dsh-ssh-tui 0.4.1 → 0.5.0

package/lib/types/approval-reviewer.d.ts

@@ -0,0 +1,20 @@
+export interface ReviewInput {
+    userText: string;
+    segments: string[];
+    toolName: string;
+    command: string;
+}
+export interface ReviewVerdict {
+    risk: 'low' | 'medium' | 'high';
+    authorization: 'yes' | 'no' | 'unknown';
+    approved: boolean;
+    reason: string;
+}
+export declare const REVIEW_SYSTEM_PROMPT: string;
+/** Assemble the compact, fence-marked user message for the reviewer. */
+export declare function buildReviewUserMessage(input: ReviewInput): string;
+/**
+ * Parse the reviewer's one-line JSON verdict. Anything unreadable, missing
+ * fields, or with invalid enum values returns undefined (fail-safe).
+ */
+export declare function parseReviewOutput(text: string): ReviewVerdict | undefined;

package/lib/types/auto-approval.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Codex-style auto-approval classifier for the /approval auto mode.
+ *
+ * This is a UX heuristic, not a security boundary. The contract mirrors
+ * Codex's unattended posture: allow-shaped commands (reads, builds, tests,
+ * git reads) approve automatically, danger-shaped commands are REJECTED with
+ * the model informed (it adapts instead of paging the human), and only
+ * genuinely unrecognized shapes fall through to a prompt — which detaches to
+ * a rejection when nobody is watching. Real damage containment still comes
+ * from the sandbox preset and git.
+ */
+export type AutoApprovalMode = 'off' | 'auto';
+export type ApprovalDecision = 'allow' | 'deny' | 'ask';
+/**
+ * Whole-command danger patterns, checked before anything else. A match keeps
+ * the interactive prompt regardless of what else the command contains.
+ */
+export declare const DANGER_PATTERNS: RegExp[];
+/**
+ * Segment-level allow patterns: low-risk, high-frequency reads, builds, and
+ * tests. A command auto-approves only when EVERY segment matches one of these.
+ */
+export declare const ALLOW_SEGMENT_PATTERNS: RegExp[];
+/**
+ * Classify one shell command line. Danger anywhere auto-rejects; otherwise
+ * the command auto-approves only when every segment is a recognized low-risk
+ * pattern — unknown shapes ask (and detach to a rejection when unattended).
+ */
+export declare function classifyCommand(command: string): ApprovalDecision;
+/**
+ * Classify one approval request. `command` is the decoded shell command when
+ * the pending call is a shell tool. 'deny' auto-rejects (the model reads the
+ * rejection and adapts); 'ask' falls through to the interactive prompt.
+ */
+export declare function classifyApproval(toolName: string, command: string | undefined): ApprovalDecision;
+/**
+ * Decode the shell command of a streamed tool call from its raw JSON args.
+ * Returns undefined for non-shell tools or unparseable args.
+ */
+export declare function commandFromArgs(toolName: string, args: string): string | undefined;
+/** Parse the /approval argument into a mode. */
+export declare function parseAutoApprovalMode(raw: string): AutoApprovalMode | undefined;

package/lib/types/display-sock.d.ts

@@ -0,0 +1,74 @@
+export declare const FRAME_STDIN = 1;
+export declare const FRAME_STDOUT = 2;
+export declare const FRAME_RESIZE = 3;
+export declare const FRAME_HELLO = 4;
+export declare const FRAME_GOODBYE = 5;
+export declare const FRAME_RTT = 6;
+/**
+ * Drop launcher SIGTERM/SIGINT/SIGHUP so closing SSH cannot dispose the tree
+ * before hangup handling. Leaving the session with setsid() is best-effort:
+ * a TTY session leader gets EPERM and stays in the SSH process group.
+ */
+export declare function detachFromSshSession(): void;
+export declare const TUI_HOST_ENV = "DSH_TUI_HOST";
+export declare function isTuiHostProcess(env?: NodeJS.ProcessEnv): boolean;
+export declare function sessionSockPath(sessionId: string, dshHome?: string): string;
+export declare function encodeFrame(type: number, payload?: Buffer): Buffer;
+export declare function encodeResize(columns: number, rows: number): Buffer;
+export declare function decodeResize(payload: Buffer): {
+    columns: number;
+    rows: number;
+} | undefined;
+export declare function encodeRtt(rttMs: number | undefined): Buffer;
+export declare function decodeRtt(payload: Buffer): number | undefined;
+/** Incremental decoder for one socket. */
+export declare class FrameReader {
+    private buffer;
+    push(chunk: Buffer): Array<{
+        type: number;
+        payload: Buffer;
+    }>;
+}
+export interface DisplayHostHandlers {
+    onStdin(bytes: Buffer): void;
+    onResize(columns: number, rows: number): void;
+    onRtt?(rttMs: number | undefined): void;
+    onDetach(): void;
+    onAttach(): void;
+}
+/**
+ * Host-side listener. At most one Display is attached; a new hello kicks the
+ * previous relay so two SSH windows cannot both drive the session.
+ */
+export declare class DisplayHost {
+    readonly path: string;
+    private readonly handlers;
+    private server;
+    private socket;
+    private reader;
+    attached: boolean;
+    constructor(path: string, handlers: DisplayHostHandlers);
+    listen(): Promise<void>;
+    private accept;
+    sendStdout(bytes: Buffer | string): boolean;
+    sendGoodbye(): void;
+    close(): Promise<void>;
+}
+export declare function waitForDisplaySock(path: string, timeoutMs?: number, pid?: number, errFile?: string): Promise<void>;
+export declare function hostArgvForSession(sessionId: string, argv?: string[], execArgv?: string[]): string[];
+/** Spawn a detached Host copy of this `dsh` invocation and return its sock path. */
+export declare function spawnDetachedHost(sessionId: string): {
+    pid: number;
+    sock: string;
+    errFile?: string;
+};
+export declare function probeDisplaySock(path: string, timeoutMs?: number): Promise<boolean>;
+export interface RelayResult {
+    /** Host sent goodbye — user exited from the attached session. */
+    reason: 'goodbye' | 'host-closed' | 'signal';
+}
+/**
+ * Turn this process into a Display relay until the Host hangs up or the
+ * local TTY dies. Restores the terminal before resolving.
+ */
+export declare function runDisplayRelay(path: string): Promise<RelayResult>;

package/lib/types/dsh-compat.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Dual-stack shims for dsh 0.1.1-rc.2 and 0.1.2-rc.1.
+ *
+ * 0.1.2 turned the settings free functions into `SettingsProvider` methods,
+ * replaced `Session.events` with on-demand readers, and started branding
+ * namespaces at the type level only. Every shim here keeps the same runtime
+ * value on both hosts and picks the API shape that is actually present.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
+import type { SettingsNamespace, SettingsSectionHooks } from '@deepseek-ai/dsh-settings';
+import type z from '@deepseek-ai/schemastery';
+/**
+ * 0.1.1-rc.2 wraps namespaces via `settingsNamespace()`; 0.1.2 brands them at
+ * the type level and takes the plain string at runtime. A cast covers both.
+ */
+export declare function settingsNamespace(value: string): SettingsNamespace;
+/**
+ * Register a settings section: 0.1.2-rc.1 moved the free function onto the
+ * `settings` service as `installSection`, callable only once that service is
+ * injected (plugins apply before it, so `ctx.inject` must defer — same
+ * pattern the harness's own packages use); 0.1.1-rc.2 keeps the free
+ * function, which defers internally and is safe at apply time.
+ */
+export declare function installSettingsSection<T>(ctx: Context, ns: SettingsNamespace, schema: z<T>, entry: T, hooks: SettingsSectionHooks<T>): void;
+/**
+ * Read the full durable event log: 0.1.2-rc.1 replaced the `Session.events`
+ * property with on-demand readers; 0.1.1-rc.2 still exposes the property.
+ */
+export declare function sessionEvents(session: object): readonly SessionEvent[];

package/lib/types/i18n/index.d.ts

@@ -14,10 +14,12 @@ export declare const UI_LOCALE_SCHEMA: z<Schemastery.ObjectS<{
     language: z<string, string>;
     skipUpdate: z<string, string>;
     view: z<string, string>;
+    disconnect: z<string, string>;
 }>, Schemastery.ObjectT<{
     language: z<string, string>;
     skipUpdate: z<string, string>;
     view: z<string, string>;
+    disconnect: z<string, string>;
 }>>;
 export declare function localeFromTag(tag: string): Locale | undefined;
 /** Pick zh/en from env, optionally after a saved settings value. */

package/lib/types/picker.d.ts

@@ -8,6 +8,10 @@ import type { Context } from '@deepseek-ai/cordis';
 export type SessionPickerResult = {
     kind: 'resume';
     id: string;
+} | {
+    kind: 'attach';
+    id: string;
+    sock: string;
 } | {
     kind: 'new';
 } | null;

package/lib/types/provider-catalog.d.ts

@@ -0,0 +1,35 @@
+export interface CatalogPreset {
+    id: string;
+    name: string;
+    baseUrl: string;
+    modelIds: string[];
+}
+/** Filter presets by a case-insensitive substring match on id or name. */
+export declare function filterCatalogPresets(presets: readonly CatalogPreset[], query: string): CatalogPreset[];
+/** One selectable provider row in the /setup wizard's first step. */
+export interface ProviderListEntry {
+    /** Unique key: `template:<type>` for the pinned rows, `catalog:<id>` otherwise. */
+    key: string;
+    label: string;
+    detail: string;
+    catalog?: CatalogPreset;
+}
+/**
+ * Merge the pinned templates with the web-catalog presets into one list:
+ * catalog ids in `dedupeIds` drop out (the template already covers them),
+ * and `query` filters by case-insensitive substring on label/key/detail.
+ */
+export declare function mergeProviderEntries(templates: readonly ProviderListEntry[], presets: readonly CatalogPreset[], dedupeIds: readonly string[], query: string): ProviderListEntry[];
+/**
+ * Read the catalog. Anchors are module paths that plausibly sit inside the dsh
+ * install: the running CLI entry (`process.argv[1]`) and the plugin's module
+ * base. Returns undefined when no reachable install ships a usable catalog or
+ * the child does not answer within 10 seconds.
+ */
+export declare function readProviderCatalog(anchors: Array<string | undefined>): Promise<CatalogPreset[] | undefined>;
+/**
+ * Read the catalog once per process and memoize the result: the child needs a
+ * moment to load pi-ai, so callers warm it at startup and reuse the settled
+ * value.
+ */
+export declare function loadProviderCatalog(anchors: Array<string | undefined>): Promise<CatalogPreset[] | undefined>;

package/lib/types/session-list.d.ts

@@ -4,6 +4,7 @@
  * both surfaces offer the same sessions.
  */
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence';
+import { listAttachableHosts } from './session-lock.js';
 /** Last path segment for the footer chip (`\root\genshin\srv` → `srv`). */
 export declare function sessionCwdLabel(cwd: string): string;
 export declare function formatFooterCwd(cwd: string): string;
@@ -28,7 +29,13 @@ export interface ResumableSession {
     cwd: string;
     /** Whether the full event log could not be inspected (corrupt/unsupported). */
     unreadable?: boolean;
+    /** Live Host that a new SSH can attach to. */
+    attach?: {
+        pid: number;
+        sock: string;
+        state?: string;
+    };
 }
 /** `MM-DD HH:mm` local-time label for session lists. */
 export declare function formatSessionTime(timestamp: number): string;
-export declare function listResumableSessions(persistence: SessionPersistence, currentId: string): Promise<ResumableSession[]>;
+export declare function listResumableSessions(persistence: SessionPersistence, currentId: string, listHosts?: typeof listAttachableHosts): Promise<ResumableSession[]>;

package/lib/types/session-lock.d.ts

@@ -1,8 +1,19 @@
+export type SessionLockState = 'attached' | 'paused' | 'running-detached';
+export type DisconnectPolicy = 'pause' | 'continue';
+export type SessionLockAgentStatus = 'idle' | 'running' | 'cancelling';
 export interface SessionLockInfo {
     pid: number;
     sessionId: string;
     startedAt: string;
+    /** `/proc/sys/kernel/random/boot_id` when the lock was taken (POSIX only). */
+    bootId?: string;
+    /** `/proc/<pid>/stat` starttime (field 22) of `pid` when the lock was taken. */
+    pidStart?: string;
     tty?: string;
+    sock?: string;
+    state?: SessionLockState;
+    disconnectPolicy?: DisconnectPolicy;
+    agentStatus?: SessionLockAgentStatus;
 }
 export declare class SessionLockHeldError extends Error {
     readonly lock: SessionLockInfo;
@@ -13,14 +24,54 @@ export declare function sessionLockPath(sessionId: string, dshHome?: string): st
 export declare function parseSessionLock(raw: string): SessionLockInfo | undefined;
 /** True when `pid` still exists on this machine (best-effort). */
 export declare function processIsAlive(pid: number): boolean;
+/**
+ * True when `pid` is genuinely the Host process that wrote `lock`.
+ *
+ * `processIsAlive` alone is not enough: the pid may have been recorded inside
+ * a different pid namespace (sandbox/container) and then be recycled by an
+ * unrelated host process — e.g. a lock written as pid 5 in a sandbox matches
+ * the forever-alive pid 5 kernel thread on the host, which used to produce a
+ * permanent false "zombie" that blocked `--resume`. We therefore verify the
+ * process identity:
+ *  - new locks carry `bootId` + `pidStart` (boot_id + /proc/<pid>/stat
+ *    starttime): a matching pair can only be the same process on the same
+ *    boot, so a recycled or cross-namespace pid fails the check;
+ *  - older locks fall back to `/proc/<pid>/cmdline`: the detached Host is
+ *    always launched with `--resume=<sessionId>` in argv, so any other
+ *    process (kernel threads have an empty cmdline) is proven stale.
+ * On platforms without procfs the legacy kill(pid, 0) behavior is kept.
+ */
+export declare function lockOwnerIsAlive(lock: SessionLockInfo): boolean;
 export declare function formatLockHeldMessage(lock: SessionLockInfo): string;
 export declare function sessionLockDisabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function readSessionLock(sessionId: string, dshHome?: string): Promise<{
+    path: string;
+    info: SessionLockInfo;
+} | undefined>;
+export declare function writeSessionLock(path: string, info: SessionLockInfo): Promise<void>;
 export declare function acquireSessionLock(sessionId: string, options?: {
     pid?: number;
     tty?: string | null;
     dshHome?: string;
+    sock?: string;
+    state?: SessionLockState;
+    disconnectPolicy?: DisconnectPolicy;
+    agentStatus?: SessionLockAgentStatus;
 }): Promise<{
     path: string;
     info: SessionLockInfo;
 }>;
 export declare function releaseSessionLock(path: string, pid?: number): Promise<void>;
+export type LiveHostKind = 'attachable' | 'zombie';
+export declare function inspectLiveHost(sessionId: string, dshHome?: string): Promise<{
+    kind: LiveHostKind;
+    lock: SessionLockInfo;
+    path: string;
+    sock: string;
+} | undefined>;
+/** Every lock file under `$DSH_HOME/tui-locks` whose Host pid is still alive. */
+export declare function listAttachableHosts(dshHome?: string): Promise<Array<{
+    sessionId: string;
+    lock: SessionLockInfo;
+    sock: string;
+}>>;