dsh-rewind-plugin 0.20.0-alpha.3 → 0.20.0

package/README.en.md

@@ -34,19 +34,17 @@ Every user message carries a **↶ rewind** button in its action row. Clicking i
 
 ## Install
 
-Check your local DSH version, then find the matching plugin version in
-[Releases](https://github.com/SiriLee/dsh-rewind/releases).
-
 **Command line**:
 
 ```sh
-dsh plugin --profile <name> add dsh-rewind-plugin@<version>
+dsh plugin --profile <name> add dsh-rewind-plugin
 ```
 
-**Graphical interface**: the **Plugins** page in the sidebar → **Add plugin** → enter `dsh-rewind-plugin@<version>` → install → restart DSH.
+**Graphical interface**: the **Plugins** page in the sidebar → **Add plugin** → enter `dsh-rewind-plugin` → install → restart DSH.
+
+<img src="assets/screenshots/add-plugin.png" width="600" alt="Add plugin dialog: enter dsh-rewind-plugin in the field"><br>
 
-<img src="assets/screenshots/add-plugin.png" width="600" alt="Add plugin dialog: enter dsh-rewind-plugin@version in the field"><br>
-<sub>The screenshot is an example only — use the version that matches your DSH version.</sub>
+The default install is `latest`, which targets the latest stable DSH release. If you are on an older or alpha DSH version, find the matching plugin version on the [Releases](https://github.com/SiriLee/dsh-rewind/releases) page and install that version explicitly.
 
 > [!WARNING]
 > The npm name `dsh-rewind` belongs to another author's package — install with `dsh-rewind-plugin`.
@@ -130,21 +128,21 @@ The whole design rests on two principles, simple but deliberate: **the conversat
 
 ### 2. File restore: lightweight checkpointing, "before-write backup"
 
-The file half follows Claude Code's checkpoint semantics — **partial tracking + before-write backup, plus a re-scan of tracked files at each message**, not a whole-tree snapshot. This trade-off saves space, and it's actually more complete:
+The file half follows Claude Code's checkpoint semantics — **partial tracking + before-write backup, plus a re-scan of tracked files at each message**, not a whole-tree snapshot. This trade-off saves space while still covering external changes to tracked files:
 
 - **Before-write backup**: tracks only the write-class tools (`write`, `edit`) — backs up the original content before a write and records/tracks the files it touches; it never backs up the whole workspace, so it's lightweight; **a single file that is too large is not backed up**.
 - **External changes count too**: at every user-message boundary the plugin re-checks all tracked files — external changes such as a command run or a manual edit are recorded as well and restored by a later rewind. "Lightweight" but not "incomplete".
 - **Unchanged-not-recorded**: an entry is written only when something changed — at the message-boundary re-check, an unchanged file is never backed up (no record); at before-write time, when the new content matches the path's prior record, only a **link to it** (`ref`) is stored instead of a copy.
-- **Accurate restore**: backups are the sole standard, checked against the real disk — **only files that actually differ are touched**. Backups are stored byte for byte, so the restored result matches the backups exactly, with no "ghost impact". There is a limit, though: [File-rewind tracking boundary](docs/compat/tracking-boundary.md).
+- **Accurate restore**: backups are the sole standard, checked against the real disk — **only files that actually differ are touched**. Backups are stored byte for byte, so the restored result matches the backups exactly, with no "ghost impact". Coverage is bounded by design: [File-rewind tracking boundary](docs/compat/tracking-boundary.md).
 - **Safety and integrity**: paths are sanitized so nothing ever escapes the backup root; symlinks / hard links are skipped so one restore can't clobber another name of the same file; a per-file failure never aborts the pass; backups and the restore journal are written atomically and kept across restarts, so a half-applied restore after a crash can be continued or rolled back.
 
 > **Design highlight**: this checkpoint's light footprint comes from **recording only what was actually touched and really changed** — before-write backup makes it restorable, unchanged-not-recorded and content-as-link drop the repetition; only the files that differ are touched at restore time.
 
-## What it deliberately does NOT do
+## Scope and division of labour
 
-This plugin deliberately stays lightweight and focused on one thing — "conversation rewind". The following are **out of its scope**:
+This plugin deliberately stays lightweight and focused on one thing — "conversation rewind". The following are **out of its scope**, and each has a better owner (see [design boundaries](docs/boundaries.md)):
 
-- **Whole-tree / Git-level snapshots** — only write-class tool edits plus external changes to already-tracked files are backed up; files never touched by a tool are not restored. For a worktree-level full snapshot rollback, use a more specialized snapshot tool (git).
+- **Whole-tree / Git-level snapshots** — only write-class tool edits plus external changes to already-tracked files are backed up; files never touched by a tool are not restored. Workspace history — any file, any moment — belongs to Git; the agent already uses it, and the plugin does not rebuild that layer. For a worktree-level full snapshot rollback, use Git or the snapshot tool the project already uses.
 - **Subagent edits** — not tracked, and no rewind inside a subagent session (same as Claude Code): a subagent runs its own session, so its backups could never be restored by a rewind of the parent session, and none are kept for one.
 - **Fork / branch rewind** — DSH already provides this ("branch in new chat"); no need to reinvent the wheel.
 
@@ -158,12 +156,10 @@ This plugin deliberately stays lightweight and focused on one thing — "convers
 > This project and DeepSeek Harness are both in developer preview. Pin exact
 > versions in reproducible environments and review the behavior notes above.
 
-## Known issues
+## Known limitations
 
-1. **Exported logs are complete** — `/export` exports the whole session log (raw JSONL), **withdrawn content included**; this plugin cannot alter exports.
-2. **Lightweight file rewind has a cost** — in specific cases not all changes can be rewound. Consistent with Claude Code. See: [File-rewind tracking boundary](docs/compat/tracking-boundary.md).
-3. **Turn navigation keeps rewound turns** — the right-side turn navigation keeps an "unloaded" tick for each rewound turn, and hovering previews the withdrawn content. Only a display difference; no functional impact.
-4. **A far rewind may show a blank transcript** — when the target predates the loaded history, the conversation area goes blank; click **Load earlier** to page back until the history appears.
+1. **Turn navigation keeps rewound turns** — the right-side turn navigation keeps an "unloaded" tick for each rewound turn, and hovering previews the withdrawn content. Only a display difference; no functional impact.
+2. **A far rewind may show a blank transcript** — when the target predates the loaded history, the conversation area goes blank; click **Load earlier** to page back until the history appears.
 
 > [!NOTE]
 > Browser diagnostics are available; see [Browser diagnostics](docs/compat/diagnostics.md).
@@ -185,7 +181,7 @@ node scripts/verify-host.mjs   # end-to-end verification of the built artifact
 
 `prepack` runs the full build, so `npm pack` / `npm publish` always ship a complete `lib/`. Install from npm or a packed tarball — a git checkout has no built `lib/`.
 
-Maintainers: the module map and harness interface reference live in [docs/harness-reference.md](docs/harness-reference.md).
+Maintainers: the source layout and architecture are in [docs/architecture.md](docs/architecture.md); the harness interface reference is in [docs/harness-reference.md](docs/harness-reference.md).
 
 Contributing guide: [CONTRIBUTING.md](CONTRIBUTING.md).
 

package/README.md

@@ -34,18 +34,17 @@ DeepSeek Harness 插件：**一键就地回退对话到任意更早的用户消
 
 ## 安装
 
-确认本机 DSH 版本后，在 [Release](https://github.com/SiriLee/dsh-rewind/releases) 找到适配的插件版本。
-
 **命令行**：
 
 ```sh
-dsh plugin --profile <name> add dsh-rewind-plugin@<版本>
+dsh plugin --profile <name> add dsh-rewind-plugin
 ```
 
-**图形界面**：侧栏「插件」页 →「添加插件」→ 填 `dsh-rewind-plugin@<版本>` → 安装 → 重启 DSH。
+**图形界面**：侧栏「插件」页 →「添加插件」→ 填 `dsh-rewind-plugin` → 安装 → 重启 DSH。
+
+<img src="assets/screenshots/add-plugin.png" width="600" alt="「添加插件」弹窗：在输入框填入 dsh-rewind-plugin"><br>
 
-<img src="assets/screenshots/add-plugin.png" width="600" alt="「添加插件」弹窗：在输入框填入 dsh-rewind-plugin@版本号"><br>
-<sub>图片仅为示例，请以实际适配版本号为准。</sub>
+默认安装 `latest`，它适配 DSH 最新稳定版本。若使用的是旧版或内测版 DSH，请在 [Releases](https://github.com/SiriLee/dsh-rewind/releases) 页面找到适配的插件版本，并指定版本安装。
 
 > [!WARNING]
 > npm 上的 `dsh-rewind` 属于其他作者，请用 `dsh-rewind-plugin` 安装。
@@ -116,23 +115,23 @@ rm <dsh home>/snapshot-cleanup-last-sweep.json
 
 ### 2. 文件还原：轻量检查点，「写前备份」
 
-文件部分对齐 Claude Code 的检查点语义——**局部追踪、写前备份 + 每条消息重扫已跟踪文件**，而不是整树快照。这项取舍既省空间，又更完整：
+文件部分对齐 Claude Code 的检查点语义——**局部追踪、写前备份 + 每条消息重扫已跟踪文件**，而不是整树快照。这项取舍省空间，也让已跟踪文件的外部改动同样可还原：
 
 - **写前备份**：只追踪写类工具（`write`、`edit`），写前**备份原内容**，并**记录、追踪**被处理的文件——从不备份整个工作区，因此轻量；**单个文件过大时不备份**。
 - **外部变更也追**：每条用户消息边界，插件重新检查所有已跟踪文件——命令执行、手动修改等外部变更同样被记录，回退时一并还原。这让「轻量」却不「残缺」。
 - **不变不存**：记录只在有变化时发生——消息边界重扫时无变更的**不备份**（不留记录）；写前备份时若与前一条记录一致，只存指向它的链接（`ref`）而非复制内容。
-- **还原准确**：以备份为唯一标准，对照真实磁盘，只动真正不一致的文件；备份逐字节存储。还原结果与备份一致，无“幽灵影响”。但存在限制：[文件回退的追踪边界](docs/compat/tracking-boundary.zh.md)。
+- **还原准确**：以备份为唯一标准，对照真实磁盘，只动真正不一致的文件；备份逐字节存储。还原结果与备份一致，无“幽灵影响”。覆盖范围按设计限定：[文件回退的追踪边界](docs/compat/tracking-boundary.zh.md)。
 - **安全与完整性**：路径经安全化处理，绝不越出备份根目录；符号/硬链接跳过，避免透过一次还原误伤同名的另一份文件；单个文件失败绝不中止整轮还原；备份与还原日志均原子写落盘（跨重启仍在），断电或崩溃后的半还原可续做或回滚。
 
 > **设计点睛**：这套检查点的「轻」，来自**只记录被工具动过、且确实变化的文件**——写前备份保证可还原，不变不存与存链接压掉重复；还原时再对照真实磁盘，只动不一致的文件。
 
-## 明确不做的事
+## 范围与分工
 
-本插件刻意保持轻量、聚焦「对话回退」这一件事，以下场景**不属于它的职责**：
+本插件刻意保持轻量、聚焦「对话回退」这一件事，以下场景**不属于它的职责**，各自有更合适的归属（见[设计边界](docs/boundaries.zh.md)）：
 
-- **整树 / Git 级快照**——只跟踪写类工具编辑 + 已跟踪文件的外部改动，从未被工具碰过的文件不还原。需要工作树级的完整快照回退时，请交给更专业的快照工具（git）。
+- **整树 / Git 级快照**——只跟踪写类工具编辑 + 已跟踪文件的外部改动，从未被工具碰过的文件不还原。工作区历史（任意文件、任意时刻）归 Git；Agent 本来就在用 Git，插件不重复造这层。需要工作树级的完整快照回退时，请交给 Git 或项目自选的快照工具。
 - **子代理的编辑**——不追踪，子代理会话内也不提供回退（同 Claude Code）：子代理运行在自己的会话里，其备份无法由父会话的回退还原，因此也不会为子会话保留备份。
-- **fork / 分支回退**——DSH 已内置「在新对话中分支」，不重复造轮子。
+- **fork / 分支回退**——DSH 已内置「在新对话中分支」功能，不重复造轮子。
 
 ## 兼容性
 
@@ -144,12 +143,10 @@ rm <dsh home>/snapshot-cleanup-last-sweep.json
 > 本项目与 DeepSeek Harness 均处于开发者预览阶段。可复现环境请 pin 精确版本，
 > 并阅读上述行为说明。
 
-## 已知问题
+## 已知限制
 
-1. **导出的日志是完整内容**——`/export` 导出整个会话日志（原始 JSONL），包含**已撤回的内容**；本插件无法改动导出。
-2. **轻量文件回退存在代价**——特定情况可能无法回退所有修改。行为与 Claude Code 一致。详见：[文件回退的追踪边界](docs/compat/tracking-boundary.zh.md)。
-3. **轮次导航保留已回退轮次**——右侧轮次导航为已回退轮次保留「未加载」刻度，悬浮可预览已撤回内容。仅显示差异，无功能影响。
-4. **较远回退可能显示空白**——回退目标早于已加载的历史时，对话区会显示空白；需点击「加载更早」往前翻，才能看到历史对话。
+1. **轮次导航保留已回退轮次**——右侧轮次导航为已回退轮次保留「未加载」刻度，悬浮可预览已撤回内容。仅显示差异，无功能影响。
+2. **较远回退可能显示空白**——回退目标早于已加载的历史时，对话区会显示空白；需点击「加载更早」往前翻，才能看到历史对话。
 
 > [!NOTE]
 > 本插件提供浏览器端诊断输出；详见 [浏览器诊断](docs/compat/diagnostics.zh.md)。
@@ -171,7 +168,7 @@ node scripts/verify-host.mjs   # 端到端验证构建产物
 
 `prepack` 在打包前执行完整构建，所以 `npm pack` / `npm publish` 总会产出完整的 `lib/`。请从 npm 或打好的 tarball 安装——git 检出的源码里没有构建好的 `lib/`。
 
-维护者：模块地图与 harness 接口参考见 [docs/harness-reference.md](docs/harness-reference.md)
+维护者：源码布局与架构见 [docs/architecture.md](docs/architecture.md)，harness 接口参考见 [docs/harness-reference.md](docs/harness-reference.md)。
 
 贡献指南：[CONTRIBUTING.md](CONTRIBUTING.md)
 

package/SECURITY.md

@@ -1,10 +1,10 @@
 # Security model
 
 This document is the security model of **dsh-rewind** — how the plugin treats
-untrusted input, what it is allowed to mutate, and how it survives crashes.
-It is derived from the implementation (`src/index.ts`, `src/snapshot.ts`); if
-this document and the code ever disagree, the code wins and this document is
-a bug.
+untrusted input, what it is allowed to mutate, how it contains filesystem
+writes, and how it survives crashes. It is derived from the implementation; if
+this document and the code ever disagree, the code wins and this document is a
+bug.
 
 ## Trusted boundary
 
@@ -17,190 +17,167 @@ following are treated as **untrusted inputs**:
 - **Session log contents** — events are parsed structurally; a hostile or
   malformed id must never escape the store root.
 - **Current worktree state** — restore planning reconciles against the live
-  disk, which may have been changed by anything.
+  disk, which anything may have changed.
 - **Concurrent external modifications** — a restore never assumes the disk
   still matches its records.
 
-The DSH host (and its other plugins) is trusted; this plugin does not
-re-verify the host's own authority boundaries.
+The DSH host (and its other plugins) is trusted; this plugin does not re-verify
+the host's own authority boundaries.
 
 ## Mutation gates
 
-When `fileCheckpointingEnabled` is on, the plugin **automatically captures**
+When snapshot backups are on, the plugin **automatically captures**
 before-backups of tracked mutations, but **never automatically applies** one.
-A workspace restore happens only through an explicit user-invoked
-`/rewind-plugin @<seq> both` (the per-message ↶ button or the command channel),
-and only when all of the following hold:
-
-1. **A validated target**: `planRewind` accepts only a `user/message` seq that
-   is currently on the session surface (`parseRewindTarget` → `RewindPlan`).
-2. **A fresh plan**: the plan is derived from the current `events` + `surface`
-   at execution time — never cached across events.
-3. **Committed backups exist**: every planned action comes from a committed
+A workspace restore happens only through an explicit user action (the
+per-message ↶ button or `/rewind`), and only when all of the following hold:
+
+1. **A validated target** — a `user/message` seq currently on the session
+   surface.
+2. **A fresh plan** — derived from the current events and surface at execution
+   time, never cached across events.
+3. **Committed backups exist** — every planned action comes from a committed
    checkpoint entry anchored at or after the target.
-4. **Live-disk reconciliation**: `planRestore` compares each entry against the
-   current disk and plans only actions that would actually change it — an
+4. **Live-disk reconciliation** — each entry is compared with the current disk
+   and only actions that would actually change it are planned; an
    already-matching state is a no-op (restores are idempotent).
-5. **Exclusive execution**: a per-session in-flight guard rejects concurrent
-   rewinds; a running turn is force-cancelled (`keepInbox`) and quiescence is
-   awaited before the surface is cut.
-6. **Session binding**: the restore reads/writes only the store of the rewound
-   session (paths are resolved display paths the session's own tools touched).
-
-**Concurrency scope**: the in-flight guard above only serializes concurrent
-*rewinds* of one session; it does not stop other processes from modifying the
-workspace. `planRestore` reconciles against the live disk at plan time, but
-there is no re-validation between planning and applying — a file changed by
-another process in that window is overwritten by the restore. The rescue state
-is captured at apply start, so `rollbackRestore` still returns the workspace
-to exactly the apply-start state, and per-file failures are reported rather
-than hidden.
+5. **Exclusive execution** — a per-session in-flight guard rejects concurrent
+   rewinds; a running turn is cancelled (queued messages are kept) and
+   quiescence is awaited before the surface is cut.
+6. **Session binding** — the restore reads and writes only the rewound
+   session's store, over paths that session's own tools touched.
+
+**Concurrency scope:** the guard serializes concurrent *rewinds* of one session;
+it does not stop other processes from changing the workspace. The plan is
+reconciled against the live disk at plan time, with no re-validation before
+apply, so a file changed in that window is overwritten by the restore. The
+pre-restore state is captured at apply start, so a rollback still returns the
+workspace to exactly that state, and per-file failures are reported rather than
+hidden.
 
 A failed gate fails closed: an invalid target, a missing store, an absent
 backup, or a cancelled invocation aborts the rewind with an error. A store
-written by a **newer** build is one of those gates: it is refused as a whole —
-no partial restore and no new entry written into it, and the automatic
-format-change clear below is skipped — while the conversation rewind itself
-still works. An explicit clear (`run --current --apply`) or the age-based sweep,
-being a user-directed deletion of whole session directories, is deliberately not
-version-gated.
-
-**Automatic store deletion**: two things delete session snapshots. The opt-in
-`snapshot-auto-cleanup` sweep (default off) removes the whole directories of
-**long-inactive** sessions, unrelated to restores. Separately, a session's
-snapshots are cleared automatically when the conversation log's session format
-has changed (a DSH upgrade), because those backups are anchored to message
-positions that no longer line up. Both stay confined to the store root, use
-`lstat` (so they never follow a symlink out of the root), the sweep never targets
-the active session, and neither touches the conversation log. When auto-cleanup
-is disabled (the default), only the format-change clear runs, and only for an
-affected session. The store-format guard runs before that clear, so a session
-whose store is **newer** than this build understands is not cleared by it (see
-`docs/format.md`).
+written by a **newer** build is refused as a whole — no partial restore, no new
+entry, and no automatic format-change clear — while the conversation rewind
+still works. An explicit clear or the age-based sweep, being user-directed
+deletion of whole session directories, is deliberately not version-gated.
+
+**Automatic store deletion.** Two things delete session snapshots: the opt-in
+`snapshot-auto-cleanup` sweep (off by default) removes whole directories of
+long-inactive sessions; separately, a session's snapshots are cleared when the
+session format has changed (a DSH upgrade), because the backups are anchored to
+message positions that no longer line up. Both stay confined to the store root,
+never follow a symlink out of it, never touch the conversation log, and the
+sweep never targets the active session. The format guard runs before the clear,
+so a store newer than this build is not cleared by it. See
+[snapshot auto-cleanup](docs/snapshot-auto-cleanup.md) and
+[the store format](docs/format.md).
 
 ## Conversation integrity
 
 The session log is **append-only** — the plugin never deletes or rewrites
-recorded history. A rewind appends a single marker event (a `user/message` whose
-content is the constant `(empty message)` placeholder) whose `surfaceOp`
-replaces every surface node after the target. The raw log (audit trail, search,
-`/export`) is untouched — only the model-visible surface is cut, so the next
-request derives its context from the target onward. The marker's content is a
-constant, so it carries no untrusted text into the model context; the client
-hides the `[target, marker]` span from the rendered transcript.
+recorded history. A rewind appends a single marker event whose content is a
+constant placeholder and whose surface operation replaces every surface node
+after the target. The raw log (audit trail, search, `/export`) is untouched;
+only the model-visible surface is cut, so the next request derives its context
+from the target onward. The marker's constant content carries no untrusted text
+into the model context, and the client hides the withdrawn span from the
+rendered transcript. The marker shape is specified in
+[architecture](docs/architecture.md).
 
 ## Filesystem containment
 
-- **Store root**: `<dsh home>/rewind-snapshots/` by default (resolved via
-  `resolveDshHome`, so `$DSH_HOME` feeds the base and `~/.dsh` is the fallback);
-  the `snapshotDir` config overrides the whole path. The plugin reads no
-  environment variable of its own. Deleting the root only removes file backups
-  and the store rebuilds from scratch.
-- **Path sanitization**: session ids and call ids are scrubbed to
-  `[a-zA-Z0-9._-]` (`safeSessionId` / `safeFileId`) before joining the store
-  root; `.` and `..` bare values are replaced — hostile ids cannot traverse
-  out of the root.
-- **Links and moved directories are refused**: two checks guard a tracked path.
-  (1) Planning skips a path whose last component is a symlink or a hard link
-  (`lstat().nlink > 1`) and reports it, never restoring it — a symlink would
-  redirect the write outside the checkpoint, and a hard link would clobber every
-  other name of the same inode (e.g. pnpm-installed files); a link swapped in
-  after planning is not re-checked. (2) At apply time, every record this build
-  writes — entry, link and
-  journal action — carries the `realpath` of the file's directory at commit time
-  (the location pin; best-effort, and absent on released-v1 data or a commit
-  whose parent could not be resolved), and a restore re-checks it before
-  touching the path, including a post-restart continue or rollback, which reads
-  the pin from the journal: a directory that no longer resolves there (a
-  repointed or moved ancestor) is refused and reported instead of writing
-  outside the recorded location, while data with no pin falls back to check (1)
-  alone. A parent chain that
-  is gone is still recreated (files whose directory was deleted are restorable),
-  but only while its nearest surviving ancestor resolves inside the pin. A
-  stable symlinked ancestor resolves identically on both sides, so a symlinked
-  workspace or temp root is never a false skip. This matches Claude Code's
-  checkpoint behavior since v2.1.216.
+- **Store root**: `<dsh home>/rewind-snapshots/` by default (`$DSH_HOME` feeds
+  the base, `~/.dsh` is the fallback); the `snapshotDir` config overrides the
+  whole path. The plugin reads no environment variable of its own. Deleting the
+  root only removes file backups; the store rebuilds.
+- **Path sanitization**: session and call ids are scrubbed to a safe character
+  set before joining the store root; bare `.` and `..` are replaced — hostile
+  ids cannot traverse out of the root.
+- **Links are refused**: planning skips a path whose last component is a
+  symlink or a hard link and reports it — a symlink would redirect the write
+  outside the checkpoint, and a hard link would clobber every other name of the
+  same inode. A link swapped in after planning is not re-checked.
+- **Recorded locations are re-checked**: every record written by this build
+  carries the directory location resolved at commit time; a restore re-checks
+  it before touching the path, including after a restart. A directory that no
+  longer resolves there is refused and reported; a missing parent chain is
+  recreated only inside the recorded location. Data with no recorded location
+  falls back to the link check. This matches Claude Code's checkpoint behavior.
+- **Observation sync (best-effort)**: after a restore, the plugin re-emits the
+  host's `fs/observed` event for the paths it changed (absent, or present with
+  the current version), so a host with the observation policy enabled does not
+  judge the next write against a pre-restore observation. It heals only the
+  inconsistency the restore itself created; later external changes are still
+  seen normally.
 - **Restores name only recorded paths**: the store contains resolved display
   paths of the session's own write-class tool calls (plus boundary re-checks
   over that same tracked set) — a restore can never write an arbitrary path.
-- **Path resolution rule**: relative paths resolve against the session's current
-  working directory, read from the same service the fs tools resolve through.
-- **Bounded backups**: `prune` keeps the newest 100 anchor groups per session
-  (`MAX_ANCHOR_GROUPS`), except groups a non-terminal restore journal still
-  references (pinned so the op can be finished), so backup accumulation stays
-  bounded by the cap plus the number of unresolved journals (the exact cap is
-  pinned in `docs/format.md`). Across sessions, the opt-in `pruneStale` sweep
-  removes whole **long-inactive** session directories (measured by the newest
-  member being idle past the configured `autoCleanupMaxAgeDays`); it uses
-  `lstat` (no symlink following), skips dot-prefixed temp files, and never
-  targets the active session (`keepActiveId`).
+- **Path resolution**: relative paths resolve against the session's current
+  working directory, read from the service the fs tools resolve through.
+- **Bounded backups**: the store keeps a bounded number of anchor groups per
+  session, except groups a non-terminal restore still references (pinned so the
+  operation can be finished); the exact cap is in
+  [the store format](docs/format.md). Across sessions, the opt-in sweep removes
+  whole long-inactive session directories and never targets the active session.
 
 ## Crash safety
 
-- **Ordered commits**: a checkpoint commit places the before-sidecar (a raw
-  byte copy) before publishing the entry JSON, so a crash can leave an
-  unreferenced sidecar but never an entry whose bytes are missing. Every JSON
-  write (checkpoint entries, restore journals) goes to a sibling temp file and
-  is renamed over the target: a host crash mid-write can leave only an inert
-  `<target>.tmp` — never a readable half-written file — and readers never pick
-  up temp files.
-- **Journaled restores**: before mutating anything, the restore captures each
-  planned path's pre-restore ("rescue") state and persists an intent journal,
-  then marks each action done as it is applied. A crash at any point leaves
-  the journal on disk.
-- **Disk is truth**: an interrupted op keeps its journal on disk, and the store's
-  recovery API re-derives the true state from the real disk — `reconcileRestores`
-  reports which paths already match the goal (restored) and which are pending,
-  `continueRestore` finishes the op, `rollbackRestore` undoes it to the exact
-  pre-restore state, and a journal whose goal is already reached auto-heals to
-  its terminal state. The plugin never runs them on its own: an interrupted op
-  stays interrupted until an explicit caller resumes or undoes it.
-- **Fail-loud vs fail-soft**: a corrupt **journal** is reported
-  `recovery-required` — never silently dropped (dropping it would erase the
-  interrupted restore's recovery record). Corrupt **checkpoint entries** are
-  silently ignored (they only lose one backup, not the recovery path), and a
-  record whose sidecar is missing or truncated fails only that file — never a
-  delete of the live file.
-- **Journal IO never fails the restore**: if the journal cannot be written the
-  restore proceeds with pre-journal semantics (crash safety degrades,
-  behavior does not).
+- **Ordered commits**: a checkpoint writes the before-sidecar (a raw byte copy)
+  before publishing the entry, so a crash can leave an unreferenced sidecar but
+  never an entry whose bytes are missing. Every JSON write goes to a sibling
+  temp file and is renamed over the target: a crash can leave only an inert
+  `.tmp`, never a readable half-written file, and readers never pick up temp
+  files.
+- **Journaled restores**: before mutating anything, a restore captures each
+  planned path's pre-restore state and persists an intent journal, then marks
+  each action done as it is applied. A crash at any point leaves the journal on
+  disk.
+- **Disk is truth**: an interrupted operation keeps its journal, and recovery
+  re-derives the true state from the real disk — which paths already match the
+  goal and which are pending, can finish the operation, and can undo it to the
+  exact pre-restore state. A journal whose goal is already reached auto-heals.
+  The plugin never runs recovery on its own: an interrupted operation stays
+  interrupted until an explicit caller resumes or undoes it.
+- **Fail-loud vs fail-soft**: a corrupt journal is reported as
+  `recovery-required`, never silently dropped — dropping it would erase the
+  recovery record. Corrupt entries are ignored (they lose one backup, not the
+  recovery path), and a missing or truncated sidecar fails only that file —
+  never a delete of the live file.
+- **Journal IO never fails the restore**: if the journal cannot be written, the
+  restore proceeds with pre-journal semantics; crash safety degrades, behavior
+  does not.
 
 ## Explicit non-goals
 
-- This plugin does **not** sandbox other processes or stop them from changing
-  files concurrently.
-- It does **not** provide confidentiality or tamper resistance against the
-  same operating-system user: **store** files are created with the process
-  default permissions (a standard umask applies), and the host user remains
-  trusted. Restored **workspace** files do carry their recorded permission
-  bits: a content restore reapplies them (`chmod`, best-effort), while a mode
-  difference on its own never triggers a restore.
-- It does **not** exclude paths from the store, and it never oversteps: the
-  plugin only adds backup/restore on top of permissions DSH already holds. Two
-  distinct cases follow:
-  1. **Sensitive / personal-information files** (e.g. a `.env` file, which may
-     sit inside the workspace) the model may read or edit are backed up and
-     restorable, unless the file is over the size cap.
-  2. **Files outside the session workspace** the model is allowed to touch are
-     likewise backed up and restored.
-  In both cases the plugin introduces no authority of its own — DSH already
-  granted the read/edit; the plugin merely records a before-backup and can
-  restore it. Keeping a path out is a **DSH model-permission** concern (a
-  per-path deny), not a rewind feature.
-- It does **not** touch git (no refs, index, or worktree operations), makes
-  **no network requests**, and does **not** access credentials.
-- It does **not** roll back whole-log state: telemetry, search, and `/export`
-  still see the withdrawn messages (documented behavior, not a bug).
+This section declares scope, not a gap list: each item names what stays outside
+the plugin and what remains the host's or the user's responsibility. The
+boundary contract is in [design boundaries](docs/boundaries.md).
+
+- It does **not** sandbox other processes or stop them from changing files
+  concurrently.
+- It does **not** provide confidentiality or tamper resistance against the same
+  OS user: **store** files use the process default permissions under the
+  process umask, and the host user remains trusted. Restored **workspace** files
+  carry their recorded permission bits (a content restore reapplies them,
+  best-effort), while a mode difference alone never triggers a restore.
+- It does **not** exclude paths from the store, and it introduces no authority of
+  its own: sensitive files (e.g. a `.env` the model may edit) and files outside
+  the workspace the model may touch are backed up and restorable, unless over
+  the size cap. Keeping a path out is a **DSH model-permission** concern, not a
+  rewind feature.
+- It does **not** touch git, make network requests, or access credentials.
+- It does **not** roll back whole-log state: search, telemetry and `/export`
+  still see withdrawn messages (by design; see [boundaries](docs/boundaries.md)).
 - It does **not** restore files written by a cancelled tool call that never
   committed a backup.
-- **Subagent session edits are not tracked** (Claude Code alignment): a
-  subagent runs its own session, so the files it changes are not backed up and
-  cannot be restored by a rewind of the parent session; the plugin keeps no
-  snapshot for a subagent session and offers no rewind inside one.
+- **Subagent session edits are not tracked**: a subagent runs its own session,
+  so its files cannot be restored by a rewind of the parent, and the plugin
+  offers no rewind inside one. See [boundaries](docs/boundaries.md).
 
 ## Reporting
 
 Report a vulnerability through the repository's GitHub security channel or to
-a repository maintainer. Include: the plugin version/commit, the DSH
+a repository maintainer. Include the plugin version/commit, the DSH
 (`@deepseek-ai/*`) version, the platform, and a minimal reproduction — and
-whether the failure happened before or after workspace mutation.
+whether the failure happened before or after workspace mutation. Do not open a
+public issue for a vulnerability.

package/lib/client.js

@@ -475,12 +475,13 @@ function waitForCommand(session, chatOf, match, timeoutMs = 8e3, watch) {
     check();
   });
 }
-var previewCall = null;
+var UNAVAILABLE = () => Promise.resolve({ kind: "error", text: "host query is unavailable" });
+var previewCall = UNAVAILABLE;
 function registerPreviewCall(call) {
-  previewCall = call;
+  previewCall = call ?? UNAVAILABLE;
 }
 function previewImpact(sessionId, seq) {
-  return previewCall?.(sessionId, seq) ?? Promise.resolve({ kind: "error", text: "host RPC is unavailable" });
+  return previewCall(sessionId, seq);
 }
 function el(tag2, className, text) {
   const node = document.createElement(tag2);
@@ -1530,12 +1531,18 @@ function createRewindBridge(deps) {
   };
 }
 
-// src/client/host-rpc.ts
-var CHANNEL = "/dsh-rewind";
+// src/client/host-api.ts
 var TIMEOUT_MS = 8e3;
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isResult(value) {
+  if (!isRecord(value)) return false;
+  if (value["ok"] === true) return true;
+  if (value["ok"] !== false || !isRecord(value["error"])) return false;
+  const error = value["error"];
+  return typeof error["code"] === "string" && typeof error["message"] === "string" && isRecord(error["details"]);
+}
 function isImpact(value) {
   return isRecord(value) && typeof value["path"] === "string" && (value["action"] === "restore" || value["action"] === "delete");
 }
@@ -1546,53 +1553,67 @@ function isAbort(error) {
   const name2 = error?.name;
   return name2 === "AbortError" || name2 === "TimeoutError";
 }
-async function previewOverRpc(connection, sessionId, seq) {
-  if (connection === void 0) return { kind: "error", text: "host RPC is unavailable" };
+function init(payload, signal) {
+  return {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(payload),
+    signal
+  };
+}
+async function settleQuery(response, route) {
+  if (!response.ok) throw new Error(`transport failure for ${route}: HTTP ${response.status}`);
+  const result = await response.json();
+  if (!isResult(result)) throw new Error(`invalid response for ${route}`);
+  return result;
+}
+async function previewOverApi(sessionId, seq) {
   try {
-    const result = await connection.rpc.call(CHANNEL, "preview", { sessionId, seq }, AbortSignal.timeout(TIMEOUT_MS));
+    const response = await fetch("./api/dsh-rewind/preview", init({ sessionId, seq }, AbortSignal.timeout(TIMEOUT_MS)));
+    const result = await settleQuery(response, "preview");
     if (!result.ok) {
-      rewindLog.warn("preview", `RPC preview failed for @${seq}`, result.error);
+      rewindLog.warn("preview", `preview request failed for @${seq}`, result.error);
       return { kind: "error", text: result.error.message };
     }
     const value = result.value;
     if (!isRecord(value) || typeof value["backupOff"] !== "boolean" || !Array.isArray(value["files"]) || !value["files"].every(isImpact)) {
-      rewindLog.warn("preview", `RPC preview returned an invalid result for @${seq}`);
+      rewindLog.warn("preview", `preview request returned an invalid result for @${seq}`);
       return { kind: "error", text: "invalid preview response" };
     }
     return { kind: "success", files: value["files"], backupOff: value["backupOff"] };
   } catch (error) {
     if (isAbort(error)) {
-      rewindLog.warn("preview", `RPC preview timed out for @${seq}`);
+      rewindLog.warn("preview", `preview request timed out for @${seq}`);
       return null;
     }
-    rewindLog.warn("preview", `RPC preview threw for @${seq}`, error);
+    rewindLog.warn("preview", `preview request threw for @${seq}`, error);
     return { kind: "error", text: error instanceof Error ? error.message : String(error) };
   }
 }
-async function candidatesOverRpc(connection, sessionId) {
-  if (connection === void 0) return void 0;
+async function candidatesOverApi(sessionId) {
   try {
-    const result = await connection.rpc.call(CHANNEL, "candidates", { sessionId }, AbortSignal.timeout(TIMEOUT_MS));
+    const response = await fetch("./api/dsh-rewind/candidates", init({ sessionId }, AbortSignal.timeout(TIMEOUT_MS)));
+    const result = await settleQuery(response, "candidates");
     if (!result.ok) {
-      rewindLog.warn("preview", "RPC candidates failed", result.error);
+      rewindLog.warn("preview", "candidate request failed", result.error);
       return void 0;
     }
     const value = result.value;
     if (!isRecord(value) || !Array.isArray(value["candidates"]) || !value["candidates"].every(isCandidate)) {
-      rewindLog.warn("preview", "RPC candidates returned an invalid result");
+      rewindLog.warn("preview", "candidate request returned an invalid result");
       return void 0;
     }
     return value["candidates"];
   } catch (error) {
-    rewindLog.warn("preview", "RPC candidates threw", error);
+    rewindLog.warn("preview", "candidate request threw", error);
     return void 0;
   }
 }
 
 // src/client/build-info.ts
-var PLUGIN_VERSION = true ? "0.20.0-alpha.3" : "dev";
+var PLUGIN_VERSION = true ? "0.20.0" : "dev";
 var PLUGIN_PACKAGE = "dsh-rewind-plugin";
-var BUILD_HASH = true ? "46008907" : "dev";
+var BUILD_HASH = true ? "c59b80ee" : "dev";
 
 // src/client/locales.ts
 var en = {
@@ -2063,7 +2084,7 @@ function SettingsCard(props) {
 
 // src/client/index.ts
 var name = "dsh-rewind";
-var inject = ["slots", "sessions", "locale", "commandUi", "configForms", "connection"];
+var inject = ["slots", "sessions", "locale", "commandUi", "configForms"];
 var NS2 = "rewind";
 var HEADER_ACTIONS_SLOT = "conversation.session.header.actions";
 var COMPOSER_EDITABLE_SELECTOR2 = "[data-composer-input]";
@@ -2072,8 +2093,7 @@ function apply(ctx) {
   ctx.effect(function* () {
     yield ctx.locale.register(NS2, CLIENT_DICTS);
     const t = ctx.locale.bind(NS2);
-    const connection = ctx.get("connection");
-    registerPreviewCall((sessionId, seq) => previewOverRpc(connection, sessionId, seq));
+    registerPreviewCall(previewOverApi);
     yield () => {
       registerPreviewCall(null);
     };
@@ -2227,7 +2247,7 @@ function apply(ctx) {
       const chat = chatOf(face);
       return chat !== void 0 && rewindCandidatesOfChat(chat).length > 0;
     };
-    const fetchHostCandidates = async (face) => candidatesOverRpc(connection, face.sessionId);
+    const fetchHostCandidates = async (face) => candidatesOverApi(face.sessionId);
     const hostCandidatesCache = /* @__PURE__ */ new Map();
     const composerAnchor = () => {
       const surface = composerSurface2();

package/lib/index.js

@@ -2583,7 +2583,8 @@ function shouldRunAutoSweep(lastAtMs, nowMs, intervalMs = AUTO_SWEEP_INTERVAL_MS
 var name = "dsh-rewind";
 var inject = ["commands", "tools", "settings"];
 var ENGINE_COMMAND = "rewind-plugin";
-var REWIND_RPC_CHANNEL = "/dsh-rewind";
+var REWIND_PREVIEW_PATH = "/api/dsh-rewind/preview";
+var REWIND_CANDIDATES_PATH = "/api/dsh-rewind/candidates";
 var DEFAULT_FILE_CHECKPOINTING_ENABLED = true;
 var Config = z.object({
   snapshotDir: z.string().required(false),
@@ -2776,36 +2777,45 @@ async function previewImpact(store, session, seq, checkpointingEnabled) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function rpcFailure(code, message) {
+function queryFailure(code, message) {
   return { ok: false, error: { code, message, details: {} } };
 }
-function createRewindRpcHandler(store, agentsOf, checkpointingEnabled) {
-  return async (endpoint, payload) => {
+function queryResponse(result) {
+  return Response.json(result);
+}
+function createRewindQueryHandler(store, agentsOf, checkpointingEnabled, query) {
+  return async (request) => {
     try {
-      if (!isRecord(payload)) return rpcFailure("rewind/bad-request", "invalid payload");
+      if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") {
+        return new Response("content type must be application/json", { status: 415 });
+      }
+      let payload;
+      try {
+        payload = await request.json();
+      } catch {
+        return new Response("body is not JSON", { status: 400 });
+      }
+      if (!isRecord(payload)) return queryResponse(queryFailure("rewind/bad-request", "invalid payload"));
       const sessionId = payload["sessionId"];
       if (typeof sessionId !== "string" || sessionId.length === 0) {
-        return rpcFailure("rewind/bad-request", "sessionId must be a non-empty string");
+        return queryResponse(queryFailure("rewind/bad-request", "sessionId must be a non-empty string"));
       }
       const agents = agentsOf();
-      if (agents === void 0) return rpcFailure("rewind/agents-unavailable", "agent registry is unavailable");
+      if (agents === void 0) return queryResponse(queryFailure("rewind/agents-unavailable", "agent registry is unavailable"));
       const agent = agents.get(sessionId);
-      if (agent === void 0) return rpcFailure("rewind/session-not-found", `session ${sessionId} is not attached`);
+      if (agent === void 0) return queryResponse(queryFailure("rewind/session-not-found", `session ${sessionId} is not attached`));
       const session = agent.session;
-      if (endpoint === "preview") {
+      if (query === "preview") {
         const seq = payload["seq"];
-        if (!Number.isSafeInteger(seq)) return rpcFailure("rewind/bad-request", "seq must be an integer");
-        return { ok: true, value: await previewImpact(store, session, seq, checkpointingEnabled()) };
-      }
-      if (endpoint === "candidates") {
-        return {
-          ok: true,
-          value: { candidates: listRewindCandidates(session.snapshotEvents(), session.surface.nodes) }
-        };
+        if (!Number.isSafeInteger(seq)) return queryResponse(queryFailure("rewind/bad-request", "seq must be an integer"));
+        return queryResponse({ ok: true, value: await previewImpact(store, session, seq, checkpointingEnabled()) });
       }
-      return rpcFailure("rewind/unknown-endpoint", `unknown endpoint: ${endpoint}`);
+      return queryResponse({
+        ok: true,
+        value: { candidates: listRewindCandidates(session.snapshotEvents(), session.surface.nodes) }
+      });
     } catch (error) {
-      return rpcFailure("rewind/failed", error instanceof Error ? error.message : String(error));
+      return queryResponse(queryFailure("rewind/failed", error instanceof Error ? error.message : String(error)));
     }
   };
 }
@@ -3244,21 +3254,24 @@ function apply(ctx, config) {
     })();
   }, { global: true });
   ctx.inject(["connection"], (scope) => {
-    try {
-      const connection = scope.root.connection;
-      if (connection === void 0) return;
-      const dispose = connection.rpc.handle(
-        REWIND_RPC_CHANNEL,
-        createRewindRpcHandler(
-          store,
-          () => scope.get("agents"),
-          () => isFileCheckpointingEnabled(config)
-        )
-      );
-      scope.effect(() => dispose, "dsh-rewind RPC channel");
-    } catch (error) {
-      ctx.logger.warn(`[dsh-rewind] RPC channel registration failed: ${error instanceof Error ? error.message : String(error)}`);
-    }
+    const connection = scope.connection;
+    if (connection === void 0) return;
+    const agentsOf = () => scope.get("agents");
+    const checkpointingEnabled = () => isFileCheckpointingEnabled(config);
+    const register = (path, query) => {
+      try {
+        scope.effect(() => connection.fetch.register({
+          path,
+          methods: ["POST"],
+          requestBody: "buffered",
+          fetch: createRewindQueryHandler(store, agentsOf, checkpointingEnabled, query)
+        }), `dsh-rewind ${path} route`);
+      } catch (error) {
+        ctx.logger.error(`[dsh-rewind] route registration failed for ${path}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    };
+    register(REWIND_PREVIEW_PATH, "preview");
+    register(REWIND_CANDIDATES_PATH, "candidates");
   });
   ctx.inject(["fs", "workingDirectory"], (scope) => {
     const fs = scope.fs;

package/lib/types/client/candidates.d.ts

@@ -74,7 +74,8 @@ export declare function rewindCandidatesOf(snap: CandidateChat, limit?: number):
 export declare function rewindCandidatesOfChat(snap: CandidateChat): RewindCandidate[];
 /**
  * Map typed candidates to popupSelect rows. The list comes from the host over
- * RPC, so it covers the FULL host surface rather than the windowed chat snapshot.
+ * the host query route, so it covers the FULL host surface rather than the
+ * windowed chat snapshot.
  */
 export declare function rewindOptionsFromCandidates(candidates: readonly RewindCandidate[], t: Translate): SelectOption[];
 export {};

package/lib/types/client/host-api.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The browser half of the two read-only host queries: the mode popover's impact
+ * preview and the `/rewind` candidate list, posted to their exact `/api` routes.
+ *
+ * @module dsh-rewind/client/host-api
+ */
+import type { RewindCandidate } from './candidates.ts';
+/** One file affected by a rewind. */
+export interface PreviewFileImpact {
+    readonly path: string;
+    readonly action: 'restore' | 'delete';
+}
+/** One impact probe resolved, failed, or timed out (`null`). */
+export type PreviewOutcome = {
+    readonly kind: 'success';
+    readonly files: readonly PreviewFileImpact[];
+    readonly backupOff: boolean;
+} | {
+    readonly kind: 'error';
+    readonly text: string;
+} | null;
+/** Fetch one target's impact through the host query route. */
+export type PreviewCall = (sessionId: string, seq: number) => Promise<PreviewOutcome>;
+/** Resolve one target's file impact through the host query route. */
+export declare function previewOverApi(sessionId: string, seq: number): Promise<PreviewOutcome>;
+/** Fetch the full rewind candidate list through the host query route. */
+export declare function candidatesOverApi(sessionId: string): Promise<readonly RewindCandidate[] | undefined>;

package/lib/types/client/index.d.ts

@@ -9,7 +9,7 @@
  * The command decoration (`ctx.commandUi.decorate`) makes a bare `/rewind` (or
  * its alias `/undo`) open the harness's own popupSelect instead of executing;
  * the parameterized `@<seq>` form stays the execution channel, while the
- * popover's impact and candidate reads go over the host RPC channel.
+ * popover's impact and candidate reads go over the host's exact `/api` routes.
  *
  * @module dsh-rewind/client
  */

package/lib/types/client/popover.d.ts

@@ -2,7 +2,7 @@
  * The rewind mode-selection popover (plain DOM, no React). Step two of the
  * interaction: the target is already fixed (the clicked message); the popover
  * offers the two modes. Choosing "both" fetches the impact list over the host
- * RPC channel and shows it before confirming.
+ * `/api` preview route and shows it before confirming.
  *
  * Keyboard: ↑/↓ move focus across the step's ACTION buttons only (the two
  * modes, or the confirm button on the impact step), Enter activates the
@@ -16,7 +16,7 @@
 import type { SessionFace } from '@deepseek-ai/dsh-api-session-controller/client';
 import type { CommandNode } from '@deepseek-ai/dsh-client-ui-conversation/client';
 import { type ChatOf } from './hidden.ts';
-import type { PreviewCall } from './host-rpc.ts';
+import type { PreviewCall } from './host-api.ts';
 import type { RewindKey } from './locales.ts';
 type Translate = (key: RewindKey, params?: Record<string, unknown>) => string;
 export interface PopoverOptions {
@@ -66,7 +66,7 @@ export declare function waitForCommand(session: SessionFace, chatOf: ChatOf, mat
     kind: 'success' | 'error';
     text?: string;
 } | null>;
-/** Register the host RPC preview call (null clears it on unload). */
+/** Register the host preview call; null restores the unavailable default. */
 export declare function registerPreviewCall(call: PreviewCall | null): void;
 /** Open the mode-selection popover anchored near the given button. */
 export declare function openPopover(opts: PopoverOptions): void;

package/lib/types/locales.d.ts

@@ -16,7 +16,7 @@
  *
  * The client half (`src/client/locales.ts`) owns all interactive UI copy via
  * `ctx.locale` + `t()`; the client never parses host prose (the popover reads
- * travel over the RPC channel).
+ * travel over the host `/api` query routes).
  *
  * DSH localizes only its OWN command descriptions via the client locale — a
  * closed `HOST_FACES` allowlist; third-party plugin descriptions are

package/lib/types/snapshot.d.ts

@@ -179,7 +179,7 @@ export interface LinkEntry {
 export type StoredEntry = CheckpointEntry | LinkEntry;
 /** True when an entry is a dedup link (carries `ref`, not `before`). */
 export declare function isLinkEntry(entry: StoredEntry): entry is LinkEntry;
-/** Per-file restore impact preview (served by the host RPC channel). */
+/** Per-file restore impact preview (served by the host preview route). */
 export interface FileImpact {
     readonly path: string;
     /** `restore` = write the before content back; `delete` = remove the file. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rewind-plugin",
-  "version": "0.20.0-alpha.3",
+  "version": "0.20.0",
   "description": "In-window conversation rewind with workspace file restore",
   "icon": "./assets/icon.svg",
   "keywords": [
@@ -23,7 +23,7 @@
   "license": "MIT",
   "engines": {
     "node": ">=24.9.0",
-    "dsh": ">=0.2.2-alpha.2 <0.3.0-0"
+    "dsh": ">=0.2.2-rc.1 <0.3.0-0"
   },
   "type": "module",
   "main": "lib/index.js",
@@ -58,7 +58,6 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-connection",
         "@deepseek-ai/dsh-client-ui-commands",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-settings"
@@ -79,24 +78,24 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.6-alpha.1",
-    "@deepseek-ai/dsh-client-connection": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-locale": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-commands": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-primitives": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-commands": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-fs": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-home-paths": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-llm": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-sandbox": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-session": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-settings": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-tools": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/dsh-working-directory": ">=0.2.2-alpha.2 <0.3.0-0",
-    "@deepseek-ai/schemastery": "^3.18.6-alpha.1"
+    "@deepseek-ai/cordis": "^4.1.0",
+    "@deepseek-ai/dsh-client-connection": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-locale": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-commands": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-commands": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-fs": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-home-paths": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-sandbox": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-session": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.2-rc.1 <0.3.0-0",
+    "@deepseek-ai/schemastery": "^3.19.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -155,45 +154,45 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.6-alpha.1",
-    "@deepseek-ai/cosmokit": "1.8.7-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-attachment": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-store": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-commands": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-session": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-command-compact": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-commands": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-compaction": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-compaction-basic": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-compaction-image-offload": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-fs": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-goal": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-plan-mode": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-scope": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-session": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-session-stats": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-session-title": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-settings": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-token-meter": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-user-questions": "0.2.2-alpha.2",
-    "@deepseek-ai/dsh-working-directory": "0.2.2-alpha.2",
-    "@deepseek-ai/schemastery": "3.18.6-alpha.1",
+    "@deepseek-ai/cordis": "4.1.0",
+    "@deepseek-ai/cosmokit": "1.9.0",
+    "@deepseek-ai/dsh-agent": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-commands": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-command-compact": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-commands": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-compaction": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-compaction-basic": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-compaction-image-offload": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-goal": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-plan-mode": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-scope": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-session-stats": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-session-title": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-settings": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-token-meter": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-user-questions": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-working-directory": "0.2.2-rc.1",
+    "@deepseek-ai/schemastery": "3.19.0",
     "@types/node": "^24.0.0",
     "@types/react": "^18.3.31",
     "@types/react-dom": "^18.3.7",

package/lib/types/client/host-rpc.d.ts

@@ -1,45 +0,0 @@
-/**
- * The browser half of the rewind RPC channel: the mode popover's impact
- * preview and the `/rewind` candidate list. Both are read-only host queries,
- * so they travel over Connection RPC instead of the human command channel.
- *
- * @module dsh-rewind/client/host-rpc
- */
-import type { RewindCandidate } from './candidates.ts';
-/** One file affected by a rewind. */
-export interface PreviewFileImpact {
-    readonly path: string;
-    readonly action: 'restore' | 'delete';
-}
-/** One impact probe resolved, failed, or timed out (`null`). */
-export type PreviewOutcome = {
-    readonly kind: 'success';
-    readonly files: readonly PreviewFileImpact[];
-    readonly backupOff: boolean;
-} | {
-    readonly kind: 'error';
-    readonly text: string;
-} | null;
-/** Fetch one target's impact through the registered RPC call. */
-export type PreviewCall = (sessionId: string, seq: number) => Promise<PreviewOutcome>;
-type RpcResult = {
-    readonly ok: true;
-    readonly value: unknown;
-} | {
-    readonly ok: false;
-    readonly error: {
-        readonly code: string;
-        readonly message: string;
-    };
-};
-/** The slice of the client `connection` service this module reads. */
-export interface ConnectionLike {
-    readonly rpc: {
-        call(channel: string, endpoint: string, payload: unknown, signal?: AbortSignal): Promise<RpcResult>;
-    };
-}
-/** Resolve one target's file impact over RPC. */
-export declare function previewOverRpc(connection: ConnectionLike | undefined, sessionId: string, seq: number): Promise<PreviewOutcome>;
-/** Fetch the full rewind candidate list over RPC. */
-export declare function candidatesOverRpc(connection: ConnectionLike | undefined, sessionId: string): Promise<readonly RewindCandidate[] | undefined>;
-export {};