* feat(gates): reject value exports on function plugin entries
A function plugin entry may export only the Loader fields (name, inject,
Config, apply), types, and classes whose instances extend Cordis Service or
Error, as docs/defensive-patterns/package-surface.md requires. The new
verify-plugin-entry-exports gate reads every packages/*/*/src/index.ts that
exports a value apply through the Host and then the Client compiler face,
and rejects any other value export, including a default export beside
apply, values that arrive through export *, and exports that do not resolve.
Exports that predate the gate are listed per package in
scripts/plugin-entry-existing-exports.ts. A listed export passes; a line
fails when its package has no function plugin entry, its list is empty or
repeats a name, or it names an export the entry no longer reports.
* docs(gates): mark new existing-export lines as rule exceptions
A line added to scripts/plugin-entry-existing-exports.ts after the gate's
introduction is an exception under the plugin entry rule in
docs/defensive-patterns/package-surface.md, which requires the domain
owner's confirmation.
* fix(gates): report a default export beside apply even when it is a class
The class allowance also covered the default export, so a function plugin
entry that default-exported a class extending Cordis Service or Error beside
apply passed the gate. The Loader then loads that default export instead of
the module namespace, which is the mixed plugin form the rule forbids. A
default export beside apply is now reported whatever it holds.
* fix(gates): judge plugin entry exports by their run-time export paths
The gate read TypeScript's export table, which differs from what the entry
exports at run time in two forms. An `export type { x }` hid a value that
`export *` brings in under the same name, although the type-only export is
erased and the value stays. A name that a nested `export type *` reaches was
reported as a value, although nothing reaches the entry at run time.
The gate now walks the emitted export forms: type-only exports and declare
declarations emit nothing, a re-export emits only a run-time export of its
target, and `export *` brings in every run-time name of its target except
default and the names the module exports itself. An `export *` whose module
does not resolve is reported as `*`.
* feat(gates): check service plugin entries for value exports
The plugin entry rule in docs/defensive-patterns/package-surface.md covers
both entry forms: a function plugin exports the Loader fields, a service
plugin default-exports its plugin class, and beyond those a Host entry may
export only Service Definition classes and error types. The gate checked
only function plugins, so a value on a service plugin entry, which another
package imports past the Loader row just the same, went unreported, and an
entry could escape the gate by default-exporting a class.
An entry without apply whose default export is a class the Loader can
construct is now a service plugin. Its default class passes under any name,
as do types and classes extending Cordis Service or Error; name, inject,
Config, and every other value are reported. Libraries, a default export
that is not a class, and an abstract default class, which defines a
capability seam, stay unchecked. The corpus guard now requires both forms.
The existing-export list is regenerated to cover the service plugin
entries' current value exports.
* fix(gates): admit the plugin entry export list as a plugin record name
The plugin entry export list now records the session service entry's
existing value exports, appendPluginRecord among them. Like the published
dependency policy, the list names the function without calling it, so the
plugin record caller gate admits it.
* chore(gates): list the plugin entry exports that landed on master
Master gained value exports on the plugin-manager, llm, and subagent
service entries and renamed office-to-pdf to office-kit before the gate
lands. They predate the gate, so the existing-export list records them.
verify-package-dependencies now covers experimental Client packages, and the
forge panel's Host face imported four workspace values that no policy entry
classified. appendPluginRecord writes through the Session class's private log,
and readers recognize a deadline's TimeoutReason only by instanceof, so both
need the provider's shared instance. pluginRecordOf and generatedWorktreeName
keep no state; classifying them as peer-required keeps the panel's existing
Session and worktree peer edges.
With the exports classified, the fixer keeps worktree, Session, and timeout as
the panel's only workspace peers, moves its type-only relationships to
devDependencies and dsh-typert-protocol to dependencies, and regenerates the
lockfile and the module graph.
verify-plugin-record-callers counts a string literal that spells
appendPluginRecord as a caller, so it now admits the dependency policy file,
which names the export to classify it and never calls it.
A sloppy-mode .cjs or .js file can spell the name as '\141ppendPluginRecord',
which TypeScript decodes to appendPluginRecord, but the prefilter only
removed the backslash and skipped the file. The prefilter now decodes a
legacy octal escape as TypeScript does, taking three digits only after
0 to 3, so the value stays within 0o377. The spec rejects two spellings
that use three-digit octal escapes, and tests the decoder itself for
the digit limit, which no spelling of the name, whose letters are all
0o1xx, can exercise.
The caller gate parsed only files whose text held appendPluginRecord or a
\u escape, so a release package could reach the function through
S['\x61ppendPluginRecord'], a \u{61} code point escape, a needless
character escape, or a line continuation, which TypeScript reads as the
same string. The gate now also parses a file when its text with every
escape unescaped holds the name, and its spec rejects each spelling.
- Make the record commit an ES private method, so appendPluginRecord()
is its only runtime entry.
- Document PluginRecordType and PluginRecord on the session subsystem
page, and state in the README and JSDoc that the V3-to-V4 edge renames
unknown ignorable V3 events into the plugin: namespace and that plugins
outside this repository must not call the writer.
- The caller gate parses only files that contain the name or a \u
escape, documents that wildcard re-exports are not reported, and its
spec reads a temporary repository instead of this checkout.
- Cover Session.fromRestore in the record test and name SessionEventMap
in the catalog generator's diagnostic.
Add appendPluginRecord(), which appends one ignorable event whose type is
`plugin:` followed by lowercase slash-separated segments, and
pluginRecordOf(), which reads such an event back. Records are not
SessionEventMap members, so the persistence catalog is unchanged; a build
that does not recognize one retains and skips it, and records never enter
the model-visible surface. Resume and fork carry them with the log, and a
format migration keeps them on a best-effort basis.
Only production source under packages/experimental/ may call the writer.
The verify-plugin-record-callers hygiene gate checks every reference in
repository sources, and the persistence catalog generator rejects a
SessionEventMap member in the plugin: namespace.
Session.append() and the record writer share one commit path, so a record
follows the same reentrancy, detach, and observer-containment rules. The
ignorable-events decision, the session README, the format-version
cookbook, and the plugin-author practices describe the records.
Ruilin Geng