dsh-tui-theme 0.7.0 → 0.7.1

package/README.md

@@ -150,7 +150,7 @@ rm ~/.dsh-tui/theme-follow.json
 ## 开发
 
 ```sh
-npm install
+npm install --include=dev   # 见下方安装前提，本仓不提交 lockfile
 npm run build
 npm run verify
 npm run verify:package
@@ -159,7 +159,12 @@ DSH_TUI_SOURCE_ROOT=/path/to/dsh-TUI-source \
 npm run verify:host
 ```
 
-`verify:host` 默认使用开发依赖中的 dsh-TUI（当前为 0.10.1）进行零配置验证；需要验证旧版或发布基线时，再显式指向同一版本的宿主 adapter 与源码。需要锁定版本时，额外设置 `DSH_TUI_EXPECTED_VERSION`。
+安装前提（这两条会让普通 `npm install` 失败或静默不装依赖）：
+
+- **本仓有意不提交 `package-lock.json`。** devDependency 里的宿主 tarball 内嵌 `@dsh-std/*`，其包内 manifest 仍声明 `workspace:*`；提交的 lockfile 会被 npm 忠实重放，于是 `npm install` 与 `npm ci` 都报 `EUNSUPPORTEDPROTOCOL`。删掉 lockfile 后 npm 会直接跳过 tarball 内的 bundle 目录，正常安装。请勿把 lockfile 提交回来（CI 的 `contract` 档会直接拦下）。
+- **安装时不要带 `NODE_ENV=production`。** 该变量会让 npm 按 `omit=dev` 静默省略 devDependencies，表现为 `up to date` 但 `node_modules` 为空、随后 `tsc` 找不到。所以显式写 `--include=dev`（CI 里另外固定 `NODE_ENV=development`）。
+
+`verify:host` 默认使用开发依赖中的 dsh-TUI（当前为 0.10.1）进行零配置验证，无需本地宿主源码检出；需要验证旧版或发布基线时，再显式指向同一版本的宿主 adapter 与源码。需要锁定版本时，额外设置 `DSH_TUI_EXPECTED_VERSION`。CI 只覆盖这条 0.10.1 零配置线，0.9.x 兼容回归仍需本机按上面的 env 指向对应宿主 worktree。
 
 主题调色板改起来最直接：编辑 `themes/*.json` 后重新 `npm run verify`，再删掉 `~/.dsh-tui/themes/` 下对应文件让插件重装。
 

package/lib/types/autoTheme.d.ts

@@ -13,6 +13,9 @@
  */
 interface FollowCache {
     light: boolean;
+    /** Diagnostic only (the /settings panel shows its date); never an expiry
+     *  signal — the cache is applied as-is whenever the user opts in, and this
+     *  plugin has no producer to refresh it (see the module header). */
     at: number;
 }
 /** The persisted theme pref ({ theme: name }), host format. */

package/lib/types/autoTheme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"autoTheme.d.ts","sourceRoot":"","sources":["../../src/autoTheme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,UAAU,WAAW;IACnB,KAAK,EAAE,OAAO,CAAA;IACd,EAAE,EAAE,MAAM,CAAA;CACX;AAsCD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAGxE;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrE;AAED,oFAAoF;AACpF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAA;AAE3B;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,OAAO,EACxB,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GACvC,IAAI,CAUN"}
+{"version":3,"file":"autoTheme.d.ts","sourceRoot":"","sources":["../../src/autoTheme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,UAAU,WAAW;IACnB,KAAK,EAAE,OAAO,CAAA;IACd;;wEAEoE;IACpE,EAAE,EAAE,MAAM,CAAA;CACX;AAsCD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAGxE;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrE;AAED,oFAAoF;AACpF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAA;AAE3B;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,OAAO,EACxB,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GACvC,IAAI,CAUN"}

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMlD,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAKjF,eAAO,MAAM,IAAI,kBAAY,CAAA;AAE7B,wDAAwD;AACxD,MAAM,MAAM,MAAM,GAAG,eAAe,CAAA;AAUpC,eAAO,MAAM,MAAM,EAAE,WAAW,CAAC,MAAM,CAUrC,CAAA;AAoBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAiK7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMlD,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAKjF,eAAO,MAAM,IAAI,kBAAY,CAAA;AAE7B,wDAAwD;AACxD,MAAM,MAAM,MAAM,GAAG,eAAe,CAAA;AAUpC,eAAO,MAAM,MAAM,EAAE,WAAW,CAAC,MAAM,CAUrC,CAAA;AAoBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAoK7D"}

package/lib/types/index.js

@@ -94,6 +94,9 @@ export function apply(ctx, config = {}) {
         if (!cordis.autoInstallThemes)
             return;
         const result = installBundledThemes();
+        if (result.sourceError !== undefined) {
+            ctx.logger.warn(`${PLUGIN_ID}: ${result.sourceError}`);
+        }
         for (const file of result.installed) {
             ctx.logger.info(`${PLUGIN_ID}: installed bundled theme "${file}" into ~/.dsh-tui/themes/`);
         }

package/lib/types/statusLine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"statusLine.d.ts","sourceRoot":"","sources":["../../src/statusLine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAkBlD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,YAAY,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,iEAAiE;IACjE,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AAsCrD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAyGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,GAAG,IAAI,CAgIvF"}
+{"version":3,"file":"statusLine.d.ts","sourceRoot":"","sources":["../../src/statusLine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAkBlD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,YAAY,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,iEAAiE;IACjE,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AAsCrD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAuGD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,GAAG,IAAI,CAyIvF"}

package/lib/types/statusLine.js

@@ -106,8 +106,7 @@ function activeThemeName(dataDir) {
     }
     return prefCache.value;
 }
-function isPinkThemeActive(dataDir) {
-    const name = activeThemeName(dataDir);
+function isPinkTheme(name) {
     return name !== undefined && PINK_THEMES.has(name);
 }
 // ── palette colors ──────────────────────────────────────────────────────────
@@ -151,13 +150,12 @@ function readPalette(name) {
     }
     return NO_COLORS;
 }
-function paletteFor(dataDir) {
-    const name = activeThemeName(dataDir);
-    if (name === undefined || !PINK_THEMES.has(name))
+function paletteFor(themeName) {
+    if (!isPinkTheme(themeName))
         return NO_COLORS;
     const now = Date.now();
-    if (colorsCache === undefined || colorsCache.name !== name || now - colorsCache.at >= THEME_PREF_TTL_MS) {
-        colorsCache = { at: now, name, colors: readPalette(name) };
+    if (colorsCache === undefined || colorsCache.name !== themeName || now - colorsCache.at >= THEME_PREF_TTL_MS) {
+        colorsCache = { at: now, name: themeName, colors: readPalette(themeName) };
     }
     return colorsCache.colors;
 }
@@ -192,7 +190,8 @@ export function startStatusLine(ctx, getEffective) {
         // differ in how the result reaches the host.
         const renderScalar = () => {
             const eff = getEffective();
-            const cells = statusCells(eff);
+            const themeName = activeThemeName(dataDir);
+            const cells = statusCells(eff, themeName);
             const separator = sanitizeOrnament(eff.statusSeparator, SEPARATOR);
             const parts = [cells.glyph, cells.clock, cells.turns].filter((value) => value !== undefined);
             const text = parts.join(` ${separator} `);
@@ -209,14 +208,18 @@ export function startStatusLine(ctx, getEffective) {
             try {
                 if (store !== undefined) {
                     const eff = getEffective();
-                    const cells = statusCells(eff);
+                    // One pref read per render, shared by the visibility check and the
+                    // palette: the module header's "one cheap stat" invariant holds on
+                    // both paths (statusCells and paletteFor each used to re-resolve).
+                    const themeName = activeThemeName(dataDir);
+                    const cells = statusCells(eff, themeName);
                     store.push({
                         visible: cells.glyph !== undefined || cells.clock !== undefined || cells.turns !== undefined,
                         glyph: cells.glyph,
                         clock: cells.clock,
                         turns: cells.turns,
                         separator: sanitizeOrnament(eff.statusSeparator, SEPARATOR),
-                        colors: paletteFor(dataDir),
+                        colors: paletteFor(themeName),
                     });
                     return;
                 }
@@ -227,9 +230,10 @@ export function startStatusLine(ctx, getEffective) {
             }
         };
         /** The three optional cells (all undefined = the line is off: master
-         *  switch, theme scope, and the toggles fold into this one shape). */
-        function statusCells(eff) {
-            const enabled = eff.statusEnabled && (eff.statusScope === 'all-themes' || isPinkThemeActive(dataDir));
+         *  switch, theme scope, and the toggles fold into this one shape).
+         *  Takes the theme name resolved once by the caller per render. */
+        function statusCells(eff, themeName) {
+            const enabled = eff.statusEnabled && (eff.statusScope === 'all-themes' || isPinkTheme(themeName));
             if (!enabled)
                 return { glyph: undefined, clock: undefined, turns: undefined };
             return {

package/lib/types/themeAssets.d.ts

@@ -19,6 +19,10 @@ export interface ThemeInstallResult {
     readonly repaired: readonly string[];
     /** Files that could not be installed (per-file failures). */
     readonly failed: readonly string[];
+    /** Set only when the bundled directory itself was unreadable, so nothing
+     *  was attempted and no per-file entry exists. Carries the directory and
+     *  the underlying error for the caller's log. */
+    readonly sourceError?: string;
 }
 export interface BundledTheme {
     readonly file: string;

package/lib/types/themeAssets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"themeAssets.d.ts","sourceRoot":"","sources":["../../src/themeAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACxC;AAID,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,MAA2B,GAAG,YAAY,EAAE,CA0CxF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,GAAE,MAA0B,EACrC,SAAS,GAAE,MAA2B,GACrC,kBAAkB,CAmCpB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,GAAE,MAA0B,EACrC,SAAS,GAAE,MAA2B,GACrC,MAAM,EAAE,CAuBV;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,MAA0B,EACrC,SAAS,GAAE,MAA2B,GACrC,MAAM,EAAE,CAkBV"}
+{"version":3,"file":"themeAssets.d.ts","sourceRoot":"","sources":["../../src/themeAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;qDAEiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACxC;AAOD,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,MAA2B,GAAG,YAAY,EAAE,CA0CxF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,GAAE,MAA0B,EACrC,SAAS,GAAE,MAA2B,GACrC,kBAAkB,CAqCpB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,GAAE,MAA0B,EACrC,SAAS,GAAE,MAA2B,GACrC,MAAM,EAAE,CAuBV;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,MAA0B,EACrC,SAAS,GAAE,MAA2B,GACrC,MAAM,EAAE,CAkBV"}

package/lib/types/themeAssets.js

@@ -15,7 +15,10 @@ import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 // Same resolution order as the host's utils/paths.ts homeDir(): os.homedir()
-// first, USERPROFILE/HOME spellings as stripped-down fallbacks.
+// first, USERPROFILE/HOME spellings as stripped-down fallbacks. When all three
+// come up empty the returned '' makes every derived path resolve against the
+// process cwd — the host's own semantics, kept deliberately identical rather
+// than second-guessed here.
 export function homeDir() {
     return homedir() || process.env.USERPROFILE || process.env.HOME || '';
 }
@@ -87,8 +90,10 @@ export function installBundledThemes(targetDir = themesTargetDir(), sourceDir =
     try {
         files = readdirSync(sourceDir).filter(entry => entry.toLowerCase().endsWith('.json'));
     }
-    catch {
-        return { installed, skipped, repaired, failed: [sourceDir] };
+    catch (error) {
+        // No file was attempted, so `failed` stays empty; the directory-level
+        // reason travels separately so the caller can log a precise line.
+        return { installed, skipped, repaired, failed, sourceError: `could not read bundled themes from ${sourceDir}: ${String(error)}` };
     }
     for (const file of files) {
         const target = join(targetDir, file);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tui-theme",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Sakura-pink themes for dsh-TUI with optional cached background follow (pink-day/pink-night), a blossom status line, and a /settings section. No shortcuts, no commands.",
   "type": "module",
   "main": "lib/types/index.js",
@@ -58,8 +58,8 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.2-alpha.3 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.6 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.2-alpha.3 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.0-rc.6 || ^0.1.1-rc.1 || ^0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {

package/scripts/runtime-themes-headless.mjs

@@ -240,3 +240,78 @@ assert.ok(followToast.text.includes('pink-day') && followToast.text.includes('re
 assert.equal(JSON.parse(readFileSync(join(dataDir3, 'theme.json'), 'utf8')).theme, 'pink-day', 'the follow pref write still happened')
 await mount3.fiber.dispose()
 console.log('OK toast phase 3: apply-time self-heal and boot-follow toasts delivered on the real host')
+
+// ── Phase 4: settings namespace registers against the REAL service, late ────
+// The stub suites cover the namespace registration with fakes, and phase 3
+// stands in a minimal fake at apply time; this phase mounts a real
+// @deepseek-ai/dsh-settings SettingsProvider AFTER the plugin (and after the
+// extensions row), so the plugin's parked ['settings'] inject fires against
+// the genuine register()/scope/watch machinery. The end-to-end signal: a
+// user-layer followSystem write through the real service flips theme.json.
+const sandbox4 = mkdtempSync(join(tmpdir(), 'pink-settings-late-'))
+process.env.USERPROFILE = sandbox4
+process.env.HOME = sandbox4
+const dataDir4 = join(sandbox4, '.dsh-tui')
+mkdirSync(dataDir4, { recursive: true })
+writeFileSync(join(dataDir4, 'theme-follow.json'), JSON.stringify({ light: true, at: 1 }, null, 2))
+
+const { SettingsProvider } = await import(pathToFileURL(hostRequire.resolve('@deepseek-ai/dsh-settings')).href)
+
+/** Minimal concrete provider: in-memory storage, no file, no background IO. */
+class MemorySettingsProvider extends SettingsProvider {
+  static provide = 'settings'
+  writable = true
+  stored = {}
+  async load() {
+    return { ...this.stored }
+  }
+
+  async persist(ns, section) {
+    this.stored[ns] = { ...section }
+  }
+}
+
+const app4 = new Context()
+await app4.plugin(pluginHost.default ?? pluginHost)
+const mount4 = await mountPlugin(app4)
+await mount4.context.plugin(pink)
+await app4.plugin(extensions.default ?? extensions)
+// Deliberately last: the namespace registration can only be "late" when the
+// service arrives after everything the plugin injects at apply time.
+await app4.plugin(MemorySettingsProvider)
+
+const provider = app4.get('settings')
+assert.ok(provider, 'the real dsh-settings provider must be mounted')
+const settingsDeadline = Date.now() + 5_000
+while (provider.get(SETTINGS_NAMESPACE) === undefined && Date.now() < settingsDeadline) {
+  await sleep(25)
+}
+assert.ok(
+  provider.get(SETTINGS_NAMESPACE),
+  `the plugin namespace must register with the real service within ${5_000}ms of its late arrival`,
+)
+await provider.update(SETTINGS_NAMESPACE, { followSystem: true })
+assert.equal(
+  provider.get(SETTINGS_NAMESPACE)?.followSystem,
+  true,
+  'the real service must resolve the committed user layer for the namespace',
+)
+
+const prefPath4 = join(dataDir4, 'theme.json')
+const followDeadline = Date.now() + 5_000
+let followed = false
+while (!followed && Date.now() < followDeadline) {
+  try {
+    followed = JSON.parse(readFileSync(prefPath4, 'utf8')).theme === 'pink-day'
+  } catch {
+    // Pref not written yet.
+  }
+  if (!followed) await sleep(25)
+}
+assert.equal(
+  followed,
+  true,
+  'the user-layer follow toggle must apply the cached light background through the real service',
+)
+await mount4.fiber.dispose()
+console.log('OK settings: namespace registers late on the real dsh-settings service and drives the follow pref')

package/scripts/validate-themes-against-host.mjs

@@ -105,6 +105,13 @@ assert.deepEqual(
 // guarantee, so the count is reported instead of pinned to a hardcoded floor.
 console.log(`* host Theme key count: ${allKeys.length} (coverage asserted per key)`)
 
+// The color keys the host's /settings screen paints with (screens/Settings.tsx
+// at the pinned baseline: promptBorder card frame, permission card title,
+// selectionBg focused row, suggestion/error/success/inactive/subtle row text
+// and checkbox chips, warning badges). Maintained by hand because the screen
+// has no exported key manifest; revisit this list whenever a dsh-TUI release
+// adds a Theme key to that screen — the per-key coverage assertion below then
+// fails loudly instead of shipping an unreadable settings card.
 const settingsKeys = [
   'promptBorder',
   'selectionBg',

package/scripts/verify-package.mjs

@@ -7,9 +7,14 @@ import { existsSync, readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import assert from 'node:assert/strict'
 
+// This repo deliberately ships no package-lock.json: the pinned host tarball
+// bundles @dsh-std/* packages whose manifests still declare workspace:*, and
+// npm replays a committed lockfile faithfully — every install (npm ci too)
+// dies with EUNSUPPORTEDPROTOCOL. Removing the lockfile makes npm skip the
+// bundled directories instead. The peer/dev consistency checks below therefore
+// read package.json only; CI's contract job guards the deletion (REVIEW.md G1).
 const pluginRoot = fileURLToPath(new URL('..', import.meta.url))
 const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
-const lockfile = JSON.parse(readFileSync(new URL('../package-lock.json', import.meta.url), 'utf8'))
 const packCommand = process.platform === 'win32'
   ? { file: 'cmd.exe', args: ['/d', '/s', '/c', 'npm pack --dry-run --json --ignore-scripts'] }
   : { file: 'npm', args: ['pack', '--dry-run', '--json', '--ignore-scripts'] }
@@ -90,12 +95,10 @@ for (const name of Object.keys(packageJson.peerDependencies)) {
   assert.equal(devAccepted, true, `${name} dev pin must be accepted by its peer range`)
 }
 assert.equal(packageJson.dependencies?.['@deepseek-ai/schemastery'], undefined)
-const rootLock = lockfile.packages?.['']
-assert.ok(rootLock, 'lockfile must have root metadata')
-assert.equal(lockfile.version, packageJson.version)
-assert.deepEqual(rootLock.devDependencies, packageJson.devDependencies)
-assert.deepEqual(rootLock.peerDependencies, packageJson.peerDependencies)
-assert.equal(rootLock.dependencies, undefined)
+// The lockfile's root metadata is deliberately not compared here: this script
+// also ships inside the published tarball (package.json `files`), and npm never
+// packs a lockfile, so the check could not hold for a consumer. The repo-level
+// lockfile invariant lives in the CI contract job instead (REVIEW.md G1).
 assert.equal(existsSync(new URL('../lib/types/index.js', import.meta.url)), true)
 
 console.log(`✓ package manifest: ${packed.name}@${packed.version}, ${files.size} files`)

package/scripts/verify.mjs

@@ -650,6 +650,31 @@ const emit = (record, event, ...args) => {
   console.log('✓ follow logging: baseline docs stay quiet, real toggles still log')
 }
 
+// ── 12c. unreadable bundled source: the directory-level failure stays precise ──
+{
+  const targetDir = join(sandboxHome, 'source-fail-target')
+  const sourceDir = join(pluginRoot, 'themes')
+  const originalReaddir = builtinFs.readdirSync
+  try {
+    builtinFs.readdirSync = (path, ...rest) => {
+      if (String(path) === sourceDir) throw new Error('EACCES: source unreadable')
+      return originalReaddir(path, ...rest)
+    }
+    syncBuiltinESMExports()
+    const result = installBundledThemes(targetDir, sourceDir)
+    assert.deepEqual(result.failed, [], 'no per-file failure exists when nothing was attempted')
+    assert.match(
+      result.sourceError ?? '',
+      /could not read bundled themes from .*themes.*EACCES/,
+      'the directory-level error names the source and the cause',
+    )
+  } finally {
+    builtinFs.readdirSync = originalReaddir
+    syncBuiltinESMExports()
+  }
+  console.log('✓ unreadable bundled source: precise sourceError, no bogus per-file failure')
+}
+
 // ── 12. status injection: session handlers die with tuiStatus activation ────
 {
   const outerHandlers = new Map()