped `prompt.md`, and
+ * injected into the system prompt while the component is enabled.
+ *
+ * The prompt store (saved file, shipped default, effective-prompt holder)
+ * lives in ./config.js and is re-exported here as the single source of truth
+ * the system-prompt seam (TASK-003) and the settings routes (TASK-004) pull
+ * from.
+ * @module dsh-plugin-local-infer/orchestrator
+ */
+import { getOrchestratorPrompt } from './config.js';
+import { registerOrchestratorRoutes } from './route.js';
+export { defaultOrchestratorPrompt, getOrchestratorPrompt, hasSavedOrchestratorPrompt, orchestratorConfigPath, readOrchestratorConfig, setOrchestratorPrompt, writeOrchestratorConfig, } from './config.js';
+export const name = 'local-infer-orchestrator';
+// No required top-level services: the `systemPrompt` and `webServer` seams
+// are pulled with scoped injects in their own effects, so the component
+// stays loadable in profiles that lack either service.
+export const inject = [];
+// The section placement: the deployment persona prefix sits at 0 and the
+// first centrally allocated policy section (PLAN_POLICY) at 500, so 100
+// puts the Orchestrator instructions just after the persona and ahead of
+// first-party guidance. dsh-system-prompt allocates nothing between 0 and
+// 500, and external contributions may pick any finite order.
+const orchestratorSectionOrder = 100;
+/**
+ * mountSeam pulls one optional service through a scoped inject and mounts
+ * the half that needs it. A profile without the seam never runs the
+ * callback, and a mount failure is logged and swallowed so the component
+ * still loads without that half. `skipped` names the half in the catch log.
+ */
+function mountSeam(ctx, service, skipped, mount) {
+    ctx.inject([service], (scope) => {
+        try {
+            mount(scope);
+        }
+        catch (error) {
+            console.error(`[local-infer] orchestrator ${skipped}: ${error}`);
+        }
+    });
+}
+/**
+ * Mount the Orchestrator prompt. The scoped `systemPrompt` inject registers
+ * the one global `orchestrator` section where the seam exists; the effect
+ * scope ties the registration to the plugin, so it unregisters with the
+ * plugin. The scoped `webServer` inject registers the /local-infer/
+ * orchestrator settings routes where that seam exists, so a headless profile
+ * keeps no routes.
+ */
+export function apply(ctx) {
+    if (typeof ctx.inject !== 'function') {
+        return;
+    }
+    mountSeam(ctx, 'systemPrompt', 'prompt section skipped', (scope) => {
+        const systemPrompt = scope.systemPrompt;
+        systemPrompt.section({
+            name: 'orchestrator',
+            order: orchestratorSectionOrder,
+            // The prompt is user-editable text: a stray {{var}} stays literal
+            // instead of failing every later prompt assembly.
+            interpolate: false,
+            // Provider form re-reads the holder per assembly, so a settings
+            // Save reaches the next assembly without a host restart.
+            text: () => getOrchestratorPrompt(),
+        });
+    });
+    mountSeam(ctx, 'webServer', 'settings routes skipped', (scope) => {
+        registerOrchestratorRoutes(scope);
+    });
+}
+const plugin = { name, inject, apply };
+export default plugin;
+//# sourceMappingURL=index.js.map

package/packages/orchestrator/lib/route.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The Orchestrator settings routes the Web card talks to: GET
+ * /local-infer/orchestrator answers { prompt, defaultPrompt, saved } (the
+ * effective prompt, the shipped prompt.md default, and whether the effective
+ * prompt is a saved value), and POST /local-infer/orchestrator/save persists
+ * { prompt } through the config setter (an empty string clears the saved
+ * override back to the default) and answers with the same payload. The routes
+ * are held by an effect, so they go when the component does.
+ *
+ * The HTTP plumbing is a minimal local mirror of the ui package's defineRoute
+ * template (method guard 405, bounded body 413, JSON answer). The ui package
+ * does export its template, but this package deliberately keeps no dependency
+ * on ui: importing ui's route module would load its whole route graph (the
+ * service, providers, and core packages) into a component that ships disabled
+ * and must stay loadable headless, so the shared shape is copied rather than
+ * imported, and the two copies change together by hand. The stream helpers
+ * the ui template carries are dropped; these two routes only ever answer with
+ * one JSON body.
+ * @module dsh-plugin-local-infer/orchestrator/route
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/**
+ * OrchestratorRoute is one webServer route definition the register step holds
+ * by an effect: the stable name, the exact-match path, and the handler the web
+ * server invokes per request.
+ */
+export interface OrchestratorRoute {
+    name: string;
+    kind: 'exact';
+    path: string;
+    handler: (req: IncomingLike, res: OutgoingLike) => void | Promise<void>;
+}
+/**
+ * The webServer service is dsh-specific and absent from the cordis Context
+ * type, so the route narrows the scoped context to the one member it needs
+ * (same shape as the ui's WebServerService narrowing).
+ */
+export interface WebServerService {
+    register(route: OrchestratorRoute): () => void;
+}
+interface IncomingLike extends AsyncIterable<Buffer> {
+    method: string;
+    url: string;
+    destroy(): void;
+}
+interface OutgoingLike {
+    writeHead(status: number, headers?: Record<string, string>): OutgoingLike;
+    end(body?: string): void;
+}
+/**
+ * registerOrchestratorRoutes registers the GET and save routes on the web
+ * server and holds them by an effect, so a component switch off removes them
+ * before the next switch on re-registers. The scoped context carries the
+ * webServer.
+ */
+export declare function registerOrchestratorRoutes(scope: Context & {
+    webServer: WebServerService;
+}): void;
+export {};
+//# sourceMappingURL=route.d.ts.map