dsh-ptc-plus 0.2.1 → 0.2.2

package/README.md

@@ -1,6 +1,9 @@
 # dsh-ptc-plus
 
+English | [简体中文](README.zh.md)
+
 [![Node.js ^22.19.0 || >=24.0.0](https://img.shields.io/badge/Node.js-%5E22.19.0%20%7C%7C%20%3E%3D24.0.0-5fa04e?logo=nodedotjs&logoColor=white)](package.json)
+[![npm version](https://img.shields.io/npm/v/dsh-ptc-plus?logo=npm)](https://www.npmjs.com/package/dsh-ptc-plus)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-PTC%20mode-4b6bfb)](https://github.com/deepseek-ai/deepseek-harness)
 [![Status: community plugin](https://img.shields.io/badge/Status-community%20plugin-lightgrey)](docs/publishing.md)
@@ -107,10 +110,12 @@ Open **Settings → Plugin configuration** to use the card shown above. The `ena
 
 Every setting applies live and keeps existing bindings. A submitted cell uses one configuration for its complete execution; changes made while it runs apply to cells submitted afterward. A failed change rolls back. Node fixes a worker's V8 old-generation limit when the worker starts, so that one setting is rejected while a session worker is active and can be changed after the session is disposed. A failed enable is rolled back and persisted as disabled.
 
-`cordisToolsEnabled` is off by default. Turning it on atomically adds DSH's official Cordis tools, owner guidance, and `cordis-plugin-development` companion Skill to PTC agents; turning it off removes all three. It neither switches presets nor changes the direct `run_code`/`edit_run_code` surface. Cordis runs model-written plugins against the live DSH runtime, so enabling it requires shell-level trust.
+`cordisToolsEnabled` is off by default. Turning it on atomically adds DSH's official Cordis tools, owner guidance, and exactly the `cordis-plugin-development` companion Skill to PTC agents; sibling Skills in the shipped preset are not exposed. Turning it off removes all three. It neither switches presets nor changes the direct `run_code`/`edit_run_code` surface. Cordis runs model-written plugins against the live DSH runtime, so enabling it requires shell-level trust.
 
 When a Cordis call rejects after a cell has assigned a large host or client source string, that top-level binding remains live. Retry only the Cordis call from a short later cell and reuse the binding instead of resending the source.
 
+After cold recovery or re-enabling Cordis, recorded Cordis values remain historical data but do not prove that process-local Plugins, Runs, approvals, or earlier Inspect observations are still live. PTC Plus adds a bounded recovery context until a new successful Cordis Inspect call validates the current process.
+
 See [Client UI](docs/client-ui.md), [ADR 0019](docs/adr/0019-plugin-settings-and-kill-switch.md), and [ADR 0020](docs/adr/0020-optional-cordis-tools-in-ptc-mode.md).
 
 ## Scope
@@ -119,14 +124,14 @@ PTC Plus provides the session-bound persistent `run_code` layer. DSH and the ope
 
 ## Install
 
-Requires Node.js `^22.19.0 || >=24.0.0` and DSH with TypeScript PTC mode:
+Requires Node.js `^22.19.0 || >=24.0.0` and DSH with TypeScript PTC mode. Install the published package from npm into the profile you use:
 
 ```sh
-dsh plugin --profile <profile> add github:muyuanjin/dsh-ptc-plus#main
+dsh plugin --profile <profile> add dsh-ptc-plus
 dsh --profile <profile> --dump-config
 ```
 
-Other install methods and compatibility details are in the [installation guide](docs/installation.md).
+Restart that DSH profile after installation. Version-pinned npm, GitHub, local-checkout, and tarball installs are covered in the [installation guide](docs/installation.md).
 
 `danger-full-access` is the primary supported experience. The worker isolates lifecycle, not malicious code.
 

package/README.zh.md

@@ -1,6 +1,9 @@
 # dsh-ptc-plus
 
+[English](README.md) | 简体中文
+
 [![Node.js ^22.19.0 || >=24.0.0](https://img.shields.io/badge/Node.js-%5E22.19.0%20%7C%7C%20%3E%3D24.0.0-5fa04e?logo=nodedotjs&logoColor=white)](package.json)
+[![npm version](https://img.shields.io/npm/v/dsh-ptc-plus?logo=npm)](https://www.npmjs.com/package/dsh-ptc-plus)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-PTC%20mode-4b6bfb)](https://github.com/deepseek-ai/deepseek-harness)
 [![Status: community plugin](https://img.shields.io/badge/Status-community%20plugin-lightgrey)](docs/publishing.md)
@@ -107,10 +110,12 @@ import { readFile } from 'node:fs/promises'
 
 所有设置都会实时应用，并保留已有 binding。已提交的 cell 在完整执行期间使用同一份配置；执行期间发生的更新用于随后提交的 cell。更新失败会回滚。Node 在 worker 创建时固定 V8 old-generation 上限，因此活动 session worker 存在时修改这一项会被拒绝，释放 session 后才能修改。启用失败时，运行时会回滚并把设置保持为停用。
 
-`cordisToolsEnabled` 默认关闭。打开后，DSH 官方 Cordis 工具、owner guidance 与 `cordis-plugin-development` companion Skill 会作为一个整体加入 PTC agent，关闭时也会一起移除；它不切换 preset，也不改变 `run_code`/`edit_run_code` 的直接调用面。Cordis 能在实时 DSH runtime 中运行模型编写的插件，开启它需要接受 shell 级信任。
+`cordisToolsEnabled` 默认关闭。打开后，DSH 官方 Cordis 工具、owner guidance 与精确的 `cordis-plugin-development` companion Skill 会作为一个整体加入 PTC agent；同一 shipped preset 目录中的其他 Skill 不会随之暴露。关闭时这三项也会一起移除；它不切换 preset，也不改变 `run_code`/`edit_run_code` 的直接调用面。Cordis 能在实时 DSH runtime 中运行模型编写的插件，开启它需要接受 shell 级信任。
 
 如果 Cordis 调用在 cell 已经赋值大段 host 或 client 源码之后才失败，这些顶层 binding 仍会保留。后续只需在短 cell 中重试 Cordis 调用并复用该 binding，无需再次传输源码。
 
+cold recovery 或重新启用 Cordis 后，已记录的 Cordis value 仍是历史数据，但不能证明进程内 Plugin、Run、approval 或先前 Inspect observation 仍然存活。PTC Plus 会提供有界恢复 context，直到一次新的成功 Cordis Inspect 调用验证当前进程。
+
 详见 [客户端 UI](docs/client-ui.md)、[ADR 0019](docs/adr/0019-plugin-settings-and-kill-switch.md) 与 [ADR 0020](docs/adr/0020-optional-cordis-tools-in-ptc-mode.md)。
 
 ## 范围
@@ -119,14 +124,14 @@ PTC Plus 提供会话绑定的持久 `run_code` 层。原生工具的权限、
 
 ## 安装
 
-要求 Node.js `^22.19.0 || >=24.0.0`，并已安装带 TypeScript PTC 模式的 DSH：
+要求 Node.js `^22.19.0 || >=24.0.0`，并已安装带 TypeScript PTC 模式的 DSH。把 npm 正式包安装到你实际使用的 profile：
 
 ```sh
-dsh plugin --profile <profile> add github:muyuanjin/dsh-ptc-plus#main
+dsh plugin --profile <profile> add dsh-ptc-plus
 dsh --profile <profile> --dump-config
 ```
 
-其他安装方法和兼容性说明见[安装指南](docs/installation.md)。
+安装后重启对应的 DSH profile。固定 npm 版本、GitHub、本地 checkout 和 tarball 安装方式见[安装指南](docs/installation.md)。
 
 `danger-full-access` 是首要支持方式。worker 只隔离生命周期，不隔离恶意代码。
 

package/docs/adr/0010-session-log-derived-recovery-tips.md

@@ -6,12 +6,14 @@ The persistent REPL contract must stay short enough for every request, while som
 
 ## Decision
 
-PTC Plus keeps the stable REPL guidance limited to invariants, discovery entry points, and environment-neutral boundaries. `internal/session-log-view.js` scans the event sequence once, pairs settled calls within each open turn, validates execution journals and rewrite records once, and returns immutable facts for edit targeting, successful-run reset, context distance, and canonical DSH system-prompt snapshots. Each snapshot preserves its named sections. `internal/runtime-contexts.js` renders rewrite feedback only when the rewritten cell failed or lacks a valid journal, plus at most one context from the reserved `tools:ptc-plus-tip/<trigger>/<ordinal>` name family. Successful transparent rewrites remain result metadata and do not create aggregate snapshot churn. It never emits edit provenance or target-lifecycle context: those facts belong to the registered tool call/result and its private derived-execution metadata. Tips never change the tool list, tool schemas, or system sections.
+PTC Plus keeps the stable REPL guidance limited to invariants, discovery entry points, and environment-neutral boundaries. `internal/session-log-view.js` scans the event sequence once, pairs settled calls within each open turn, validates execution journals and rewrite records once, and returns immutable facts for edit targeting, successful-run reset, context distance, normalized Cordis call/inspection counts, and canonical DSH system-prompt snapshots. Each snapshot preserves its named sections. `internal/runtime-contexts.js` renders rewrite feedback only when the rewritten cell failed or lacks a valid journal, the fixed `tools:ptc-plus-cordis-recovery` context when a new agent or Cordis enable generation contains historical Cordis transcript without a newer successful live Inspect, plus at most one context from the reserved `tools:ptc-plus-tip/<trigger>/<ordinal>` name family. Successful transparent rewrites remain result metadata and do not create aggregate snapshot churn. It never emits edit provenance or target-lifecycle context: those facts belong to the registered tool call/result and its private derived-execution metadata. These contexts never change the tool list, tool schemas, or system sections.
 
 The default triggers are a repeated binding failure and a failure whose diagnostic or structured cause identifies an executable, shell, or path problem. The first tip is concise. A matching trigger may produce another tip only after `tipCooldownMessages` model-context steps; unresolved matching tips reach the detailed form after `tipEscalationFailures` occurrences. A successful cell resets the unresolved escalation count. Every emitted tip name carries its stable trigger identity and next per-trigger ordinal. Reconstruction accepts only canonical snapshots from DSH's system-prompt owner, treats a named section as one effective-state transition even when another owner's aggregate update repeats it, and ignores legacy or malformed plugin prose. Visible wording does not determine cooldown or escalation identity.
 
 Platform wording names execution-world differences without assuming Windows, WSL, POSIX, a shell, or package-runner availability. `edit_run_code` remains independently available as a fixed real tool and does not depend on a recovery-tip trigger.
 
+The Cordis recovery context is not a failure tip and is not controlled by fatigue settings. It narrows the meaning of recorded values after a lifecycle boundary: they remain historical program data but cannot prove current process-local state. It clears only after a newly settled successful `cordis_inspect*` transcript, does not infer whether the original process survived, and never redispatches a historical effect.
+
 ## Alternatives considered
 
 - **Keep all recovery instructions in the stable system prompt.** This makes every request pay for rare failures and makes platform-specific text look universally applicable.
@@ -20,6 +22,7 @@ Platform wording names execution-world differences without assuming Windows, WSL
 - **Infer tip identity from rendered prose or one fixed section name.** Wording changes would reset history, unrelated plugin text could create false matches, and an unchanged aggregate context would not persist repeated occurrences.
 - **Change the available tools when a tip is needed.** This would break the fixed code-only direct-tool prefix and make failure state observable through schema churn.
 - **Let each runtime-context renderer scan the event log.** Independent scans duplicate parsing and can disagree about call/result pairing, turn boundaries, repair consumption, or successful-run resets. A shared projection keeps event interpretation separate from presentation policy.
+- **Mark all Cordis calls volatile.** This would discard reconstructable REPL bindings and special values merely because their external referents need revalidation. Recorded-value replay and live-state proof are separate contracts.
 
 ## Consequences
 

package/docs/adr/0020-optional-cordis-tools-in-ptc-mode.md

@@ -14,7 +14,7 @@ Tool registration must finish before the prompt assembly returned to the agent;
 
 ## Decision
 
-Add `cordisToolsEnabled: boolean`, default `false`, as a live PTC Plus setting. When enabled, PTC Plus mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and a maintained `@deepseek-ai/dsh-skill-filesystem` provider in each agent scope that exposes `run_code`; disabling it disposes both fibers immediately. The provider resolves the shipped `cordis` preset through the public `agentPresets` service and publishes only its sibling `skills` directory under a PTC Plus-specific provider name. It neither switches the current preset nor includes default roots. If an agent is created before `run_code` becomes visible, the owner retains it as pending and retries on the DSH tools-change signal.
+Add `cordisToolsEnabled: boolean`, default `false`, as a live PTC Plus setting. When enabled, PTC Plus mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and a maintained `@deepseek-ai/dsh-skill-filesystem` provider in each agent scope that exposes `run_code`; disabling it disposes both fibers immediately. The provider resolves the shipped `cordis` preset through the public `agentPresets` service and reads its sibling `skills` root without including default roots. At the public `skills.registerProvider` seam, PTC Plus transparently filters discovery and loading to exactly `cordis-plugin-development`; the maintained filesystem provider still owns parsing, resource bases, watch, invalidation, incomplete observations, and body loading. This prevents unrelated or obsolete sibling Skills from silently enlarging the PTC surface without copying the companion content or switching the current preset. If an agent is created before `run_code` becomes visible, the owner retains it as pending and retries on the DSH tools-change signal.
 
 The Skill provider and official Cordis child fiber form one reversible mount. Both must settle, and the scoped `skills` service must prove that `cordis-plugin-development` resolves from the added provider as model-invocable and loadable, before the first prompt assembly is returned. A prepended public `system-prompt/assemble` waterfall listener is the final race barrier: if collection began before the mount settled, it waits for readiness, discards that stale assembly, and invokes public assembly again so DSH recollects the official providers. It does not synthesize or mutate Cordis schemas or guidance. The Cordis fiber's resolved `inject` declaration is the authoritative required-service list, and its live registrations are the authoritative tool names, schemas, and guidance. A missing or broken preset, Skill service/tool, declared service, publication, or child fiber is a configuration error and rolls back every contribution.
 
@@ -22,6 +22,8 @@ The official plugin also registers Host inspect providers in the process-global
 
 Cordis tools remain native program bindings under `tools.*`. The PTC code-only direct-tool projection remains exactly `[run_code, edit_run_code]`; native agents and unrelated scopes do not inherit this option.
 
+Cordis definitions and Runs are process-local, while PTC journals replay every settled program binding as a recorded value without redispatch. On the first prompt for an agent or a new Cordis enable generation, PTC Plus derives whether normalized journals contain a Cordis transcript. If they do, it emits the fixed `tools:ptc-plus-cordis-recovery` runtime context: recorded values remain historical data, but the model must perform a live read-only Cordis Inspect before relying on prior IDs, state, approvals, or capability observations. The context remains until a newly settled successful `cordis_inspect*` call appears in the session log. It neither asserts that live state was lost nor reruns a mutating call.
+
 ## Alternatives Considered
 
 1. Add the Cordis row to the PTC preset. Rejected: PTC Plus is installed as a host plugin and does not own or fork DSH's shipped preset files; the operator asked for a plugin setting.
@@ -30,7 +32,8 @@ Cordis tools remain native program bindings under `tools.*`. The PTC code-only d
 4. Enable the tools by default. Rejected: the tools can execute model-written plugins against the live runtime and carry a fixed schema cost. That trust and context expansion must be explicit.
 5. Mount one global Cordis tool fiber and hide it from native agents. Rejected: its prompt hook and `@pluginId` context listener would remain global even if tool schemas were restricted, so unrelated agents would inherit behavior they did not enable.
 6. Copy `SKILL.md` into PTC Plus or add the Cordis preset's directory to global Skill roots. Rejected: copied instructions drift, while a global root leaks the optional workflow into agents that did not enable it.
+7. Publish the complete preset-local Skill directory. Rejected: directory membership is not the PTC feature contract; unrelated sibling additions would silently change the model surface and may target a different authoring workflow or tool generation.
 
 ## Consequences
 
-PTC Plus declares the maintained DSH Cordis tool, Skill filesystem, settings, and tool-runtime packages as required peers through the current release channel and mirrors them in development dependencies. They resolve from DSH's installation-maintained profile fallback; installing PTC Plus must not add a profile-local DSH core package instance. When enabled, the official Cordis schemas, guidance, and companion Skill become available together in PTC agent scopes; disabled configurations remain unchanged. Changing this option updates live agent scopes without a DSH restart, including repeated disable/re-enable cycles. A DSH release may rename or reshape its Cordis surface without requiring a mirrored-name change in PTC Plus, provided the public plugin, preset, Skill, and inspect-provider contracts remain compatible.
+PTC Plus declares the maintained DSH Cordis tool, Skill filesystem, settings, and tool-runtime packages as required peers through the current release channel and mirrors them in development dependencies. They resolve from DSH's installation-maintained profile fallback; installing PTC Plus must not add a profile-local DSH core package instance. When enabled, the official Cordis schemas, guidance, and exact companion Skill become available together in PTC agent scopes; disabled configurations remain unchanged. Changing this option updates live agent scopes without a DSH restart, including repeated disable/re-enable cycles. Resume and re-enable may append one bounded recovery snapshot but do not change stable tool schemas or system sections. A DSH release may rename or reshape its Cordis tool surface without requiring a mirrored-name change in PTC Plus, while the named companion Skill remains an explicit compatibility contract and fails activation if unavailable or inconsistent.

package/docs/architecture.md

@@ -29,7 +29,7 @@ DSH 为一个 agent composition 固定选择 `native`、`code` 或 `both`。首
 `run_code`。无目标或参数不合法时不执行，返回 `{ edited: false, reason }` 并保留原目标。
 进程内 claim 区分 executing 与 settled：抛错、取消或缺少有效 PTC journal 的派生结果立即释放；已由 journal 证明进入 runtime 的派生执行继续占用旧 target，直到外层 result 的私有 metadata 通过最终 policy 并由 session log 投影为新 target。最终 result 丢失 metadata 时由 `tools/result` 释放。session log 投影在 edit call event 处记录 eligible target，只接受 target call sequence 匹配该快照且 journal 有效、非 noop 的派生源码，因此 live 与 cold recovery 从同一持久关系决定可编辑目标。
 
-`internal/session-log-view.js` 单次前向扫描 session events，分别投影最新执行、可编辑目标、rewrite metadata 和恢复 tip
+`internal/session-log-view.js` 单次前向扫描 session events，分别投影最新执行、可编辑目标、rewrite metadata、规范 journal 中的 Cordis transcript 计数和恢复 tip
 所需事实。`edit_run_code` 不产生专用 runtime context：真实 call/result 已完整表达操作身份和结果，额外 contribution
 只会触发 DSH 聚合 runtime-context 全量快照并重复无关 policy 文本。只有失败或完成状态不可信的 rewrite feedback 才保留独立生命周期；成功的透明改写不产生 runtime context。
 
@@ -44,7 +44,7 @@ return 或打印需要展示的值。失败恢复先按状态分类：解析或
 相同提示受 `tipCooldownMessages` 间隔约束，连续未解决时才升级为详细版本，成功 cell 会重置未解决计数；提示不会改变
 system sections、tool schema 或 tool order，也不假设 Windows、WSL、POSIX、shell 或 package runner。
 
-当前策略位于独立的 `internal/recovery-tips.js` local provider，核心只消费其有界的 named context。未来外部决策插件的接入必须等待稳定的 facts/decision contract；在此之前不猜测跨插件 API，local provider 继续作为 fallback。
+当前策略位于独立的 `internal/recovery-tips.js` local provider，核心只消费其有界的 named context。另一个固定名称 `tools:ptc-plus-cordis-recovery` 只在新 agent 或 Cordis 重新启用代际观察到历史 Cordis transcript 时出现，将 replay value 限定为历史数据，并保持到 session log 出现新的成功 `cordis_inspect*` settlement；它不受疲劳阈值控制、不重放调用，也不推断 live process 是否实际丢失。未来外部决策插件的接入必须等待稳定的 facts/decision contract；在此之前不猜测跨插件 API，local provider 继续作为 fallback。
 
 ## 设置与启用开关
 
@@ -66,7 +66,7 @@ Client half 通过 `settings.plugin.item` 卡片呈现全部配置。`enabled`
 | Replacement | 只有 DSH 拥有的 compaction 或其他显式 surface replacement 可以替换已保留历史；PTC Plus 不用 replacement 表达瞬时状态。 |
 | Independent request | 新的辅助模型调用必须单独说明 route、prefix 和 token 影响，不能用它的缓存表现证明主会话前缀稳定。当前插件不发起辅助模型请求。 |
 
-一次性或会变化的 session 状态必须作为 `PromptAssembly.contexts` 的命名贡献交给 DSH。DSH 将完整快照记录为带来源的 `user/message` 并追加到历史尾部；值未变时不重复，值变化或全部消失时追加更新或 clearance。完整快照携带当时所有 owner 的命名 context，因此任一贡献变化都会使未变化贡献在新的尾部消息中再次出现；这会增加 append-only history token，但不会改写已有前缀。PTC Plus 不通过绕过 prompt assembly 的私有消息通道规避这项宿主聚合成本。此类状态不得进入 `PromptAssembly.sections`，也不得通过增删 tool、改变 schema 字段或调整 tool order 传递。
+一次性或会变化的 session 状态必须作为 `PromptAssembly.contexts` 的命名贡献交给 DSH。DSH 将完整快照记录为带来源的 `user/message` 并追加到历史尾部；值未变时不重复，值变化或全部消失时追加更新或 clearance。完整快照携带当时所有 owner 的命名 context，因此任一贡献变化都会使未变化贡献在新的尾部消息中再次出现；这会增加 append-only history token，但不会改写已有前缀。PTC Plus 不通过绕过 prompt assembly 的私有消息通道规避这项宿主聚合成本。Cordis 恢复 context 使用规范 journal 的历史 transcript 与当前 agent/enable generation 作为事实源，不能从进程内 Plugin registry 直接生成未记录输入。此类状态不得进入 `PromptAssembly.sections`，也不得通过增删 tool、改变 schema 字段或调整 tool order 传递。
 
 所有模型可见输入都必须能从 session log 重建。静态 system/schema 由 `request/header` 保存，动态 context 由带来源的 `user/message` 保存；进程内临时状态不能直接成为未记录的模型输入。在同一插件版本与配置下，普通执行结果、可编辑目标、诊断和其他插件拥有的运行期变化都不得改变 header；`edit_run_code` 的身份与结果由真实 call/result 表达，不生成 edit feedback context。插件升级、显式配置变化、provider/model route 变化、真实 native capability schema 变化，以及 DSH 拥有的 history replacement 可以使缓存从首个变化 token 起失效。
 
@@ -111,7 +111,7 @@ CodeRuntime request 已携带的 owner-provided program namespace 会被原样
 }
 ```
 
-`calls` 只保存 global、member、PTC Value Graph 编码的 args/result 或 error，以及 settlement 序号。cold replay 校验调用名称、参数、数量和提交顺序，并按 recorded settlement order 释放 recorded result；不会重新 dispatch program binding 或重做外部 effect。该规则同样适用于 native tools、owner-provided namespace 和 `code.run`，不按名称分支。若基础设施终止时仍有未结算 binding，heap 回滚到 durable frontier，discarded journal 以最先观察到的 `global.member` 保留 possible-effect boundary。effect、completeness 和 source metadata 属于 capability explorer，不伪装成 journal 字段。
+`calls` 只保存 global、member、PTC Value Graph 编码的 args/result 或 error，以及 settlement 序号。cold replay 校验调用名称、参数、数量和提交顺序，并按 recorded settlement order 释放 recorded result；不会重新 dispatch program binding 或重做外部 effect。该规则同样适用于 native tools、owner-provided namespace 和 `code.run`，不按名称分支。Cordis 的进程内对象不会因此被宣称已恢复；presentation 可以从已验证 transcript 派生重新检查要求，但不能改变 replay。若基础设施终止时仍有未结算 binding，heap 回滚到 durable frontier，discarded journal 以最先观察到的 `global.member` 保留 possible-effect boundary。effect、completeness 和 source metadata 属于 capability explorer，不伪装成 journal 字段。
 
 journal 通过 `run_code.output.presentationMeta` 附着到最终 result，再由 `tools/result` 做两阶段确认。缺失、损坏或被替换的 journal 形成 unknown/volatile 边界；未进入 runtime 的 call 由后续 `confirms` 以对应 `tool/call.seq` 证明为 no-op。volatile 源码保留在原 session log，但不参与 cold replay。
 

package/docs/client-ui.md

@@ -12,7 +12,7 @@ Host half 通过 DSH 公共 `settings` 服务注册命名空间 `ptc-plus`。字
 | 分组 | 字段 | 说明 |
 | --- | --- | --- |
 | 开关 | `enabled` | 关闭后不注册 `run_code`/`edit_run_code`、不修改 system prompt、不创建 session runtime；只保留设置 UI。 |
-| Cordis | `cordisToolsEnabled` | 默认关闭；开启后为 PTC agent 加入创造模式使用的官方 Cordis 工具、指引与 companion Skill。 |
+| Cordis | `cordisToolsEnabled` | 默认关闭；开启后为 PTC agent 加入官方 Cordis 工具、指引与精确的 `cordis-plugin-development` companion Skill，不发布同目录 sibling。 |
 | 计算 | `computeMs` / `maxWallMs` | 单 cell CPU 与墙钟预算。 |
 | 输出 | `maxOutputBytes` / `maxValueNodes` / `maxValueEdges` / `maxValueArrayLength` / `maxValueBigIntDigits` | Value Graph 与输出字节预算。 |
 | Worker | `maxOldGenerationSizeMb` / `maxNestedRunCodeDepth` | kernel worker 内存与嵌套执行深度。 |

package/docs/durability-design.md

@@ -87,7 +87,7 @@ journal、diagnostic、source、cause、call、operation、completion 和 comple
 }
 ```
 
-`settle` 必须是从 0 开始的连续序列。重放按源码产生调用，但不重新 dispatch；它校验 global、member、args 和提交数量，再按 recorded settlement order 释放 recorded value/error。这个 `recorded-value` 承诺重建的是 REPL 计算状态，不表示外部 effect 被重做、撤销或验证。completeness、effect、authority 和 source evidence 属于 capability metadata，不伪装成 journal 字段。
+`settle` 必须是从 0 开始的连续序列。重放按源码产生调用，但不重新 dispatch；它校验 global、member、args 和提交数量，再按 recorded settlement order 释放 recorded value/error。这个 `recorded-value` 承诺重建的是 REPL 计算状态，不表示外部 effect 被重做、撤销或验证。对进程内 Cordis 状态，恢复值明确只是历史数据：Cordis 可见时，固定 runtime context 要求在把旧 ID、Run、approval 或 capability observation 当作当前事实前完成一次新的成功 live Inspect。completeness、effect、authority 和 source evidence 属于 capability metadata，不伪装成 journal 字段。
 
 journal 的 capability-call `args`/`value` 与 completion value 保存 `ptc-value-graph/v1` canonical envelope，不保存 decoded rich JS value，也不依赖递归 `JSON.stringify` 或 `structuredClone`。因此深层数组/对象、own `__proto__`、`undefined`、special number、BigInt、hole、shared identity 和 cycle 不会被外层 session JSON 改写。完整支持域和预算见 [PTC Value Graph V1](value-wire.md)。
 

package/docs/program-data-plane.md

@@ -18,7 +18,7 @@ DSH authority/policy -> native dispatch -> canonical result
                                       `-> args/result + settlement transcript
 ```
 
-cold replay 校验相同的调用序列并返回 recorded value，不重新执行工具。这保证 REPL 计算状态可重建，但不声称外部 effect 可逆或仍与历史相同。
+cold replay 校验相同的调用序列并返回 recorded value，不重新执行工具。这保证 REPL 计算状态可重建，但不声称外部 effect 可逆或仍与历史相同。Cordis Plugin、Run 和 Inspect observation 属于进程内实时状态；恢复出的 Cordis value 只作为历史数据保留，后续状态性决策必须先按恢复 context 执行新的 live Inspect。
 
 同一 settlement 规则适用于当前 request 中的全部 program binding，包括 owner-provided namespace 与 `code.run`。已结算的 value/error 可进入 durable transcript；若取消、超时或 worker failure 发生时调用仍未结算，cell heap 回滚，discarded journal 以实际 `global.member` 保留 possible-effect boundary。分类来自可观察生命周期，不来自 capability 名称表。
 

package/docs/runtime-reference.md

@@ -71,10 +71,12 @@ The configuration uses `ptc-plus` as the DSH plugin ID and `dsh-ptc-plus` as the
 
 `enabled: false` is the settings-based kill switch: the Host keeps only the settings namespace and client card, and removes every runtime hook, prompt section, and tool surface. Every setting is applied live when its owner can reconcile it. A submitted cell retains one configuration snapshot through preflight, execution, binding calls, completion validation, and diagnostics; an update accepted while it runs applies to cells submitted afterward. Node fixes a worker's V8 old-generation limit at creation, so changing `maxOldGenerationSizeMb` while a session worker is active is rejected and rolled back rather than reported as applied. Other non-`enabled` updates reconfigure existing owners without replacing session-bound bindings. The settings card is available under Settings → Plugin configuration, shows “已启用” or “已停用”, and disables every control except `enabled` while the plugin is off. If a live enable or reconfiguration cannot install a complete runtime, PTC Plus unwinds or restores every owner and persists the last applied settings; a failed compensating settings write is surfaced as an activation diagnostic. The TypeScript language check is deferred until runtime activation, so a non-TypeScript host can load the plugin in disabled mode but cannot enable it.
 
-`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and the shipped `cordis-plugin-development` companion Skill in PTC agent scopes. PTC Plus resolves the official `cordis` preset through DSH's public preset service and publishes only that preset's Skill directory through the maintained filesystem provider; it does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, Skill provider, and scoped Skill load are all ready. A missing or broken preset, Skill/tool service, declared Cordis service, inconsistent inspect manifest, or rejected activation fails the setting change and removes every provisional contribution. Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code, edit_run_code]`. Agents whose `run_code` surface appears after creation are retried on the DSH tools-change signal. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
+`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the shipped `cordis-plugin-development` companion Skill in PTC agent scopes. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider own its Skill root, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. A missing or broken preset, Skill/tool service, declared Cordis service, inconsistent inspect manifest, or rejected activation fails the setting change and removes every provisional contribution. Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code, edit_run_code]`. Agents whose `run_code` surface appears after creation are retried on the DSH tools-change signal. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
 
 Keep large Cordis host or client source in a top-level binding before calling a Cordis tool. A parse or validation rejection is a runtime failure, so bindings assigned before it remain live for a short retry cell; reuse the binding instead of resending the source.
 
+Cordis Plugins and Runs are process-local. On a resumed agent or after Cordis is re-enabled, normalized journal calls can restore their recorded return values but do not prove that prior IDs, approvals, Runs, or Inspect observations are live. The fixed `tools:ptc-plus-cordis-recovery` context remains present until a new successful `cordis_inspect*` call is settled. Use that live read-only inspection before a stateful Cordis decision; do not rerun a mutating historical call merely to rebuild state.
+
 `durableReplay: false` starts new kernels without historical REPL state while preserving live bindings in the current process. It does not delete session logs.
 
 Recovery tips are disabled with `tipsEnabled: false`. When enabled, a bounded runtime context in the reserved `tools:ptc-plus-tip/<trigger>/<ordinal>` name family may appear after a repeated binding failure or a diagnostic that identifies an executable, shell, or path problem in the current execution world. The trigger and per-trigger ordinal are reconstructed from canonical named system-prompt snapshots; repeated aggregate copies and visible wording do not advance the history. A tip is subject to `tipCooldownMessages` and becomes detailed only after `tipEscalationFailures` unresolved matches; it never changes the code-only direct-tool list or schema. `edit_run_code` does not emit a runtime context because its real call and result already carry the relevant fact.

package/internal/cordis-tools-owner.js

@@ -8,6 +8,63 @@ const CORDIS_PRESET_ID = 'cordis'
 const CORDIS_SKILL_NAME = 'cordis-plugin-development'
 const CORDIS_SKILL_PROVIDER = 'ptc-plus-cordis'
 
+function exactCompanionCandidates(observation) {
+  if (Array.isArray(observation)) {
+    return observation.filter(candidate => candidate?.name === CORDIS_SKILL_NAME)
+  }
+  if (observation === null || typeof observation !== 'object'
+    || !Array.isArray(observation.candidates)) return observation
+  return {
+    ...observation,
+    candidates: observation.candidates.filter(candidate => candidate?.name === CORDIS_SKILL_NAME),
+  }
+}
+
+function exactCompanionProvider(provider) {
+  if (provider === null || typeof provider !== 'object'
+    || typeof provider.name !== 'string'
+    || typeof provider.list !== 'function'
+    || typeof provider.get !== 'function') {
+    throw new Error('ptc-plus: DSH Cordis Skill provider is incompatible')
+  }
+  return {
+    ...provider,
+    async list(options) {
+      return exactCompanionCandidates(await Reflect.apply(provider.list, provider, [options]))
+    },
+    async get(candidate, options) {
+      if (candidate?.name !== CORDIS_SKILL_NAME) return undefined
+      const skill = await Reflect.apply(provider.get, provider, [candidate, options])
+      return skill?.name === CORDIS_SKILL_NAME ? skill : undefined
+    },
+  }
+}
+
+function exactCompanionSkillPlugin(skillFilesystemPlugin) {
+  return {
+    ...skillFilesystemPlugin,
+    apply(pluginCtx, config) {
+      if (typeof pluginCtx?.extend !== 'function') {
+        throw new Error('ptc-plus: cordisToolsEnabled requires the DSH Context.extend API')
+      }
+      const skills = pluginCtx.get?.('skills')
+      if (typeof skills?.registerProvider !== 'function') {
+        throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skills.registerProvider API')
+      }
+      const facade = new Proxy(skills, {
+        get(target, property) {
+          if (property === 'registerProvider') {
+            return create => target.registerProvider(control => exactCompanionProvider(create(control)))
+          }
+          const value = Reflect.get(target, property, target)
+          return typeof value === 'function' ? value.bind(target) : value
+        },
+      })
+      return skillFilesystemPlugin.apply(pluginCtx.extend({ skills: facade }), config)
+    },
+  }
+}
+
 function requireFiberServices(agent, fiber, owner) {
   if (typeof agent?.ctx?.get !== 'function') {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH agent Context.get API')
@@ -32,8 +89,9 @@ function requireCompanionServices(agent) {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH agentPresets.resolve API')
   }
   const skills = agent.ctx.get('skills')
-  if (typeof skills?.list !== 'function' || typeof skills?.get !== 'function') {
-    throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skills list/get APIs')
+  if (typeof skills?.registerProvider !== 'function'
+    || typeof skills.list !== 'function' || typeof skills.get !== 'function') {
+    throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skills registerProvider/list/get APIs')
   }
   if (agent.ctx.tools?.get?.('skill', agent) === undefined) {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skill tool in the PTC agent scope')
@@ -57,10 +115,11 @@ async function requireCompanionSkill(agent, skills) {
     cwd: agent.session?.header?.cwd,
     scope: agent,
   }
-  const summary = (await skills.list(lookup)).find(skill => skill?.name === CORDIS_SKILL_NAME)
-  if (summary?.provider !== CORDIS_SKILL_PROVIDER
+  const owned = (await skills.list(lookup)).filter(skill => skill?.provider === CORDIS_SKILL_PROVIDER)
+  const summary = owned[0]
+  if (owned.length !== 1 || summary?.name !== CORDIS_SKILL_NAME
     || summary.invocation?.modelInvocable !== true) {
-    throw new Error(`ptc-plus: official Cordis companion Skill ${JSON.stringify(CORDIS_SKILL_NAME)} is not model-invocable`)
+    throw new Error(`ptc-plus: official Cordis Skill provider must publish exactly ${JSON.stringify(CORDIS_SKILL_NAME)} as model-invocable`)
   }
   const skill = await skills.get(CORDIS_SKILL_NAME, lookup)
   if (skill?.provider !== CORDIS_SKILL_PROVIDER
@@ -177,6 +236,7 @@ export function createCordisToolsOwner(
   const pending = new Set()
   const cordisInspectLeases = createCordisInspectLeases(ctx)
   const scopedCordisPlugin = cordisInspectLeases.plugin(cordisPlugin)
+  const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin)
   let disposed = false
 
   const leafErrors = error => error instanceof AggregateError
@@ -242,7 +302,7 @@ export function createCordisToolsOwner(
       const skillDirectory = await companionSkillDirectory(agentPresets)
       if (mount.disposed) return
 
-      const skillFiber = agent.ctx.plugin(skillFilesystemPlugin, {
+      const skillFiber = agent.ctx.plugin(scopedSkillPlugin, {
         providerName: CORDIS_SKILL_PROVIDER,
         includeDefaultRoots: false,
         customSkillDirs: [skillDirectory],

package/internal/direct-surface-owner.js

@@ -59,6 +59,38 @@ function rejection(message) {
   }
 }
 
+export function createCordisRecoveryPolicy(initiallyEnabled) {
+  const states = new WeakMap()
+  let enabled = initiallyEnabled
+  let generation = enabled ? 1 : 0
+  return Object.freeze({
+    reconfigure(nextEnabled) {
+      if (!enabled && nextEnabled) generation += 1
+      enabled = nextEnabled
+    },
+    required(agent, view) {
+      if (!enabled) return false
+      let state = states.get(agent)
+      if (state?.generation !== generation) {
+        state = {
+          generation,
+          baselineInspections: view.cordisTranscript.inspections,
+          required: view.cordisTranscript.calls > 0,
+        }
+        states.set(agent, state)
+      }
+      if (state.required
+        && view.cordisTranscript.inspections > state.baselineInspections) {
+        state.required = false
+      }
+      return state.required
+    },
+    disposeAgent(agent) {
+      states.delete(agent)
+    },
+  })
+}
+
 function presentationState(assembly) {
   const tools = Array.isArray(assembly?.tools) ? assembly.tools : []
   if (!tools.some(tool => tool?.name === RUN_CODE)) {
@@ -110,6 +142,7 @@ export function createDirectSurfaceOwner({
   const compositions = new Map()
   const canonicalRequests = new WeakMap()
   const sessions = new Map()
+  const cordisRecovery = createCordisRecoveryPolicy(runtimeConfig.cordisToolsEnabled)
   let currentCanonicalizeToolCalls = canonicalizeToolCalls
   const tipConfig = {
     enabled: runtimeConfig.tipsEnabled,
@@ -175,6 +208,7 @@ export function createDirectSurfaceOwner({
   return Object.freeze({
     reconfigure(nextConfig) {
       currentCanonicalizeToolCalls = nextConfig.canonicalizeToolCalls
+      cordisRecovery.reconfigure(nextConfig.cordisToolsEnabled)
       tipConfig.enabled = nextConfig.tipsEnabled
       tipConfig.cooldownMessages = nextConfig.tipCooldownMessages
       tipConfig.escalationFailures = nextConfig.tipEscalationFailures
@@ -231,7 +265,11 @@ export function createDirectSurfaceOwner({
         directTools = [adaptRunCodeSchema(runCode), editRunCodeSchema()]
       }
       const runtimeContexts = sessionPtc
-        ? sessionRuntimeContexts(agent, tipConfig)
+        ? sessionRuntimeContexts(agent, tipConfig, {
+          cordisRecoveryRequired(view) {
+            return cordisRecovery.required(agent, view)
+          },
+        })
         : { contexts: [] }
       const contexts = sessionPtc && Array.isArray(assembly.contexts)
         && runtimeContexts.contexts.length > 0
@@ -310,6 +348,7 @@ export function createDirectSurfaceOwner({
     disposeAgent(agent) {
       const id = sessionId(agent)
       compositions.delete(agent)
+      cordisRecovery.disposeAgent(agent)
       if (id !== undefined) clearSession(id)
     },
     disposeSession(session) {

package/internal/runtime-contexts.js

@@ -2,6 +2,8 @@ import { latestRecoveryTip } from './recovery-tips.js'
 import { projectSessionLog } from './session-log-view.js'
 
 const REWRITE_FEEDBACK = 'tools:ptc-plus-rewrite-info'
+const CORDIS_RECOVERY = 'tools:ptc-plus-cordis-recovery'
+const CORDIS_RECOVERY_TEXT = 'Recorded Cordis values in the recovered REPL are historical data, not proof that process-local Plugins, Runs, approvals, or Inspect observations still exist in the current DSH process. Before relying on prior Cordis IDs, state, or capability data, follow the current Cordis owner guidance and call the live read-only Cordis Inspect bindings through `tools.*`; do not rerun mutating Cordis calls merely to reconstruct history.'
 
 function continuationFeedback(view) {
   const run = view.latestRun
@@ -18,13 +20,17 @@ function continuationFeedback(view) {
 }
 
 /** Build all dynamic PTC contexts from one session-log projection. */
-export function sessionRuntimeContexts(agent, tipConfig) {
+export function sessionRuntimeContexts(agent, tipConfig, options = {}) {
   const view = projectSessionLog(agent)
   const rewrite = continuationFeedback(view)
   const tip = latestRecoveryTip(view, tipConfig)
+  const cordisRecovery = options.cordisRecoveryRequired?.(view) === true
+    ? { name: CORDIS_RECOVERY, text: CORDIS_RECOVERY_TEXT }
+    : undefined
   return Object.freeze({
     contexts: Object.freeze([
       ...(rewrite === undefined ? [] : [{ name: REWRITE_FEEDBACK, text: rewrite }]),
+      ...(cordisRecovery === undefined ? [] : [cordisRecovery]),
       ...(tip === undefined ? [] : [tip]),
     ]),
   })

package/internal/session-log-view.js

@@ -27,6 +27,20 @@ function isContextStep(event) {
     || (event?.type === 'user/message' && event.data?.source?.kind === 'user')
 }
 
+function cordisTranscriptFacts(timeline) {
+  let calls = 0
+  let inspections = 0
+  for (const result of timeline.results.values()) {
+    for (const call of result?.journal?.calls ?? []) {
+      if (call.global !== 'tools' || typeof call.member !== 'string'
+        || !call.member.startsWith('cordis_')) continue
+      calls += 1
+      if (call.ok === true && call.member.startsWith('cordis_inspect')) inspections += 1
+    }
+  }
+  return Object.freeze({ calls, inspections })
+}
+
 /** Project session events into immutable facts consumed by prompt presentation. */
 export function projectSessionLog(agent, requestedEdit) {
   const events = agent?.session?.events
@@ -39,6 +53,7 @@ export function projectSessionLog(agent, requestedEdit) {
       latestRun: undefined,
       editableRun: undefined,
       repairSource: undefined,
+      cordisTranscript: Object.freeze({ calls: 0, inspections: 0 }),
     })
   }
   let contextStep = 0
@@ -60,6 +75,7 @@ export function projectSessionLog(agent, requestedEdit) {
     : undefined
   const latestRun = timeline.openTurn ? timeline.latestRun : undefined
   const editableRun = timeline.openTurn ? timeline.editableRun : undefined
+  const cordisTranscript = cordisTranscriptFacts(timeline)
   return Object.freeze({
     openTurn: timeline.openTurn,
     contextStep,
@@ -68,6 +84,7 @@ export function projectSessionLog(agent, requestedEdit) {
     latestRun,
     editableRun,
     repairSource: editableRun?.source,
+    cordisTranscript,
     ...(requestedEdit === undefined ? {} : { requestedEditTarget }),
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ptc-plus",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "A session-bound agent-native REPL for DeepSeek Harness PTC mode.",
   "type": "module",
   "main": "./index.js",