dsh-ptc-plus 0.5.4 → 0.5.7

package/docs/releases/v0.5.4.md

@@ -2,7 +2,7 @@
 
 <h3 id="cn-v054">宿主适配</h3>
 
-* 目标仍是当前官方 DSH 发行：插件继续使用它的公共扩展面（设置卡片座位、会话投影、能力探测与公共 `Menu`），本版本不要求宿主侧改动，也不按宿主版本分支；`engines.dsh` 声明 `>=0.2.1-0 <0.2.3`
+* 适配 DSH `0.2.2-alpha.3` 的公共扩展面，并保留上一代宿主调用方式；设置卡片、会话投影与公共 `Menu` 不要求宿主侧改动。兼容性按公共能力判定，不按版本号分支
 * 会话的能力决定与绑定取用改为写进会话日志本身，不再占用对话消息：重载或重启后恢复会话时，面板读到的仍是当时那次决定，模型也不会因此多收到一条消息
 * 支持哪些宿主仍由通道表达，而不是由版本号判定：`latest` 与 `next` 是阻塞通道，`alpha` 线只报告结果
 
@@ -15,6 +15,7 @@
 
 <h3>修复</h3>
 
+* 新版 DSH 中，`edit_run_code` 接受的修订继续属于原调用，保留本次运行可用的工具范围，并遵循宿主的策略与取消决定；后续单元格能继续使用修订后的状态
 * 本会话关闭过的能力不再出现在任何模型可见处：`tools:sdk` 声明块、程序里真实的 `tools` 成员、`capabilities.*` 的探索结果，以及能力方案与说明段，都与这个会话真正可调的成员保持一致，关闭的能力不会只剩声明还在
 * 已保存的开关单独成列陈述，不再与本会话的记录混读：一列只回答「保存了什么」，另一列只回答「这个会话记录了什么」
 * 能力状态改用整块样式区分，而不是给控件里的文字染色：下拉控件保持正常文字颜色，只改它的填充与边框，行首的标记与那一格的词照旧陈述状态；只陈述文字的那一列改用同样底色的胶囊标签
@@ -27,8 +28,9 @@
 
 <h3>升级</h3>
 
-* 需要 Node.js `^22.19.0 || >=24.0.0`；升级插件后请重启 DSH
-* 不需要配置迁移：本版本不改配置字段；已有会话日志不需要清理或重写
+* Node.js 需同时满足插件的 `^22.19.0 || >=24.0.0` 与所选 DSH 的要求；DSH `0.2.2-alpha.3` 要求 Node.js `>=24.9.0`。升级插件后请重启 DSH
+* 不需要迁移插件配置
+* 若旧会话因能力决定或绑定取用被写到受保护的会话头之前而无法导出或重新打开，请先停止使用该 profile 的宿主，再用仓库 checkout 中的 `scripts/repair-session-log.mjs` 修复；该脚本不随 npm 包发布，插件升级不会自动改写历史日志。用法见[安装指南](../installation.md#troubleshooting)
 
 ```sh
 dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4
@@ -38,7 +40,7 @@ dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4
 
 <h3 id="en-v054">Host Compatibility</h3>
 
-* It still targets the current official DSH release and keeps using its public extension surfaces (the settings card seat, the session projection, capability probing and the public `Menu`); no host-side change is required, and no behaviour branches on a host version. `engines.dsh` declares `>=0.2.1-0 <0.2.3`
+* Adapts to the public extension surfaces of DSH `0.2.2-alpha.3` while retaining the previous Host invocation contract. Settings cards, session projections and the public `Menu` require no Host-side changes. Compatibility follows public capabilities rather than version branches
 * A session's capability decisions and binding adoption are now written into the session log itself instead of taking up conversation messages: when a session is reloaded or resumed after a restart, the panel still reads the decision that was made, and the model receives no extra message for it
 * Which hosts are supported is still expressed as channels rather than decided by a version number: `latest` and `next` are the blocking channels, and the `alpha` line is reported on without blocking a release
 
@@ -51,6 +53,7 @@ dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4
 
 <h3>Fixes</h3>
 
+* On the new DSH, a revision accepted by `edit_run_code` stays within its original call, retains the tools admitted for that run, and follows Host policy and cancellation; later cells can continue using the revised state
 * A capability this session closed no longer appears anywhere the model can see: the `tools:sdk` declaration block, the real `tools` members of a program, what `capabilities.*` can explore, and the capability plans and guidance sections all agree with the members this session can actually call, so a closed capability is never left declared on its own
 * The saved switch is stated in its own column instead of being read together with this session's record: one column answers only "what is saved", the other only "what this session recorded"
 * A capability state is told apart by the whole control instead of by tinting its words: a dropdown keeps the normal label colour and only its fill and border change, the row mark and the cell word still state the state, and a word-only cell states it as a chip of the same tone
@@ -63,8 +66,9 @@ dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4
 
 <h3>Upgrade</h3>
 
-* Requires Node.js `^22.19.0 || >=24.0.0`; restart DSH after upgrading the plugin
-* No configuration migration is needed: no configuration field changes in this version, and existing session logs need no cleanup or rewrite
+* Node.js must satisfy both the plugin's `^22.19.0 || >=24.0.0` range and the selected DSH requirements; DSH `0.2.2-alpha.3` requires Node.js `>=24.9.0`. Restart DSH after upgrading the plugin
+* No plugin configuration migration is needed
+* If an older session cannot be exported or reopened because capability decisions or binding adoption were written before its protected session head, stop the Host using that profile and repair the log with `scripts/repair-session-log.mjs` from the repository checkout. The script is not shipped in the npm package, and a plugin upgrade does not rewrite historical logs automatically. See the [installation guide](../installation.md#troubleshooting) for usage
 
 ```sh
 dsh plugin --profile <profile> add dsh-ptc-plus@0.5.4

package/docs/releases/v0.5.5.md

@@ -0,0 +1,41 @@
+[中文](#cn-v055) | [English](#en-v055)
+
+<h3 id="cn-v055">宿主适配</h3>
+
+* 适配 DSH `0.2.2-rc.1` 的公共工具执行接口，保留上一代宿主的调用方式；兼容性按宿主提供的公共能力判定
+
+<h3>修复</h3>
+
+* 新版 DSH 中，`edit_run_code` 接受的修订保留原调用关系和本次运行可用的工具范围，继续遵循宿主策略与取消决定；后续单元格能继续使用修订后的状态
+
+<h3>升级</h3>
+
+* Node.js 需同时满足插件的 `^22.19.0 || >=24.0.0` 与所选 DSH 的要求；DSH `0.2.2-rc.1` 要求 Node.js `>=24.9.0`
+* 无需迁移插件配置；升级后重启 DSH。插件升级不会自动改写历史会话日志
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.5
+```
+
+---
+
+<h3 id="en-v055">Host Compatibility</h3>
+
+* Adapts to the public tool execution interface of DSH `0.2.2-rc.1` while retaining the previous Host invocation contract; compatibility follows the public capabilities the Host provides
+
+<h3>Fixes</h3>
+
+* On the new DSH, a revision accepted by `edit_run_code` retains its original call relationship and the tools admitted for that run, and continues to follow Host policy and cancellation; later cells can continue using the revised state
+
+<h3>Upgrade</h3>
+
+* Node.js must satisfy both the plugin's `^22.19.0 || >=24.0.0` range and the selected DSH requirements; DSH `0.2.2-rc.1` requires Node.js `>=24.9.0`
+* No plugin configuration migration is needed; restart DSH after upgrading. A plugin upgrade does not rewrite historical session logs automatically
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.5
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.4...v0.5.5

package/docs/releases/v0.5.6.md

@@ -0,0 +1,45 @@
+[中文](#cn-v056) | [English](#en-v056)
+
+<h3 id="cn-v056">宿主适配</h3>
+
+* 适配 DSH `0.2.2-rc.1` 的公共工具执行接口，保留上一代宿主的调用方式；运行时接口按宿主提供的公共能力选择
+* 声明 DSH 兼容范围 `>=0.2.1-0 <0.2.3`，由宿主按官方版本预检规则判断安装与启动资格；`0.2.2-rc.1` 在该范围内
+
+<h3>修复</h3>
+
+* 新版 DSH 中，`edit_run_code` 接受的修订保留原调用关系和本次运行可用的工具范围，继续遵循宿主策略与取消决定；后续单元格能继续使用修订后的状态
+* 修复 0.5.5 将 DSH 兼容范围意外改成 `*` 的问题，恢复 0.5.4 的上下界；范围内的运行时接口仍按宿主公共能力选择
+
+<h3>升级</h3>
+
+* Node.js 需同时满足插件的 `^22.19.0 || >=24.0.0` 与所选 DSH 的要求；DSH `0.2.2-rc.1` 要求 Node.js `>=24.9.0`
+* 无需迁移插件配置；升级后重启 DSH。插件升级不会自动改写历史会话日志
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.6
+```
+
+---
+
+<h3 id="en-v056">Host Compatibility</h3>
+
+* Adapts to the public tool execution interface of DSH `0.2.2-rc.1` while retaining the previous Host invocation contract; runtime interfaces follow the Host's public capabilities
+* Declares the DSH compatibility range `>=0.2.1-0 <0.2.3`; the Host applies its official version preflight to installation and startup. This range includes `0.2.2-rc.1`
+
+<h3>Fixes</h3>
+
+* On the new DSH, a revision accepted by `edit_run_code` retains its original call relationship and the tools admitted for that run, and continues to follow Host policy and cancellation; later cells can continue using the revised state
+* Fixes 0.5.5 unintentionally changing the DSH compatibility range to `*`, restoring the bounds from 0.5.4; runtime interfaces within that range continue to follow the Host's public capabilities
+
+<h3>Upgrade</h3>
+
+* Node.js must satisfy both the plugin's `^22.19.0 || >=24.0.0` range and the selected DSH requirements; DSH `0.2.2-rc.1` requires Node.js `>=24.9.0`
+* No plugin configuration migration is needed; restart DSH after upgrading. A plugin upgrade does not rewrite historical session logs automatically
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.6
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.4...v0.5.6

package/docs/releases/v0.5.7.md

@@ -0,0 +1,51 @@
+[中文](#cn-v057) | [English](#en-v057)
+
+<h3 id="cn-v057">宿主适配</h3>
+
+* 适配 DSH `0.2.2-rc.2` 的官方 Cordis 开发 Skill；启用 `cordisToolsEnabled` 后加载 `dsh-doc`，同时保留旧版宿主的兼容入口
+* DSH 安装准入范围保持 `>=0.2.1-0 <0.2.3`；运行时接口继续按宿主提供的公共能力选择
+
+<h3>修复</h3>
+
+* 宿主显式重置程序环境后，会话变量、命名 checkpoint 和可编辑目标会被清除，重启或 fork 后也不会恢复；普通 Agent 释放仍保留可验证的会话恢复
+* 历史重置记录缺失或包含不支持的版本时，只收缩一次无法验证的状态；后续已确认的新计算可跨冷恢复和 fork 保留，不重复执行历史外部操作
+* 包含多次重置的会话日志可正常迁移，并保留重置后计算的恢复关系
+* Windows 开发启动器使用实际 Windows Node.js 检查监听端口，自动替换被占用或拒绝访问的缓存端口；手动指定的端口保持原值，探测失败时保留原缓存并停止启动
+* “绑定更新语义”设置直接显示当前策略，可选择“允许重声明和覆盖”（`stateful`）或“启用名称保护”（`protected`）；已有配置值保持不变
+
+<h3>升级</h3>
+
+* Node.js 需同时满足插件的 `^22.19.0 || >=24.0.0` 与所选 DSH 的要求；DSH `0.2.2-rc.2` 要求 Node.js `>=24.9.0`
+* 无需迁移插件配置；升级后重启 DSH。插件升级不会自动改写历史会话日志
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.7
+```
+
+---
+
+<h3 id="en-v057">Host Compatibility</h3>
+
+* Adapts to the official Cordis development Skill in DSH `0.2.2-rc.2`: enabling `cordisToolsEnabled` loads `dsh-doc`, while retaining the compatibility entry for older Hosts
+* The DSH admission range remains `>=0.2.1-0 <0.2.3`; runtime interfaces continue to follow the Host's public capabilities
+
+<h3>Fixes</h3>
+
+* An explicit Host environment reset clears session variables, named checkpoints and edit targets across restart and fork; ordinary Agent disposal still preserves verifiable session recovery
+* Missing or unsupported versions in historical reset records contract unproved state once; subsequently confirmed computation survives cold recovery and fork without repeating historical external operations
+* Session logs containing multiple resets migrate successfully while preserving recovery relationships for post-reset computation
+* The Windows development launcher probes listening ports with the actual Windows Node.js runtime and replaces occupied or denied cached ports; explicit ports remain unchanged, and failed probes preserve the cache and stop startup
+* The “Binding update semantics” setting displays the selected policy by name: “Allow redeclarations and overrides” (`stateful`) or “Protect names” (`protected`); existing configuration values remain unchanged
+
+<h3>Upgrade</h3>
+
+* Node.js must satisfy both the plugin's `^22.19.0 || >=24.0.0` range and the selected DSH requirements; DSH `0.2.2-rc.2` requires Node.js `>=24.9.0`
+* No plugin configuration migration is needed; restart DSH after upgrading. A plugin upgrade does not rewrite historical session logs automatically
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@0.5.7
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/v0.5.6...v0.5.7

package/docs/runtime-reference.md

@@ -148,17 +148,17 @@ Missing-description diagnostics append a complete DSH user message to `additiona
     tipEscalationFailures: 2
 ```
 
-The five legacy binding and module switches remain migration inputs. Complete enabled/protected choices map to the corresponding new policy; mixed old choices retain their effective controls until the user explicitly selects the new switch. The Host schema preserves an omitted `bindingUpdates` value until migration, and the settings card resolves the same policy. Selecting the switch also clears the compatibility marker.
+The five legacy binding and module switches remain migration inputs. Complete enabled/protected choices map to the corresponding new policy; mixed old choices retain their effective controls until the user explicitly selects a policy. The Host schema preserves an omitted `bindingUpdates` value until migration, and the settings card resolves the same policy. The **Binding update semantics** selector displays **Legacy settings (not migrated)** until a policy is selected, then shows **Allow redeclarations and overrides** (`stateful`) or **Protect names** (`protected`). Selecting a policy also clears the compatibility marker.
 
 `enabled: false` is the settings-based kill switch: the Host keeps the settings namespace, client card, and passive cleanup that can withdraw old PTC declarations at the next permitted accepted step. It removes execution hooks, prompt sections, and tool surfaces without reading binding storage. Settings are applied live when their owner can reconcile them, except the capability inputs frozen per session above and the activation-only seam wait `executionSeamTimeoutMs`, which is read when the plugin activates or reloads. A submitted cell retains one configuration snapshot for its budgets and policies through preflight, execution, binding calls, completion validation, and diagnostics; an update accepted while it runs applies to cells submitted afterward. Worker lifecycle bounds are not cell budgets: `maxOldGenerationSizeMb` is fixed at creation, and `workerReclaimMs` and `startupProbeMs` are read from the current configuration when a worker is created or closed. Node fixes a worker's V8 old-generation limit at creation, so changing `maxOldGenerationSizeMb` while a session worker is active or a submitted cell is preparing to execute is rejected and rolled back rather than reported as applied. Other non-`enabled` updates reconfigure existing owners without replacing session-bound bindings. The settings card renders in whichever settings seat the installed DSH declares — the sidebar **Plugins → Installed** page per-bundle configuration (`plugins.row.config`), or the preceding Host's **Settings → Plugin configuration** card (`settings.plugin.item`) ([ADR 0019](adr/0019-plugin-settings-and-kill-switch.md)) — places the main switch beside the PTC Plus title and disables every other control while the plugin is off. The card does not register in General settings; the sparkle menu opens the same complete form in an application dialog. If a live enable or reconfiguration cannot install a complete runtime, PTC Plus unwinds or restores every owner and persists the last applied settings; a failed compensating settings write is surfaced as an activation diagnostic. The TypeScript language check is deferred until runtime activation, so a non-TypeScript host can load the plugin in disabled mode but cannot enable it.
 
 `startupProbeMs` bounds the worker startup conformance probe, which must settle before the kernel reports ready. The worker reads the value from its startup data and falls back to 5000 ms when it is absent; a healthy probe settles inside the worker's own microtasks, so the bound can only fire when startup itself yields or blocks, and the failure is reported as a startup diagnostic without executing any cell. That worker-side read is verified by inspection rather than by a timer test, because a healthy probe never reaches the bound.
 
-`officialReplPriority` defaults to `false` and is evaluated against the live provider capability rather than a release number: a provider that declares `retainsState: true` keeps a program environment per state owner, and a provider that predates that declaration answers through the one retained source form (`programFormat: 'repl'`). With the setting enabled and such a provider live, this host attachment installs no session runtime, so `run_code` and its descriptors — `programFormat`, `retainsState`, `executionInstructions`, `sandboxMode` and `timeout` — stay with the official provider, and the plugin's REPL guidance, session-state semantics, recovery, editor tool, capability SDK, REPL observation and binding workbench are suspended until ownership changes back. The settings card, enablement and stored global bindings remain available so the switch can be reversed. Changing the setting or the host mode re-evaluates ownership as an installation change: the retired attachment disposes its live kernels before the other shape installs, so no committed cell mixes owners. Calls executed under the official mode produce no plugin journal records and are never recovery evidence. The plugin's provider surface forwards `programFormat` to the live original, answers `retainsState` for itself (an installed session kernel retains a per-session environment; otherwise the original declaration decides) and retains weak owner-to-original dispatch provenance for `release(owner)` — captured Agent cleanup reaches the original instances that served that owner even after adapter removal or source replacement, and a failed cleanup remains available for explicit retry. Owner-keyed retained environments and the executed program format belong to the provider that actually runs the program, and non-session consumers such as the workflow adapter keep executing through it — while `executionInstructions`, `sandboxMode` and `timeout` stay withheld while PTC Plus owns session execution. The plugin's own session kernel state is keyed by session and released through the plugin lifecycle, not by `release(owner)`.
+`officialReplPriority` defaults to `false` and is evaluated against the live provider capability rather than a release number: a provider that declares `retainsState: true` keeps a program environment per state owner, and a provider that predates that declaration answers through the one retained source form (`programFormat: 'repl'`). With the setting enabled and such a provider live, this host attachment installs no session runtime, so `run_code` and its descriptors — `programFormat`, `retainsState`, `executionInstructions`, `sandboxMode` and `timeout` — stay with the official provider, and the plugin's REPL guidance, session-state semantics, recovery, editor tool, capability SDK, REPL observation and binding workbench are suspended until ownership changes back. The settings card, enablement and stored global bindings remain available so the switch can be reversed. Changing the setting or the host mode re-evaluates ownership as an installation change: the retired attachment disposes its live kernels before the other shape installs, so no committed cell mixes owners. Calls executed under the official mode produce no plugin journal records and are never recovery evidence. The plugin's provider surface forwards `programFormat` to the live original, answers `retainsState` for itself (an installed session kernel retains a per-session environment; otherwise the original declaration decides) and retains weak owner-to-original dispatch provenance for `release(owner)` — captured Agent cleanup reaches the original instances that served that owner even after adapter removal or source replacement, and a failed cleanup remains available for explicit retry. Owner-keyed retained environments and the executed program format belong to the provider that actually runs the program, and non-session consumers such as the workflow adapter keep executing through it — while `executionInstructions`, `sandboxMode` and `timeout` stay withheld while PTC Plus owns session execution. The plugin's own kernel is keyed by session. For a live session Agent, `release(owner)` implements the Host's explicit reset: it releases the kernel and appends a durable reset boundary, clearing earlier bindings, named checkpoints and edit targets from subsequent computation. For an Agent scope whose public Cordis fiber uid is already null, release is lifecycle cleanup and preserves proven cold recovery. Both routes also clean up original-provider state; failures propagate for Host-managed retry. Non-session owners retain original-provider delegation.
 
-`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the shipped `cordis-plugin-development` companion Skill in agent scopes that expose the `run_code` and `skill` tools plus the public preset and Skill services. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider read its Skill root as an immutable bundled Host resource, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. An agent scope that omits one of those surfaces is left for later: the owner publishes nothing there, reports nothing, and retries when the tool surface changes or the next prompt is assembled. A scope whose exposed preset, Skill/tool service, declared Cordis service, inspect manifest, or activation contradicts the host contract fails the setting change at installation and removes every provisional contribution; reached through the host's own `agent/created` or assemble call it withdraws from that scope with one warning instead, so this plugin's unavailability never fails an agent another plugin created ([ADR 0029](adr/0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)). Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code]`. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
+`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the selected official companion Skill in agent scopes that expose the `run_code` and `skill` tools plus the public preset and Skill services. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider read its Skill root as an immutable bundled Host resource, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. An agent scope that omits one of those surfaces is left for later: the owner publishes nothing there, reports nothing, and retries when the tool surface changes or the next prompt is assembled. A scope whose exposed preset, Skill/tool service, declared Cordis service, inspect manifest, or activation contradicts the host contract fails the setting change at installation and removes every provisional contribution; reached through the host's own `agent/created` or assemble call it withdraws from that scope with one warning instead, so this plugin's unavailability never fails an agent another plugin created ([ADR 0029](adr/0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)). Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code]`. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
 
-The Skill root uses the preset's absolute composition path when that generation publishes one. A pathless generation is resolved through the active Host's public `pluginPackages.packageOf` service, which returns the official singular or plural preset package from that installation rather than an ambient package reachable from the plugin profile. An older generation with no such service may resolve only its historical plural package relative to the Host's `ctx.baseUrl`; the fallback is disabled whenever `pluginPackages` exists. The exact `cordis-plugin-development/SKILL.md` must exist before the mount begins. An invalid published path remains authoritative and fails instead of falling through to another generation's package layout.
+The Skill root uses the preset's absolute composition path when that generation publishes one. A pathless generation is resolved through the active Host's public `pluginPackages.packageOf` service, which returns the official singular or plural preset package from that installation rather than an ambient package reachable from the plugin profile. An older generation with no such service may resolve only its historical plural package relative to the Host's `ctx.baseUrl`; the fallback is disabled whenever `pluginPackages` exists. The root must contain `dsh-doc/SKILL.md` or the historical `cordis-plugin-development/SKILL.md`; `dsh-doc` takes precedence when both exist. The selected official name and resource base remain intact through discovery, loading and readiness validation. An invalid published path remains authoritative and fails instead of falling through to another generation's package layout.
 
 Keep large Cordis host or client source in a top-level binding before calling a Cordis tool. If that call rejects while the worker stays live, an initialized binding can be reused in a short continuation. Decide whether to retry from the operation owner's retry/idempotence contract and available execution facts; a thrown call or a smaller cell does not prove that no effect occurred.
 

package/internal/config-spec.js

@@ -130,8 +130,8 @@ export const CONFIG_FIELDS = Object.freeze([
     type: 'enum',
     options: Object.freeze(['stateful', 'protected']),
     default: 'stateful',
-    label: '跨 cell 声明策略',
-    labelEn: 'Cross-cell declaration policy',
+    label: '绑定更新语义',
+    labelEn: 'Binding update semantics',
     description: '同一作用域的声明和赋值可更新变量、函数、类及导入。选“启用名称保护”时改为检测跨 cell 重声明，并保护新建的 const 和 import；静态 import/export 始终可用。',
     descriptionEn: 'Declarations and assignments update variables, functions, classes and imports in the same scope. With “Protect names” selected, cross-cell redeclarations are detected instead and newly created const and import bindings are protected; static import/export remains available.',
   },

package/internal/cordis-tools-owner.js

@@ -8,7 +8,7 @@ import { RUN_CODE } from './runtime-bridge-owner.js'
 import { sessionExecutionAvailable } from './host-tool-sdk.js'
 
 const CORDIS_PRESET_ID = 'cordis'
-const CORDIS_SKILL_NAME = 'cordis-plugin-development'
+const COMPANION_SKILL_NAMES = Object.freeze(['dsh-doc', 'cordis-plugin-development'])
 const CORDIS_SKILL_PROVIDER = 'ptc-plus-cordis'
 const COMPANION_SKILL_TOOL = 'skill'
 const COMPANION_PACKAGE_LAYOUTS = Object.freeze([
@@ -22,19 +22,19 @@ const COMPANION_PACKAGE_LAYOUTS = Object.freeze([
   }),
 ])
 
-function exactCompanionCandidates(observation) {
+function exactCompanionCandidates(observation, skillName) {
   if (Array.isArray(observation)) {
-    return observation.filter(candidate => candidate?.name === CORDIS_SKILL_NAME)
+    return observation.filter(candidate => candidate?.name === skillName)
   }
   if (observation === null || typeof observation !== 'object'
     || !Array.isArray(observation.candidates)) return observation
   return {
     ...observation,
-    candidates: observation.candidates.filter(candidate => candidate?.name === CORDIS_SKILL_NAME),
+    candidates: observation.candidates.filter(candidate => candidate?.name === skillName),
   }
 }
 
-function exactCompanionProvider(provider) {
+function exactCompanionProvider(provider, skillName) {
   if (provider === null || typeof provider !== 'object'
     || typeof provider.name !== 'string'
     || typeof provider.list !== 'function'
@@ -44,17 +44,17 @@ function exactCompanionProvider(provider) {
   return {
     ...provider,
     async list(options) {
-      return exactCompanionCandidates(await Reflect.apply(provider.list, provider, [options]))
+      return exactCompanionCandidates(await Reflect.apply(provider.list, provider, [options]), skillName)
     },
     async get(candidate, options) {
-      if (candidate?.name !== CORDIS_SKILL_NAME) return undefined
+      if (candidate?.name !== skillName) return undefined
       const skill = await Reflect.apply(provider.get, provider, [candidate, options])
-      return skill?.name === CORDIS_SKILL_NAME ? skill : undefined
+      return skill?.name === skillName ? skill : undefined
     },
   }
 }
 
-function exactCompanionSkillPlugin(skillFilesystemPlugin) {
+function exactCompanionSkillPlugin(skillFilesystemPlugin, skillName) {
   return {
     ...skillFilesystemPlugin,
     apply(pluginCtx, config) {
@@ -68,7 +68,7 @@ function exactCompanionSkillPlugin(skillFilesystemPlugin) {
       const facade = new Proxy(skills, {
         get(target, property) {
           if (property === 'registerProvider') {
-            return create => target.registerProvider(control => exactCompanionProvider(create(control)))
+            return create => target.registerProvider(control => exactCompanionProvider(create(control), skillName))
           }
           const value = Reflect.get(target, property, target)
           return typeof value === 'function' ? value.bind(target) : value
@@ -144,12 +144,13 @@ function requireCompanionServices(agent) {
   return { agentPresets, skills }
 }
 
-function containsCompanionSkill(directory, fileExists) {
-  return fileExists(join(directory, CORDIS_SKILL_NAME, 'SKILL.md'))
+function companionSkill(directory, fileExists) {
+  const skillName = COMPANION_SKILL_NAMES.find(name => fileExists(join(directory, name, 'SKILL.md')))
+  return skillName === undefined ? undefined : { skillRoot: directory, skillName }
 }
 
 /** Resolve the official Cordis companion Skill across DSH preset generations. */
-export async function resolveCompanionSkillDirectory(agentPresets, options = {}) {
+export async function resolveCompanionSkillResource(agentPresets, options = {}) {
   const preset = await agentPresets.resolve(CORDIS_PRESET_ID)
   const resolution = typeof options === 'function' ? options() : options
   const fileExists = resolution.fileExists ?? existsSync
@@ -161,10 +162,11 @@ export async function resolveCompanionSkillDirectory(agentPresets, options = {})
       throw new Error('ptc-plus: DSH cordis preset did not expose an absolute composition path')
     }
     const directory = join(dirname(preset.path), 'skills')
-    if (!containsCompanionSkill(directory, fileExists)) {
-      throw new Error(`ptc-plus: DSH cordis preset does not contain ${CORDIS_SKILL_NAME}/SKILL.md beside its composition`)
+    const resource = companionSkill(directory, fileExists)
+    if (resource === undefined) {
+      throw new Error(`ptc-plus: DSH cordis preset does not contain a supported companion SKILL.md beside its composition`)
     }
-    return directory
+    return resource
   }
 
   for (const layout of COMPANION_PACKAGE_LAYOUTS) {
@@ -174,7 +176,8 @@ export async function resolveCompanionSkillDirectory(agentPresets, options = {})
       throw new Error(`ptc-plus: DSH pluginPackages returned an invalid ${layout.name} package resource`)
     }
     const directory = layout.skillRoot(pkg.dir)
-    if (containsCompanionSkill(directory, fileExists)) return directory
+    const resource = companionSkill(directory, fileExists)
+    if (resource !== undefined) return resource
   }
 
   if (resolution.packageOf === undefined && resolution.resolveLegacyPackageManifest !== undefined) {
@@ -186,29 +189,30 @@ export async function resolveCompanionSkillDirectory(agentPresets, options = {})
     }
     if (manifest !== undefined) {
       const directory = join(dirname(manifest), 'presets', CORDIS_PRESET_ID, 'skills')
-      if (containsCompanionSkill(directory, fileExists)) return directory
+      const resource = companionSkill(directory, fileExists)
+      if (resource !== undefined) return resource
     }
   }
-  throw new Error(`ptc-plus: the active DSH installation does not publish a loadable ${CORDIS_SKILL_NAME} companion Skill through its package-resolution surface`)
+  throw new Error(`ptc-plus: the active DSH installation does not publish a loadable official companion Skill through its package-resolution surface`)
 }
 
-async function requireCompanionSkill(agent, skills) {
+async function requireCompanionSkill(agent, skills, skillName) {
   const lookup = {
     cwd: agent.session?.header?.cwd,
     scope: agent,
   }
   const owned = (await skills.list(lookup)).filter(skill => skill?.provider === CORDIS_SKILL_PROVIDER)
   const summary = owned[0]
-  if (owned.length !== 1 || summary?.name !== CORDIS_SKILL_NAME
+  if (owned.length !== 1 || summary?.name !== skillName
     || summary.invocation?.modelInvocable !== true) {
-    throw new Error(`ptc-plus: official Cordis Skill provider must publish exactly ${JSON.stringify(CORDIS_SKILL_NAME)} as model-invocable`)
+    throw new Error(`ptc-plus: official Cordis Skill provider must publish exactly ${JSON.stringify(skillName)} as model-invocable`)
   }
-  const skill = await skills.get(CORDIS_SKILL_NAME, lookup)
+  const skill = await skills.get(skillName, lookup)
   if (skill?.provider !== CORDIS_SKILL_PROVIDER
     || skill.invocation?.modelInvocable !== true
     || typeof skill.content !== 'string'
     || skill.content.length === 0) {
-    throw new Error(`ptc-plus: official Cordis companion Skill ${JSON.stringify(CORDIS_SKILL_NAME)} is not loadable`)
+    throw new Error(`ptc-plus: official Cordis companion Skill ${JSON.stringify(skillName)} is not loadable`)
   }
 }
 
@@ -321,7 +325,6 @@ export function createCordisToolsOwner(
   const withdrawn = new Map()
   const cordisInspectLeases = createCordisInspectLeases(ctx)
   const scopedCordisPlugin = cordisInspectLeases.plugin(cordisPlugin)
-  const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin)
   const packageBaseUrl = ctx.baseUrl
   const skillResolution = companionResolution ?? (() => {
     const pluginPackages = ctx.get?.('pluginPackages')
@@ -423,13 +426,14 @@ export function createCordisToolsOwner(
     mounts.set(agent, mount)
     mount.activation = Promise.resolve().then(async () => {
       const { agentPresets, skills } = requireCompanionServices(agent)
-      const skillDirectory = await resolveCompanionSkillDirectory(agentPresets, skillResolution)
+      const { skillRoot, skillName } = await resolveCompanionSkillResource(agentPresets, skillResolution)
+      const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin, skillName)
       if (mount.disposed) return
 
       const skillFiber = agent.ctx.plugin(scopedSkillPlugin, {
         providerName: CORDIS_SKILL_PROVIDER,
         includeDefaultRoots: false,
-        bundledSkillDir: skillDirectory,
+        bundledSkillDir: skillRoot,
         watch: false,
       })
       if (typeof skillFiber?.dispose !== 'function') {
@@ -449,7 +453,7 @@ export function createCordisToolsOwner(
       await Promise.resolve(cordisFiber)
       if (mount.disposed) return
 
-      await requireCompanionSkill(agent, skills)
+      await requireCompanionSkill(agent, skills, skillName)
       if (mount.disposed) return
       mount.activated = true
     }).catch(async error => {

package/internal/edit-transport-owner.js

@@ -310,8 +310,9 @@ export function createEditTransportOwner(ctx, {
           subCallId: `${String(exec.callId)}:derived`, name: RUN_CODE, arguments: argumentsValue }
         const executionStart = agent.session.append('tool/ptc-dispatch-start', data)
         const derivedExec = { callId: data.subCallId, rootCallId: data.rootCallId,
-          parent: rootExec.token, name: RUN_CODE, arguments: argumentsValue, agent, signal: rootSignal }
-        const dispatch = () => dispatchToolCall(ctx.tools, derivedExec)
+          parent: rootExec.token, name: RUN_CODE, arguments: argumentsValue, agent, signal: rootSignal,
+          ...(rootExec.toolSet === undefined ? {} : { toolSet: rootExec.toolSet }) }
+        const dispatch = () => dispatchToolCall(ctx.tools, derivedExec, ctx)
         const tentative = await executeTentative(executionStart.seq, start.rootCallSeq,
           dispatch, executionLog, derivedExec)
         const inner = tentative.result

package/internal/execution-seam-compat.js

@@ -94,19 +94,16 @@ export function createExecutionSeam(service, serviceName) {
       requireCompatible()
       return installed === undefined ? upstreamRun.call(service, input) : installed.execute(input)
     },
-    /**
-     * Release one owner's retained environment. The resources live in the
-     * original generation (the session kernel releases its state through its
-     * own lifecycle). Adapter retirement only closes execution; the original
-     * still owns cleanup for references retained by its consumers.
-     */
-    release(owner) {
-      if (typeof service.release !== 'function') return Promise.resolve()
-      try {
-        return Promise.resolve(service.release.call(service, owner))
-      } catch (error) {
-        return Promise.reject(error)
-      }
+    /** Release both the installed environment and any original-provider state. */
+    async release(owner) {
+      const entry = installed
+      const results = await Promise.allSettled([
+        Promise.resolve().then(() => entry?.release?.(owner)),
+        Promise.resolve().then(() => service.release?.call(service, owner)),
+      ])
+      const failures = results.filter(result => result.status === 'rejected').map(result => result.reason)
+      if (failures.length === 1) throw failures[0]
+      if (failures.length > 1) throw new AggregateError(failures, 'ptc-plus: execution environment release failed')
     },
     [PLUGIN_EXECUTION_SEAM]() { return seam },
   })
@@ -143,11 +140,12 @@ export function createExecutionSeam(service, serviceName) {
       requireCompatible()
       return upstreamRun.call(service, spec)
     },
-    installExecute(execute) {
+    installExecute(execute, release) {
       requireAvailable()
       if (typeof execute !== 'function') throw new TypeError('ptc-plus: execution entry must be a function')
       if (installed !== undefined) throw new Error('ptc-plus: execution seam already installed')
-      const entry = { execute, language: service.language }
+      if (release !== undefined && typeof release !== 'function') throw new TypeError('ptc-plus: release entry must be a function')
+      const entry = { execute, release, language: service.language }
       installed = entry
       const restore = () => {
         if (installed !== entry) return

package/internal/host-tool-sdk.js

@@ -260,41 +260,29 @@ export function sessionExecutionAvailable(tools, scope, name = 'run_code') {
 }
 
 /**
- * Executions this plugin submitted under the host's batch dispatch contract.
+ * Dispatch one tool call through the Host's invocation policy.
  *
- * That contract assigns the execution identity itself, so the execution object a
- * host runs is not the one the caller built and carries no parent token the caller
- * could compare. The submission record is what remains: the call id this plugin
- * chose, which the host matched its result back to.
- */
-const batchSubmissions = new WeakSet()
-
-/**
- * Whether this execution was submitted as a host batch call.
- * @param {object} execution - an execution object this plugin built.
- * @returns {boolean} true when the batch contract dispatched it.
- */
-export function isBatchSubmission(execution) {
-  return execution !== null && typeof execution === 'object' && batchSubmissions.has(execution)
-}
-
-/**
- * Dispatch one tool call through the host registry.
- *
- * Two dispatch contracts are published. A registry host accepts one call and
- * resolves to that call's settled result. An executor host accepts a complete
- * model batch, assigns the execution identity itself, and resolves to the
- * ordered outcomes — so the caller supplies only the call it wants run, and the
- * executor's own token is the one its observers see.
+ * Registry Hosts accept an execution input directly. Executor Hosts reserve
+ * batches for root calls; nested inputs use the published invocation pipeline
+ * so the Host retains their actual parent token and enclosing root identity.
+ * The Host owns validation, policy, cancellation and result materialization.
  * @param {object} tools - the host tool registry (`ctx.tools`).
  * @param {object} execution - call identity, arguments, agent and signal.
+ * @param {object} [ctx] - the owning plugin context, required for nested execution.
  * @returns {Promise<object>} this call's settled result.
  */
-export async function dispatchToolCall(tools, execution) {
+export async function dispatchToolCall(tools, execution, ctx) {
   if (typeof tools?.selectExecutor !== 'function') return tools.execute(execution)
-  // Recorded before the host runs the batch: it calls back into this plugin during
-  // the dispatch, and the relation has to be provable then.
-  batchSubmissions.add(execution)
+  if (execution.parent !== undefined) {
+    if (ctx === undefined) throw new Error('ptc-plus: nested Host execution requires its owning context')
+    const { ToolExecutionPipeline } = await import('@deepseek-ai/dsh-tools/pipeline')
+    const pipeline = new ToolExecutionPipeline(ctx, {
+      get: (name, scope) => hostTransportDefinition(tools, scope, name),
+    })
+    const prepared = await pipeline.prepare(execution)
+    const outcome = prepared.kind === 'dispatch' ? await pipeline.dispatch(prepared.exec) : prepared
+    return pipeline.complete(prepared.exec, outcome)
+  }
   const settled = await tools.execute({
     calls: [{ id: execution.callId, name: execution.name, arguments: JSON.stringify(execution.arguments) }],
     signal: execution.signal,

package/internal/runtime-bridge-owner.js

@@ -25,7 +25,7 @@ import {
 } from './program-bindings.js'
 import { deepFreeze } from './record-utils.js'
 import { adaptRunCodeSchema } from './direct-surface-owner.js'
-import { hostTransportDefinition, isBatchSubmission } from './host-tool-sdk.js'
+import { hostTransportDefinition } from './host-tool-sdk.js'
 import { REPL_MEMORY_META_KEY, withReplMemorySnapshot } from './repl-memory-projection.js'
 import { withUserBindingDraftCapability } from './user-binding-draft-projection.js'
 import { POST_EDIT_KEY } from './session-journal-schema.js'
@@ -697,22 +697,24 @@ function applyEditableSlots(definition, promptText, slotPatches) {
       .finally(projected.release)
   }
 
-  const releaseSeam = seam.installExecute(patchedRun)
+  const releaseSeam = seam.installExecute(patchedRun, owner => {
+    if (owner?.session === undefined || sessionId(owner) === undefined) return
+    // Host uses release for explicit reset and for its retained-environment effect.
+    // Cordis clears the public Agent scope uid before invoking disposal effects.
+    if (owner.ctx?.fiber?.uid === null) return sessions.disposeAgent(sessionId(owner))
+    return sessions.resetEnvironment(owner.session)
+  })
 
   /**
    * Whether this execution is the derived execution the edit transport submitted.
    *
-   * A registry host runs the very object the plugin built, so the call id, the root
-   * call and the parent token it carries all prove the relation. The batch contract
-   * assigns its own identity instead: the parent token is the host's own and the
-   * root call is whichever call that host treats as direct. What survives there is
-   * the call id this plugin chose, which the host matched the batch result back to,
-   * together with the dispatch record; the derived source is compared beside it.
+   * Both Host invocation contracts preserve the submitted call id, enclosing
+   * root and actual parent token. All three must match; a root batch submission
+   * cannot establish a nested execution merely by choosing the same call id.
    */
   const isDerivedExecution = (derived, exec) => {
     if (derived === null || typeof derived !== 'object' || exec === null || typeof exec !== 'object') return false
     if (derived.callId !== exec.callId) return false
-    if (isBatchSubmission(derived)) return true
     return exec.parent !== undefined
       && derived.rootCallId === exec.rootCallId && derived.parent === exec.parent
   }

package/internal/runtime-messages.js

@@ -1,3 +1,4 @@
+import { ENVIRONMENT_RESET_VERSION } from './session-journal-schema.js'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import {
   CATALOG_PREFIX, EMPTY_CATALOG, LEGACY_STATE_PREFIX, PREVIOUS_EMPTY_CATALOG, PREVIOUS_STATE_PREFIX,
@@ -185,3 +186,10 @@ export function runtimeNoticeMessage(tip) {
   if (readRuntimeMessage(message) === undefined) throw new Error('invalid PTC recovery notice')
   return message
 }
+
+/** A persisted computation boundary; the Host separately owns its reset receipt. */
+export function environmentResetMessage() {
+  return createUserMessage({ source: { kind: PTC_MESSAGE_SOURCE_KIND, form: 'environment-reset', version: ENVIRONMENT_RESET_VERSION },
+    content: [{ type: 'text', text: 'PTC Plus computation reset: earlier session bindings, named checkpoints and edit targets are retired. New computation starts empty with the configured global bindings. Completed external effects remain.' }],
+  })
+}