dsh-ptc-plus 0.4.1 → 0.4.3

package/internal/worker-realm-surfaces.js

@@ -0,0 +1,197 @@
+import { runtimeIntrinsics as internal } from './runtime-intrinsics.js'
+
+const { Error, TypeError, includes, objectFreeze,
+  objectGetOwnPropertyDescriptor, objectHasOwn, toString, Reflect: privateReflect } = internal
+
+export const WORKER_REALM_MUTATION = objectFreeze({
+  STABLE: 'stable-native-divergence',
+  TEMPORARY: 'temporary-compiler-name',
+  PROGRAM: 'per-cell-program-binding',
+  USER: 'user-declaration-binding',
+  RESTORE: 'restoration-only',
+})
+
+const MUTATION_CLASSES = objectFreeze([
+  WORKER_REALM_MUTATION.STABLE,
+  WORKER_REALM_MUTATION.TEMPORARY,
+  WORKER_REALM_MUTATION.PROGRAM,
+  WORKER_REALM_MUTATION.USER,
+  WORKER_REALM_MUTATION.RESTORE,
+])
+
+export const PROCESS_CONTROL_ERROR_CODE = 'ERR_PTC_PROCESS_CONTROL'
+export const WORKER_REALM_SURFACE_CONTRACT = objectFreeze([
+  objectFreeze({
+    surface: 'console',
+    owner: 'internal/kernel-worker.js and internal/user-binding-console-worker.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: 'native Console methods; output enters the per-cell log budget',
+    reference: 'plain Node worker console methods',
+    verification: 'console-methods',
+  }),
+  objectFreeze({
+    surface: 'process.stdout.write/process.stderr.write',
+    owner: 'internal/kernel-worker.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: 'captured per cell as writable own methods; direct descriptor output remains covered by the helper transport',
+    reference: 'plain Node worker stream descriptors',
+    verification: 'stream-descriptors',
+  }),
+  objectFreeze({
+    surface: 'process.cwd',
+    owner: 'internal/worker-cwd-virtualization.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: 'recorded cwd; immutable and non-configurable when a session cwd exists',
+    reference: 'plain Node worker process descriptor',
+    verification: 'cwd-descriptor',
+  }),
+  objectFreeze({
+    surface: 'cwd-projected Node builtins',
+    owner: 'internal/worker-cwd-virtualization.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: 'relative fs, path, and child-process calls use the recorded cwd while retaining callable descriptors',
+    reference: 'plain Node worker fs, fs/promises, path, and child_process callable descriptors',
+    verification: 'cwd-projected-builtins',
+  }),
+  objectFreeze({
+    surface: 'process.exit/abort/kill/chdir',
+    owner: 'internal/worker-realm-surfaces.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: `immutable lifecycle guards; failures use ${PROCESS_CONTROL_ERROR_CODE}`,
+    reference: 'plain Node worker process descriptors',
+    verification: 'process-controls',
+  }),
+  objectFreeze({
+    surface: 'fd 1/2 and inherited child output',
+    owner: 'internal/worker-client.js and internal/worker-output-capture.js',
+    classification: 'transport-boundary',
+    contract: 'captured in the acknowledged per-cell dual-stream fence window; out-of-round output resets the worker',
+    reference: 'helper stdout/stderr transport contract in ADR 0027',
+    verification: 'descriptor-output',
+  }),
+  objectFreeze({
+    surface: 'cell module metadata',
+    owner: 'internal/session-cell-executor.js and internal/kernel-worker.js and internal/user-binding-console-worker.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: 'current cells expose import.meta url/filename/dirname; require subset exists without ambient CommonJS wrapper globals',
+    reference: 'plain Node worker CommonJS surface and the session module parent',
+    verification: 'module-surface',
+  }),
+  objectFreeze({
+    surface: 'private AsyncLocalStorage receiver methods',
+    owner: 'internal/async-local-storage-intrinsics.js',
+    classification: WORKER_REALM_MUTATION.STABLE,
+    contract: 'immutable captured getStore, enterWith, and run methods on plugin-private receivers',
+    reference: 'the corresponding native AsyncLocalStorage methods bound to a fresh receiver',
+    verification: 'private-async-local-storage',
+  }),
+  objectFreeze({
+    surface: 'AsyncLocalStorage.prototype.run',
+    owner: 'internal/async-local-storage-intrinsics.js',
+    classification: WORKER_REALM_MUTATION.TEMPORARY,
+    contract: 'native at rest; synchronously replaced only during private REPL bootstrap',
+    reference: 'plain Node worker AsyncLocalStorage descriptors',
+    verification: 'async-local-storage',
+  }),
+])
+
+function assertMutation(classification, surface) {
+  if (!includes(MUTATION_CLASSES, classification)) {
+    throw new TypeError(`unknown worker realm mutation classification: ${classification}`)
+  }
+  if (classification !== WORKER_REALM_MUTATION.STABLE) return
+  let registered = false
+  for (let index = 0; index < WORKER_REALM_SURFACE_CONTRACT.length; index += 1) {
+    const entry = WORKER_REALM_SURFACE_CONTRACT[index]
+    if (entry.surface === surface && entry.classification === classification) registered = true
+  }
+  if (!registered) {
+    throw new TypeError(`stable worker realm mutation requires a matching registered classification: ${surface}`)
+  }
+}
+
+/** The only supported write boundary for worker globals, process surfaces and native prototypes. */
+export function defineWorkerRealmProperty(classification, surface, owner, property, descriptor) {
+  assertMutation(classification, surface)
+  if (!privateReflect.defineProperty(owner, property, descriptor)) {
+    throw new TypeError(`worker realm property ${toString(property)} could not be defined`)
+  }
+  return owner
+}
+
+export function assignWorkerRealmProperty(classification, surface, owner, property, value) {
+  assertMutation(classification, surface)
+  if (!privateReflect.set(owner, property, value)) {
+    throw new TypeError(`worker realm property ${toString(property)} could not be assigned`)
+  }
+  return value
+}
+
+export function deleteWorkerRealmProperty(classification, surface, owner, property) {
+  assertMutation(classification, surface)
+  return privateReflect.deleteProperty(owner, property)
+}
+
+function codedError(code, message) {
+  const error = new Error(message)
+  privateReflect.defineProperty(error, 'code', {
+    configurable: true,
+    enumerable: true,
+    writable: true,
+    value: code,
+  })
+  return error
+}
+
+export function installProjectedProcessCwd(processObject, cwd) {
+  defineWorkerRealmProperty(WORKER_REALM_MUTATION.STABLE, 'process.cwd', processObject, 'cwd', {
+    configurable: false,
+    enumerable: true,
+    writable: false,
+    value: () => cwd,
+  })
+}
+
+export function installProcessControlGuards(processObject, properties) {
+  for (let index = 0; index < properties.length; index += 1) {
+    const property = properties[index]
+    const descriptor = objectGetOwnPropertyDescriptor(processObject, property)
+    defineWorkerRealmProperty(
+      WORKER_REALM_MUTATION.STABLE,
+      'process.exit/abort/kill/chdir',
+      processObject,
+      property,
+      {
+      configurable: false,
+      enumerable: descriptor?.enumerable ?? true,
+      writable: false,
+      value: () => {
+        throw codedError(PROCESS_CONTROL_ERROR_CODE, `process.${property} is forbidden inside the REPL kernel`)
+      },
+      },
+    )
+  }
+}
+
+/** Stable facts consumed by the conformance test and runtime documentation. */
+export function workerRealmSurfaceFacts(processObject) {
+  const descriptor = (owner, name) => {
+    const value = objectGetOwnPropertyDescriptor(owner, name)
+    return value === undefined ? undefined : {
+      configurable: value.configurable,
+      enumerable: value.enumerable,
+      writable: value.writable,
+      own: true,
+    }
+  }
+  const controls = []
+  for (const name of ['exit', 'abort', 'kill', 'chdir']) controls.push([name, descriptor(processObject, name)])
+  return {
+    cwd: descriptor(processObject, 'cwd'),
+    controls,
+    stdoutWrite: descriptor(processObject.stdout, 'write'),
+    stderrWrite: descriptor(processObject.stderr, 'write'),
+    stdoutWriteOwn: objectHasOwn(processObject.stdout, 'write'),
+    stderrWriteOwn: objectHasOwn(processObject.stderr, 'write'),
+  }
+}

package/internal/worker-repl-realm.js

@@ -0,0 +1,140 @@
+import { createContext, runInContext, runInThisContext } from 'node:vm'
+import { types } from 'node:util'
+import { protectNextAsyncLocalStorageRun } from './async-local-storage-intrinsics.js'
+import {
+  WORKER_REALM_MUTATION,
+  defineWorkerRealmProperty,
+  deleteWorkerRealmProperty,
+} from './worker-realm-surfaces.js'
+
+export const WORKER_REPL_OPTIONS = Object.freeze({ useGlobal: true })
+const NativeMap = Map
+const ownKeys = Reflect.ownKeys
+const getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor
+const createObject = Object.create
+const hasOwn = Object.hasOwn
+const sameValue = Object.is
+const isMap = types.isMap
+const mapSet = Function.prototype.call.bind(Map.prototype.set)
+const mapHas = Function.prototype.call.bind(Map.prototype.has)
+const mapForEach = Function.prototype.call.bind(Map.prototype.forEach)
+const DESCRIPTOR_FIELDS = ['configurable', 'enumerable', 'writable', 'value', 'get', 'set']
+
+/** Snapshot the native worker surface before Node installs REPL conveniences. */
+export function captureWorkerReplGlobals(globalObject = globalThis) {
+  const baseline = new NativeMap()
+  const keys = ownKeys(globalObject)
+  for (let index = 0; index < keys.length; index += 1) {
+    mapSet(baseline, keys[index], getOwnPropertyDescriptor(globalObject, keys[index]))
+  }
+  return baseline
+}
+
+function descriptorsEqual(left, right) {
+  const field = (descriptor, name) => descriptor !== undefined && hasOwn(descriptor, name)
+    ? descriptor[name] : undefined
+  return left !== undefined && right !== undefined
+    && field(left, 'configurable') === field(right, 'configurable')
+    && field(left, 'enumerable') === field(right, 'enumerable')
+    && field(left, 'writable') === field(right, 'writable')
+    && sameValue(field(left, 'value'), field(right, 'value'))
+    && field(left, 'get') === field(right, 'get')
+    && field(left, 'set') === field(right, 'set')
+}
+
+function detachedDescriptor(descriptor) {
+  const detached = createObject(null)
+  for (let index = 0; index < DESCRIPTOR_FIELDS.length; index += 1) {
+    const name = DESCRIPTOR_FIELDS[index]
+    if (hasOwn(descriptor, name)) detached[name] = descriptor[name]
+  }
+  return detached
+}
+
+/** Remove Node's REPL-only module shortcuts and restore changed native globals. */
+export function restoreWorkerReplGlobals(baseline, globalObject = globalThis) {
+  if (!isMap(baseline)) throw new TypeError('worker REPL global baseline must be a Map')
+  const keys = ownKeys(globalObject)
+  for (let index = 0; index < keys.length; index += 1) {
+    const key = keys[index]
+    if (typeof key === 'string' && !mapHas(baseline, key)
+      && !deleteWorkerRealmProperty(WORKER_REALM_MUTATION.RESTORE, undefined, globalObject, key)) {
+      throw new Error(`worker REPL added a non-configurable global ${String(key)}`)
+    }
+  }
+  mapForEach(baseline, (descriptor, key) => {
+    if (!descriptorsEqual(getOwnPropertyDescriptor(globalObject, key), descriptor)) {
+      defineWorkerRealmProperty(
+        WORKER_REALM_MUTATION.RESTORE, undefined, globalObject, key, detachedDescriptor(descriptor),
+      )
+    }
+  })
+  return globalObject
+}
+
+/** A dedicated worker is the native realm shared by its REPL and Node modules. */
+export function workerReplContext(server) {
+  if (server.context !== globalThis) {
+    throw new Error('worker REPL did not use its native global realm')
+  }
+  return server.context
+}
+
+let replAsyncContextProtected = false
+
+/** Newer Node REPLs own an AsyncLocalStorage instance whose public prototype
+ * remains user-mutable. Give only that platform instance its native operations
+ * before the first user evaluation. */
+export function protectWorkerReplAsyncContext(server) {
+  if (replAsyncContextProtected) return
+  let callbackError
+  const scope = protectNextAsyncLocalStorageRun(() => {
+    server.eval('void 0\n', server.context, 'ptc-plus-repl-bootstrap', error => { callbackError = error })
+  })
+  if (callbackError !== null && callbackError !== undefined) throw callbackError
+  replAsyncContextProtected = true
+  return scope !== undefined
+}
+
+export function runInWorkerReplRealm(source, options) {
+  return runInThisContext(source, options)
+}
+
+/** Control promises stay outside the user-mutable worker realm. */
+export function createWorkerControlPromise() {
+  return runInContext('Promise', createContext())
+}
+
+/** PTC owns settlement; the REPL's legacy domain would run Node bookkeeping
+ * through user-mutable prototypes in the shared worker realm. */
+export function disableWorkerReplDomain(domain) {
+  domain.enter = () => domain
+  domain.exit = () => domain
+  return domain
+}
+
+/** Newer REPLs format errors before the eval callback unless an owned
+ * evaluation consumes the original thrown value through handleError. */
+export function createWorkerReplErrorHandler(evaluationScope, settle) {
+  return error => {
+    const finish = evaluationScope.getStore()
+    if (finish === undefined) return 'unhandled'
+    settle(finish, error)
+    return 'ignore'
+  }
+}
+
+/** Older REPLs can bypass handleError. Keep their process-level fallback
+ * directly testable without requiring a version-specific uncaught event. */
+export function createWorkerUncaughtExceptionHandler(evaluationScope, listenerOwner = process) {
+  const handleUncaughtException = error => {
+    const finish = evaluationScope.getStore()
+    if (finish !== undefined) {
+      finish(true, error)
+      return
+    }
+    listenerOwner.removeListener('uncaughtException', handleUncaughtException)
+    throw error
+  }
+  return handleUncaughtException
+}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "dsh-ptc-plus",
-  "version": "0.4.1",
+  "version": "0.4.3",
+  "icon": "assets/ptc-plus-icon.svg",
   "description": "A session-bound agent-native REPL for DeepSeek Harness PTC mode.",
   "type": "module",
   "main": "./index.js",
@@ -25,6 +26,7 @@
     "src",
     "internal",
     "docs",
+    "assets/ptc-plus-icon.svg",
     "assets/dsh-ptc-plus-banner-en.webp",
     "assets/dsh-ptc-plus-banner-zh.webp",
     "assets/ptc-plus-bindings-en.png",
@@ -61,7 +63,7 @@
     "@codemirror/language": "^6.12.4",
     "@codemirror/state": "^6.7.4",
     "@codemirror/view": "^6.43.11",
-    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/schemastery": "^3.18.3",
     "@jridgewell/trace-mapping": "^0.3.31",
     "@lezer/highlight": "^1.2.3",
     "acorn": "^8.15.0",
@@ -87,16 +89,24 @@
     "build:check": "node scripts/client-bundle.mjs check && node scripts/compiler-bundle.mjs check",
     "test:client": "vitest run --config scripts/client-test.config.mjs",
     "test:semantics": "node --test --test-concurrency=1 test/semantic-test262.test.js test/semantic-dialect.test.js test/semantic-boundaries.test.js",
+    "semantic:check": "node scripts/semantic-obligations.mjs",
     "test:client:web": "node scripts/client-web-smoke.mjs",
     "test:client:layout": "node scripts/client-binding-layout.mjs",
     "prepack": "npm run build:check",
     "hooks:install": "node scripts/review-findings.mjs install-hook",
     "review:new": "node scripts/review-findings.mjs create",
+    "review:plan:new": "node scripts/review-findings.mjs plan-create",
+    "review:plan": "node scripts/review-findings.mjs plan",
+    "review:status": "node scripts/review-findings.mjs status",
+    "review:lane": "node scripts/review-findings.mjs lane-verdict",
+    "review:finalize": "node scripts/review-findings.mjs finalize",
+    "review:clear": "node scripts/review-findings.mjs review-clear",
     "review:validate": "node scripts/review-findings.mjs validate",
     "review:gate": "node scripts/review-findings.mjs gate",
     "session:migrate": "node scripts/migrate-session-log.mjs",
     "coverage": "node scripts/coverage.mjs",
-    "verify": "npm run review:validate && npm run build:check && node --check index.js && node --check internal/kernel-worker.js && node --check scripts/migrate-session-log.mjs && node --check scripts/expensive-headless-acceptance.mjs && node --check scripts/ab-headless-trajectories.mjs && npm run test:client && npm run coverage",
+    "coverage:focus": "node scripts/coverage.mjs --focus",
+    "verify": "npm run review:validate && npm run semantic:check && npm run build:check && node --check index.js && node --check internal/kernel-worker.js && node --check scripts/migrate-session-log.mjs && node --check scripts/expensive-headless-acceptance.mjs && node --check scripts/ab-headless-trajectories.mjs && npm run test:client && npm run coverage",
     "check": "node scripts/review-findings.mjs check",
     "test:expensive": "node scripts/expensive-headless-acceptance.mjs",
     "test:ab": "node scripts/ab-headless-trajectories.mjs"
@@ -156,6 +166,8 @@
     "@deepseek-ai/dsh-commands": "next",
     "@deepseek-ai/dsh-home-paths": "next",
     "@deepseek-ai/dsh-llm": "next",
+    "@deepseek-ai/dsh-session-format-catalog": "next",
+    "@deepseek-ai/dsh-session-format-v0-to-v1": "next",
     "@deepseek-ai/dsh-session-persistence-jsonl": "next",
     "@deepseek-ai/dsh-settings": "next",
     "@deepseek-ai/dsh-skill-filesystem": "next",
@@ -163,15 +175,36 @@
     "@deepseek-ai/dsh-tools": "next",
     "@deepseek-ai/dsh-typert-protocol": "next",
     "@deepseek-ai/dsh-typert-registry": "next",
+    "@deepseek-ai/dsh-util-workspace-path": "next",
+    "@shikijs/langs": "^4.3.1",
     "@testing-library/react": "^16.3.3",
+    "anser": "^2.3.5",
     "c8": "^12.0.0",
+    "clsx": "^2.0.0",
     "convert-source-map": "^2.0.0",
+    "diff": "^9.0.0",
     "esbuild": "0.28.2",
+    "immer": "^10.1.1",
     "jsdom": "^29.1.1",
+    "katex": "^0.16.47",
+    "mdast-util-from-markdown": "^2.0.3",
+    "mdast-util-gfm": "^3.1.0",
+    "mdast-util-math": "^3.0.0",
+    "micromark-core-commonmark": "^2.0.3",
+    "micromark-extension-gfm": "^3.0.0",
+    "micromark-extension-math": "^3.1.0",
+    "micromark-factory-space": "^2.0.1",
+    "micromark-util-character": "^2.1.1",
+    "micromark-util-classify-character": "^2.0.1",
+    "micromark-util-sanitize-uri": "^2.0.1",
+    "micromark-util-symbol": "^2.0.1",
     "playwright": "^1.63.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
+    "shiki": "^4.3.1",
+    "simple-icons": "16.31.0",
     "vitest": "^5.0.0",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "zustand": "~4.4.7"
   }
 }

package/src/client-activity.js

@@ -3,6 +3,7 @@ import {
   STATUSES as JOURNAL_STATUSES,
   BINDING_MODES,
   JOURNAL_FIELDS,
+  LANGUAGE_SEMANTICS_JOURNAL_FIELDS,
   PER_NAME_JOURNAL_FIELDS,
   LANGUAGE_SEMANTICS_JOURNAL_VERSION,
   WHOLE_ENTRY_JOURNAL_FIELDS,
@@ -33,6 +34,7 @@ import {
   USER_BINDINGS_REUSE_POLICIES,
 } from '../internal/session-journal-schema.js'
 import { normalizeLanguageSemantics } from '../internal/language-semantics.js'
+import { normalizeModuleTransform } from '../internal/module-transform-contract.js'
 import {
   VALUE_CODEC,
   DEFAULT_VALUE_LIMITS,
@@ -103,7 +105,7 @@ function isLine(value) {
 }
 
 function isSafeSequence(value) {
-  return Number.isSafeInteger(value) && value >= 0
+  return Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0)
 }
 
 function isValidPosition(value) {
@@ -185,6 +187,7 @@ function isValidValueWire(value) {
     nodeCount: value.nodes.length,
     discovered: new Set(),
     edges: 0,
+    arraySlots: 0,
     textBytes: 0,
   }
   if (!isValidValueAtom(value.root, state)) return false
@@ -194,6 +197,8 @@ function isValidValueWire(value) {
       if (!hasExactOrderedFields(node, VALUE_ARRAY_FIELDS)
         || !Number.isSafeInteger(node.length) || node.length < 0 || node.length > MAX_ARRAY_LENGTH
         || !Array.isArray(node.entries)) return false
+      state.arraySlots += node.length
+      if (state.arraySlots > MAX_ARRAY_LENGTH) return false
       let previous = -1
       for (const entry of node.entries) {
         if (!Array.isArray(entry) || entry.length !== 2 || !Number.isSafeInteger(entry[0])
@@ -292,7 +297,8 @@ function isReadableJournalUnchecked(value) {
       : value.version === 4 ? RELATIONLESS_JOURNAL_FIELDS
         : value.version === 5 ? FINGERPRINT_REUSE_JOURNAL_FIELDS
           : value.version < PER_NAME_USER_BINDINGS_JOURNAL_VERSION ? WHOLE_ENTRY_JOURNAL_FIELDS
-            : value.version < LANGUAGE_SEMANTICS_JOURNAL_VERSION ? PER_NAME_JOURNAL_FIELDS : JOURNAL_FIELDS
+          : value.version < LANGUAGE_SEMANTICS_JOURNAL_VERSION ? PER_NAME_JOURNAL_FIELDS
+            : value.version === LANGUAGE_SEMANTICS_JOURNAL_VERSION ? LANGUAGE_SEMANTICS_JOURNAL_FIELDS : JOURNAL_FIELDS
   const required = predecessor
     ? ['version', 'bindingMode', 'status', 'calls', 'operations', 'diagnostics']
     : ['version', 'bindingPolicy', 'rewritePolicy', 'moduleSemantics', 'status', 'calls', 'operations', 'diagnostics']
@@ -307,6 +313,10 @@ function isReadableJournalUnchecked(value) {
     required.push('languageSemantics')
     normalizeLanguageSemantics(value.languageSemantics)
   }
+  if (value.version > LANGUAGE_SEMANTICS_JOURNAL_VERSION) {
+    required.push('moduleTransform')
+    normalizeModuleTransform(value.moduleTransform, value.languageSemantics)
+  }
   if (!hasClosedFields(value, fields, required)
     || (predecessor && !BINDING_MODES.has(value.bindingMode))
     || (value.version >= 4 && !isValidBindingPolicy(value.bindingPolicy))