dsh-ptc-plus 0.5.2 → 0.5.4

package/internal/capability-plan.js

@@ -83,11 +83,19 @@ function createLegacyCapabilityPlan(input) {
   if (!Array.isArray(options.capabilities)) throw new TypeError('ptc-plus: capabilities must be an array')
   const ids = new Set()
   const excluded = []
+  // Ids whose own invocation path the inventory could not reach. The planner states
+  // availability from the recorded choices, so a row the inventory already proved
+  // unreachable is closed here too — otherwise a baseline full contract keeps instructing
+  // a call the composition does not deliver. The policy generation states the same fact as
+  // `availabilitySource: 'invocation-path'`; a recorded v1/v2 inventory carries no such
+  // field, so its recomposition is unchanged.
+  const pathClosed = new Set()
   const capabilities = options.capabilities.map(raw => {
     const value = record(raw, 'capability')
     const id = text(value.id, 'capability id')
     if (ids.has(id)) throw new TypeError(`ptc-plus: duplicate capability identity ${id}`)
     ids.add(id)
+    if (value.effectiveAvailability === 'closed') pathClosed.add(id)
     const revision = text(value.revision, 'capability revision')
     if (EXCLUDED_CATEGORIES.has(value.category)) {
       excluded.push({ id, revision, category: value.category })
@@ -148,8 +156,10 @@ function createLegacyCapabilityPlan(input) {
       throw new TypeError(`ptc-plus: cannot determine the MCP server owner of ${capability.id}; conflicting namespaces: ${capability.mcpServerCandidates.join(', ')}`)
     }
     const serverClosed = capability.mcpServer !== undefined && overrides[`mcpServers.${capability.mcpServer}`] === 'closed'
-    const explicit = serverClosed ? 'closed' : Object.hasOwn(overrides, capability.id) ? overrides[capability.id] : undefined
-    const entry = { id: capability.id, revision: capability.revision, category: capability.category, selection: explicit ?? 'on-demand', reason: serverClosed ? 'mcp-server-disabled' : explicit ? 'manual-override' : 'baseline-not-selected' }
+    const unreachable = pathClosed.has(capability.id)
+    const explicit = serverClosed || unreachable ? 'closed' : Object.hasOwn(overrides, capability.id) ? overrides[capability.id] : undefined
+    const entry = { id: capability.id, revision: capability.revision, category: capability.category, selection: explicit ?? 'on-demand',
+      reason: serverClosed ? 'mcp-server-disabled' : unreachable ? 'invocation-path' : explicit ? 'manual-override' : 'baseline-not-selected' }
     entries.push(entry)
     selections.set(capability.id, entry)
     if (explicit === 'full') full.push(capability)
@@ -235,6 +245,12 @@ function createLegacyCapabilityPlan(input) {
     schema, enabled: true, configurationRevision, entries,
     excluded: excluded.sort(compareIds), catalogText, directoryText, directoryCategories,
     budgets: { unit: 'utf8-bytes', budgetBytes, directoryBudgetBytes, contractBytes: bytes(catalogText), directoryBytes: bytes(directoryText), overageBytes: Math.max(0, bytes(catalogText) - budgetBytes) },
+    // Configured ids this composition resolved no definition for. The composition is built
+    // from the step's admission, so a configured capability that step does not deliver is
+    // listed here beside one that no longer exists at all — the field states what this
+    // plan could not resolve, not what this session may call, and no model-visible text is
+    // rendered from it. Reading it as the capability list would name a closed capability
+    // as available and an absent one as configured.
     unresolvedConfigurationIds: [...new Set([...baseline, ...Object.keys(overrides)])].filter(id => !capabilities.some(entry => entry.id === id)).sort(),
     statisticsStatus: settings.usable ? 'enabled' : settings.reason,
   })

package/internal/capability-policy.js

@@ -82,6 +82,19 @@ export function capabilityRule(policy, capability) {
   return { availability, disclosure, availabilitySource, disclosureSource }
 }
 
+/** The policy document a record's own words make.
+ *
+ * A configuration that saved no policy has only a synthesized document, whose bottom layer is
+ * shaped by switches that belong to no record. Editing a rule, or writing one saved cell, must
+ * start from the record's own layers instead: the declared defaults plus the layers the record
+ * wrote (the legacy override record and the usage-statistics switch `capabilityPolicyForConfig`
+ * folds into the allocation).
+ */
+export function capabilityPolicyFromRecord(config) {
+  return capabilityPolicyForConfig({ ...config, capabilityPolicy: undefined,
+    capabilityManagementEnabled: false })
+}
+
 /** Change one reusable dimension, removing only that dimension for automatic. */
 export function changeCapabilityRule(policy, id, dimension, choice) {
   const next = structuredClone(policy)

package/internal/capability-selection.js

@@ -0,0 +1,330 @@
+import { createUserMessage } from '@deepseek-ai/dsh-llm'
+import { CAPABILITY_PLAN_FORM, isPtcMessageSource, PTC_MESSAGE_SOURCE_KIND, RETIRED_SURFACE_RECORD } from './message-sources.js'
+import { CAPABILITY_DISCLOSURES } from './capability-policy.js'
+
+/**
+ * Session capability choices: the capability decisions this session recorded.
+ *
+ * The panel states two different facts side by side. The saved column answers
+ * "what does the global configuration say", and this record answers "what did
+ * this session decide". Keeping them apart is what lets a session state a choice
+ * while the global configuration still reads as it did: neither answer is
+ * derived from the other, and neither needs a session runtime.
+ *
+ * Three states, one question: no record (`none`) means the session inherits the
+ * saved column; a readable newest record (`decided`) is that session's own
+ * answer; a newest record this build cannot parse (`unreadable`) supersedes the
+ * readable ones before it, so no consumer may answer from an older record in its
+ * place. The third state is a fact about that record, not a state of the panel:
+ * every row it touches keeps its control, and recording a new decision replaces
+ * it.
+ *
+ * A choice never claims supply. It names an entry by id and never adds or
+ * restores a row, because the row it applies to exists only while the host
+ * declares that entry. A record may therefore outlive the declaration it was
+ * written for: the session keeps its decision, the catalogue stops offering the
+ * row, and nothing reads the record as a supply. `change()` asks this module's
+ * vocabulary before it appends, so a decision about an entry this vocabulary
+ * cannot name never becomes a record.
+ *
+ * A record is not the only shape this session's decision has ever had. Before
+ * this record existed, the plugin wrote a session's choices into a plan snapshot —
+ * the one it delivered, or the one a pending command receipt carried when no step
+ * had accepted it yet — and those sessions have no record at all. Reading such
+ * a session as `none` would recompose it from an empty set and withdraw choices
+ * its own log still holds, so this module reads the newest delivered plan's
+ * `sessionOverrides` as the same statement (`decided`, marked `legacy`) when the
+ * session recorded none. The delivered plan is the equivalent form of one
+ * statement, never a second owner: a record outvotes it, and the next write
+ * restates every choice this read answered with. Only a plan that delivered a
+ * choice is such a statement — an empty override map says the session inherited
+ * everything, which is the state a session without a record already reads as — and
+ * a plan that states the map unreadably reports `unreadable` for the same reason a
+ * record does.
+ *
+ * A choice about this session's capability set is a statement the session makes
+ * about itself, not correspondence with the model, and the carrier it travels on
+ * decides when it may be written. It travels as the plugin record below, which the
+ * host retains on every read and interprets as a surface node by none: a decision
+ * taken before the session's first step is therefore durable at once and never
+ * becomes a surface node ahead of the protected head. The `user/message` form is
+ * the historical carrier that 0.5.4 and earlier wrote; it is still read (a session
+ * persisted by those releases keeps its decision), and no writer produces it.
+ */
+export const CAPABILITY_SELECTION_FORM = 'capability-selection'
+export const CAPABILITY_SELECTION_SCHEMA = 'ptc-capability-selection/v1'
+
+/**
+ * The log record this session's own choice is written as.
+ *
+ * A choice about this session's capability set is the session's statement about
+ * itself, not correspondence with the model, so it belongs in the log beside the
+ * turn events rather than on the model-visible surface. A plugin record is the
+ * host's carrier for exactly that kind of fact: it is retained on every read,
+ * interpreted as a surface node by none, and it may be written at any moment —
+ * including before the host publishes its protected surface head, where a message
+ * would make the whole log unreadable.
+ *
+ * A record that exists only as a plugin record means the step that composes the
+ * next environment is the only reader that has to know it, which is why the panel
+ * and the planner read this type directly instead of waiting for a delivery.
+ */
+export const CAPABILITY_SELECTION_RECORD = 'plugin:ptc-plus/capability-selection'
+
+const MAX_CHOICES = 256
+/** The one entry-id vocabulary a choice record may use; its writer validates the same form. */
+export const CAPABILITY_ENTRY_ID = /^(tools|skills|mcp|mcpServers)\.[^\s]{1,200}$/
+const ENTRY_ID = CAPABILITY_ENTRY_ID
+const AVAILABILITY = ['enabled', 'closed', 'automatic']
+const DISCLOSURE = ['automatic', ...CAPABILITY_DISCLOSURES]
+const PREFIX = 'PTC Plus session capability choices. These are this session\'s own decisions; the global configuration still owns the saved column, and the host still owns which entries exist. Choices:'
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function sortedEntries(choices) {
+  return Object.entries(choices).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+}
+
+export function normalizeCapabilitySelection(value) {
+  if (!isRecord(value) || Reflect.ownKeys(value).length !== 2
+    || !Object.hasOwn(value, 'schema') || !Object.hasOwn(value, 'choices')) {
+    throw new TypeError('invalid capability selection')
+  }
+  if (value.schema !== CAPABILITY_SELECTION_SCHEMA) throw new TypeError('invalid capability selection schema')
+  if (!isRecord(value.choices) || Reflect.ownKeys(value.choices).length > MAX_CHOICES) {
+    throw new TypeError('invalid capability selection choices')
+  }
+  const choices = {}
+  for (const [id, choice] of sortedEntries(value.choices)) {
+    if (!ENTRY_ID.test(id) || !isRecord(choice) || Reflect.ownKeys(choice).length === 0) {
+      throw new TypeError('invalid capability selection entry')
+    }
+    const next = {}
+    for (const [dimension, selection] of Object.entries(choice)) {
+      const allowed = dimension === 'availability' ? AVAILABILITY
+        : dimension === 'disclosure' ? DISCLOSURE : undefined
+      if (allowed === undefined || !allowed.includes(selection)) throw new TypeError('invalid capability selection dimension')
+      next[dimension] = selection
+    }
+    choices[id] = next
+  }
+  return Object.freeze({ schema: CAPABILITY_SELECTION_SCHEMA,
+    choices: Object.freeze(Object.fromEntries(Object.entries(choices).map(([id, choice]) => [id, Object.freeze(choice)]))) })
+}
+
+/** The exact model-visible wording one selection record carries. */
+export function capabilitySelectionText(selection) {
+  return `${PREFIX}\n${JSON.stringify(normalizeCapabilitySelection(selection).choices)}`
+}
+
+/**
+ * The historical message this statement was written as before the record carrier.
+ *
+ * 0.5.4 and earlier appended this message on the model-visible surface, which is what
+ * `scripts/repair-session-log.mjs` repairs. No writer produces it now: the record below is
+ * the statement, and this form survives so that a session persisted by one of those releases
+ * is still read, and so that the repair has the shape it retires to build a fixture from.
+ */
+export function capabilitySelectionMessage(selection) {
+  const text = capabilitySelectionText(selection)
+  const message = createUserMessage({
+    source: { kind: PTC_MESSAGE_SOURCE_KIND, form: CAPABILITY_SELECTION_FORM },
+    content: [{ type: 'text', text }],
+  })
+  if (readCapabilitySelection(message) === undefined) throw new TypeError('invalid capability selection message')
+  return message
+}
+
+/** Read one committed plugin record back as this session's selection, or nothing. */
+export function readCapabilitySelectionRecord(event) {
+  if (event?.type !== CAPABILITY_SELECTION_RECORD || event.ignorable !== true) return undefined
+  try {
+    return normalizeCapabilitySelection(event.data)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Whether one event states this session's capability selection at all.
+ *
+ * The record type states it, and so does the historical message form. A repaired statement
+ * (`RETIRED_SURFACE_RECORD`) states it only when the payload it kept is this owner's own form:
+ * a repair retires every surface node ahead of the protected head, whichever owner wrote it, so
+ * the carrier alone says nothing about who the statement belongs to. Reading another owner's
+ * retired statement as this one would answer `unreadable` for a decision this session never made
+ * — and would then outvote the selection the session did record.
+ */
+function statesCapabilitySelection(event) {
+  if (event?.type === CAPABILITY_SELECTION_RECORD) return true
+  const source = event?.data?.source
+  return isPtcMessageSource(source) && source.form === CAPABILITY_SELECTION_FORM
+}
+
+/**
+ * Read one selection out of either carrier.
+ *
+ * A record and the historical message state the same selection, so a caller that walks a log
+ * does not have to know which release wrote it — and a repaired statement answers for the owner
+ * whose form it carries.
+ */
+export function readCapabilitySelectionStatement(event) {
+  if (event?.type === CAPABILITY_SELECTION_RECORD) return readCapabilitySelectionRecord(event)
+  if (event?.type === RETIRED_SURFACE_RECORD) {
+    return event.ignorable === true && statesCapabilitySelection(event) ? readCapabilitySelection(event.data) : undefined
+  }
+  return event?.type === 'user/message' ? readCapabilitySelection(event.data) : undefined
+}
+
+/** Read one selection record back from a message, message projection or message fact. */
+export function readCapabilitySelection(value) {
+  const source = value?.source
+  if (!isPtcMessageSource(source) || source.form !== CAPABILITY_SELECTION_FORM) return undefined
+  if (!Array.isArray(value.content) || value.content.length !== 1 || value.content[0]?.type !== 'text') return undefined
+  const text = value.content[0].text
+  if (typeof text !== 'string' || !text.startsWith(`${PREFIX}\n`)) return undefined
+  try {
+    const choices = JSON.parse(text.slice(PREFIX.length + 1))
+    const selection = normalizeCapabilitySelection({ schema: CAPABILITY_SELECTION_SCHEMA, choices })
+    return capabilitySelectionText(selection) === text ? selection : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * How this session's newest selection record reads.
+ *
+ * The newest record is the current statement whether or not this build can parse
+ * it, so an unreadable one is not evidence for an earlier record either.
+ */
+export function classifyCapabilitySelection(records) {
+  if (!Array.isArray(records)) return Object.freeze({ state: 'none' })
+  for (let index = records.length - 1; index >= 0; index -= 1) {
+    const record = records[index]
+    if (record?.form !== CAPABILITY_SELECTION_FORM) continue
+    try {
+      return Object.freeze({ state: 'decided',
+        selection: normalizeCapabilitySelection({ schema: CAPABILITY_SELECTION_SCHEMA, choices: record.choices }) })
+    } catch {
+      return Object.freeze({ state: 'unreadable' })
+    }
+  }
+  return Object.freeze({ state: 'none' })
+}
+
+/**
+ * The dimension rule one selection states, or `{}` when it states no decision.
+ *
+ * One selection is the vocabulary a saved decision, a command intent and a
+ * delivered plan's override all use; a record states dimensions. This function
+ * is the only place the two spellings meet, so a writer that copies a selection
+ * into a record and a reader that turns a delivered override back into one
+ * cannot disagree about what that selection meant. Anything narrower — a rule
+ * naming only one dimension — is already in this shape and is copied as it is.
+ */
+export function capabilityRuleOfSelection(selection) {
+  if (isRecord(selection)) return { ...selection }
+  return selection === undefined || selection === 'inherit' ? {}
+    : selection === 'automatic' ? { availability: 'automatic', disclosure: 'automatic' }
+      : selection === 'closed' ? { availability: 'closed' } : { availability: 'enabled', disclosure: selection }
+}
+
+/**
+ * The dimension form of one recorded-by-plan override.
+ *
+ * A delivered plan recorded this session's choices in the compact vocabulary a
+ * saved configuration uses — one whole selection per entry, or the dimensions a
+ * policy rule states — while a record states dimensions only. The two meet in
+ * `capabilityRuleOfSelection`, which is why the plan is an equivalent form of one
+ * statement rather than a second vocabulary: every value it reads maps back to
+ * the same compact selection, so a choice read from a plan and restated into a
+ * record says what the plan said.
+ */
+function planChoice(override) {
+  const choice = capabilityRuleOfSelection(override)
+  return Object.keys(choice).length === 0 ? undefined : choice
+}
+
+/**
+ * This session's statement as its newest delivered plan recorded it.
+ *
+ * Only a plan that delivered at least one choice is a statement: an empty
+ * override map says the session inherited everything, which is the state a
+ * session without a record already reads as, not a decision to migrate. A plan
+ * whose overrides cannot be read as this vocabulary is `unreadable` for the same
+ * reason a record is: it supersedes what came before it and this build cannot
+ * say what it decided.
+ */
+function planSelection(message) {
+  const snapshot = message?.source?.snapshot
+  const overrides = snapshot?.sessionOverrides
+  // A snapshot that states no choices at all (the v1 generation) recorded nothing to
+  // migrate. One that states them in a shape this vocabulary cannot read is
+  // `unreadable`: it supersedes what came before it, and reporting `none` would let
+  // the composition withdraw a decision the log still holds.
+  if (overrides === undefined) return Object.freeze({ state: 'none' })
+  if (!isRecord(overrides)) return Object.freeze({ state: 'unreadable' })
+  try {
+    // The entries are collected as pairs and materialized with own data properties: an
+    // override key the record vocabulary cannot name (for example `__proto__`) must reach
+    // the vocabulary check as a name it refuses, not silently become the map's prototype
+    // and leave the statement reading `none` where the record branch reads `unreadable`.
+    const entries = []
+    for (const [id, override] of sortedEntries(overrides)) {
+      const choice = planChoice(override)
+      if (choice !== undefined) entries.push([id, choice])
+    }
+    if (entries.length === 0) return Object.freeze({ state: 'none' })
+    return Object.freeze({ state: 'decided', legacy: true,
+      selection: normalizeCapabilitySelection({ schema: CAPABILITY_SELECTION_SCHEMA, choices: Object.fromEntries(entries) }) })
+  } catch {
+    return Object.freeze({ state: 'unreadable' })
+  }
+}
+
+/**
+ * How this session's newest statement reads, from its own log events.
+ *
+ * One entry answers for every consumer: a record when the session wrote one,
+ * otherwise the newest delivered plan as the equivalent form. Reading the plan
+ * only when no record exists keeps the record the newest word, so a session that
+ * upgraded and then decided again is not answered from an older plan.
+ *
+ * A caller that knows which session the log belongs to passes that identity, and a
+ * delivered plan that names a different session is then not read as this session's
+ * statement. A plan message carries the session it was composed for, and the writers
+ * that restore one require that identity; a record carries none, so the log it was
+ * appended to is its only identity.
+ */
+export function capabilitySelectionOf(events, sessionId) {
+  const records = []
+  let delivered
+  for (const event of Array.isArray(events) ? events : []) {
+    // A record is the statement itself; the message form is the same statement on a release
+    // that wrote one. A repaired statement keeps its wording and loses only the carrier, so all
+    // three take part in the same "newest statement wins" ordering — but only while the payload
+    // is this owner's own form, because the repair retires every owner's surface node.
+    if (event?.type === CAPABILITY_SELECTION_RECORD || event?.type === RETIRED_SURFACE_RECORD) {
+      if (!statesCapabilitySelection(event)) continue
+      records.push({ form: CAPABILITY_SELECTION_FORM, choices: readCapabilitySelectionStatement(event)?.choices })
+      continue
+    }
+    if (event?.type !== 'user/message') continue
+    const source = event.data?.source
+    if (!isPtcMessageSource(source)) continue
+    if (source.form === CAPABILITY_SELECTION_FORM) {
+      records.push({ form: CAPABILITY_SELECTION_FORM, choices: readCapabilitySelection(event.data)?.choices })
+    } else if (source.form === CAPABILITY_PLAN_FORM
+      && (sessionId === undefined || source.sessionId === sessionId)) delivered = event.data
+  }
+  const recorded = classifyCapabilitySelection(records)
+  return recorded.state === 'none' ? planSelection(delivered) : recorded
+}
+
+/** The choice this session recorded for one entry, or `undefined` when it recorded none. */
+export function capabilityChoiceOf(statement, id) {
+  return statement?.state === 'decided' ? statement.selection.choices[id] : undefined
+}

package/internal/config-spec.js

@@ -130,10 +130,10 @@ export const CONFIG_FIELDS = Object.freeze([
     type: 'enum',
     options: Object.freeze(['stateful', 'protected']),
     default: 'stateful',
-    label: '允许重声明和覆盖',
-    labelEn: 'Allow redeclarations and overrides',
-    description: '同一作用域的声明和赋值可更新变量、函数、类及导入。关闭后检测跨 cell 重声明，并保护新建的 const 和 import；静态 import/export 始终可用。',
-    descriptionEn: 'Declarations and assignments update variables, functions, classes and imports in the same scope. Disabling detects cross-cell redeclarations and protects newly created const and import bindings; static import/export remains available.',
+    label: '跨 cell 声明策略',
+    labelEn: 'Cross-cell declaration policy',
+    description: '同一作用域的声明和赋值可更新变量、函数、类及导入。选“启用名称保护”时改为检测跨 cell 重声明，并保护新建的 const 和 import；静态 import/export 始终可用。',
+    descriptionEn: 'Declarations and assignments update variables, functions, classes and imports in the same scope. With “Protect names” selected, cross-cell redeclarations are detected instead and newly created const and import bindings are protected; static import/export remains available.',
   },
   {
     key: 'canonicalizeToolCalls',
@@ -287,6 +287,15 @@ export const CONFIG_FIELDS = Object.freeze([
     description: '检测到官方持久 REPL 模式时由官方运行时接管 PTC 会话执行；PTC Plus 让出 run_code 及其进程内会话状态语义，关闭时始终由 PTC Plus 接管。',
     descriptionEn: 'Lets the official runtime own PTC session execution when the official persistent REPL mode is active; PTC Plus then leaves run_code and its in-process session-state semantics to DSH. Disabled keeps PTC Plus in charge.',
   },
+  {
+    key: 'editRewritesHistory',
+    type: 'boolean',
+    default: false,
+    label: '编辑时替换原单元格',
+    labelEn: 'Replace the edited cell in place',
+    description: '默认关闭，一般也不需要打开：编辑只会追加一次执行，原单元格和它创建的绑定都还在。开启后，编辑会替换原单元格，之后的重建按新版本进行，新版本里不再声明的名字会被点名"已被替换"，而不是悄悄消失。只有当你希望环境表现得"这一格一直就是新版本"时才需要打开。',
+    descriptionEn: 'Off by default, and usually unnecessary: an edit appends one more execution, leaving the original cell and the bindings it created in place. When on, the edit replaces the original cell, later rebuilds follow the new version, and a name the new version no longer declares is reported as replaced rather than silently disappearing. Turn it on only when the environment should behave as if that cell had always been the new version.',
+  },
   {
     key: 'tipsEnabled',
     type: 'boolean',
@@ -483,7 +492,7 @@ export const CONFIG_GROUPS = Object.freeze([
     key: 'recovery',
     label: '状态与恢复',
     labelEn: 'State and recovery',
-    fields: Object.freeze(['durableReplay', 'unmeasuredCellLimit', 'officialReplPriority', 'tipsEnabled', 'tipCooldownMessages', 'tipEscalationFailures']),
+    fields: Object.freeze(['durableReplay', 'editRewritesHistory', 'unmeasuredCellLimit', 'officialReplPriority', 'tipsEnabled', 'tipCooldownMessages', 'tipEscalationFailures']),
   },
   {
     key: 'extensions',

package/internal/cordis-tools-owner.js

@@ -5,6 +5,7 @@ import { createRequire } from 'node:module'
 import { dirname, isAbsolute, join } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { RUN_CODE } from './runtime-bridge-owner.js'
+import { sessionExecutionAvailable } from './host-tool-sdk.js'
 
 const CORDIS_PRESET_ID = 'cordis'
 const CORDIS_SKILL_NAME = 'cordis-plugin-development'
@@ -111,7 +112,7 @@ function requireFiberServices(agent, fiber, owner) {
 function absentCompanionSurfaces(agent) {
   if (typeof agent?.ctx?.get !== 'function') return undefined
   const missing = []
-  if (agent.ctx.tools?.get?.(RUN_CODE, agent) === undefined) missing.push(`the ${RUN_CODE} tool`)
+  if (!sessionExecutionAvailable(agent.ctx.tools, agent, RUN_CODE)) missing.push(`the ${RUN_CODE} tool`)
   if (agent.ctx.tools?.get?.(COMPANION_SKILL_TOOL, agent) === undefined) {
     missing.push(`the ${COMPANION_SKILL_TOOL} tool`)
   }

package/internal/direct-surface-owner.js

@@ -27,7 +27,7 @@ const INVALID_TOOL_JSON_FAILURE = Object.freeze({
 const MALFORMED_TOOL_REJECTION_ID = 'dsh-ptc-plus-malformed-tool-json'
 const MALFORMED_TOOL_REJECTION_ARGUMENTS = '{"dsh_ptc_plus_malformed_tool_json":'
 
-function adaptRunCodeSchema(tool, promptText) {
+export function adaptRunCodeSchema(tool, promptText) {
   const parameters = tool.parameters
   const properties = isRecord(parameters) ? parameters.properties : undefined
   const code = isRecord(properties) ? properties.code : undefined
@@ -109,9 +109,14 @@ export function createCordisRecoveryPolicy(initiallyEnabled) {
   })
 }
 
-function presentationState(assembly) {
-  const tools = Array.isArray(assembly?.tools) ? assembly.tools : []
-  if (!tools.some(tool => tool?.name === RUN_CODE)) {
+function presentationState(assembly, declaresRunCode, agent) {
+  const tools = Array.isArray(assembly?.tools) ? assembly.tools : undefined
+  // A host that declares tools after the presentation waterfall carries no
+  // array here; the transport it publishes is then the same fact.
+  const present = tools === undefined
+    ? declaresRunCode?.(agent) === true
+    : tools.some(tool => tool?.name === RUN_CODE)
+  if (!present) {
     return { presentation: 'native', ownerProven: false, collapseSectionName: undefined }
   }
   const collapse = PTC_COLLAPSE_SECTION_NAMES
@@ -453,6 +458,7 @@ export function createDirectSurfaceOwner({
   canonicalizeToolCalls,
   sessionId,
   toolSchemasForAgent,
+  declaresRunCode,
   userBindingsForAgent = async () => undefined,
   setAgentPresentation = async () => {},
   sessionLogView,
@@ -578,7 +584,7 @@ export function createDirectSurfaceOwner({
       const requestOwner = id === undefined ? undefined : sessionOwner(id)
       const isCurrent = () => !disposed && (requestOwner === undefined
         || (requestOwner.active && sessions.get(id) === requestOwner))
-      const initialState = presentationState(initialAssembly)
+      const initialState = presentationState(initialAssembly, declaresRunCode, agent)
       let composition = compositions.get(agent)
       if (composition === undefined && id !== undefined
         && (initialState.ownerProven || initialState.presentation === 'ptc')) {
@@ -590,11 +596,17 @@ export function createDirectSurfaceOwner({
 
       const assembly = await next()
       if (!isCurrent()) return assembly
+      // A host may declare the model-facing tool array after this waterfall, in
+      // which case the assembly carries none. The declaration surface is then
+      // host-owned: the plugin still owns presentation, sections, contexts and
+      // request policy, but it must not claim to have replaced declarations the
+      // host has not asked it for. A present but non-array declaration is still
+      // a malformed assembly.
       const tools = assembly.tools
-      if (!Array.isArray(tools)) {
+      if (tools !== undefined && !Array.isArray(tools)) {
         throw new Error('ptc-plus: incompatible prompt assembly; expected a tools array')
       }
-      const completedState = presentationState(assembly)
+      const completedState = presentationState(assembly, declaresRunCode, agent)
       if (composition === undefined && id !== undefined) {
         const state = initialState.ownerProven ? initialState : completedState
         composition = captureComposition(agent, id, state.presentation)
@@ -607,7 +619,7 @@ export function createDirectSurfaceOwner({
       const requestSignal = context?.signal !== null && typeof context?.signal === 'object'
         ? context.signal
         : undefined
-      if (!tools.some(tool => tool?.name === RUN_CODE)) {
+      if (completedState.presentation === 'native') {
         if (presentation !== 'native') {
           throw new Error(`ptc-plus: ${presentation} agent composition assembled without run_code`)
         }
@@ -625,15 +637,25 @@ export function createDirectSurfaceOwner({
       if (!isCurrent()) return assembly
       const sessionPtc = presentation !== 'native' && id !== undefined
       const sessionPtcProjection = presentation === 'ptc' && id !== undefined
-      if (sessionPtc) await capabilityEnvironment?.prepare(agent, assembly.sections)
+      // The step's admission is the delivered capability set: the Host renders its own
+      // `tools:sdk` block from it and builds a program's `tools` members from it, so a
+      // declaration composed from the registered-definitions view can name a member this
+      // step does not deliver. Reading it here keeps the declaration, the plan and the
+      // program about one set; a host that publishes no admission states no set, and the
+      // registry view is then the only evidence left.
+      const delivered = sessionPtc && context?.toolSet !== undefined
+        ? toolSchemasForAgent(agent, context.toolSet) : undefined
+      if (sessionPtc) await capabilityEnvironment?.prepare(agent, assembly.sections, false, undefined, delivered)
       const userBindings = sessionPtc ? await userBindingsForAgent(agent) : undefined
       if (!isCurrent()) return assembly
-      const runCode = tools.find(tool => tool?.name === RUN_CODE)
+      const runCode = tools?.find(tool => tool?.name === RUN_CODE)
       const promptText = currentPromptText
-      let directTools = sessionPtc ? capabilityEnvironment?.visibleSchemas(agent, tools) ?? tools : tools
+      const hostDeclaresTools = tools !== undefined
+      let directTools = tools === undefined ? undefined
+        : sessionPtc ? capabilityEnvironment?.visibleSchemas(agent, tools) ?? tools : tools
       if (sessionPtcProjection) {
         editTransport.ensureInstalled(agent)
-        directTools = [adaptRunCodeSchema(runCode, promptText)]
+        if (hostDeclaresTools) directTools = [adaptRunCodeSchema(runCode, promptText)]
       }
       const runtimeContexts = sessionPtc
         ? sessionRuntimeContexts(agent, tipConfig, {
@@ -654,9 +676,9 @@ export function createDirectSurfaceOwner({
         && assembly.sections.some(section => section?.name === 'tools:sdk'
           || (sessionPtcProjection && section?.name === completedState.collapseSectionName))
       const sections = projectsSections
-        ? (capabilityEnvironment?.projectSections(agent, assembly.sections) ?? assembly.sections).map(section => {
+        ? (capabilityEnvironment?.projectSections(agent, assembly.sections, delivered) ?? assembly.sections).map(section => {
             if (section?.name === 'tools:sdk') {
-              return { ...section, text: capabilitySdk(capabilityEnvironment?.sdk(agent, section.text) ?? section.text,
+              return { ...section, text: capabilitySdk(capabilityEnvironment?.sdk(agent, section.text, delivered) ?? section.text,
                 userBindings !== undefined, languageSemantics) }
             }
             if (sessionPtcProjection && section?.name === completedState.collapseSectionName) {
@@ -666,8 +688,13 @@ export function createDirectSurfaceOwner({
           })
         : assembly.sections
       if (id !== undefined) {
+        // A top-level call is repaired into a program call only for a member this step
+        // delivers: the admission is what the declaration and the program state, so a
+        // name the registry merely carries is a call no member answers and no schema
+        // proves. A step that published no admission keeps the registry view.
+        const callable = delivered ?? toolSchemasForAgent(agent)
         const nativeSchemas = presentation === 'ptc'
-          ? new Map((capabilityEnvironment?.visibleSchemas(agent, toolSchemasForAgent(agent)) ?? toolSchemasForAgent(agent))
+          ? new Map((capabilityEnvironment?.visibleSchemas(agent, callable) ?? callable)
             .filter(schema => typeof schema?.name === 'string'
               && schema.name !== RUN_CODE && schema.name !== EDIT_RUN_CODE)
             .map(schema => [schema.name, schema]))
@@ -685,11 +712,11 @@ export function createDirectSurfaceOwner({
 
       return {
         ...assembly,
-        tools: sessionPtcProjection
+        ...(directTools === undefined ? {} : { tools: sessionPtcProjection
           ? directTools
           : directTools.map(tool => tool?.name === RUN_CODE
             ? adaptRunCodeSchema(tool, promptText)
-            : tool),
+            : tool) }),
         sections,
       }
     },

package/internal/edit-transport-owner.js

@@ -12,7 +12,7 @@ import {
   normalizeRecoveryBoundaries,
   normalizeRewrites,
   validatedRewrites,
-  withDiagnosticWording,
+  withSettlementProof,
 } from './session-journal.js'
 import {
   EXPECTED_TARGET_CALL_SEQ,
@@ -29,6 +29,7 @@ import { sessionEvents } from './session-events.js'
 import { deepEqualJson, snapshotJsonValue } from '@deepseek-ai/dsh-util-values'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import { RUN_CODE } from './runtime-bridge-owner.js'
+import { dispatchToolCall } from './host-tool-sdk.js'
 import { CAPABILITY_EVIDENCE_KEY } from './capability-environment.js'
 import { isRecord } from './record-utils.js'
 import {
@@ -199,9 +200,9 @@ export function createEditTransportOwner(ctx, {
           derived.draftCapability,
           presentationGeneration,
         )
-    // The derived settlement records its own diagnostic wording, so a replay reads
-    // the same pairing the root path publishes.
-    const withWording = withDiagnosticWording(withDraft, withDraft[JOURNAL_KEY])
+    // The derived settlement proves its own facts, so a replay reads the same
+    // settlement the root path publishes.
+    const withWording = withSettlementProof(withDraft, withDraft[JOURNAL_KEY])
     return derived.replMemory === undefined
       ? withWording
       : withReplMemorySnapshot(withWording, derived.replMemory, presentationGeneration)
@@ -310,7 +311,7 @@ export function createEditTransportOwner(ctx, {
         const executionStart = agent.session.append('tool/ptc-dispatch-start', data)
         const derivedExec = { callId: data.subCallId, rootCallId: data.rootCallId,
           parent: rootExec.token, name: RUN_CODE, arguments: argumentsValue, agent, signal: rootSignal }
-        const dispatch = () => ctx.tools.execute(derivedExec)
+        const dispatch = () => dispatchToolCall(ctx.tools, derivedExec)
         const tentative = await executeTentative(executionStart.seq, start.rootCallSeq,
           dispatch, executionLog, derivedExec)
         const inner = tentative.result

package/internal/execution-provider-owner.js

@@ -1,4 +1,5 @@
 import { createExecutionSeam, EXECUTION_SEAM_SERVICE, LEGACY_EXECUTION_SEAM_SERVICE } from './execution-seam-compat.js'
+import { providerRetainsState } from './official-repl-priority.js'
 
 export const name = 'ptc-plus-execution-provider'
 export const inject = ['loader']
@@ -70,6 +71,11 @@ export function apply(ctx, config = {}) {
       get language() { return readOriginal().language },
       get isolation() { return readOriginal().isolation },
       get programFormat() { return readOriginal().programFormat ?? 'function-body' },
+      // This composition isolates state owners and forwards every run to the
+      // original provider, so the original's retention declaration is the
+      // truthful answer. A host plugin that reads it must not see a stateful
+      // environment reported as stateless.
+      get retainsState() { return providerRetainsState(readOriginal()) },
       get executionInstructions() { return readOriginal().executionInstructions },
       get sandboxMode() { return readOriginal().sandboxMode },
       get timeout() { return readOriginal().timeout },