super-dsh 0.3.0-a → 0.3.0-d

package/node_modules/better-dsh/README.md

@@ -1,323 +0,0 @@
-> Part of [Super D](../README.md). This is the independently installable `better-dsh` package. Super Dash embeds the same local build and registers it as a separate native Plugin Manager row, with its own enable/disable switch; both packages share version 0.3.0-a. Active source is this directory, with shared specifications and references under root `docs/`.
-
-# Better Dsh — Dashr
-
-DASHR is a persistent-kernel REPL for the DeepSeek Harness (dsh): a
-**stateful `ctx.replRuntime` provider** (one persistent IPython kernel
-subprocess **per session**, the run's `principal`, held in a map inside the
-one service instance per mount). Each `run()` is one cell on the calling
-session's kernel; variables, imports, and definitions assigned in run N
-survive into run N+1 — *state codification* (blueprint §1.1 channel ②),
-deliberately NOT the per-run isolation a one-shot execution backend
-provides — and two sessions sharing one service instance never see each
-other's variables.
-
-Naming (v0.1.5 layer model): the runtime class is **`DashrRuntime`** — the
-standing-mount-layer component (one instance per mount holding the
-cross-session kernel map), and therefore the de facto daemon while the
-profile-level `DashrDaemon` concept stays an empty shell; the session layer
-is the ipykernel subprocess itself, a pure interpreter with no harness
-awareness.
-
-The presentation half — the `eval` transport tool, the Python SDK renderer,
-and the tool→binding bridge — lives in the SAME package (merged in v0.1.8;
-the pre-merge `dsh-rlm-mode`/`dashr-presentation` sibling split is gone).
-The runtime registers the service key `replRuntime` through its own vendored
-Service Definition (see `src/vendored/repl-runtime.ts`), so it carries **zero
-dsh runtime package dependencies**: only `@deepseek-ai/cordis` (peer),
-`schemastery`, and `zeromq`.
-
-## Package positioning
-
-- npm name: `better-dsh` (unscoped; formerly `@pgmi-builds/better-dsh`, which
-  now stays published only as a deprecated pointer to this name).
-- A standard Cordis plugin (`Context` + schemastery `Config`, every tunable
-  configurable from `cordis.yml`, no hardcoded tunables).
-- "Registrations are effects": the kernel lifecycle (lazy spawn on a key's
-  first `run()`, teardown on that session's `agent/disposed`, optional
-  snapshot at either teardown) is effect-owned, so plugin disposal tears
-  every subprocess down.
-- Published surface: `lib/` only (`files: ["lib"]`, `main`/`types`/`exports`
-  pointing at `lib/index.js` / `lib/index.d.ts`) — the build emits beside the
-  manifest (`outDir: 'lib'`; the tsdown default `dist/` left the exports map
-  dangling, fixed in M2B). The root also re-exports the vendored Service
-  Definition's public contract (`ReplRuntime` plus the `CodeRun*` /
-  `CodeBinding*` / `CodeJsonValue` types) so consumers depend on the
-  published shape instead of reaching into sources. The declaration keeps
-  dependency imports external (`dts: { resolve: false }`): bundled copies
-  would create duplicate type identities in a consumer's program.
-
-## Native Web defaults
-
-The bundle owns native DSH Web policies as independently toggleable components.
-`dashr-web-trust` accepts authenticated serving Host/Origin values while retaining
-native cookie authentication. `dashr-webserver` inherits the native server and
-waits for welcome confirmation before listening; its default address is
-`0.0.0.0`, with the native port and CLI override behavior preserved.
-Automatic credential onboarding is disabled; users can still configure models.
-
-`dashr-welcome-notice` reads the current `WELCOME_NOTICE_VERSION` from the Models
-client belonging to the actual DSH installation and acknowledges it through the
-original General settings namespace before the first HTTP read. No version is
-pinned in the plugin. Ordinary version bumps adapt at startup; changed private
-symbols or build layouts fail explicitly. Restore native welcome behavior with:
-
-```yaml
-- id: dashr-welcome-notice
-  disabled: true
-```
-
-The sibling Super Dash pack builds this repository locally and embeds its actual
-tarball. Better Dash remains independently installable. `../dev-webmcp` is an
-unshipped development-only bundle owned by this repository.
-
-## Install
-
-```sh
-npm install better-dsh
-```
-
-The runtime OWNS its kernel environment. With `python` left at the
-`python3` sentinel (or absent), it provisions a managed venv under the
-package (`.venv-kernel`) on first use, installing `ipykernel` + `dill`
-(CPython 3.11) — no `/tmp` symlink, no blind trust in a host `python3`.
-An explicit `python` (or `DASHR_KERNEL_PYTHON`) is verified instead. For
-development and tests, pre-create the venv:
-
-```sh
-npm run kernel:venv        # uv venv .venv-kernel --python 3.11 + ipykernel + dill
-```
-
-Tests pick the kernel interpreter from `DASHR_TEST_PYTHON`, falling back to
-`./.venv-kernel/bin/python`, then `python3` — see `test/helpers.ts`.
-
-## Configuration
-
-Every field of the plugin `Config` (schemastery defaults shown):
-
-| Field | Default | Meaning |
-| --- | --- | --- |
-| `python` | `python3` | Explicit interpreter with `ipykernel`; the bare `python3` sentinel (or absent) selects a managed venv under `kernelEnvDir`. |
-| `startupTimeoutMs` | `30000` | Budget for kernel spawn → ready, in milliseconds. |
-| `runTimeoutMs` | `120000` | Wall budget per run; expiry interrupts the kernel then force-settles. |
-| `interruptGraceMs` | `2000` | Grace between a timeout/abort interrupt and the force-settle. |
-| `interruptConfirmMs` | `250` | Confirm window between the control-channel interrupt and the SIGALRM escalation (must be `< interruptGraceMs`); see "Interrupts" below. |
-| `disposeTimeoutMs` | `5000` | Budget for graceful kernel teardown (shutdown_request → SIGKILL). |
-| `snapshotTimeoutMs` | `30000` | Budget for internal snapshot/restore cells (dill dump/load). |
-| `maxOutputBytes` | `67108864` | Hard cap for serialized log-array, completion-value, and failure-message payloads. |
-| `snapshotDir` | *(unset)* | Base directory for per-session namespace snapshots (`<dir>/<principal>/state.dill` + `manifest.json`); none when absent. |
-| `snapshotSizeCapBytes` | `268435456` | Serialized-size cap for a turn-end snapshot; over-cap snapshots are skipped (one-time model warning). |
-| `username` | `dashr` | Jupyter username stamped on wire messages. |
-| `kernelEnvDir` | *(unset)* | Managed venv directory (defaults to `<package>/.venv-kernel`). |
-| `kernelPythonVersion` | *(unset)* | Preferred CPython version for a managed venv (default `3.11`). |
-| `kernelAutoInstall` | `true` | Provision the managed venv (`ipykernel` + `dill`) on first use. |
-
-## Persistent-state semantics
-
-- **Cell semantics**: each `run({ program })` is one cell on the calling
-  session's kernel namespace (`user_ns`) — a pure IPython REPL. Top-level
-  `await` works; a top-level `return` is a SyntaxError, exactly as in a
-  native IPython cell. The completion value is the LAST expression's value
-  (REPL displayhook-style): a statement-ending cell or a `None` final
-  expression yields no `value` field, and a non-JSON value comes back as its
-  repr text.
-- **Session keying** (M3-A): one kernel per distinct `request.principal`
-  (the presentation bridge passes the calling agent's session id); runs
-  without a principal share one default key, preserving M1 semantics. The
-  service instance count is unchanged — one per mount — the keying is a
-  `Map<principal, kernel>` inside the provider.
-- **Kernel lifetime**: lazy start on a key's first `run()`; teardown when
-  that session's agent is disposed (the dsh `agent/disposed` event, payload
-  `{ agent: { id } }`, listened through the untyped cordis event service to
-  keep this package's zero-dsh-dependency rule) and on plugin disposal
-  (`shutdown_request`, then SIGKILL after `disposeTimeoutMs`). A kernel that
-  dies unexpectedly is never reused in-process: it respawns onto its nearest
-  replayable snapshot (or a fresh empty kernel when none exists) and the run
-  that observed the death gets an explicit `worker-exit` naming what was lost.
-- **Turn-end snapshots** (M3-B): with `snapshotDir` configured, every
-  successful run is followed by a size-capped snapshot cell that dumps the
-  user namespace to `<snapshotDir>/<principal>/state.dill` + `manifest.json`
-  (`turn`, `pythonVersion`, `venvPath` = the kernel's own `sys.executable`,
-  `skills`, `names`, `sizeBytes`). A namespace whose serialized size exceeds
-  `snapshotSizeCapBytes` is skipped — estimated BEFORE any dill IO by a
-  bounded walk that reads numpy/pandas in-memory footprints, then confirmed
-  against the actual `.part` dump — and the model is warned once through the
-  run's own logs. Skipped snapshots never replace the previous good one.
-- **Restore-on-first-boot** (M3-B): a key's first kernel boot restores its
-  on-disk snapshot before running user code. The kernel validates the
-  manifest itself (python version, interpreter identity, skills); a
-  non-replayable snapshot degrades to an EMPTY namespace and the first run
-  tells the model so. Variable state and the append-only transcript are NOT
-  transactionally consistent (blueprint §8.3): the snapshot is a point-in-time
-  namespace capture that can lag the transcript, and a degraded restore never
-  fabricates variables the transcript once saw.
-- **Interrupts** (M3-A hardened): aborts/timeouts escalate in two phases —
-  the zmq control `interrupt_request` first, then SIGALRM only after
-  `interruptConfirmMs` if the cell has still not settled. The kernel-side
-  bootstrap installs a busy guard that only raises `KeyboardInterrupt` while
-  a dashr cell is actually executing, so a signal landing on an idle or
-  booting kernel is swallowed instead of terminating the process (the M1
-  same-tick dual send killed idle kernels deterministically — 10/10
-  same-tick, 8/10 at +1-2ms, 40/40 during cold boot; see
-  `test/interrupt-race.spec.ts`). The hard-abort contract is intact: a busy
-  `while True: pass` still breaks inside the grace (blueprint §10.4).
-- **Concurrency**: the bridge serializes cells per kernel (`executeCell`
-  awaits the previous cell), so concurrent `run()` calls on one session
-  queue rather than interleave; see `test/parallel.spec.ts`. Runs on
-  DIFFERENT principals execute on their own kernels concurrently.
-- **What snapshots do NOT carry**: nothing outside the kernel namespace is
-  ever in scope — the v0.1.8b removal deleted the Continual Harness
-  (`refine()`, `harnessDir`) entirely, so the snapshot/restore cycle's only
-  persistence channel is the kernel namespace itself (blueprint §8.4).
-  Anything a cell stores in ordinary variables follows the snapshot rules
-  above as before.
-
-## Testing
-
-```sh
-npm install
-npm run kernel:venv     # once; or export DASHR_TEST_PYTHON=/path/to/python
-npm run typecheck       # tsc --noEmit
-npm test                # vitest --run (fileParallelism: false)
-```
-
-Teardown discipline: every test context is disposed through
-`onTestFinished`, and CI must assert no orphan kernels remain:
-
-```sh
-pgrep -cf -- '-[m] ipykernel_launcher' || echo no-orphans
-```
-
-(The `-[m]` trick prevents `pgrep` from matching itself; 208 orphaned
-kernels once exhausted machine memory while every unit test stayed green —
-blueprint §10.8/§10.9.)
-
----
-
-# Presentation half (eval transport, SDK, bindings)
-
-The DASHR agent-plane presentation (blueprint §7.4): the plugin half that
-presents the persistent-kernel runtime to the model as **cells on one
-persistent IPython kernel**. It contributes:
-
-- **`eval`** — the cell transport tool: one call = one cell on the calling
-  session's kernel (the `ctx.replRuntime` service). Variables, imports, and
-  definitions survive across calls. Nested tool calls ride the host
-  registry's native scheduling pipeline as `await tool.name({...})` inside
-  the cell — one positional arguments object per call, keyword arguments
-  rejected. Every registry-visible tool is bound as a member; the
-  `send_message` bridge callable joins them in the same catalog block.
-- **`dashr:tool-catalog`** — a generated Python SDK prompt section: one
-  `async def name(args) -> Output` per visible tool (flat `tool.*` shape)
-  plus the cell contract (persistent namespace, completion-value rules,
-  `ToolCallError`, sub-call concurrency).
-- **The model-direct collapse** — an assembly filter leaves `eval` the only
-  contributed tool schema, and a monotonic guard denies a model-direct call
-  naming anything else with the route back into a cell. Both are scoped to
-  the mounting composition, so a PTC (native Code Mode) preset in the same
-  process keeps its own presentation.
-- **Masking (ADR-0002)** — exactly two upstream tool names are displaced
-  from the model's surface (`send_message` and the child-scoped `report`),
-  collapsed into the single dual-direction `send_message` bridge. Every
-  other delegation tool (`subagent`, `subagent_fork`, `list_agents`,
-  `interrupt_agent`, `workflow`, `ralph`) stays **directly exposed** as a
-  native `tool.*` binding — the model calls it exactly as the host ships it.
-  Masking is presentation-only: the registry is never touched.
-
-Removed in v0.1.8b: the `refine` Continual Harness and the `compact` REPL
-bridge (harness/refine became third-party territory; context compaction is
-the host runtime's business, not the REPL's).
-
-## Install
-
-Install this package independently with the native plugin command. Use Super Dash instead when you also want the Foreign Agent Hub:
-
-```sh
-# 1. plugin — the pnpm registry-metadata cache can lag a fresh npm publish
-#    by minutes-to-hours, so drop it first, or `@latest` resolves the OLD
-#    version right after a release:
-rm -rf ~/.cache/pnpm
-dsh plugin --profile web add --config.auto-install-peers=false better-dsh@latest
-
-# 2. restart the running instance:  systemctl --user restart dsh
-```
-
-Notes: `--config.auto-install-peers=false` is MANDATORY — the profile
-already resolves `@deepseek-ai/*` peers through the harness install; letting
-the package manager auto-install them adds a second, divergent copy of
-cordis and friends. The version is deliberately unpinned (`@latest`).
-
-## Coexistence with a PTC Code-Mode session
-
-`eval` is our own transport name (the registry reserves `run_code`), so a
-Code-Mode preset (`@deepseek-ai/dsh-agent-tool-presentation` with
-`mode: code` over the host-plane worker-thread `codeRuntime`) composes
-beside a DASHR session in one process: the PTC agent's assembly shows
-`run_code` plus the TS `tools:sdk` section, the DASHR agent's shows `eval`
-plus the Python `dashr:tool-catalog`, and neither execution path touches
-the other's runtime.
-
-## Composition
-
-```ts
-import dashr from 'better-dsh'
-
-ctx.plugin(dashr, { maxParallelSubCalls: 10 })
-```
-
-One plugin, one row: `apply` mounts `DashrRuntime` first (providing
-`ctx.replRuntime`), then the presentation half injects on `replRuntime` —
-a composition without the runtime fails AT MOUNT, named in the preset's
-activation audit, instead of at the first prompt. The dashr bundle patch
-mounts the row on the HOST plane, so every agent in every preset sees the
-`eval` tool (`agent → preset → global`).
-
-## Delegation and messaging
-
-The upstream delegation tools stay REGISTERED, EXECUTABLE, and directly
-bound — `subagent`, `subagent_fork`, `list_agents`, `interrupt_agent`,
-`workflow`, `ralph` are ordinary `tool.*` members the model calls exactly
-as the host ships them. Two names are displaced by the single
-`send_message` bridge (ADR-0001): upstream `send_message` (the
-parent→child downlink) and the child-scoped `report` (the child→parent
-uplink) collapse into one dual-direction channel:
-
-- `await tool.send_message({"receiver": "child", "message": ..., "subagent_id": ...})`
-  delivers down through the tool layer;
-- `await tool.send_message({"receiver": "parent", "message": ...})` reports
-  up through the SERVICE layer (`ctx.subagents.reportFrom(...)`) — live
-  continuable children only; a root agent gets a structured `UNAUTHORIZED`.
-
-Every binding returns structured JSON; errors are a FIELD on the result,
-never a host crash — a missing `ctx.subagents` service, a depth cap, an
-unknown id, or an infrastructure rejection all map to an `error` string.
-
-## Config
-
-| Field | Default | Meaning |
-| --- | --- | --- |
-| `maxParallelSubCalls` | `10` | Cap on one cell's overlapping sub-calls (native scheduler contract; `1` = strictly serial). |
-| *(runtime keys)* | — | The runtime slice (`python`, `snapshotDir`, timeouts, caps, kernel-env knobs) is documented in the Configuration table above. |
-
-## Tests
-
-```sh
-npm install
-npm run kernel:venv     # once; or export DASHR_TEST_PYTHON=/path/to/python
-npm run typecheck
-npm test                # vitest --run
-```
-
-The suite needs a Python interpreter with `ipykernel` (+ `dill` for the
-snapshot tiers) for the real-kernel specs; it resolves one from
-`DASHR_TEST_PYTHON`, then `./.venv-kernel/bin/python`, then `python3` —
-see `test/helpers.ts`.
-
-## Relationship to upstream
-
-Structure mirrors `@deepseek-ai/dsh-agent-tool-presentation` and the Code
-Mode half of `@deepseek-ai/dsh-tools` (0.1.1-rc.2), re-pointed at the
-vendored `replRuntime` Service Definition. See the module docs in
-`src/index.ts` for the deliberate deltas (`eval` vs `run_code`, ordinary
-scoped registration, guard-based collapse, mirrored `tools/code-dispatch-log`
-waterfall).

package/node_modules/better-dsh/THIRD_PARTY_NOTICES.md

@@ -1,52 +0,0 @@
-# Third-party notices
-
-`better-dsh` ships source copies of three MIT-licensed packages under
-[`third_party/`](third_party/). They are **vendored, not dependencies**: the
-plugin must not depend on how a host installation scope resolves them, so the
-sources live here, are imported by relative path, and are inlined into the
-published `lib/` bundle. Provenance, version pins, and the update procedure are
-documented in [`third_party/README.md`](third_party/README.md).
-
-| Package | Version | License | Upstream |
-|---|---|---|---|
-| `@deepseek-ai/schemastery` | 3.18.4 | MIT | <https://github.com/deepseek-ai/deepseek-harness> |
-| `@deepseek-ai/cosmokit` | 1.8.5 | MIT | <https://github.com/deepseek-ai/deepseek-harness> |
-| `@standard-schema/spec` | 1.1.0 | MIT | <https://github.com/standard-schema/standard-schema> |
-| `@ast-grep/wasm` | 0.45.3 | MIT | <https://github.com/ast-grep/ast-grep> |
-| `web-tree-sitter` | 0.26.12 | MIT | <https://github.com/tree-sitter/tree-sitter> |
-| `@lumis-sh/wasm-*` (14 grammars) | 0.26.x | MIT | <https://www.npmjs.com/org/lumis-sh> |
-
-`@standard-schema/spec` is a type-only import of `schemastery`'s declarations;
-`cosmokit` is `schemastery`'s sole runtime dependency and is resolved from
-`third_party/schemastery/node_modules/`.
-
-## MIT License
-
-Applies to all three packages above, each with its own copyright holder:
-
-```
-MIT License
-
-Copyright (c) 2021-present Shigma                 (schemastery, cosmokit)
-Copyright (c) 2024 Colin McDonnell                (@standard-schema/spec)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
-Each copy also retains its upstream `LICENSE` file in place.

package/node_modules/better-dsh/cordis.patch.yml

@@ -1,139 +0,0 @@
-# DASHR bundle patch: six component rows on the HOST plane (spec
-# docs/specs/plugins-page-components/spec.md). Each insert is one toggleable
-# component on the native Plugins page; a row toggle writes `{id, disabled}`
-# into the profile's user patch layer and applies live. The rows share no
-# inject edges — each degrades gracefully when its dependencies (host
-# services, not sibling rows) are absent.
-#
-# `dashr-repl` (core): the `eval` tool and persistent-kernel REPL runtime land
-# in the global scope layer, so every agent in every preset sees them
-# (`agent → preset → global`). One process-global runtime keys one kernel per
-# Session/Agent, torn down on `agent/disposed` — the promotion of the v0.1.5
-# DashrDaemon shell. The tool is an ordinary registration: upstream's `code`
-# preset still applies its own `tools:code-only` rule (a direct `eval` call in
-# a PTC session resolves to UNKNOWN_TOOL). DASHR ships no PTC mode, so that
-# rule never bites here.
-#
-# `python` is only a hint: the runtime OWNS the kernel environment. An
-# explicit interpreter (DASHR_KERNEL_PYTHON) is verified; the bare
-- insert:
-    # No-op standalone; keeps a containing pack's local companion delivery current.
-    - id: dashr-bundle-delivery
-      name: 'better-dsh/bundle-delivery'
-
-    - id: dashr-repl
-      name: 'better-dsh'
-      config:
-        python: !!js process.env.DASHR_KERNEL_PYTHON ?? 'python3'
-
-    # URL-aware I/O + hashline + devices. Gates ride THIS row's config
-    # (schema defaults: both ON — opt-out), no longer the core row's.
-    - id: dashr-url-schemes
-      name: 'better-dsh/url-schemes'
-
-    # LLM failover (settings-driven; the row config is the chain base —
-    # both slots default "not set").
-    - id: dashr-failover
-      name: 'better-dsh/failover'
-
-    # Auto-compaction threshold preference (settings-driven).
-    - id: dashr-compaction-tuning
-      name: 'better-dsh/compaction-tuning'
-
-    # Trusted page authorities leg of the boot script (browser-side twin of
-    # the connection fence below). Schema default derives trustedPageAuthorities
-    # from DSH_TRUSTED_HOSTS (v0.2.2a ruling: schema defaults, not patch
-    # config — they survive every overlay layer; an explicit value still wins).
-    - id: dashr-web-trust
-      name: 'better-dsh/web-trust'
-      config:
-        trustAllHosts: true
-
-    # Mobile responsiveness leg of the boot script (gestures payload +
-    # zoomGuard section). All knobs default ON; `enabled: false` opts out.
-    - id: dashr-mobile
-      name: 'better-dsh/mobile'
-
-    # Remote execution framework (plan 2026-09-23-remote-framework-impl.md):
-    # `remote` tool face — two-track (oneshot default / pty opt-in), CLI
-    # transports (ssh/docker/incus), BYO-PTY spawn, nonce framing, 10min TTL.
-    # All config defaults, so the row carries no config block.
-    - id: dashr-remote
-      name: 'better-dsh/remote'
-
-    # Browser session gate: the native flow's door is a per-boot `?token=` URL,
-    # and exchanging it mints a durable signed cookie from a key that lives in
-    # this home's credential store. This row claims exact `/` (unclaimed
-    # upstream — dispatch is exact → longest prefix → fallback) and asks for a
-    # password instead, minting the SAME native cookie for the same 30 days.
-    # `/index.html` and every `/api` request keep being verified by the native
-    # checker, so no upstream code is touched; `?token=` simply stops being a
-    # door. The password is the row's own credential record, seeded to `admin`.
-    - id: dashr-web-password
-      name: 'better-dsh/web-password'
-
-    # Automatically acknowledge the installed Host's current welcome version.
-    # Single-row opt-out: dashr-welcome-notice: disabled.
-    - id: dashr-welcome-notice
-      name: 'better-dsh/welcome-notice'
-
-# Native compaction at the host plane: the base bundle ships the engine, the
-# `/compact` command, and the tool-result pruner as host rows; dsh-web-app
-# disables them to move compaction behind per-session presets. DASHR is
-# host-plane, so re-enable them here (upstream defaults: threshold 0.8, retain
-# 0.16). Applied last in bundle order, overriding dsh-web-app's disable.
-- id: compaction-basic
-  disabled: false
-- id: command-compact
-  disabled: false
-- id: tool-result-pruner
-  disabled: false
-
-# Web-trust fence authorities (v0.2.1f): override the connection row the
-# dsh-web-app bundle declares (same id), restating its full shape per the
-# patch-layer contract, with `trustedHosts` merging the DSH_TRUSTED_HOSTS
-# environment (whitespace-separated, operator-declared serving authorities)
-# ahead of the upstream webRuntime-derived ones (LAN literals from an
-# all-interface bind plus --trusted-host extras). Unset/empty env ⇒ identical
-# behavior to the unpatched row. Malformed entries fail plugin load loudly
-# (upstream assertTrustedAuthority). The browser-side twin (page-authority
-# loopback verdict) is the plugin's webserver/index-inject boot script —
-# see src/web-trust.ts.
-- id: connection
-  name: '@deepseek-ai/dsh-client-connection'
-  inject: [webRuntime]
-  config:
-    trustedHosts: !!js (process.env.DSH_TRUSTED_HOSTS ?? '').split(/\s+/).filter(Boolean).concat(ctx.webRuntime.trustedHosts)
-
-# Replacement uses the public patch mechanism: disable the native provider,
-# then insert a distinct row providing the same native webServer service.
-- id: webserver
-  name: '@deepseek-ai/dsh-host-webserver'
-  disabled: true
-- insert:
-    - id: dashr-webserver
-      name: 'better-dsh/webserver'
-      inject: [webStartup]
-      config:
-        host: !!js ctx.webStartup.host ?? '0.0.0.0'
-        port: !!js ctx.webStartup.port ?? 3080
-        compression: gzip
-        compressionLevel: 1
-        compressionThresholdBytes: 1024
-
-- id: ui-settings-models
-  name: '@deepseek-ai/dsh-client-ui-settings-models'
-  config:
-    credentialOnboarding: false
-
-# Native watcher/queue with scoped transaction context across listener replacement.
-# Distinct row preserves whole-bundle disablement in the native manager.
-- id: hmr
-  name: '@deepseek-ai/dsh-hmr'
-  disabled: true
-- insert:
-    - id: dashr-hmr
-      name: 'better-dsh/hmr'
-      disabled: !!js "!ctx.get('profileContext')"
-      config:
-        root: []

package/node_modules/better-dsh/docs/00_adr/0001-bridge-tool-layer-not-service-layer.md

@@ -1,14 +0,0 @@
-# Bridge the tool layer, not the service layer
-
-DASHR's `rlm()` family dispatches upstream delegation tools through the tool registry (nested sub-dispatch), not `ctx.subagents` service methods. The tool layer carries the deployment's enforcement surface — approval pipeline, sandbox policy, per-instance config (maxDepth, backgroundMode, persona) — that a direct service call would silently bypass. The cost: per-call model selection is impossible, because the tool schema exposes no `model` parameter; `rlm(model=...)` from 0.1.4 is dropped, and `subagentModel` degrades to a static `agentOptions.model` in the preset patch.
-
-## Considered Options
-
-- **Service layer direct** (0.1.4's approach): `ctx.subagents.start()` with a hand-built request. Full control over request fields (including `agentOptions.model` and `maxDepth`), but every policy the tool instance would have applied must be re-implemented or lost.
-- **Tool layer nested dispatch** (chosen): `rlm("spawn")` executes the registry's `subagent` tool with a parent token. Upstream policy is inherited wholesale; the schema boundary is the tool's own contract.
-
-## Consequences
-
-- `rlm(mode, prompt, *, label, run_in_background)` — no `model` kwarg. Parent-model inheritance is the default; a different child model requires a preset patch, not a call argument.
-- Depth enforcement comes from the tool instance's `maxDepth` config, patched to 10 in the preset (see `dev/kernel-refactoring/V0.1.5-development-plan.md` Q22/Q23).
-- The upstream delegation tools (`subagent`, `subagent_fork`, `interrupt_agent`) must stay registered and executable even though the model never sees their names — which is why masking is presentation-only (ADR-0002).

package/node_modules/better-dsh/docs/00_adr/0002-masking-is-presentation-only.md

@@ -1,15 +0,0 @@
-# Masking is presentation-only
-
-Hiding exactly two upstream A2A tool names (`send_message` — the parent→child downlink — and `report` — the child→parent uplink) from the model is done by excluding them from the generated Tool Catalog text and from the kernel binding names — nothing else. The two tools stay registered, executable, and dispatchable; the single `send_message` bridge dispatches them internally. Every OTHER upstream delegation tool (`subagent`, `subagent_fork`, `list_agents`, `interrupt_agent`, `workflow`, `ralph`) is exposed directly as a native `tool.*` member — no re-wrapping (v0.1.9).
-
-## Considered Options
-
-- **`restrict()` at runtime**: hides names in the registry's model-facing view, but validates against the live view at call time — ordering hazards against late tool registration can fail the whole preset mount.
-- **`disabled: true` include patches**: physically unregisters the tool, which also removes the bridge's dispatch target. Masking must not break the bridge.
-- **Presentation-only exclusion** (chosen): the registry is never touched. The model's surface (wire schema collapse to `eval`, Tool Catalog text, kernel bindings) is entirely DASHR-generated, so exclusion happens at the two points DASHR owns.
-
-## Consequences
-
-- The masked tools remain in the registry and are reachable via nested sub-dispatch with a parent token, which passes the model-direct guard.
-- **Field-verified (v0.1.8d, `both` presentation mode)**: reachable by MODEL-DIRECT native call too — no parent token needed. A probe calling the masked `skill({"name":…})` through the API function-call surface executed in full. Cause: the mask registers no visibility filter, so the name stays in `view(scope).visible`, and `resolveExecution` collapses model-direct calls only under `code` mode. The mask is an ADVERTISING cut, not an enforcement point; the hard gate is the REPL binding allowlist (`unknown binding`). If a deployment ever needs true model-direct rejection, the mechanisms are a visibility-layer `restrict()` (rejected here for ordering hazards) or a `code`-mode collapse — both are deployment-level decisions, not mask-level ones.
-- Zero upstream mutation means zero interference with host-plane modules that enumerate or interact with the delegation tools.