dsh-rewind-plugin 0.1.10 → 0.2.1

package/lib/types/index.d.ts

@@ -1,35 +1,58 @@
 /**
- * dsh-rewind host half: the `/rewind` command and the write-class change
- * ledger, composed as one dual-face bundle row (the browser half lives in
- * `src/client/`).
+ * dsh-rewind host half: the `/rewind` command and the Claude-Code-style
+ * checkpoint store, composed as one dual-face bundle row (the browser half
+ * lives in `src/client/`).
  *
  * Rewind mechanism: planning is pure (`src/rewind.ts`); execution appends a
- * marker `user/message` into the session log whose `surfaceOp` replaces every
- * surface node after the target message with the marker. The append-only log
- * (and the rendered transcript) is untouched — only the model-visible surface
- * is cut, so the next request derives its context from the target onward.
- * Mode `both` additionally reverses every ledger-recorded file change that
- * followed the target.
+ * marker `assistant/message` into the session log whose `surfaceOp` replaces
+ * every surface node after the target message with the marker. The
+ * append-only log (and the rendered transcript) is untouched — only the
+ * model-visible surface is cut, so the next request derives its context from
+ * the target onward.
+ *
+ * File restore (mode `both`) follows Claude Code's checkpointing: the plugin
+ * backs up each tracked write-class edit BEFORE it happens (at the
+ * `tools/execute` around-dispatch stage, so an approval short-circuit cannot
+ * skip the capture and a denied call never records), commits the backup under
+ * the turn's anchor message seq at `tools/post-execute`, and a rewind to
+ * message N restores every backup anchored at or after N — modified files are
+ * written back to their pre-edit content, files created after N are deleted.
+ * Backups persist on disk under the dsh data directory (newest 100 message
+ * groups per session), so restores work after a host restart, and they
+ * read/write the real file system with plain `node:fs` — independent of the
+ * fs service. See `src/snapshot.ts`.
  *
  * @module dsh-rewind
  */
 import type { Context } from '@deepseek-ai/cordis';
+export { SnapshotStore } from './snapshot.ts';
+export type { CheckpointEntry, FileImpact, RestoreOutcome } from './snapshot.ts';
 export declare const name = "dsh-rewind";
 export declare const inject: string[];
+/** Plugin config: optional override of the checkpoint store root. */
+export interface RewindConfig {
+    /** Checkpoint store root (defaults to `~/.dsh/rewind-snapshots`). */
+    readonly snapshotDir?: string;
+}
 /**
- * Register the `/rewind` command and the tools-pipeline ledger hooks.
+ * Register the `/rewind` command and the checkpoint pipeline (before-capture
+ * at `tools/execute`, disk commit at `tools/post-execute`).
  *
- * The command is fs-independent and registers immediately. The ledger needs
- * `fs`, so its hooks mount through a dynamic `ctx.inject(['fs'])` — they take
- * effect whenever the fs service becomes available (and never fail the
- * plugin's load when a deployment has no fs).
+ * The command is fs-independent and registers immediately. The checkpoint
+ * pipeline needs `fs` to resolve tracked paths to their real display paths,
+ * so it mounts through a dynamic `ctx.inject(['fs'])` — it takes effect
+ * whenever the fs service becomes available (and never fails the plugin's
+ * load when a deployment has no fs; without it, no entries are recorded and
+ * `both` restores report "no tracked changes").
  *
  * Capture runs in `tools/execute` (the around-dispatch stage), NOT in
  * `tools/pre-execute`: a pre-execute `{ kind: 'ask' }` short-circuit from
  * another plugin (e.g. dsh-edit-approval) skips later pre-execute listeners,
  * and a denied call never dispatches — so approved calls are still captured,
- * denied calls never leave a pending entry behind.
+ * denied calls never leave a pending entry behind. Entries are committed to
+ * disk at `tools/post-execute` under the turn's anchor message seq.
  *
  * @param ctx - context carrying `commands`, `tools`, and an optional `fs`.
+ * @param config - optional override of the checkpoint store root.
  */
-export declare function apply(ctx: Context): void;
+export declare function apply(ctx: Context, config?: RewindConfig): void;

package/lib/types/session-cwd.d.ts

@@ -1,5 +1,5 @@
 /**
- * Session-cwd resolution for ledger reads/restores, mirroring the fs tools'
+ * Session-cwd resolution for snapshot tracking reads, mirroring the fs tools'
  * own rule (`@deepseek-ai/dsh-tool-fs/session-cwd.ts`): relative paths
  * resolve against the calling agent's session workspace
  * (`exec.agent.session.header.cwd`), not the server's launch dir.

package/lib/types/snapshot.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Checkpoint store — the Claude Code style file-rewind backing for dsh-rewind.
+ *
+ * Claude Code's checkpointing (see README) works like this: it creates a
+ * BACKUP of a file BEFORE every tracked modification, groups those backups by
+ * the user message they belong to (a "checkpoint"), and rewinding to a
+ * checkpoint restores every backup recorded at or after it — modified files
+ * are written back to their pre-edit content, files created after the target
+ * are deleted. This module is the same design, persisted on disk:
+ *
+ * - `tools/execute` captures the BEFORE state of each tracked write/edit call
+ *   (or "created" when the file did not exist) — the capture happens at the
+ *   around-dispatch stage, so an approval `ask` short-circuit cannot skip it
+ *   and a denied call never records.
+ * - The entry is committed to disk at `tools/post-execute` under the turn's
+ *   anchor seq: `<root>/<sessionId>/<anchorSeq>/<callId>.json`, carrying the
+ *   path and the before content (`before: null` = the file was created).
+ * - Because entries live on disk under the dsh data directory, they survive a
+ *   host restart, are bounded (the newest 100 anchor groups per session are
+ *   kept), and restores read/write the real file system with plain `node:fs`
+ *   — independent of the fs service.
+ *
+ * Restore semantics (identical to Claude Code): for every path with entries
+ * anchored at or after the target message, apply the EARLIEST entry — write
+ * the before content back, or delete the file when that entry recorded a
+ * creation. Symlinked and hard-linked paths are skipped and reported, never
+ * written through.
+ *
+ * @module dsh-rewind/snapshot
+ */
+/** Default store root: the dsh data directory. */
+export declare const DEFAULT_SNAPSHOT_ROOT: string;
+/** Environment variable overriding the store root (tests, exotic homes). */
+export declare const SNAPSHOT_ROOT_ENV = "DSH_REWIND_SNAPSHOT_DIR";
+/** Number of newest anchor groups (user messages) kept per session. */
+export declare const MAX_ANCHOR_GROUPS = 100;
+/** One committed before-backup, keyed by tool call. */
+export interface CheckpointEntry {
+    readonly callId: string;
+    /** Seq of the user message anchoring the turn in which the change happened. */
+    readonly anchorSeq: number;
+    /** Resolved display path (absolute) of the tracked file. */
+    readonly path: string;
+    /** Full content before the change; null when the file was created. */
+    readonly before: string | null;
+    /** Epoch ms the entry was committed (stable ordering within a group). */
+    readonly time: number;
+}
+/** Per-file restore impact preview (`/rewind preview @seq both`). */
+export interface FileImpact {
+    readonly path: string;
+    /** `restore` = write the before content back; `delete` = remove the file. */
+    readonly action: 'restore' | 'delete';
+}
+/** Outcome of one restore pass. */
+export interface RestoreOutcome {
+    readonly restored: readonly string[];
+    readonly deleted: readonly string[];
+    /** Symlinked or hard-linked paths left untouched. */
+    readonly skipped: readonly string[];
+    readonly failed: readonly {
+        path: string;
+        message: string;
+    }[];
+}
+/** Deletes one file by its real path (node:fs, bypassing the fs service). */
+export type DeleteFile = (path: string) => Promise<void>;
+/**
+ * On-disk checkpoint store. Every write goes straight through `node:fs`, so a
+ * restore reliably lands on the real file system.
+ */
+export declare class SnapshotStore {
+    readonly root: string;
+    /** Debounce window for the per-commit prune (keeps the readdir+sort off the hot path). */
+    private static readonly PRUNE_INTERVAL_MS;
+    private lastPruneAt;
+    constructor(root?: string);
+    /** Absolute path of one session's snapshot directory (id sanitized). */
+    sessionDir(sessionId: string): string;
+    /** Absolute path of one anchor group directory. */
+    anchorDir(sessionId: string, anchorSeq: number): string;
+    /** Commit one before-backup under its turn's anchor group. */
+    recordEntry(sessionId: string, entry: Omit<CheckpointEntry, 'time'>): Promise<void>;
+    /**
+     * All committed entries anchored at or after `targetSeq`, newest first (for
+     * preview ordering). The boundary is inclusive: rewinding to a message also
+     * reverts the changes its own turn caused (the rewind cut removes that
+     * turn's assistant response and tool calls), so only entries anchored at
+     * earlier messages survive.
+     */
+    entriesAfter(sessionId: string, targetSeq: number): Promise<CheckpointEntry[]>;
+    /**
+     * Per-path EARLIEST committed entry anchored at or after the target — the
+     * single source of truth for both restore and impact preview.
+     */
+    private earliestEntries;
+    /** Per-file restore impact for the earliest entry at/after the target. */
+    impactsAfter(sessionId: string, targetSeq: number): Promise<FileImpact[]>;
+    /**
+     * Restore the workspace to the target message's checkpoint: for every path
+     * with entries anchored at or after it, apply the EARLIEST entry — write the
+     * before content back, or delete the file when it was created after the
+     * target. Symlinked and hard-linked paths are skipped (reported, never
+     * written through); a restored file's parent directory is created when it
+     * was deleted after the backup. Failures are per-file and never abort the
+     * pass.
+     */
+    restoreAfter(sessionId: string, targetSeq: number, deleteFile: DeleteFile): Promise<RestoreOutcome>;
+    /**
+     * Drop the session's oldest anchor groups beyond `keep` (default
+     * {@link MAX_ANCHOR_GROUPS}), deleting their whole directories.
+     */
+    prune(sessionId: string, keep?: number): Promise<void>;
+    /** True when a path exists on disk (used by tests and diagnostics). */
+    exists(path: string): Promise<boolean>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rewind-plugin",
-  "version": "0.1.10",
+  "version": "0.2.1",
   "description": "DeepSeek Harness plugin: in-place conversation rewind in the same session window (Claude Code /rewind semantics) with optional workspace file restore",
   "keywords": [
     "deepseek-harness",
@@ -32,14 +32,15 @@
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
     },
-    "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
   "files": [
     "lib",
     "cordis.patch.yml",
-    "scripts",
     "README.md",
+    "README.zh.md",
+    "docs",
+    "assets",
     "LICENSE"
   ],
   "dsh": {

package/lib/types/ledger.d.ts

@@ -1,88 +0,0 @@
-/**
- * In-memory change ledger: records every write-class tool mutation that
- * happened while the plugin was running, so a "rewind conversation and code"
- * can reverse the changes that followed a target message.
- *
- * Scope (v0.1): the ledger covers only `write` / `edit` / `str_replace_editor`
- * mutations observed through the tools pipeline while the plugin is loaded.
- * Changes made by bash or external programs are not recorded and cannot be
- * restored; a git-first snapshot layer is a v2 option.
- *
- * @module dsh-rewind/ledger
- */
-import type { FileSystem } from '@deepseek-ai/dsh-fs';
-/** One recorded write-class mutation. */
-export interface LedgerEntry {
-    /** Tool that made the change: `write` | `edit` | `str_replace_editor`. */
-    readonly toolName: string;
-    /** Seq of the user message anchoring the turn in which the change happened. */
-    readonly anchorSeq: number;
-    /** Display path (model/UI-facing), as resolved at record time. */
-    readonly path: string;
-    /** Full file content before the change; undefined when the file was created. */
-    readonly before: string | undefined;
-    /** Full file content after the change. */
-    readonly after: string;
-}
-/** Unique per-file impact of rewinding past a target message. */
-export interface FileImpact {
-    readonly path: string;
-    /** `restore` = the file existed before the target; `delete` = created after it. */
-    readonly action: 'restore' | 'delete';
-}
-/** Result of one reverse restore pass. */
-export interface RestoreOutcome {
-    readonly restored: readonly string[];
-    readonly deleted: readonly string[];
-    readonly failed: readonly {
-        path: string;
-        message: string;
-    }[];
-}
-/** Deletes one file by its process path (the host supplies the backend-appropriate delete). */
-export type DeleteFile = (processPath: string) => Promise<void>;
-/**
- * Per-session cap on recorded entries. The ledger is intentionally bounded so
- * an extremely long session cannot grow one entry list without limit; the
- * oldest entries are dropped first, so rewinds to very early messages in a
- * pathological session may lose the earliest file history (a declared
- * tradeoff, see README).
- */
-export declare const MAX_LEDGER_ENTRIES = 2000;
-/**
- * Append-only change ledger. Entries are recorded in commit order; a rewind
- * replays them in reverse for the affected range. Bounded per session to
- * {@link MAX_LEDGER_ENTRIES} (oldest dropped first).
- */
-export declare class RewindLedger {
-    private readonly entries;
-    /** Record one committed mutation, dropping the oldest entry when over the cap. */
-    record(entry: LedgerEntry): void;
-    /**
-     * All entries anchored at or after `targetSeq`, newest first. The boundary
-     * is inclusive: rewinding to a message also reverts the changes its own
-     * turn caused (the rewind cut removes that turn's assistant response and
-     * tool calls), so only changes anchored at earlier messages survive.
-     */
-    changesAfter(targetSeq: number): readonly LedgerEntry[];
-    /**
-     * Unique per-file impact for preview. A file whose earliest affected change
-     * created it (`before === undefined`) is deleted on restore; any other file
-     * is written back to its pre-target content.
-     */
-    impactsAfter(targetSeq: number): readonly FileImpact[];
-    /**
-     * Reverse every change anchored at or after `targetSeq`. Each entry writes
-     * its pre-change content back; a file that did not exist before the target
-     * is deleted instead. Failures are collected per file and never abort the pass.
-     * @param fs - the filesystem service (resolve/readText/writeText/processPath).
-     * @param deleteFile - backend-appropriate file deletion by process path.
-     * @param targetSeq - the rewind target; only later changes are reverted.
-     * @param options - session workspace cwd (relative ledger paths resolve
-     *   against it, mirroring the fs tools) and an optional abort signal.
-     */
-    restoreAfter(fs: FileSystem, deleteFile: DeleteFile, targetSeq: number, options?: {
-        cwd?: string;
-        signal?: AbortSignal;
-    }): Promise<RestoreOutcome>;
-}

package/scripts/build.mjs

@@ -1,89 +0,0 @@
-#!/usr/bin/env node
-/**
- * dsh-rewind build — produces the npm-package artifacts under lib/:
- *   lib/index.js  — host half: src/index.ts bundled to plain ESM. Every
- *                   `@deepseek-ai/*` import stays external: the dsh loader
- *                   resolves those from the harness installation, never from
- *                   this package.
- *   lib/client.js — client half: src/client/index.ts bundled to CJS, then
- *                   wrapped in the web boot handoff
- *                   `window.__ModuleLoader__.load({ id, factory })`, the
- *                   closure-factory format every `dsh.client` package's
- *                   `./client` export must use. The client half is fully
- *                   self-contained (plain DOM, no React), so nothing is
- *                   external and the injected `require` is never called.
- *
- * Type checking is a separate step (`npm run typecheck`, tsc --noEmit); this
- * script only transpiles (esbuild) and runs smoke checks: both outputs must
- * parse, and the host half must import with the expected plugin shape.
- */
-import { build } from 'esbuild'
-import { execSync } from 'node:child_process'
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
-const pkg = JSON.parse(await readFile(join(ROOT, 'package.json'), 'utf8'))
-
-await mkdir(join(ROOT, 'lib'), { recursive: true })
-
-// ---- type declarations: host (lib/types) + client (lib/types/client) ----
-execSync('npx tsc -p tsconfig.build.json', { cwd: ROOT, stdio: 'inherit' })
-execSync('npx tsc -p tsconfig.client.json', { cwd: ROOT, stdio: 'inherit' })
-
-// ---- host half: bundled TS -> ESM (@deepseek-ai/* stays external) ----
-await build({
-  entryPoints: [join(ROOT, 'src', 'index.ts')],
-  outfile: join(ROOT, 'lib', 'index.js'),
-  format: 'esm',
-  platform: 'node',
-  target: 'es2024',
-  bundle: true,
-  external: ['@deepseek-ai/*'],
-  sourcemap: false,
-})
-
-// ---- client half: bundled TS -> CJS, then wrapped in the loader handoff ----
-await build({
-  entryPoints: [join(ROOT, 'src', 'client', 'index.ts')],
-  outfile: join(ROOT, 'lib', '_client.js'),
-  format: 'cjs',
-  platform: 'browser',
-  target: 'es2020',
-  bundle: true,
-  external: [],
-  sourcemap: false,
-})
-const clientSource = await readFile(join(ROOT, 'lib', '_client.js'), 'utf8')
-await rm(join(ROOT, 'lib', '_client.js'))
-
-const bundle = [
-  '/* dsh-rewind client bundle — generated by scripts/build.mjs from src/client/ */',
-  'window.__ModuleLoader__.load({',
-  `  id: ${JSON.stringify(pkg.name)},`,
-  '  factory: (require) => {',
-  '    var module = { exports: {} };',
-  '    var exports = module.exports;',
-  clientSource.replace(/\s+$/, '\n'),
-  '    return module.exports;',
-  '  }',
-  '});',
-  '',
-].join('\n')
-await writeFile(join(ROOT, 'lib', 'client.js'), bundle)
-
-// ---- smoke checks ----
-const host = await readFile(join(ROOT, 'lib', 'index.js'), 'utf8')
-const exportBlock = host.slice(host.lastIndexOf('export {'))
-for (const needle of ['name', 'inject', 'apply']) {
-  if (!exportBlock.includes(needle)) throw new Error(`host bundle missing export ${needle}`)
-}
-for (const needle of ['window.__ModuleLoader__.load', `id: ${JSON.stringify(pkg.name)}`]) {
-  if (!bundle.includes(needle)) throw new Error(`client bundle missing ${needle}`)
-}
-// Declarations must exist (published tarball carries them).
-for (const dts of ['lib/types/index.d.ts', 'lib/types/client/index.d.ts']) {
-  await readFile(join(ROOT, dts), 'utf8')
-}
-console.log('build ok: lib/index.js (host), lib/client.js (client), lib/types/ (declarations)')

package/scripts/verify-host.mjs

@@ -1,179 +0,0 @@
-#!/usr/bin/env node
-/**
- * Host-half verification: boots the built plugin (`lib/index.js`) on a real
- * cordis context with a real dsh-session, then drives the `/rewind` command
- * handler and the tools-pipeline ledger events end to end — no model, no UI.
- *
- * Run: `npm run build && node scripts/verify-host.mjs`
- *
- * What it proves:
- *  1. the plugin registers a `rewind` command on the ctx;
- *  2. `/rewind` (no args) withdraws the most recent user message;
- *  3. `/rewind @<seq> chat` (the button's call form) cuts the surface in-place (log untouched);
- *  4. the ledger captures through `tools/execute` (NOT pre-execute): a
- *     pre-execute `ask` short-circuit still gets captured after approval, and
- *     a denied call never captures (no pending leak);
- *  5. relative file paths resolve against the session cwd (fs-tools rule);
- *  6. `/rewind preview @<seq> both` reports the file impact;
- *  7. `/rewind @<seq> both` restores the file and reports it.
- */
-import { Context } from '@deepseek-ai/cordis'
-import { FileSystem, FsTargetKey, FsVersion } from '@deepseek-ai/dsh-fs'
-import { createAssistantMessage, createUserMessage } from '@deepseek-ai/dsh-llm'
-import { Session, SessionId } from '@deepseek-ai/dsh-session'
-import { join } from 'node:path'
-import { apply as applyRewind } from '../lib/index.js'
-
-const aborted = () => new AbortController().signal
-
-/** In-memory fs double with session-cwd resolution (resolve/readText/writeText/processPath). */
-class FakeFs extends FileSystem {
-  files = new Map()
-  async resolve(path, opts = {}) {
-    const displayPath = opts?.cwd !== undefined && !path.startsWith('/') ? join(opts.cwd, path) : path
-    return { targetKey: FsTargetKey(displayPath), displayPath }
-  }
-  processPath(target) { return target.displayPath }
-  async readText(target) {
-    const content = this.files.get(target.displayPath)
-    if (content === undefined) throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
-    return content
-  }
-  async writeText(target, content) { this.files.set(target.displayPath, content); return { operation: 'update', version: FsVersion('v'), before: null, after: content } }
-  async stat(target) { return this.files.has(target.displayPath) ? { version: FsVersion('v'), type: 'file' } : undefined }
-}
-
-const fs = new FakeFs(new Context())
-fs.files.set('/workspace/a.txt', 'original content')
-
-const user = text => createUserMessage({ content: [{ type: 'text', text }], source: { kind: 'user' } })
-const assistant = text => createAssistantMessage({ content: [{ type: 'text', text }], source: { provider: 'test', model: 'test' } })
-
-function buildSession(id, cwd) {
-  const session = Session.create(SessionId(id), undefined,
-    cwd !== undefined
-      ? { version: 0, id: SessionId(id), createdAt: Date.now(), cwd }
-      : undefined)
-  session.append('user/message', user('first question'), { surfaceOp: 'append' })
-  session.append('assistant/message', { turn: 0, step: 0, message: assistant('first answer') }, { surfaceOp: 'append' })
-  session.append('user/message', user('second question'), { surfaceOp: 'append' })
-  session.append('assistant/message', { turn: 1, step: 0, message: assistant('second answer') }, { surfaceOp: 'append' })
-  return session
-}
-
-const session = buildSession('verify-host')
-const agent = { id: session.id, session, status: 'idle' }
-
-const ctx = new Context()
-let registered = null
-ctx.provide('commands', {
-  register: definition => {
-    registered = definition
-    return () => {}
-  },
-})
-ctx.provide('fs', fs)
-applyRewind(ctx)
-
-const call = (agentOf, rawInput) => registered.handler({ commandId: Symbol('cid'), agent: agentOf, rawInput, signal: aborted() })
-
-let failures = 0
-const check = (name, ok, detail) => {
-  console.log(`${ok ? 'ok  ' : 'FAIL'} ${name}${ok ? '' : ` — ${detail}`}`)
-  if (!ok) failures += 1
-}
-
-// 1. command registered
-check('command registered', typeof registered?.handler === 'function' && registered.name === 'rewind', JSON.stringify(registered))
-
-// 2. bare /rewind (manual, no parameters) withdraws the most recent user
-//    message (seq 2 "second question") and everything after it
-const bareBefore = [...session.surface.nodes]
-const bareResult = await call(agent, '')
-const bareAfter = [...session.surface.nodes]
-check('bare /rewind succeeds', bareResult.kind === 'success', bareResult.text)
-check('bare /rewind withdraws the latest message', bareAfter.length === 3 && bareAfter[0] === 0 && bareAfter[1] === 1 && bareAfter[2] > 3, `before ${JSON.stringify(bareBefore)} -> after ${JSON.stringify(bareAfter)}`)
-check('log stays append-only (5 events)', session.events.length === 5, `events=${session.events.length}`)
-
-// 3. /rewind @<seq> chat (the button's exact call form) cuts the surface on a
-//    fresh session
-const paramSession = buildSession('verify-param')
-const paramAgent = { id: paramSession.id, session: paramSession, status: 'idle' }
-const before = [...paramSession.surface.nodes]
-const chatResult = await call(paramAgent, '@2 chat')
-const after = [...paramSession.surface.nodes]
-check('rewind chat succeeds', chatResult.kind === 'success', chatResult.text)
-check('surface cut to [0,1,marker] (target withdrawn)', after.length === 3 && after[0] === 0 && after[1] === 1 && after[2] > 3, `before ${JSON.stringify(before)} -> after ${JSON.stringify(after)}`)
-check('log stays append-only (5 events)', paramSession.events.length === 5, `events=${paramSession.events.length}`)
-
-const writeExec = (callId, filePath, content) => ({
-  callId, name: 'write', arguments: { file_path: filePath, content }, agent, signal: aborted(),
-})
-
-// 4. a pre-execute `ask` short-circuit (dsh-edit-approval) must not skip the
-//    capture: capture happens in tools/execute, which runs after approval.
-{
-  const exec = writeExec('c1', '/workspace/a.txt', 'rewritten')
-  // Another plugin asks at pre-execute; the user then allows it.
-  const gate = await ctx.waterfall('tools/pre-execute', exec, async () => ({ kind: 'ask', reason: 'approve me' }))
-  check('pre-execute gate asks', gate.kind === 'ask', JSON.stringify(gate))
-  // Approved → dispatch stage runs: capture fires here.
-  await ctx.waterfall('tools/execute', exec, async () => ({ isError: false, content: [] }))
-  await fs.writeText({ targetKey: FsTargetKey('/workspace/a.txt'), displayPath: '/workspace/a.txt' }, 'rewritten')
-  await ctx.waterfall('tools/post-execute', exec, { isError: false, content: [] }, async () => ({ kind: 'accept' }))
-  check('file mutated on disk', fs.files.get('/workspace/a.txt') === 'rewritten', fs.files.get('/workspace/a.txt'))
-}
-
-// 5. a denied call never captures (no pending leak: nothing recorded after it)
-{
-  const exec = writeExec('c2', '/workspace/a.txt', 'denied write')
-  const gate = await ctx.waterfall('tools/pre-execute', exec, async () => ({ kind: 'deny', reason: 'no' }))
-  check('pre-execute gate denies', gate.kind === 'deny', JSON.stringify(gate))
-  // Denied calls do not dispatch: post-execute must record nothing for c2.
-  await ctx.waterfall('tools/post-execute', exec, { isError: true, error: { message: 'denied', info: { name: 'x', code: 'y' } }, content: [] }, async () => ({ kind: 'accept' }))
-}
-
-// 6. relative paths resolve against the session cwd (fs-tools rule)
-{
-  const cwdSession = buildSession('verify-cwd', '/workspace')
-  const cwdAgent = { id: cwdSession.id, session: cwdSession, status: 'idle' }
-  fs.files.set('/workspace/rel.txt', 'relative original')
-  const exec = { callId: 'c3', name: 'write', arguments: { file_path: 'rel.txt', content: 'relative new' }, agent: cwdAgent, signal: aborted() }
-  await ctx.waterfall('tools/execute', exec, async () => ({ isError: false, content: [] }))
-  await fs.writeText({ targetKey: FsTargetKey('/workspace/rel.txt'), displayPath: '/workspace/rel.txt' }, 'relative new')
-  await ctx.waterfall('tools/post-execute', exec, { isError: false, content: [] }, async () => ({ kind: 'accept' }))
-  // Rewind to seq 2 in the cwd session must report the cwd-resolved path.
-  const preview = await call(cwdAgent, 'preview @2 both')
-  check('preview resolves relative path via session cwd', preview.kind === 'success' && preview.text.includes('/workspace/rel.txt'), preview.text)
-  const both = await call(cwdAgent, '@2 both')
-  check('both restores cwd-resolved file', both.kind === 'success' && fs.files.get('/workspace/rel.txt') === 'relative original', both.text)
-}
-
-// 7. preview reports the impact (rewind to seq 0 — still on the surface after
-//    the earlier withdraw — reverts the anchor-0 write)
-const previewResult = await call(agent, 'preview @0 both')
-check('preview shows file impact', previewResult.kind === 'success' && previewResult.text.includes('/workspace/a.txt'), previewResult.text)
-
-// 8. both mode restores the file
-const bothResult = await call(agent, '@0 both')
-check('rewind both restores file', bothResult.kind === 'success' && bothResult.text.includes('还原 1 个文件'), bothResult.text)
-check('file content restored', fs.files.get('/workspace/a.txt') === 'original content', fs.files.get('/workspace/a.txt'))
-
-// 9. a running agent is force-stopped before the rewind (not refused)
-const runningSession = buildSession('verify-running')
-const running = {
-  ...{ id: runningSession.id, session: runningSession, status: 'idle' }, status: 'running',
-  cancel: () => { cancelled = true; running.status = 'idle' },
-}
-let cancelled = false
-const runningResult = await registered.handler({ commandId: Symbol('cid'), agent: running, rawInput: '@2 chat', signal: aborted() })
-check('running agent is cancelled first', cancelled === true, `cancelled=${cancelled}`)
-check('rewind succeeds after stop', runningResult.kind === 'success', runningResult.text)
-
-// 9b. a cancel that never quiesces aborts the rewind (timeout path)
-const stuck = { ...{ id: runningSession.id, session: runningSession, status: 'idle' }, status: 'running', cancel: () => {} }
-const stuckResult = await registered.handler({ commandId: Symbol('cid'), agent: stuck, rawInput: '@2 chat', signal: aborted() })
-check('stuck agent aborts rewind', stuckResult.kind === 'error', stuckResult.text)
-
-console.log(failures === 0 ? '\nverify-host: all checks passed' : `\nverify-host: ${failures} check(s) FAILED`)
-process.exit(failures === 0 ? 0 : 1)