* feat(liveshare): add the owner host, viewer host, and share runtime
The owner-side half of the bundle: the share host that publishes a Session to a Relay and answers one viewer per share, the owner credential/authorization records, the fork registry and its enforcement, the read-only viewer access policy and read budgets, the turn-requester fold, and the Relay gateway worker. The viewer host renders the served page's assets and declarations; no browser code is included in this layer.
* test(liveshare): cover the owner host, viewer host, and gateway
Keyless host-side coverage: share publication and restore, owner login/authority, fork registry and enforcement, viewer read policy and budgets, the turn-requester fold, the Relay tunnel worker and gateway commands, and the served viewer page. The browser surfaces are covered by the client layer's own suite.
* chore(build): register the host bundle in the compiler, dependency policy, and CI
The package manifest, Host compiler face, and tsdown host entries the bundle needs; the workspace constraints the built gateway/declaration artifacts require; the release-family and README model-experience rows; the coverage-lane exemption; and the keyless CI job that runs the share cases on Linux. The dependency-policy classifications wait for the client layer, which is where the package's client face (and its imports) first appears.
* docs(liveshare): record the bundle's subsystem, projection, and decision rationale
The package README for the host layer, the subsystem page, the persistence record that declares the viewer principal projection, and the note that keeps the protocol and owner-surface decisions with their evidence.
* feat(boot): offer the Liveshare host bundle in the CLI profile and plugin manager
The bundle joins the optional bundles the CLI installation carries and the Official group the plugin manager lists, so an owner can switch it on without editing a profile by hand. The plugin-manager and plugin-config expectations follow in the client layer that renders the card's browser half.
* chore(docs): regenerate the graphs, catalogs, and persistence records for the host
Run the generators over the host layer: the event producer/consumer graphs, the persistence catalog and schema inventory, the config catalog, the module graph, and the Cordis API catalog. The persisted viewer-principal event appears in the catalog and the historical format index counts it.
* fix(liveshare): keep the bundle's locale display metadata in this layer
The CLI profile registers the bundle as optional, so the plugin manager reads title and description from ./locale/*.json. Ship the two locale files and their export here; the browser half is not needed for display metadata.
* refactor(liveshare): read the turn boundary through the typed Agents service
The retained projection-handle migration left two assertions converted through unknown; ctx.get('agents') already exposes turnBoundaryOf, so the host and the cancel-admission case call it directly and the unknown-cast baseline stays untouched.
* test(liveshare): expect the canonical viewer tier from the three-mode harness
The Relay reports a share published with the withdrawn fork-readonly tier as view and carries the fork grant separately, so the harness compares the canonical tier and forwards an explicit allowsFork when the case names one.
* refactor(liveshare): share the reader-facing record and body readers
The fork decision and the access snapshot built the same share facts twice, and the two share-writing routes read the same share-naming JSON body twice; both pairs are now one helper each, so jscpd no longer reports them. Behavior is unchanged.
* test(web): record the host layer's optional-bundle expectations
Registering the LiveShare bundle in the Official group adds its card and description to the plugin manager and plugin-config pages, and the packed preview must state that its host plugin needs LIVESHARE_RELAY_URL instead of a generic applied toggle. Refresh the affected goldens locally (keyless web snapshot refresh) and keep the card badge at this layer: the client list that labels it experimental arrives with the client layer.
* docs(liveshare): mark the shipping owner policy note implemented
The protocol-and-owner-surfaces decision shipped with this bundle, so the note moves from proposed/ to implemented/ in both languages, its proposal-era headings become Decision/Verification/Consequences, and the subsystem page plus package README link to the new path. The pairing record moves with the triplet.
* fix(liveshare): judge tool turns from the open Session turn and recheck the narrowed write
The master baseline has no ToolExecutionInput.turn, so the host derives the turn a tool execution serves from the Agent's Session: the latest turn/start with no turn/end after it. A missing Agent, Session, or open turn yields no turn and the fork guard refuses the execution (fail-closed) instead of reading it as the owner's. Also refuse a fork that names a child without a bound rpcId/operationId, classify forwarded paths by their normalized pathname so /api/session/./fork or a query suffix cannot skip the fork decision, and ask the write gate again after the final authorization refresh so a share narrowed to view during fs/write-intent cannot write. The subsystem page, package README, and model-experience census follow the two-tier model and the bounded-write child ceiling.
* refactor(liveshare): read the open turn beside the requester fold
The derivation reads the same Session log the requester fold decides, so it
lives with that fold and the host imports it instead of keeping a private copy.
* test(liveshare): cover the derived turn and the refusal paths
Drive the host's real derivation from Session events: the open turn of the
Agent's Session decides a viewer turn is confined and an owner turn is not,
while a missing Agent, an absent open turn, and a requester the host no longer
drives all refuse instead of being read as the owner's. Cover the three safety
behaviours the host commit added: fork child naming without a bound request
identity, dot-segment/query fork paths that must still reach the fork decision,
and a share narrowed to view while fs/write-intent awaits.
* fix(liveshare): avoid the deprecated snapshot reader and the extra casts
The host derived the open turn by scanning the Session event log, which the
deprecation note forbids for new production calls. Read the same state from the
turnBoundary projection the Agents service maintains instead, and let a spec
supply a fixture boundary reader where production supplies turnBoundaryOf.
The live attribution of an execution is unchanged: an absent boundary or one
between turns still yields no turn and the guard refuses it fail-closed.
* docs(liveshare): describe the bundle's indirect model experience
The bundle's Model Experience moved to the audited indirect classification,
so the README sentence now names the path: viewer prompts the owner host
forwards into a shared Session drive that Session's model requests. The
KV-cache paragraph and the bilingual pairing record follow.
* test(liveshare): pin the turn-start admission for steered and admitted reader input
The pre-step admission already re-reads Relay authority from each entering message's own source and refuses queued reader input whose grant ended before the model runs; the new cases pin the steer path and the admitted viewer turn, so the turn-start half stays proven next to the delivery-time recheck the Session Controller owns.
* test(liveshare): adapt the replay and cancel expectations to the parsed tier
* test(liveshare): align the access-state expectations with protocol v2
The parsed share-access-state frame always carries allowsFileUpload, the
withdrawn fork-readonly word no longer implies a view tier or forking, and a
hand-built frame may not name it. Update the hand-built expectations and the
two fixture specs that named the retired word, without touching production
semantics.
* test(liveshare): record the in-flight cancel race after the controller revert
The Session Controller no longer re-reads a caller's access before cancelling,
so a cancel admitted before the reader's grant ends keeps its effect. State that
as the known limitation the earlier refusal tests documented instead.
* feat(liveshare): add the viewer attachment-upload switch
The share record, registration handshake, access-state replay, and share-viewer
policy carry an owner switch that is off by default: it admits fileUploads/upload
on the shared Session and the viewer's own forks, is independent of the tier and
of forking, and is normalized to off at every untrusted state-file or frame
boundary.
* docs(liveshare): state the sandbox tiers and the attachment switch
Name the two execution tiers as a read-only sandbox and a bounded writable
sandbox, and document the independent default-off switch that lets admitted
viewers upload attachments, including that legacy shares read as off.
* refactor(liveshare): drop the withdrawn fork-readonly migration
The feature never shipped, so no stored record can name the withdrawn tier and
the boundary needs no compatibility path. Read a stored fork switch as exactly
what it states, let an old Relay state the switch explicitly instead of
inferring it from the tier, and stop accepting the retired mode name on create
or restore.
* fix(liveshare): preflight a resumed child's limit before publishing it
A resumed child is announced through agent/created before its execution limit
installs, so an installability failure left a created Session whose guard never
landed. Resolve the recorded child's granted workspace before activation and
refuse the resume there, so a child this host cannot confine is never published.
* refactor(liveshare): render the viewer page through the reader's own Peer
The served-page seam now hands the frontend reader the reader's Peer, which renders that page's own
opening access rows; the Liveshare side no longer assembles a global access snapshot and the removed
global is gone. The viewer read service builds the same Peer it already creates for every dispatch and
passes it to the asset reader.
* fix(liveshare): keep the owner upload switch across an older Relay's access frame
The Relay is the authority for what a viewer receives, but only for the fields its frame states. An
older Relay predates the upload switch and omits it entirely; the protocol parser rightly normalizes a
missing switch to off for frames that state it, so the host must inspect the raw answer to tell not
* test(liveshare): adapt the host specs to the current tool and session APIs
The host specs drove a single tool through the pre-batch executor shape and handed
some tests a Session outside its store; the current tool executor takes a call batch
and Session appends require the owning SessionStore. This adapts those fixtures to
the current shapes without changing what each test asserts.
Also gives the reader's own fork the same Session permissions as the source grant:
forking its own child again and renaming it are allowed on the child only, while the
source Session still refuses renaming and keeps forking as its one Session verb.
* fix(liveshare): let the owner's background turns run while a share is served
The requester fold only counts a message with `source.kind === 'user'`, so a
turn a background event opened has no attributable input and stayed `unknown`;
the source-session tool guard refused every tool in that turn. Establish the
owner's own turn for an input-less turn and leave unattributable input unknown.
* fix(liveshare): grant the reader its own fork's rename and gate child forks by the fork switch
* refactor(liveshare): read the served page through webServer.readResource
* feat(boot): offer the Liveshare host bundle from the official bundle list
`@deepseek-ai/dsh-official-bundles` owns the shipped template, retired, and
optional bundle lists now, so the liveshare bundle joins `OPTIONAL_BUNDLES`
there instead of being restated in the app-boot profile module.
* feat(liveshare): gate the reader's own fork independently of its input permissions
The reader's child gets prompt, cancel, and rename from a role with no extra
condition, while forking the shared Session or one of the reader's own forks
belongs to a separate role bound to the owner's fork switch. A viewer cannot
rename the shared Session, and a withdrawn fork switch also withdraws forking
a child.
* test(liveshare): adapt the admission specs to the current tool and driver APIs
* feat(liveshare): accept only the declarations a plugin's own package owns
A viewer plugin may contribute endpoints a share can offer, so a declaration
has to name a live Host Remote endpoint whose generated id belongs to the
declaring package. Fail closed: no loader entry, no local endpoint, no owning
package, or a foreign owner all refuse the declaration, and the recorded
attribution is the package name the owner sees.
The package's Typert artifact registers after its apply runs, so a plugin
declares once that registration has happened.
* feat(liveshare): classify every Remote endpoint before the reader policy decides it
The share-viewer policy refuses by default, so the endpoints it decides were a
handwritten whitelist that could drift from the generated endpoint set. State
every endpoint's reason in one shared table: the Client face proves it covers
`RemoteEndpoint` (both directions), the Host derives `POLICY_DECIDED_ACTIONS`
from the reader entries, and a load-time assertion fails if the derived set and
the roles' actions disagree.
* fix(liveshare): declare the Client face its classification gate compiles in
Typert attributes a package's exports to a face only for manifests declaring
`dsh.client` plus a `./client` subpath (`isDualFacePackage`). Without that row
the client catalog read `exports["."]` — the Host entry — from the Client
program, which holds only the classification table and its completeness gate,
and failed on the source that program does not contain.
Export the gate module as `./client`, declare the Client row, publish its
bundle, and exempt the package from Client/Host dependency treatment: the
runtime importing these dependencies is the Host's, and `dsh.client` here only
attributes the compilation face.
* test(liveshare): align worker fixtures with the protocol tenant contract
The protocol layer rejects a share RPC actor whose tenant is empty at the IPC ingress. The worker fixtures still described a peer normalizing the tenant to an empty string, so the Host dropped every fabricated request event and the lifecycle and correlation polls timed out. Use a concrete tenant in the fixtures; those scenarios do not depend on an empty tenant.
* chore(docs): count the liveshare persistence nodes in the format index
The regenerated current-checkout catalog adds the liveshare viewer-principal nodes, so the v4 row's node count moves from 622 to 626. Refresh the generated format index rather than keeping the pre-liveshare count.
* refactor(liveshare): consume the protocol package's single public entry
The protocol layer now publishes only its root entry, so the Host face reads the wire codecs, identity contract, and viewer-state vocabulary from the package root instead of the removed /protocol and /identity subpaths.
* fix(liveshare): classify the schedule cleanup endpoint before the Client gate reads it
The Client completeness gate compiles against the generated Remote endpoint map; master added schedule/deleteInactive after the table was last filled. It mutates the owner's schedules like its neighbours, so it stays owner-only.
* chore(release): carry the liveshare package to the rc.3 family version
* docs(liveshare): align the host docs with the shipped two-tier shares
The subsystem page still described a withdrawn fork-readonly compatibility, a
write-only source drive, and an immutable execution.turn. State the two tiers,
the independent fork and upload switches, the refused unknown mode, and the
turn derived from the Session boundary. Mirror the Chinese pages and re-record
the pairing hashes.
* fix(liveshare): describe the writable tier in the plugin card
The package description, both locale descriptions, and the three Web goldens
still told the owner that sharing is read-only. State driving, bounded writes,
forking, and the independent upload switch instead.
* chore(liveshare): forward the owner credential file from the bundle patch
The README lists LIVESHARE_OWNER_CREDENTIAL_FILE beside the other owner
settings, but the patch left it to a direct process.env read. Pass it through
the same config field as its siblings.
* docs(liveshare): drop stale fork module comments
The registry header still said read-only forks only, and both the registry
and the policy carried an orphan JSDoc block in front of the real one.
* refactor(liveshare): drop unreachable fork tool effect fields
ForkToolRequest.writesWorkspace and changesConfiguration had no producer in
the repository: the guard never sets them, and the only callers were the
tests. The write-denying branch also contradicted WRITE_FORK_CEILING, which
admits the bounded write tool. Remove the fields, their refusal codes, and
the test cases that manufactured them.
* refactor(liveshare-protocol): retire the attachment-upload capability
Sharing itself now carries attachment upload, so the protocol no longer
states an independent switch: `LIVESHARE_CAPABILITIES` drops
`file-upload`, and share specs and access-state frames drop
`allowsFileUpload`. Wire frames stay v1 and no Relay is deployed, so no
compatibility layer is needed.
* refactor(liveshare): grant attachment upload with visibility
The owner controls sharing, audience, the tier, and forking only.
`fileUploads/upload` now rides the Session read role, so every Session a
share serves the viewer accepts files, independent of the tier and the
fork switch. The owner record, the share APIs, the registration handshake,
and access-state adoption no longer carry an upload switch; an older owner
state file that still contains the field loads with it ignored.
Accepted risk, recorded in Known Limitations: an owner cannot refuse
uploads for an admitted viewer.
* feat(liveshare): share the owner wire records
Move the owner identity report into a module both compiler faces can import, and
declare the share-management request, result, audit, and capability records there
with the same fields the same-origin routes already answer. The Remote failure
vocabulary joins the same module so a client learns the liveshareShares/ codes
without importing the Host.
* refactor(liveshare): extract the owner share operations
Move the twelve share-management handler bodies out of the route closures into
operations implemented once inside apply(), leaving each HTTP route with its JSON
parsing, normalization, and legacy status/body. Each operation documents the
side-effect order it keeps and what reordering would break.
* feat(liveshare): serve share management over Typert Remote
Register a LiveshareShares Remote service over the same operations the routes
call, publish its ./typert and ./remote artifacts plus the shared ./types module,
and make the shared records part of the Client compiler face. The owner page gains
the Remote endpoints while the HTTP routes stay as thin adapters.
* chore(docs): regenerate the Cordis catalog for share management
Record the liveshareShares service on the LiveShare subsystem page, link its
wire records to that page, and regenerate the runtime API catalog. The service
declaration moves to the package entry so the host-face catalog projection can
render it.
* test(liveshare): refuse share management to viewer Peers over Remote
Cover the owner Peer's Remote list and the share-viewer denial of list, create,
stop, and setRelay. The refused calls leave the share list empty, the selected
Relay unchanged, and the worker channel without an add-share.
* chore(liveshare): mark the typert resource follow-ups behind #7003
The share-management Remote ships against today's resource registration. Default
resource resolvers and the stricter identity rules arrive with #7003, so the two
places that will change carry a TODO naming the PR.
* fix(docs): classify the liveshareShares service role
The share-management Remote adds one owner-side service, so the capability
seams graph owed it a role row; without the classification the generator
refuses to render and doc-sync fails.
* fix(liveshare): complete the bundle metadata and restore the static gates
The bundle shipped only two of the eight shipped-language metadata files, and its
browser face had no named tsdown config, so the locale metadata gate and the
browser bundle walk both failed. Ship the full locale set and name the client
build; share one owner-body registrar between the two POST adapters so jscpd
stops reporting an eight-line clone.
* fix(liveshare): give the bundle a client source route and a typed peer double
The product-use walk follows `${name}/client` for every mounted bundle, so the
package needs the source mapping and a Client entry the mapping resolves to.
Replace the unknown-cast peer double with a complete PeerScope literal.
* test(liveshare): adapt the viewer admission rows to the Session default resolver
#7003 replaced the `session/page` and `session/follow` resource readers with the
Session kind's default resolver. A body carrying both `sessionId` and `address`
is now refused as invalid resources before the share policy reads either, while
a lone hidden `sessionId` still resolves and is refused by the policy.
Records the new expectations; the served page names one identity per request.
* feat(liveshare): resolve create's request Session through the default resolver
#7003 registers the `session` kind's default resolver with the Session
Controller, and `liveshareShares/create` names its Session in the one request
object, so the Gateway resolves that Session for a non-owner Peer without a
reader declared on the method. The owner Peer reaches the operation without
an access decision.
Adds the Gateway resource assertion and the owner-path assertion to the
share-management security spec, regenerating the Cordis catalog.
* test(liveshare): refuse a viewer body naming two Session identities
A prompt or cancel body carrying both `sessionId` and `address` reaches the
Gateway, whose Session resolver refuses it as invalid resources, so the target
child operation never runs and no request content comes back. Prompt and
cancel requests name their Session by `sessionId` alone.
* test(liveshare): widen the two-identity coverage across the reader endpoints
The resolver refuses a request that names two Session identities for every
namespace, so cover the remaining reader endpoints with one parametrized case
instead of leaving them to the generic Gateway tests.
* refactor(liveshare): remove the unreferenced gateway heartbeat policy
The production worker keeps its own interval and missed-pong counter, so
nothing imported this module; only its spec did.
* refactor(liveshare): extract the owner state persistence
The state file reader, writer, serialized write queue, and stored-share
record types move out of the host plugin unchanged.
* refactor(liveshare): extract the Relay authority reader
The access-state cache, its generation fence, the admission rule, and the
authoritative read that adopts a frame move behind one factory.
* refactor(liveshare): extract the tunnel worker supervision
Worker start, settlement, registration replay, expiry timers, owed Relay
rows, and the credential state each registration presents move out of the
host plugin behind one factory.
* refactor(liveshare): extract the owner share operations
The twelve operations keep their order and side effects but move behind an
explicit deps factory, so the host plugin mounts them instead of owning
their bodies.
* refactor(liveshare): extract the owner routes and source access
The sixteen owner HTTP routes, their request adapters, and the credential
store move behind registerOwnerHttpRoutes. The confined source Session
layer and its turn control move to source-access, which the share-host
re-exports for its public helpers.
* refactor(liveshare): split the viewer reader into dispatch, fork, and lifecycle
The request entry and endpoint handlers, fork orchestration and branch
facts, and the streams/calls/Peers lifecycle move out of viewer-read,
which keeps the deps types and assembly. Order, TOCTOU re-checks, and
Peer ownership are unchanged.
* refactor(liveshare): share the wire JSON helpers and the fork enforcement record
The split duplicated `json`/`isRecord` across the extracted owner modules and the
child enforcement options at three call sites; the stored ACL selection type also
lost its reference to the wire type. One helper module and one record factory keep
the split modules from carrying their own copies.
* refactor(liveshare): move the shared owner record and one-definition helpers
The split published OwnerShare from the assembly while every extracted module
imported it back, and left each host module carrying its own isRecord. Move the
share record and its ACL summary to a neutral module, name the two optional
service seams instead of inline casts, and import one wire JSON helper.
* refactor(liveshare): remove the fork-enforcement audit event
Nothing consumes `liveshare/fork-enforcement` except the spec that watched
it, so the minimal-surface rule drops the declaration, the reporter, and
every report call instead of reserving an extension point for later.
The wiring spec now asserts the outcomes an observer could previously
infer stages from: an install that returns nothing leaves
`ForkRegistry.enforcementInstalled` false and the child's prompt gate
refused with `fork-ceiling-uninstalled`. The subsystem prose no longer
names the removed refusal code, and the Cordis/doc catalogs are
regenerated.
* fix(liveshare): surface fork enforcement failures
Three registration paths swallowed the error behind a fail-closed
refusal. Keep refusing, but carry the reason:
- `preflightForkChild` now throws `fork <id> preflight failed: <message>`
when the stored child cannot be read, instead of returning and letting
activation fail later; `share-host`'s `prepareChild` caller already
propagates that through the viewer's `fork-prepare-failed` answer.
- A child's confined `read`/`write` registration keeps its error in a
`ForkEnforcementFailure`, so `prepareChild` throws
`fork execution limits are unavailable: <message>` with the error as
the cause instead of the bare message.
- Source-session access keeps the refused registration on the
installation and logs it beside the existing confinement refusal.
The wiring spec asserts the preflight failure and both captured errors.
* refactor(liveshare): move the client placeholder face out of this layer
The `./client` entry existed only so the package's Client face could
compile the viewer endpoint classification against the generated Remote
map; it published no runtime this product used. P3b owns the real Client
face, so P3a drops the placeholder instead of shipping a surface ahead of
its consumer:
- delete `src/client/*` and the package's Client tsconfig; the endpoint
spec keeps the Host-table diagnostics, and the Host still derives the
policy action set from that table
- drop `dsh.client`, `exports["./client"]`, the `lib/client.js` publish
entry, the browser tsdown build, and the package path alias
- remove the dependency-policy exemption and the devDependencies only
those client sources imported
- the Host tsdown face still skips the Client build pass; `./typert` and
`./remote` stay Host-generated and the Client tsconfig never fed them
- README and subsystem prose no longer claim a browser face
* chore(ci): drop the stacked-PR e2e dispatch input
The narrow dispatch scope existed only to verify a stack's exact SHA while its
ordinary pull-request checks were unavailable; it is not part of LiveShare and
never belonged in this layer's diff.
* feat(liveshare): add the share dialogs, viewer seats, and client surfaces
The browser half of the bundle: the owner's share dialog and management surfaces, the owner sign-in flow, the viewer page's session plugin, brand, status, and seat components, and the read-only permission and model seats that replace the shipped composer controls at a shadow rank. The package README regains the client implementation links this layer provides.
* test(liveshare): cover the client surfaces and viewer seats
jsdom coverage for the share dialogs, owner login and identity, the viewer page composition, the read-only seats and their shadow rank, the served-page artifacts, and the client-face registration. The host-side suite stays in the lower layer.
* chore(build): ship the Liveshare client bundle
The client compiler face and solution reference, the tsdown client entry beside the host phase, the manifest's client export, client runtime files, locale assets, and client dependencies; the dependency-policy classifications whose consumers appear with the client face; the generated client slot catalog; and the plugin-manager expectations that list the bundle's card.
* fix(liveshare): shadow the shipped brand seats instead of colliding with them
sidebar.brand.mark and sidebar.brand.name are single slots, and a served viewer page mounts the owner's plugins, so on an official build ui-brand-official already registers both at the default rank. Register the viewer entries at a shadow rank and pin the collision in a registration spec, as the composer seats already do.
* fix(liveshare): clear the viewer's composer blocks when its plugin is disposed
The honest-composer effect raised a per-Session block but its disposer only unsubscribed, so a disposed or replaced viewer page left the owner's composer blocked. Track the Sessions it addressed and clear their blocks on disposal; a spec pins the recovery.
* style(liveshare): drop unnecessary type assertions in the registration specs
The slot test runtime's renderSlot already accepts these owner props, so the contracts-ready lint reports the as-never assertions as unnecessary.
* test(web): mark the client layer's LiveShare card experimental
The client layer ships the card that renders the bundle, and the recorded goldens already carry its Experimental badge. Add the bundle to the manager's always-held extension list and to the presentation's experimental set, and expect badge 1 in the plugin-manager spec.
* fix(liveshare-client): return to the share after viewer sign-in
The viewer page names its share in its own query (?shareId=...), so a
sign-in that returned to the bare path brought the reader back to a page
that no longer named their share. Build the Relay sign-in entry from the
page's path and query, and keep the entry's construction in one testable
function.
* fix(liveshare-client): state a half-saved share permission accurately
Saving the share permission writes the session tier first and the plugin
endpoint selection second. When the second write was refused the dialog
claimed the whole save had failed, though the tier and fork switch were
already stored. State which half landed, and re-read the host's record so
the fields show what it kept while the refused endpoint pick stays for the
retry.
* fix(liveshare-client): route viewer copy through the client locale seat
The viewer surfaces translated their own copy from navigator.language, so
a language chosen in Settings could not reach them and a Node boot read the
machine's language instead of the page's. Register the package dictionaries
once, as the client face already does, and take the bound translate seat:
React seats get it from their locale registration, and the plain-DOM status
banner takes it from the plugin and repaints on locale changes.
Also move the viewer status banner's copy and reason helpers to that seat,
and update the viewer specs to provide a LocaleRuntime the way the assembled
viewer page does.
* test(liveshare): assert the two-tier fork ceiling in the viewer artifact
The branched row states the ceiling the host installed: a view-tier
(fork-readonly reads as view) share's child runs under the read-only fork
ceiling, while a write-tier share's child carries the bounded write
ceiling, whose host half readonly-fork-cold-child.spec.ts covers. Read
that statement through the shipped Tooltip's pointer events: after the
rebase it listens to pointerenter/pointerleave, so the previous mouse-event
hover never raised the bubble and the row's statement stayed unread.
* feat(plugins): hide LiveShare until its plugin rows run
A default installation ships the LiveShare package but composes none of
its plugins, so the plugin manager must list it nowhere; enabling it
through the profile's cordis.patch.yml or its bundle selection starts
those rows and only then shows the card under Experimental plugins.
The visibility rule reads the bundle rows' own run state rather than the
profile's bundle selection, because a row inserted through cordis.patch.yml
runs while the bundle stays unselected. The hidden bundle ID stays
addressable, so openBundle still opens its details.
* test(web): assert the hidden LiveShare card across both lists
The plugin-manager scenario now checks that the default profile lists no
LiveShare card in the Experimental plugins group or on the More page, and
that the offered count is one lower than the shipped optional bundles. A
dedicated scaffold writes the bundle's declarations row into the profile
patch, waits for the loader to recompose it with bounded timeouts, and
checks the card joins the list and leaves it again when the row is removed.
* docs(plugins): document LiveShare's default hidden state and enablement
The package README now states that a default installation shows LiveShare
in neither plugin list, and gives both enable routes: inserting the
bundle's two entries in the profile's cordis.patch.yml (placeholders for
the deployment's Relay identity values, with the recomposition caveat), or
selecting the bundle in dsh.profile.bundles. It also states that removing
or disabling the rows takes the card away again. The subsystem page keeps
the rule and links to the README for the exact entries, and the plugin
manager README describes the hidden-until-running list behavior.
This also repairs the README's pre-existing Model Experience mismatch with
its audited indirect classification, which failed the documentation gate
before this change.
* docs(agent-notes): record LiveShare's hidden-until-running rule
Record why the plugin manager keys visibility on the bundle rows' run state
rather than the profile's bundle selection (the cordis.patch.yml route
leaves the bundle unselected while its plugins run), and why the detail
entry by bundle ID survives the hidden card. The rejected alternatives and
the costs of the decision are stated for review.
* test(web): expect the hidden LiveShare card in the configuration scenario
The configuration-page scenario reads the same More list as the plugin
manager, so its offered count is one lower than the installed optional
bundles while LiveShare's declared rows do not run.
* test(web): re-record the plugin goldens without the default LiveShare card
Refresh goldens remove the LiveShare entry from the Experimental plugins
list of both plugin-manager snapshots and from the plugin-configuration
snapshot, and drop the refresh card count from 12 to 11. Re-analysis under
replay confirms both scenarios green.
* fix(liveshare-client): release the viewer page state with its plugin
The viewer context facts, capability, and status stores are module-level so
every viewer surface reads one page's answer, but nothing released them when
the plugin owning the page was disposed or HMR-replaced, so the next mount
inherited the previous page's share facts, tier, and status. The viewer
session plugin now owns that lifetime: it clears the stores when it mounts
and disposes, and advances the read generation so a previous page's in-flight
answer cannot publish into the new page. A spec pins the disposed page and
the inherited state.
* feat(liveshare-client): add the viewer attachment-upload switch
The share carries whether viewers may upload attachments as its own switch,
off by default and independent of the session tier and the fork switch: a
view-tier share may allow uploads and a writable one may refuse them. The
share dialog sets it in both the create and edit flows and submits it with
the permission write; the manager sets it per share beside the fork switch.
A share the Host does not report reads as off. The dialog also states the
tier as the sandbox it runs in, so neither tier is described as carrying
file uploads.
* docs(liveshare): describe the sandbox tiers and the upload switch
The host layer owns the package README statement of the two tier sandboxes
and the upload switch; this layer's documentation adds the subsystem
contract for the switch and the client README's attachment-intake sentence —
file intake follows fileUploads/upload, which a share grants only while its
own switch is on.
* refactor(liveshare-client): drive the owner dialogs through the modal layer and shared primitives
Both owner dialogs ran their own focus trap beside Modal's layer, so initial focus, Tab wrapping, Escape
and focus restoration were each installed twice and could disagree. The hand-written trap is removed;
the shared layer owns the keyboard lifetime, including the dialog's own restore target. The hand-written
returns focus to the opener exactly as before.
The same surfaces also stop inventing their own controls: the session permission and the share lifetime
are SegmentedControl choices like the capability tier, and the independent fork and upload switches are
the shared Switch primitive. Stopping a published share now asks for the shared RiskConfirmation
acknowledgement before the destructive request runs.
* feat(liveshare-client): state the narrowed owner copy and correct the viewer surface
The share manager no longer promises a request-and-approval flow that the protocol dropped: its
description states the online state and access scope it actually shows. Stopping a share is now gated
on acknowledging that the published link stops working immediately.
The viewer status banner keeps its placement inline but takes its colors from the theme tokens with
system-color fallbacks, so the served page stays readable when the client stylesheet never loads. Both
owner dialogs size against the Modal padding box instead of a second viewport calculation, and a long
list title wraps instead of pushing the status out of its row.
A forked branch is stated as a branch, without claiming a read-only workspace the write tier does not
have; the same correction applies to a branch whose sandbox limits failed to install.
* fix(liveshare-client): align the viewer face with the current Client services
The rebased Client surface no longer carries uiConversation.noticeBranchRefusal: a refused branch leaves the view unchanged, so the viewer row consumes the rejection and the refusal-notice tests become containment tests. The plugin manager's bundle lists moved to dsh-official-bundles, so the liveshare bundle joins the centralized experimental and extension lists. Master's sidebar keeps the brand identity out of the accessibility tree when the page cannot start a Session, so the assembled-page test reads the viewer home link from the DOM. The roster gains the file-drag plugin ui-chat and ui-attachment now inject, and the fixture reads the protocol's Client-face carrier from its own project and brands the fabricated reasoning effort.
* refactor(liveshare-client): consume the protocol package's single public entry
The protocol layer now publishes only its root entry; the client tests read the wire and identity contracts from that root. The dependency policy keeps one liveshare entry carrying both the protocol vocabulary and the identity helpers.
* feat(plugin-manager): leave the LiveShare bundle unranked in the extension list
The bundle already stays invisible until one of its patch rows runs, which
keeps ordinary users from encountering it. Removing its ranking entry means an
internal profile that enables it finds the card at the end of the experimental
list instead of pinned to the front; the Experimental badge and the hidden-
until-running card both stay.
* refactor(liveshare-client): drop the attachment-upload switch
The share dialog and share management present only the tier and the fork
switch; attachment upload follows visibility on the Host, so there is
nothing left to toggle. Removes the field from the client share record,
both locale seats, and the dialog tests, and states the new rule in the
viewer README.
* feat(liveshare-client): drive share management through the liveshareShares Remote
The owner dialogs stop posting the twelve management routes and call the
generated namespace instead. The share list, creation, stopping, permission and
endpoint writes, the Relay read and override, the owner identity read, the
audit, and both Relay checks resolve to a RemoteResult, so a refusal is read
from its `liveshareShares/` code instead of an HTTP status. The sign-in round
trip keeps its three same-origin routes.
The package's client entry mounts its own generated contribution and passes the
namespace to the share surfaces through the slot inject face. `dsh.client.inject`
now names `@deepseek-ai/dsh-api-remotes`, and the viewer endpoint table
classifies the twelve management endpoints as owner-only so the Client
completeness gate stays total.
Client specs substitute the namespace with a scripted double instead of stubbing
`fetch`; the assertions read the recorded requests.
* test(liveshare): drive the owner host cases through the Remote service
The host cases no longer register a route map and post JSON to it. They call
`ctx.liveshareShares` directly, which runs the same OwnerShareOperations the
remote Gateway dispatches, so each case keeps its side-effect coverage and
asserts the RemoteError code and details a refusal carries instead of a status
and body.
The ping case is gone with the route: the header action reads `relay()` for the
effective address, which the Relay-state cases already cover. The e2e harness
publishes through `liveshareShares/create` over the owner's own `/api` carrier,
and the sign-in/credential cases keep their same-origin routes.
* refactor(liveshare): remove the owner share-management HTTP routes
The twelve same-origin management routes are gone, together with the thin
adapter layer that existed only for them: the status/body error translation,
the per-route request-body readers, and the capability-selection parser. Every
side effect stays in OwnerShareOperations, which the `liveshareShares` Remote
dispatches.
The four remaining routes are the sign-in and credential ones:
ownerLoginStart, ownerLoginRedeem, ownerLoginCancel, and ownerCredential. The
route-registration case now asserts exactly those.
* docs(liveshare): describe share management as the liveshareShares Remote
The package README (both languages) and the subsystem page now state that the
share list, creation, stopping, permission and endpoint writes, Relay state,
identity, audit, and both Relay checks are `liveshareShares` methods, and that
the sign-in round trip and credential storage are the only same-origin HTTP
routes left. The owner source table points at share-operations.ts and
share-remote.ts for management.
Re-record the README pairing hashes and regenerate the Cordis surface sections,
including the inspect catalog's service description.
* test(liveshare): restore the Client classification gate
P3a dropped the Client-face completeness gate together with its placeholder
face. P3b owns the browser runtime, so the gate returns: the Client program
proves every generated Remote endpoint has a table row, and the spec pins the
compiled export beside the diagnostics the Host also uses.
* chore(build): restore the Liveshare Client compiler face
The rebase onto the Host layer lost the solution reference and the Host
exclude that kept `src/client` out of the Host program. The package now
carries a real browser runtime, so it takes the ordinary Client/Host
dependency treatment instead of the exemption its placeholder face needed.
* docs(liveshare): restore the package's client faces
The subsystem overview names the client faces again now that the browser face
is back, and the translation pairing record is re-recorded.
* test(liveshare): cover the browser surfaces and client readers
The browser half of the package now meets the per-file gate on its own
terms: the viewer request decoder, the share-type readers, the viewer
session selection, and the owner identity readers are pinned by direct
specs, and the seats, brand row, share-path chip, status banner, model
seat, and menu row gain the cases their uncovered branches named.
Two internal simplifications remove branches that no input can reach: the
brand row strips build metadata with one replace instead of a split whose
second operand was unreachable, and the viewer-session subscription no
longer starts behind a placeholder disposer that subscribe can never call.
* test(liveshare): cover the owner host and gateway glue
The host half gains the direct specs its uncovered branches named: the
stored credential file (absent, corrupt, unbound, empty facts, deletion),
the viewer principal comparison, the share Remote's audit delegation, the
registration handshake's plain-socket scheme, the relay refusal status
reader, the JSON body reader, the fork policy's mode helpers and empty
prefix, and the fork guard's unreachable-context refusal. The worker entry
is covered through a mocked worker module, so its boot decision runs
without a spawned process.
The served-page resource answer no longer carries a `string` body: both
call sites hand it bytes, and the string branch could not run.
* test(liveshare): cover owner state, authorization, and the header action
Pins the owner state file's restore and refusal rules against real files
(every optional fact, every invalid record, the owed Relay rows, and a
failed write), the authorization transaction's four bindings and its
single-use state, the declaration surface's stable package order and
repeated withdrawal, and the Session-header action that opens the share
dialog and switches it to management.
The owner state write chain no longer catches a rejection it cannot
observe: the map holds only promises whose failures were already absorbed.
* test(liveshare): close the owner and declaration surface gaps
Pins the authorization URL the browser opens and the production clock and
lifetime a transaction gets when the host passes neither, the declaration
surface's stable package order and repeated withdrawal, the owner state
file's restore and refusal rules against real files, and the Session-header
action's open, manage, and close paths.
The declaration disposer's two optional lookups are annotated instead of
tested: this effect registers each accepted name once, so its own disposer
cannot reach a missing entry, and the effect disposers are idempotent, so a
second withdrawal never re-enters that loop.
* test(liveshare): satisfy the lint and compiler gates in the new specs
The refusal double takes the empty details its code declares, the waits
return nothing instead of a void expression, and the IPC entry reads the
channel through a computed access so the lint rule does not read it as an
unbound method reference.
* test(liveshare): cover the gateway worker and tunnel supervision
* test(liveshare): cover the owner, relay, fork, and viewer host modules
* refactor(liveshare): keep the coverage hooks behavior-preserving
* test(liveshare): fix the typed listener and endpoint fixtures
* test(liveshare): cover the owner login, share manager, and viewer plugin
* test(liveshare): cover the share dialog and host fork wiring
* test(liveshare): satisfy the contract lint in the gateway worker spec
* chore(coverage): drop the liveshare lane exemption
* feat(liveshare): ship the remaining shipped-language dictionaries
The locale parity gate requires every shipped language beside each object-form
dictionary, so the Liveshare browser plugin now carries Japanese, Spanish,
French, German, Russian, and Brazilian Portuguese alongside `zh` and `en`, and
registers all eight.
Each dictionary is typed `Record<keyof typeof zh, string>` so a missing or extra
key fails the build, and named placeholders, slash commands, and API field names
stay verbatim in every language.
* docs(liveshare): document the host config and two exported host contracts
`verify-export-jsdoc` requires prose on every exported declaration: `Config`
states what a deployment sets and why `relayUrl` has no default,
`requestedBoundary` states how a fork request names its prefix and what an
unnamed one becomes, and `OpenStream` states what the reader tracks and when it
releases the stream.
* chore(docs): regenerate the liveshare catalogs and acknowledgement after rebasing
Rebasing the host layer onto current master left the generated artifacts at the
new base's state, because each conflict was resolved to master's side rather
than merged by hand. Recompute them from the rebased tree with the repository
generators: `gen-config-catalog`, `gen-doc-graphs`, `gen-persistence-catalog`,
`gen-client-catalog`, `gen-tool-catalog`, and `verify-persistence-formats
--write`. `gen-module-graph`, `gen-cordis-catalog`, and
`gen-official-bundle-catalog` computed no change.
The LiveShare persistence acknowledgement predated master's later changes to the
four user-message source roots and stored the inventory in a non-canonical
layout, so `verify-persistence-changes` could not read it. Re-record it with
`persistence-changes --update ... --decision same-version`, which chains it onto
master's current tips and rewrites the snapshot, the bilingual declaration, and
their pairing record. Re-record the ui-plugin-manager README pair, whose
LiveShare paragraph now matches on both sides.
* test(liveshare): read attachments by the complete image reference
Current master sends `session/attachment` the complete image reference the
conversation folded from the log and answers with the stored reference plus
bytes, instead of accepting a bare `attachmentId`. The viewer fixture still
read the old field, so every assembled-page image read failed and the
viewer-shell and viewer-global-privacy artifact tests timed out waiting for the
delivered image. Follow the new request field and keep verifying by id against
the Session's log.
* test(liveshare): pass the complete reference in the owner attachment probe
`session/attachment` now takes the complete image reference, so the admission
spec's owner-side probe sends the fixture's reference instead of a bare id.
* fix(liveshare): classify the current Client endpoints for the share-viewer policy
Master added session read/observation endpoints to the Client's Remote map, and
the share-viewer policy's reader role is the only grant they can receive. Name
the six read endpoints in the reader role and in the classification table, keep
the endpoints this Client assembly cannot name out of the table (they stay
owner-only by default), and extend the served-page contract plus an admission
test so a hidden Session is still refused.
* fix(liveshare): await and type the turn-requester projection
Register the fold before publishing the policy and source layer that read
it, surface a refused registration instead of leaving it unobserved,
reset the retained handle when the projection service reloads, and type
the boundary and execution reads from Agent and TurnBoundaryProjection.
* fix(liveshare): withdraw only the fork children a revocation saw
Apply a withdrawal to the entries the registry file holds when it
commits, leave a child recorded afterwards live across restarts, and
retry a failed withdrawal without replaying it over a newer child.
* fix(liveshare): refuse a fork that names no Session
Answer 400 with a named code before dispatch, so a malformed fork body
cannot reach the owner's Gateway unrecorded.
* fix(liveshare): stop injecting a child id into fork requests
SessionForkRequest mints the child id, so the injected field was ignored.
Forward the caller's envelope and rely on the recorded operation for a
retry; document the crash window that needs a caller-supplied child id.
* fix(liveshare): classify and dispatch one normalized path
Use the same pathname plus query for the endpoint decision and the owner
dispatch, and parse with URL.canParse instead of an empty catch.
* docs(liveshare): record the two-tier driving model
Rewrite the implemented note's stale tier, turn-carrier, upload, and
retry facts, add the superseding decision note, and keep the subsystem
page and package READMEs aligned.
* fix(liveshare): publish only the exported type module from lib/types
The package published every tsc-emitted lib/types/**/*.js file, so the client
JavaScript that imports .module.css files entered the tarball without those
stylesheets. Retain only lib/types/share-api-types.js, the one runtime file
the ./types export names, alongside the declaration tree.
Teach the publication allowlist that this package's emitted tree is completed
by its exact runtime file rather than the whole glob, and pin both the accepted
and rejected payloads.
* test(liveshare): mock the generated remote for assembled viewer pages
The assembled viewer specs load the client entry, which statically imports the
generated ./remote contribution. A clean checkout has no lib/ build, and Vite
resolves a static import while transforming the entry, before vi.mock can
answer it, so the jsdom suites failed to import the page roster.
Mock the contribution in each assembly spec, matching the owner-side face
tests, and provide a resolvable test stand-in whenever the artifact is absent.
* fix(liveshare): guard hover styles and draw the viewer banner hairline
Wrap the owner action, dialog actions, and viewer wordmark hover rules in
@media (hover: hover) so touch devices do not latch the hover treatment, and
draw the viewer status banner's neutral border at the 0.5px hairline width.
* refactor(liveshare): name the owner gateway directory
The owner-side Relay connection process is LiveShare's own gateway, not the
Host API gateway; move it to src/owner-gateway so the published entry
lib/owner-gateway/cli.js and the module headers say which gateway they mean.
The protocol vocabulary (frames, tunnel mode) keeps the word gateway.
* docs(liveshare): merge the tier and visibility notes into the owner note
* docs(liveshare): call the Relay the Liveshare server
* docs(liveshare): name the Liveshare server in the share-management JSDoc
* docs(liveshare): document that new shares are organization links
The shipped Share dialog sends neither accessMode nor allowedSubjectIds, so
every share it creates is open. The agent note, both package READMEs, and
CreateShareRequest's JSDoc now say that selected/approval shares are legacy
stored records that keep their ACL and access summary, that the UI has no
creation entry for them, and that the create fields remain for those records
and direct Remote callers.
* refactor(liveshare): drop the configurable owner display name
The reader-facing owner name now always resolves from the Relay-verified
credential: its display name, otherwise the subject label, otherwise the
Relay's host name. Config.ownerDisplayName and the namedOwner dependency
only fed the removed override, so delete both and the test configuration
that set the field.
* docs(liveshare): read the owner name only from the verified credential
Remove the LIVESHARE_OWNER_NAME row and its cordis patch mapping, and say
in both READMEs that a reader-facing share name comes from the
Relay-verified credential rather than local configuration. The
LIVESHARE_OWNER_DISPLAY_NAME legacy identity label stays.
* feat(liveshare): save the relay address from the share dialog
The public address is the owner's runtime choice, not deployment configuration:
the host loads without one, the dialog saves it into the owner state, and new
shares publish there until the owner saves another or clears it. A host with no
saved address contacts no server and its sharing surfaces state that.
* docs(liveshare): describe the address saved in the share dialog
The README, subsystem page, generated API reference, and their bilingual
pairing now state the dialog-owned address and the no-address host state.
* refactor(liveshare): sandbox a shared session instead of attributing turns
Retire per-turn origin isolation: delete the turn-requester fold, the
turn-boundary derivation, and every per-turn verdict, and make the source
access layer a session-level sandbox.
While any share over a Session is active the layer's guard permits only the
confined read it mounted (plus the bounded write when some share may write);
every turn of that Session, the owner's own included, runs through them and
nothing else. The layer is released once no active share is left, which
restores the Session's own tools, and the read-only layer is re-installed
when the last write share narrows to view. Each operation re-reads the
shares' current Relay grants and checks the resolved target against the
granted root.
A viewer's session/cancel now travels the standard Gateway dispatch under
the source-write role instead of a host-side ownership comparison, and a
share that stops, expires, or loses admission stops whatever turn its
Session is running.
Behavior changes:
- The owner is confined too: while a share is active the owner's own turns
can only use the confined read (and bounded write), and the full tool set
returns when every share stops or expires.
- Cancellation has no attribution: a viewer's stop cancels the shared
Session's running turn, including one the owner started.
* test(liveshare): exercise the session sandbox and gateway cancel dispatch
Delete the specs that asserted per-turn attribution (turn-requester, source
cancel ownership, source execution turn, source turn revocation) and the test
fixtures only they used. Cover the behavior that replaced them: every turn of
a shared Session is confined while the layer is mounted, the layer is released
when no share is left, a write-to-view narrowing re-installs the read-only
layer, a share ending stops the running turn, and a viewer's cancel and prompt
both travel the standard Gateway dispatch as the reader's Peer.
The pre-step admission test now covers the messages' own principals, and the
projection double is gone with the projection it stood in for.
* docs(liveshare): document the session sandbox and retiring turn origin isolation
Update the package READMEs, the LiveShare subsystem, the share-viewer
principal persistence record, and the merged Agent Note: remove the
turn-requester fold, turn-boundary derivation, pinned source cancel, and
per-turn origin prose, and state the shipped facts instead — a Session-level
sandbox that also confines the owner while a share is active, a standard
Gateway cancel with no ownership comparison, and the pre-step admission check
as the principal's only consumer. Re-record the bilingual pairing records.
* refactor(liveshare): extract share dialog relay and identity hooks
Move the Relay address read/save/draft state and its connectivity and
permission checks into useShareRelayAddress, and the owner identity read
plus the one sign-in attempt into useOwnerIdentityLogin. ShareDialog
keeps the step guide and passes the identity facts saving an address
needs, so neither hook reaches into the other.
* refactor(liveshare): extract the share dialog create form
Move the session permission, fork switch, lifetime, and the create
action into useShareCreateForm and ShareCreateForm. The dialog keeps the
link, error, and created-record adoption it already owned, and the
shared choice builders live in share-options so the edit panel can use
the same session-mode list.
* refactor(liveshare): extract the share edit panel and tier picker
Move the stored share's permission, fork switch, endpoint tier, and the
one save into useShareEdit and ShareEditPanel, with the tier expansion and
summary in ShareCapabilitiesPicker. ShareDialog now composes the relay,
identity, create, and edit hooks and keeps only the link, advanced help,
and close/manage surface.
* fix(liveshare): take share dialog hook options as named parameters
The exported hooks documented an `options` parameter while destructuring it
in their signatures, so their JSDoc could not name the binding.
* chore(docs): regenerate graphs, catalogs, and pairing after rebasing on master
The rebase merged this branch's liveshare entries with master's forge entries;
the generated English sources and their bilingual pairing records now reflect
both.
* feat(liveshare): open the shared read and write tool surface
The source-session sandbox and each fork child's limit now admit one shared surface: read, read_image, glob, grep, present, todo_write, skill, web_search, and web_fetch at the view tier, plus edit and write at the write tier.
Every path a call declares is resolved and checked against the granted root before the deployment tool receives its canonical form; a pathless search uses the Session's working directory. Tools with no local file effect keep the deployment's own definition, which the guard vouches for by identity. Everything else, including bash, pwsh, cua, the plugin manager, and the schedule tools, stays refused.
* test(liveshare): cover the shared tool surface
Drive the view and write surfaces through the source sandbox and a fork child's limit: canonical paths, symlink and relative escapes, pathless searches, deliveries, the no-effect tools, both mutation tools, and every capability the surface does not name. Registration counts in the host wiring now read the shared table instead of one confined read.
* docs(liveshare): describe the shared tool surface
The package README, the subsystem reference, and the owner note now state the admitted tools per tier, how each declared path is checked, and that the no-effect tools keep the deployment's definition. Re-record the bilingual pairing and the generated event graph for the new fs/edit-intent consumer.
* feat(liveshare): confine viewer turns and admit PTC run_code
Owner turns of a shared Session keep the deployment's native tool chain. The
source layer now decides per turn, from the admitted input's share-viewer
principals, whether the turn is confined; agent/pre-step records that answer
in Host memory only, and the guard plus every confined replacement read it.
A turn the owner starts runs the deployment's tools unchanged, an owner's
steering input inside a viewer's turn stays confined, and stopping every
share still disposes the layer.
Both tiers also admit the PTC transport run_code. A non-empty
sandbox_permissions is refused; every nested tools.* call is a separate
execution through the same guard and confined replacements, so tools.bash
stays refused and read/edit/glob/grep keep their grantedRoot checks. Before
the runtime starts a program, run_code dispatches the new sandbox/policy
waterfall with the Session-resolved policy; the source layer caps it to the
share tier (read-only for view, workspace-write at most for write, never
danger-full-access) and drops the deployment's extra writable roots. A fork
child's installation applies the same cap from its live tier.
Verification: pnpm run typecheck, oxlint on the changed files, and the
focused liveshare specs for the turn marker, owner/viewer turns, run_code
admission and nested calls, and the policy caps. Local commits only; not
pushed.
* refactor(liveshare): drop the uncommitted-prefix fork state
The host never reads the source Session log, so it cannot know a completed
sequence. The forking command validates the requested boundary against its own
committed history instead, which makes the local boundary refusal unreachable.
* feat(ui-chat): export the official user renderer and shared-session copy
* feat(liveshare): mark shared-session reader messages through the chat node seat
* test(liveshare): cover shared-session attribution and the reused chat node seat
* fix(liveshare): leave steering rows to Chat
Only the message that opens a conversation carries the reader attribution;
steering is a turn-internal insertion, so its official Chat cell is untouched.
The wrapper now shadows the user cell alone.
* feat(plugin-manager): hide default bundles through their manifest
The LiveShare bundle now declares `dsh.bundle.listedByDefault: false` and the
page applies one manifest rule to every bundle: a default-hidden bundle is
listed only when the profile enables it, the installation carries it selected,
or one of its declared rows runs. The client-side name set and its special
details-by-id fallback are gone.
* docs(sandbox): document the per-program sandbox policy extension
The new `sandbox/policy` waterfall owns one event scope, the generated event
graph and subsystem reference now list it, and the catalog classifies its
payload type.
* chore(docs): regenerate the graphs and pairing after rebasing on master
The rebased branch now shares master's forge and sandbox service entries; the
generated English graphs and their Chinese counterparts are re-recorded.
* test(web): keep the plugin lists contiguous around the LiveShare card
The recorded accessible tree has no blank line between the last experimental
card and the installed-plugins heading.
* test(typert): expect the PTC sandbox policy event in the executor catalog
The new waterfall is part of the executor's model events.
* fix(liveshare): name the PTC transport without the unclassified tools export
The dependency policy does not classify @deepseek-ai/dsh-tools' RUN_CODE_NAME
as a safe host export. Liveshare now owns the reserved name locally, pinned to
the canonical constant by its test suite.
* fix(liveshare): close the coverage gaps in the owner-turn and PTC paths
The asynchronous policy resolver is covered by the executor tests; the
share-host guard covers unattributable executions and same-turn narrowing;
the owner's edit path exercises the native pass-through.
* test(web): align plugin goldens with the manifest visibility rule
The default profile no longer lists LiveShare before its rows run, the refresh
count includes the forge bundle master added, and the creation recommendation
skill catalog records the new bundle entry.
* fix(ptc): keep the disposed check lint-clean after policy resolution
The narrowed property read became an always-false conditional; the helper
method keeps the runtime check without the narrowing.
* test(liveshare): cover a relay probe stopped by host disposal
The probe checks the disposed flag after its fetch; a disposal landing during the
request now exercises that early return.
* fix(liveshare): encode identifiers without the base64url Buffer name
Packed worker deployments run a Buffer polyfill that only names standard
base64; the new helper produces the same unpadded base64url text from it. The
packed preview's generic bundle toggles skip the declaration-first Liveshare
bundle, which the ordinary Web scaffold covers.
* test(liveshare): build worker command fixtures from real file URLs
`file:///pkg/...` has no drive letter, so Windows `fileURLToPath` refuses it;
the launch-command test now derives both fixtures with pathToFileURL.
* feat(ui-chat): offer a user-origin seat above user rows
Chat now declares a session-scoped `conversation.chat.user.origin` list seat and passes the flow's renderer to the official user row through `ChatNodeOwnerProps.renderUserOrigin`. The flow supplies the callback only while the seat has an entry, and the official renderer calls it for `user` nodes alone, so steering keeps its DOM. Entries receive the durable message source and own their markup and copy; ui-chat ships none, and its shared-session dictionary entry moves back to the feature that writes it.
* feat(liveshare): attribute shared-session messages through Chat's origin seat
The client registers one `conversation.chat.user.origin` list entry on both faces instead of shadowing Chat's user node renderer. The component recognizes the durable share-viewer principal and states the Relay-asserted subject from the package's own `inputOrigin.sharedSession` copy in all eight dictionaries; owner-authored, malformed, and steering rows render nothing. The ui-chat runtime external and its client-inject edge are gone: the remaining ui-chat import is type-only, and `slots.inject` makes the registration independent of declaration order.
* chore(client): record the user-origin seat in the slot catalog
Regenerate the model-facing client slot catalog for `conversation.chat.user.origin`: the new list seat, its owner props, its declaring flow entry, and the Liveshare occupant. The subsystem slot tree follows the same declaration.
* chore(liveshare): publish the types entry as declarations only
`./types` no longer declares a runtime target into the tsc-emitted tree, so the
package no longer publishes `lib/types/share-api-types.js` and the workspace
constraint check no longer needs a package-name exception.
* docs(ui-chat): name the message-source decoration
The prose uses the exact field it decorates instead of the abstract term the
repository's concrete-terms gate rejects.
* fix(liveshare): classify master's tool-results stream after rebasing
Master added the `toolResults/watch` Remote endpoint and bumped the workspace to
0.2.1-rc.4; the viewer endpoint table and the read role now cover the stream,
and the package version follows the root.
* refactor(ptc): keep sandbox policy dispatch synchronous
The policy cap is a pure, cheap computation, so the waterfall should not force
every confined program through an await before the call is registered. The
event now returns the policy directly: no admission window between reading the
mode and registering the call, no async mode resolver, and no fallback branch
in PtcCalls. The event can still be dispatched twice for one Agent-owned
program; its contract names the synchronous, idempotent listener requirement
and tests lock both dispatch counts.
* docs(ptc): state the synchronous sandbox-policy contract
The README now names the synchronous waterfall and the two policy resolutions
an Agent-owned program performs, so readers know listeners must be synchronous,
pure, idempotent, and return the same cap each time.
* fix(liveshare): let the declaration entry win the fallback race
A live bundle activation can start the share host before the separate
declaration entry's service is visible in the host context. The host now gives
that entry one task turn before providing its own fallback surface, so both
rows no longer register `liveshareViewerDeclarations` twice.
* chore(liveshare): drop the now-unused require-await suppression
The deferred fallback makes apply genuinely await, so the file no longer needs
the suppression it carried for a synchronous throw.
* fix(liveshare): read the owner Remote namespace after mounting it
The client face accessed `remote.liveshareShares` on its own context before
that namespace existed, which the Remote carrier refuses without an inject
entry. The header action now registers inside a child scope injected after the
carrier mounts, and the face tests provide the mounted namespace.
* feat(liveshare): simplify the owner share dialog
Saving the relay address now checks it in the same action, and the numbered
step guide is gone. Sign-in is a single control above the share settings, and
every setting below it stays disabled until the owner signs in. Fork wording
and the read-only permission hint now state the actual permissions.
* feat(liveshare): save the relay address on blur
The address field no longer needs a Save button: leaving the field (or pressing
Enter) stores it and probes the address it put in force. Chinese copy now uses
观看者 consistently instead of mixing viewer and 观看者.
* chore(ptc): restore the run signature formatting
The synchronous policy refactor left only a line-wrap difference in this file;
the signature returns to its original one-line form.
* feat(liveshare): configure plugin sharing when creating a share
The create form now carries the same share-wide plugin-endpoint tier as the
stored-share editor and writes it immediately after the host creates the
share. The Advanced disclosure only renders for an existing share, where it
has stored-share details to show.
* fix(liveshare): show the owner name on shared-message attribution
The durable source names the reader by subject id, so the line showed the opaque
id even when the reader was the owner. The client now remembers the verified
owner identity it reads on mount, and the attribution uses that display name for
the matching subject while keeping the persisted id for every other reader.
* feat(liveshare): use the viewer's Relay name in shared-message attribution
The viewer context already carries the reader's own display name; reading it
lets a viewer's messages show their name instead of the opaque subject id,
while a reader with no reported name keeps the durable id.
* feat(liveshare): persist the viewer display name in message attribution
The Relay asserts a display name for the viewer it forwards. Copying that name
into the durable share-viewer principal lets the owner and every reader show
who sent a message, instead of only the current reader or an opaque subject id.
The name is attribution data only and stays out of authorization and model
requests; old logs and readers without it keep showing the subject id.
* feat(liveshare): share the permission fields between create and edit
Creating and managing a share now render the same session permission, fork
switch, and plugin-endpoint fields, and the stored-share view states its
lifetime and link scope inline instead of behind an empty Advanced disclosure.
The first version publishes only the never-expiring lifetime.
* feat(liveshare): edit a share lifetime and link scope after creation
`updatePermissions` now accepts a new deadline (null means never) and the
open/selected link scope. The shared permission fields expose both while
creating and editing; an existing share can be switched to the open link or
cleared back to never, and selected shares accept provider subject ids.
LiveShare prose now calls every fork product a 分叉会话.
* test(liveshare): remove duplicate lint suppression
* fix(liveshare): keep row labels on one line
* fix(liveshare): clear the static catalog and unknown-cast gates
The owner-display test no longer casts through unknown, and the generated
Cordis runtime catalog now includes the extended permission request type.
* test(liveshare): cover the unchanged update and subject-order branches
* test(liveshare): cover the unchanged restored-access branch
* fix(liveshare): re-probe a stale owner credential
* refactor(liveshare): remove the unfinished selected-colleague scope
The share dialog no longer offers or edits a selected-colleague link scope;
new shares use the organization link and stored legacy scopes stay read-only.
The create form's lifetime is the single never-expiring row, and the host
identity read re-probes a stale credential.
* feat(liveshare): simplify the share manager and add plugin sharing
The global manager now lists Session titles and opens the matching Session's
share dialog, which names the Session it edits and exposes one plugin-sharing
switch. Shares can still be listed without any plugin declaring endpoints, and
the switch states that absence.
* fix(liveshare): open the selected share from the manager
The manager's Manage action now opens that Session's share dialog directly,
and binds workspace navigation when the page has it. The rows use one grid so
titles, online state, and actions line up, and the footer offers Cancel next to
Done.
* refactor(liveshare): elect shared-session attribution through a chain seat
Chat now declares `conversation.chat.user.before` as a chain seat whose owner
props carry the durable source and row kind. Liveshare's selector elects only
share-viewer user rows, so the component no longer probes or returns null, and
the official user row stays unchanged. The manager aligns its columns, adds a
per-share cancellation action, and no longer offers a footer cancel that meant
the window rather than a share.
* refactor(liveshare): drop PTC sharing from this change
The share surface now admits only the native read/write tools. PTC
run_code admission, its sandbox-policy cap, and the executor-side policy
extension move to a separate change, so this PR keeps non-PTC sharing focused.
Core PTC files, sandbox docs, and generated catalogs return to master.
* docs(liveshare): fold the viewer display name into the principal record
The optional displayName is part of the share-viewer principal, so its
persistence acknowledgement now lives in the 2026-10-13 principal record
instead of a separate 2026-10-27 record.
* refactor(liveshare): render user attribution through its own chain slot
* refactor(liveshare): keep one user message renderer for the attribution seat
* refactor(liveshare): render the attribution seat inside the user bubble
* docs(liveshare): regenerate the event graph pages
* test(liveshare): close the endpoint control coverage gaps
Cover the endpoint tier control's empty-offer return and drop the unused expiry choice list.
* chore(docs): regenerate the persistence catalogs after rebasing onto master
* chore(liveshare): carry the 0.2.2-alpha.1 release version
* refactor(llm-deepseek): share the /models listing machinery
Move the account route's `/models` request and decoding, its
credential-scoped listing cache, and listed-catalog resolution with the
version gate into the shared DeepSeek Messages library, so a second
route can follow the same listing. Names drop the account prefix, the
cache takes each access's endpoint settings with the call, and it gains
`invalidate()` for a forced reload. `isBuiltInCatalog()` recognizes the
catalog an uncustomized `models` setting resolves to.
The account route keeps its behavior; only its imports and the
override diagnostic wording ("model listing") change.
* feat(llm-deepseek-api-key): follow the official /models listing
While `models` equals the built-in catalog and the Messages origin is
https://api.deepseek.com, `deepseek-official` serves the official
`GET /models` listing, authenticated with the API key in `x-api-key`.
Loading, refresh, fallback, merging, and the client-version gate match
the account route: the first access waits up to `modelsTimeoutMs`, a
listing older than `modelsMaxAgeMs` refreshes in the background on the
next access, a failure keeps the last good listing or the built-in
catalog, and listed models this build cannot serve are refused before
network I/O.
A customized `models` list replaces the catalog and requests nothing.
Switching between a customized catalog and the listing discards the
cached listing, so Restore defaults reloads it on the next access.
Suites that boot the route on the official endpoint now answer the
listing themselves instead of reaching the network.
* docs: describe the official route model listing
Document when `deepseek-official` follows the official `/models`
listing, its timing fields, customization precedence, and the forced
reload after Restore defaults in the API-key README, the shared
transport README, and the provider guide. Record the decision in a new
Agent Note, keep the account note's statement of where the shared
listing code lives current, and regenerate the configuration catalog.
* test(llm-deepseek-api-key): pin the once-per-listing hidden-entry diagnostic
* docs: regenerate module and event graphs for the shared listing
* fix(llm-deepseek-api-key): report credential failures on the model request
On the official endpoint, `connect` waited for the listing view, whose
credential lookup rethrew a malformed key or a credential-store failure
before the agent loop recorded the prompt. A failed lookup now resolves
the connection from the current listing view, so `resolveAuth` reports
the failure on the model request and the turn keeps the prompt and the
failed attempt. A caller abort still rejects.
* docs(llm-deepseek-api-key): name which hidden listing entries are logged
* test: keep unit suites off the official model listing
Suites that boot the DeepSeek routes with a dummy or inherited key now
request `GET https://api.deepseek.com/models` on the official endpoint.
A unit-lane setup file rejects that request at once, so such a suite
serves the built-in catalog instead of reaching production or waiting
out the listing deadline on a network that never answers; suites that
exercise the listing answer `fetch` themselves. Other requests pass
through unchanged.
* feat(llm-deepseek): read tool_update from the model listing
Both DeepSeek routes now take a listed model's Messages tool update mode
from `api_capabilities.anthropic_messages.tool_update`, alongside the
system prompt mode. `in-history` and `addition-only` replace the
bundled mode; any other value reads as `leading-only` and removes it.
An absent or `null` mode keeps the bundled one, so a listing that does
not declare the field leaves `deepseek-flash` on `addition-only`.
`system_prompt_update: null` likewise keeps the bundled mode now; it
previously read as `leading-only`, which a serializer writing empty
values as null would have turned into a cache-unfriendly downgrade.
* fix(llm-deepseek): sync the built-in context window with the official listing
The official `/models` listing declares a 1,048,576-token context window
for `deepseek-flash` and `deepseek-v4-pro`; the built-in catalog said
1,000,000, a decimal-versus-binary mismatch. Both built-in entries now
carry the listed value, so offline starts and listing failures size the
context the same way the listing does. The Models page shows the exact
count for these rows, since 1,048,576 has no decimal K/M spelling.
`defaultContextWindow`, the fallback for model ids the catalog does not
describe, stays 1,000,000.
* test(llm-deepseek-api-key): reject the stubbed listing request with an Error
* test(cli): keep the built SDK smoke off the official model listing
The SDK profile's initialize now resolves the deepseek-official catalog,
which requests GET https://api.deepseek.com/models on the official
endpoint. With the smoke's fixture key that request answers 401 and the
route warns on stderr, so the test's empty-stderr assertion failed in the
e2e and snapshots lanes. Point the run at a loopback mock and assert it
received no model call.
* feat(llm): carry /models badges into the model catalog
The shared DeepSeek listing decoder reads an optional per-entry
`badge: { text, tone }`. Text is one literal or translations keyed by
lowercase language id with a required English entry, each trimmed to 1
to 12 characters on one line; tone is neutral, info, success, or
warning, and an absent or unrecognized tone reads as neutral. An absent
or null badge declares none; an unreadable one is dropped with a listing
problem and never hides its model.
resolveListedCatalog keeps the badges of offered models, both DeepSeek
routes attach them through catalogModelInfo, LlmRuntime.listModels
detaches them, and the Host model catalog forwards them as
ModelCatalogModel.badge. resolveModelInfo omits the badge, so no model
request, Session event, or model-facing tool carries it.
* feat(client): render catalog badges in the model selector
The composer model seat shows a catalog model's badge after its name in
the trigger, the root-menu value, and each option: a Tag in the badge's
tone whose text is resolved for the active locale through
ctx.locale.resolveText. A conversation.input.model.label contribution
replaces the name and badge together and receives the badge in its
owner props.
Remove ui-deepseek-model-label-1017, which hard-coded `1017` beside
DeepSeek-V4.1-Flash for two providers, and its Web bundle row. The badge
now comes only from the model listing, so the build ships none of its
own; the upgrade guide covers profile patches that still target the
removed row. The Web e2e replaces the fixed-badge case with replay
catalogs that declare literal and translated badges, and the replay
adapter validates and advertises a configured badge.
* feat(llm-deepseek): read model badges from client_metadata
Each /models entry now declares its selector badge under
client_metadata["deepseek-harness"].badge, keyed by the User-Agent product
token like client_requirements, so the public model fields stay unchanged
and later DeepSeek Harness fields join the same object. Every field under
client_metadata is ignorable: null at any level shows no badge, and a level
that is not an object drops only the badge with a diagnostic naming it.
* docs: record why the listing badge container is client_metadata
* fix(models): refresh listed badges in open selectors
* refactor(models): share listing cache lifecycle wiring
* docs(models): refresh listing event producer catalog
* fix(models): retain badges when listing refresh fails
* fix(models): validate badge text and preserve tags beside long names
* test(models): cover account listing automatic badge removal
A queued echo now records its Inbox position like transcript and steering
echoes. Later splices move that position, so a canceled splice that removes
the row retires the echo even when no Inbox projection ever showed it, for
example when the Turn is stopped right after queueing. A claimed row still
waits for its admitted message, and the queue dock still hands the echo over
to the Host row it renders.
The fold-room e2e no longer samples the running status slide or the
`data-chat-tail-pinned` mark that this branch removed. It asserts that fold
room below a short answer takes the new Turn's growth without scrolling
through Turn end, that the room never grows back, and that the running
status only moves down.
Measured against 0.2.1-rc.4 and master with the frame-sampled motion matrix,
the transcript moved back and forth at Turn end and around input landing.
This keeps rc.4's landing behavior, master's steering layout, and fixes the
reversals that remain.
- Completion-time folding keeps the first visible surviving row still when
work rows close at once, filling the gap with bottom space capped at half
the scrollport, instead of letting the browser clamp the position.
- After the Session stops running, the running status keeps its tail slot
hidden and silent until the Turn's actions row replaces it, so the tail
does not shrink and grow back.
- A Turn's duration control takes its gap in one frame instead of sliding.
- A fold batch that takes over following for a content change absorbs
growth outside the batch before its first frame.
- Steering lands at once under either fold timing: the running Turn keeps
streaming above its echo, which a native animation would push down.
- The running status no longer slides below a Step's first output, and the
column no longer carries `data-chat-tail-pinned`; the steering entrance
keeps its animation.
- A queued prompt is accepted by its Inbox row as well as by its receipt,
so the composer clears the draft in the frame the queue dock shows it.
- A queued echo waits for the Inbox projection instead of retiring on the
durable splice, so the queue dock does not empty for a frame.
* fix(forge): make reference and worktree tests portable
* test(worktree): cover error and text cancellation reasons
* test(forge): brace void arrow bodies in the reference lookup spec
* test(ci): expect the joined version script path in the pre-merge check
---------
Co-authored-by: imccyu <[email protected]>
The scan now reads exactly the manifests the release tooling rewrites, names
every directory and file it cannot read, and refuses an empty corpus; the
command takes the root it checks so the exit code is tested, and the workflow
reports a crashed check as a warning in report mode.
Each step is a spawn whose stdio reaches the job log, the first failure stops
the list, and the script decides from CHECK_MODE whether to annotate as an
error or a warning, so the workflow only calls it.
The missing-script branch now fails in block mode instead of passing, the shell
block parses, the version walk refuses a directory it cannot read or one that
holds no manifest, the install is watched before anything else can throw, and a
spec runs `bash -n` over every Policy shell block.
`Policy / Pre-Merge Check` now runs `scripts/pre-merge-check.ts` under plain
Node and knows nothing else about the merged tree. That script installs the
dependencies, checks that every released manifest carries the root version
while the install runs, and builds the Host and Client contracts, reporting
which step failed.
Split the store's restore seed from start, accept a retained tree only
from the binding that currently owns the tab, drop the new unknown cast
in the body harness, document the watch lifetime limitation, and expect
the e2e Files directory to stay expanded after a Session round trip.
The Files tab's session-scoped store is released when the reader leaves
the Session, so returning reseeded a fresh tree at scroll offset 0 with
every directory collapsed. Retain each tab's last drawn tree in the face
per Session and tab, seed the next store with it, and replace the
earlier binding's watches.
Fixes#7361
The probe now uses [Environment]::IsPrivilegedProcess and reports PASS when CIM availability matches the child's privilege, FAIL otherwise; both runner cases assert PASS.
The Decision and How-the-restriction-works paragraphs now state the current flag set and that the derived token keeps the caller's group SIDs; the dated follow-up keeps the reason.
* feat(ui-open-in-app): announce settled open outcomes app-wide
The shared file and directory opener reported a nullable failure, so it could
not tell a handoff the Host acknowledged from a gesture an adapter deliberately
dropped — a duplicate already in flight, or a controller disposed before the
gesture ran. Its notice also lived inside the control that asked for the open,
so it died with the panel, tab, or card the gesture started in.
Replace that with a discriminated outcome on both controllers and adapters, and
report each settled gesture into one `shell.overlay` entry that renders the
app-wide Toast: the Session-header command, the files-tab and Session-header
buttons, both document-preview controls, and both delivery-card controls.
`{ kind: 'skipped' }` announces nothing, because no handoff happened, so card
status and the toast never disagree about what settled.
Name the action for what it does on every surface — "Open on your computer" —
instead of after whichever application would take the handoff. The application
stays supplementary, in the tooltip beside the shortcut it runs under, which is
what the accessible name, visible text, and command label now share.
* fix(client): unify open-in-app feedback
* fix(client): report native open outcomes accurately
* fix(client): tighten open feedback outcomes and lifecycle tests
* test(ptc): synchronize hot-loop log capture
Observe a synchronous child marker before cancellation so the console retention assertion does not depend on completing Node startup within one second.
* test(bench): interleave scaling samples
* fix(client): scope native-open feedback to mobile
Explain native opens on another device for mobile and PWA clients while keeping desktop success silent. Preserve failure feedback after the initiating surface closes and ignore skipped requests.
Remove unrelated benchmark and PTC test changes and retain existing button labels.
Refs #6097
---------
Co-authored-by: EricMoin <[email protected]>
Co-authored-by: EricMoin <[email protected]>
Queue macOS directory-picker activation until the NSOpenPanel modal event loop is running. Preserve the Edit menu, selected-path output, and cancellation behavior.
Validate the script with same-service physical-mouse reversal tests and cover queued activation and selection results in the VM regression tests. Document the macOS validation range.
Fixes#7320
Refs #6685
* fix(ci): keep the pre-merge check off the report-mode failures
* fix(ci): fail the pre-merge check in block mode without a base commit
* fix(ci): report every pre-merge failure the way its mode asks
The merge step now separates a base commit it cannot fetch from a merge it
cannot do, both failures print an annotation, and a spec pins the mode
wiring of the three Policy workflows.
* test(ci): type the Policy workflow assertions
---------
Co-authored-by: imccyu <[email protected]>
Prompt nodes now carry the durable image references of a user message, not
just a count. The Question column renders an image-count pill in the trigger
badge's style; hovering or keyboard-focusing it opens a small preview strip,
and clicking a preview or the pill loads the image in the shared lightbox.
Image reads go through uiConversation.imageUrl, so the Conversation image
cache owns the browser URLs for the Session binding's lifetime.
Also bring the older-history specs in line with the surfaced failure state
already shipped at this branch tip, so the package suite is green again.
A corner press during a return ended the return at the recorded
rectangle, so the panel jumped without pointer travel. The press now
picks the panel up where it is drawn for a resize as well: the resize
keeps the drawn origin and caps only the corner by the viewport, and the
release records the legal rectangle and springs the origin inside, as a
resize whose viewport shrank past its origin also does. Under reduced
motion a resize draws its legal rectangle and animates nothing.
- Move TabBody to its own module and draw DockSurface's docked bodies
through it too, so divider and tab drags no longer re-render bodies.
- State in TabRenderer when the kit calls renderTab again and reuses a
body.
- A corner press during a return ends it at the recorded rectangle; only
a grip press picks the panel up where it is drawn.
- The resistance and its inverse keep the legal size, a resize origin
stays inside a viewport that shrank mid-gesture, and a Windows root
without a published caption height keeps the 20px floor.
- The Web e2e waits for the resting style before checking the clamp.
- Tests say "does not re-render" and also show that a new renderer
re-renders the bodies.
A float drag and its return update the preview through React state, so
TabLayout re-rendered every TabHost and called renderTab for every
retained body on each frame. Both renderers now draw bodies through
TabBody, memoized on the renderer and the tab record, so such a frame
re-renders only panel frames and headers.
Measured in the Web e2e scaffold under 4x CPU throttling (median of 5,
60-step drag past the corner, then the return): with a 4000-line file
preview floating, drag scripting fell from 592 ms to 100 ms and the
return's from 180 ms to 56 ms; with the default small preview, drag
scripting fell from 121 ms to 95 ms.
The resting .float rule now caps width at 100vw and height at the
viewport below the caption floor, so a stale viewport reading cannot
leave an oversized panel's header controls or resize corner off screen.
Vertical limits use 100dvh, which follows window.innerHeight as the
gesture hook does. The Web e2e publishes a far-off, oversized resting
rectangle and checks that the stylesheet alone draws it over the viewport.
- A release that reaches the press's legal rectangle only raises, so a
click on a panel drawn projected no longer records a move or resize.
- The return starts at the drawn panel's speed, and launchVelocity caps
its outward part so the whole trajectory stays within 120 px.
- A panel larger than the viewport draws at the viewport's size, keeping
its header controls and resize corner reachable.
- A return ends on an undo, dock or close of its panel, and at its target
when another panel is pressed; a gesture uses the bounds of a window
resized mid-gesture; drawn samples outside the velocity window drop.
- Gestures and returns may draw above the top floor; at rest the .float
rule clamps every panel into the viewport and below the caption floor.
- Web e2e drags a Sidebar float past the right and bottom edges.
- The note is renamed to spring-based edge recovery, compressed, and
cross-linked to the docking and retained-layout notes.
Move the release verifier's npm platform check into scripts/npm-platform.ts and use it when pruning pnpm's bundled packages, so negations, 'any' and invalid fields follow npm. Skip non-directories and name the manifest on invalid fields.
pnpm's npm package carries reflink bindings for darwin-arm64, darwin-x64, win32-arm64 and win32-x64. The primary runtime copied all of them, so the Apple silicon app contained an x86_64 Mach-O module that triggers macOS's Intel app warning. Prune packages whose os/cpu fields exclude the target and bump the payload format.
Move the facade, listener, state, wait and history tests onto the new
controllers, and cover passive activation, omitted cursors and the
event subscription frames.
History, State and Web become ordinary classes sharing the Session scope.
Subscribe-before-read removes the tail repair, events and page expose the
cursor-bearing history read, observeEvent keeps a pure event subscription,
and follow stays passive unless activate is requested.
The composer collapses the model seat to its Models icon when the expanded
controls cannot share a row, but the seat's row-relative 45cqw cap made its
measured demand shrink with the row. The measured expanded state therefore
always fit and a narrow composer ellipsized the name instead of showing the
icon. Cap the seat at its 360px content width so the measurement sees the
demand, document the contract, and cover the collapse without the Plan chip.
Conversation view tabs added a tooltip to every label in 0.2.1-rc.3, including short labels that fit the 88px cell. Estimate the glyph width and only enable the tooltip when the label is expected to overflow; keep the More trigger tooltip.
Refs #7181
Conversation view tabs added a tooltip to every label in 0.2.1-rc.3, including short labels that fit the 88px cell. Estimate the glyph width and only enable the tooltip when the label is expected to overflow; keep the More trigger tooltip.
Refs #7181
The MCP SDK answers resources/list and resources/templates/list for a
server without the resources capability with an empty page, but first
writes a console.debug line to stdout. Under the ACP profile that line
lands in the JSON-RPC stream whenever the model lists resources of a
client-supplied, tools-only MCP server. Return the same empty pages
before calling the SDK, and cover it with a unit assertion and an ACP
stdout regression test.
- The checks dot in the Session list pairs its full-round radius with
corner-shape: round, as the ui-theme stylesheet gate requires.
- The client-ui-forge README summary fits the 100-word budget again
after the merge combined both branches' descriptions.
Brings the Session list branch up to date with the forge panel, whose
held messages now wait at inbox insertion.
- client-ui-forge keeps the Session list's remote-access import and the
panel's messageOf; the agent-controller import is gone.
- The README and the forge panel Agent Note combine both sides: the
forgeWorktree projection keeps its client view next to the inbox hold,
and the Session list paragraphs stay.
- The config catalog is regenerated, and the README, forge subsystem
page, and Agent Note pairings are recorded again.
Fade overflowing actions inside the gap before the next header control and
clip with overflow: clip, so no animation stays attached to the header and
focus cannot scroll the title area.
Co-authored-by: Yudong Han <[email protected]>
Master replaced the creation and plugin recommendation bundles with one
personalized recommendations bundle.
- The CLI manifest keeps master's bundle and the forge bundle.
- The plugin page expectation ranks the forge bundle before the held-back
personalized recommendations bundle.
- The experimental README pairing is recorded again.
The goal service and /goal resume accept blocked goals, and editing keeps
the phase blocked, but the Web goal bar showed only edit and clear, so a
Web user could not continue a blocked goal after editing it.
Refs #1425
The blocking ask_user_question description did not explain that an answer
item with empty selected and no custom is a user skip, so models re-asked
the same question after the user clicked Skip.
Refs #7134
The preview now shows an index URL being added and the Discover tab that lists its plugins, with the segmented Installed/Discover switch, index menu, search field, framed icons, and the Install, Installed, and Update available actions used by the real page.
* fix(ui-primitives): keep backslashes in Windows-path Markdown destinations
CommonMark reads \. in a link destination as an escaped dot, so
[x](D:\repo\.github\a.md) opened D:\repo.github\a.md. Destinations
that look like Windows paths now keep their authored text.
Fixes#7095
* fix(ui-primitives): cover relative paths and character references
Treat a backslash destination without a URL scheme as a Windows path
when it has no slash or a backslash before a letter or digit, keep
every backslash literal there, and still decode character references.
Pin the behavior in the Markdown file-links Web snapshot.
* chore: list micromark-util-decode-string in third-party notices
---------
Co-authored-by: Turtle <[email protected]>
Add the remaining material risks to the experimental plugin descriptions,
serialize only English descriptions in the official-plugin catalogs so the
skill results stay below their previous size, and read description test
literals from the locale resources.
Reading scrollLeft in the layout cleanup also captures positions that fire no
scroll event, such as a restore the browser clamps to the current offset.
Refs #7049
The root entry already re-exports the wire codecs, the identity contract, the
viewer carrier, and the viewer-state vocabulary, so `./protocol` and
`./identity` were aliases of subsets that every consumer had to mirror in the
tsconfig path list. Keep `.` alone, keep the mock provider in its source module
for tests, and bundle only the root.
A package that promises authentication-adjacent types must not hand production
callers a provider that fabricates principals from its public `./identity`
entry. The mock keeps its own `./identity/mock` export, the console face drops
it, and the entrypoint tests pin both halves.
Matching a forwarded route on the pathname alone let any origin whose URL
carried `/api/present.host` or `/open-in-app/apps` reach the owner instead of
the destination it named. Resolve the request against the page base and forward
it only when the target origin is the page's own; every other request reaches
the fetch this carrier replaced.
The face layout paragraph still counted six split packages. The
liveshare-protocol split added a seventh, and this names which part of the
package stays on each leaf.
Every other row states the ctx key or an em dash; the protocol row said
'library and protocol — no ctx key' in both languages. It now uses the
same em dash as the other rows without a ctx key.
The @module tag named a viewer-states subpath the package does not export.
The vocabulary is reached through the package root, so the tag now names
that entry.
The summary claimed both packages import the package and named only
dsh-brand, while nothing imports it in this tree and cordis is a peer. It
now states the shared definitions and both dependencies without claiming
current importers. When to use it names the package root for the viewer
carrier and viewer-state vocabulary, and the Known Limitations anchor moves
ahead of its heading like the other sections.
The v1 host/worker fixtures carried no registrationToken or token, so a
legacy branch asserted them rejected and the optional-field case skipped
them. They now carry valid tokens and round-trip through their codecs. The
unknown access-mode fixture carries a token too, so its refusal is about
the mode rather than the missing identity. The unread required lists are
deleted; the optional lists now match what the parsers accept.
A 200 open whose body was not a JSON object threw from readable() before the
abort listener was armed, so the page never sent stream-cancel and the owner
held the id until its own budget expired. The unreadable-open path now
cancels the id before rethrowing; the spec pins the cancel.
LIVESHARE_CAPABILITIES was a runtime string array, so a peer could neither
check a capability name at compile time nor compare against the same union.
The tuple is now const and LiveshareCapability derives from it; the wire
values are unchanged.
parseRelayFrame parsed the wire text for the lifecycle snapshot and again
for the envelope, and unsupportedFrameRefusal repeated both parses. One
JSON.parse now feeds the snapshot check, the envelope, and the refusal
branch, so the hot path decodes each frame exactly once.
The wire parser accepted an empty tenant while the Relay's identity adapters
store a non-empty one and identityFromKey refuses an empty segment, so a
share ACL built from such an actor could never match a normalized entry.
Reject the unnormalized actor at both the Relay frame and IPC ingress.
The package carried one Host-based tsconfig that both aggregates registered, so the browser carrier
was compiled under the Host face while the wire codecs that use Buffer were compiled under the same
config. It now follows the repository's double-face template: a solution-only package root, a Host
leaf (wire codecs, identity contract, shared vocabulary, and the root barrel that re-exports the
carrier), and a browser leaf for the viewer carrier and the pure types it shares. The two repository
aggregates register the matching leaf, and the carrier stays in the Host file list because the root
barrel re-exports it for the Relay's script generation.
The tsdown comment now states the two compiler faces and why only the Host face publishes runtime
modules.
The published declarations reference Branded from @deepseek-ai/dsh-brand, so an external consumer
must be able to resolve that package from the manifest. It moves from devDependencies to
dependencies; the lockfile records the importer under dependencies.
The protocol package leaves the repository-wide coverage exemption and meets the same per-file 100%
gate as the other packages. The new specs cover the identity mock, the wire helpers and every
additive-field parser branch, both public entry points, and the carrier's forwarded-route paths; the
key parser drops an unreachable guard so its remaining branches are exercised.
An IPC share spec accepted any string as its deadline while the frame parser required a parseable
time, so a registration could carry an expiry no reader could enforce. Both parsers now apply the
same rule: a stated expiry must be a string Date.parse accepts.
The key codec now states its precondition: a caller normalizes an identity first, because an
unnormalized empty tenant renders a segment the parser cannot read back. The viewer carrier and the
viewer-state vocabulary join the file map, reached through the package root rather than their own
subpaths, and the placeholder-tenant comment is one complete rule again.
The new actor credential and share connection are untrusted wire inputs: a non-string credential and an unknown connection mode are refused, an absent connection parses as the relay default, and an absent credential keeps the Relay-asserted actor.
Additive wire evolution: an actor may carry an owner-verifiable credential (type-checked here, verified by the owner, absent keeps today's Relay assertion), and a share spec may carry a connection that defaults to relay while a Relay that owns the data path refuses direct. Capabilities actor-credential and direct-connection declare support; the recorded frames carry both fields.
TunnelShareSpec and ShareAccessStateFrame repeated the same six permission fields. They now extend one SharePermissions interface (the committed frame is the authority), with the upload switch optional in a request and required in a frame. The wire shape is unchanged, so the recorded frames replay byte for byte; the display-only and grouping fields plus the registration-token and request-id roles are documented in place.
The identity contract and its fixtures named specific providers even though the package only describes the abstract triple. The JSDocs now say a deployment's adapter implements it, and every fixture and spec uses the neutral example provider while keeping the encoding, round-trip, and empty-field cases they pin.
The v2 upgrade guide and the fork-readonly normalization were development-period artifacts that never shipped, so the protocol returns to version 1: the guide triplet is deleted with its references, the withdrawn tier is no longer named anywhere (unknown tiers are rejected generically), and the README plus the version test state version 1. The file-upload capability and its additive field stay.
The share spec gains an optional allowsFileUpload switch, the access-state frame always states it (an absent field reads as off), and the file-upload capability separates the field from the tier and fork switches. The wire version stays 2 because the change is additive; the upgrade guide says so and the recorded add-share frame names the new field.
Normalizing fork-readonly to view dropped the switch the withdrawn name implied when no allowsFork was present, so a legacy registration silently lost forking. Both parsers now set allowsFork true for that case, matching what the old name granted.
viewer-states publishes only each condition's retry decision: HTTP statuses and error codes belong to the Relay and copy keys to the client, so the mismatched accessDeniedTitle key is gone with the wire discriminator. Both parsers read the withdrawn fork-readonly tier back as view while keeping allowsFork, matching the documented treatment, and the protocol version is pinned in a test. The coverage-exclusion comment now names this package's own deferred lane instead of another package's.
The carrier matched forwarded routes by substring, so /api/present.hostile and /x/open-in-app/apps-foo were posted to the owner as if they were the read routes. Match only where the route starts a path segment and ends at the pathname or a following slash, keeping the Relay base path prefix working; add hit, subpath, prefix-neighbour and query cases.
The carrier called the captured page fetch as a plain function, so a browser fetch that checks its receiver would fail on every non-forwarded request. Call it with globalThis as the receiver, as the repository's other fetch wrappers do, and pin the receiver in a spec.
The access-mode vocabulary changed from open|approval to open|selected without a protocol version change, so a peer could declare version 1 while refusing every value the other side sends. Version 2 states the break; the retired approval name stays refused rather than reinterpreted, and an upgrade guide records the peer upgrade order.
The wire vocabulary now spells the allowlist-gated mode `selected` and the
closed enum is `open | selected`. The retired `approval` spelling falls outside
the enum, so both the share spec and the authority snapshot refuse it instead of
widening the share; the refused-frame fixture and the malformed-field case pin
that refusal.
The owner bundle and the Relay must agree on the frames they exchange and on
how one viewer identity is keyed, without either depending on the other. This
package carries both halves: the owner/worker IPC frames, the gateway frames the
Relay forwards without interpreting, and the provider-neutral identity contract
with its loopback mock. `parseGatewayFrame` answers undefined for input this
build does not understand instead of failing the connection, and
`unsupportedFrameRefusal` turns such a frame into the refusal to send back.
The package is registered as a release member, a doc-standard library, a
tsconfig host and client program, and carries the coverage lane the wire codec
needs. Its Further Exploration list names the owner bundle and the Relay
without linking to packages this layer does not add yet.
* feat(experimental): ship the two card experiments as one Personalized recommendations bundle
@deepseek-ai/dsh-personalized-recommendations inserts the action card
service, its browser half, Personalized pages and Plugin recommendations
with their card bodies under the existing row ids. As the only layer that
declares those ids, the Plugins page addresses and switches each row,
including the two shared card rows that were read-only while two bundles
inserted them.
The two experiment packages stop being bundles; the new bundle takes their
place in the official lists and the dsh installation, with the personalized
pages icon, localized title and description, and a feature preview of both
cards. The two feature rows describe what they do on the bundle page.
* fix(experimental): drop the model reason line from plugin recommendation cards
The reason follows the language of the user's question while the catalog
description below it follows the interface language, so the two lines could
differ in language and largely repeat each other; the answer already gives
the reason. The card keeps the catalog title and description, both in the
interface language, as its details target.
* test(web): refresh the card fixtures for the Personalized recommendations bundle
Both card replays enable the new bundle, so each Session lists both card
skills, and each skill's catalog lists Personalized recommendations in place
of the two former bundles. The plugin card goldens lose the reason line.
---------
Co-authored-by: ZiyaZhang <[email protected]>
Each tab host draws its own strip while selected, so every open, close, or
selection mounted a strip at offset 0 that then glided across the whole row
to the active chip. Record each pane's chip-box offset in TabLayout, jump a
new strip to it, and glide only the remaining distance; a first placement
with no recorded offset jumps.
Refs #7049
Experimental plugin detail documents keep only their feature preview; each
bundle's meta.description states what it does, how to use it, and its
material risks.
- The panel and the forge bundle ship Spanish, French, German, Russian,
and Portuguese titles and descriptions.
- Their versions follow the root release version 0.2.1-rc.3.
The parent branch now carries master through #6426 again.
- Master moved the optional, experimental, and plugin page bundle lists
into @deepseek-ai/dsh-official-bundles; the forge bundle joins the
optional and experimental lists there.
- The CLI manifest, release families, and plugin page expectations keep
both sides; the forge bundle ranks before the held-back recommendation
bundles.
- The lockfile, the event matrix, and the experimental persistence
catalog are regenerated, and the capability-seams and experimental
README pairings are recorded again.
- The forge, forge-github, and forge-session packages ship Spanish,
French, German, Russian, and Portuguese titles and descriptions.
- Their versions follow the root release version 0.2.1-rc.3.
The parent branch now carries master through #6426.
- The root manifest keeps the forge packages and master's action cards.
- The event matrix and the experimental persistence catalog are
regenerated, and the capability-seams and experimental README pairings
are recorded again.
- The Spanish, French, German, Russian, and Portuguese dictionaries name
the sending composer.
- The device classification case expects the acceptance callback that a
prompt submission carries.
- The composer's primary button keeps master's rule that hides a denied
action and draws the sending state inside it; a sending prompt stays
interruptible through master's stopAction.
- The ui-conversation README pairing is recorded again for the merged
sections.
Add an authored headless scenario that appends a changed prompt and then replaces a surface node before the third step. The unchanged-rendering series start must keep both prompt versions and write no system/message event; the scenario fails against the pre-fix projection. Also tighten the tool-series-start assertions and make the prefix premise explicit.
Clarify the SystemPromptDecisionInput.startsSeries contract (a new request series no longer implies consolidation), record the tool-schema series-start exception consistently in the decision and consequences, and correct the complete-declaration attribution to the unsupported-route projection.
Each /models entry now declares its selector badge under
client_metadata["deepseek-harness"].badge, keyed by the User-Agent product
token like client_requirements, so the public model fields stay unchanged
and later DeepSeek Harness fields join the same object. Every field under
client_metadata is ignorable: null at any level shows no badge, and a level
that is not an object drops only the badge with a diagnostic naming it.
Group READMEs no longer place the bundle lists under boot/, util/ names its
data-only exception, PROTECTED_PLUGINS states what removing a name allows,
EXTENSION_BUNDLES is described as a ranking, and the package README records
the browser inlining constraint.
Takes master's move of the official plugin lists into
@deepseek-ai/dsh-official-bundles. The Plugins page files come from master,
and the plugin recommendations bundle follows the personalized pages bundle
in OPTIONAL_BUNDLES, MORE_BUNDLES and EXPERIMENTAL_BUNDLES.
The plugin skill's catalog lists every official plugin's title and
description in the eight shipped languages, and the page skill's catalog
lists the plugin recommendations entry with its new translations.
Master now ships Spanish, French, German, Russian and Portuguese, and its
locale gates require every package's plugin metadata and Client dictionaries
in those languages. Both plugin recommendation packages add them, the card
registers the new dictionaries, and the terms follow the card and Plugins
page translations.
Takes master 020a053a120 through the base, which ships Spanish, French,
German, Russian and Portuguese and requires them in every package. The page
card fixture takes the base's eight-language plugin catalog.
Master now ships Spanish, French, German, Russian and Portuguese, and its locale gates require every package's plugin metadata and Client dictionaries in those languages. The four card packages add them and register the new dictionaries.
Move @deepseek-ai/dsh-official-bundles from packages/boot to packages/util
and move the plugin manager's protected plugin list and the Web plugin
page's hidden, ordered, and experimental bundle lists into it, so editing
any of these lists no longer touches app-boot or either plugin manager
package.
The two packages keep their directories under packages/experimental and are
registered as experimental name exceptions:
- @deepseek-ai/dsh-plugin-recommendations
- @deepseek-ai/dsh-client-ui-plugin-recommendations
Loader row ids, the Remote service name, locale namespaces and the
enable_official_plugin action are unchanged. Generated catalogs are
regenerated, and both card Web fixtures record the renamed bundle in their
skills' plugin catalogs.
Takes the card packages' new names and master up to e115cc98d65. The plugin
recommendation packages and their bundle rows now name
@deepseek-ai/dsh-action-cards and @deepseek-ai/dsh-client-ui-action-cards;
generated catalogs are regenerated, and both card Web fixtures record the
renamed bundles in their skills' plugin catalogs.
The four packages keep their directories under packages/experimental and
are registered as experimental name exceptions:
- @deepseek-ai/dsh-action-cards
- @deepseek-ai/dsh-client-ui-action-cards
- @deepseek-ai/dsh-creation-recommendations
- @deepseek-ai/dsh-client-ui-creation-recommendations
Loader row ids, plugin record names, message source kinds, the Remote
service name and locale namespaces are unchanged. Generated catalogs are
regenerated, and the page card Web fixture records the renamed bundle in
the skill's plugin catalog.
The model sometimes wrote the skill's invitation sentence without calling
propose_action, so users read "click below" with no card. The plugin kind
now registers its invitation, which only an accepted call's result carries:
"Card shown below your answer. Do not restate it. End with at most one short
invitation in the user’s language to click Enable below; do not say the
plugin is already on." The skill drops its invitation sentence and says the
call's result tells how to end the answer. A test runs a real turn and checks
that the accepted result carries the invitation and a refused call does not;
the plugin Web fixture is refreshed for the new skill and result text.
Takes the card invitation that only an accepted call's result carries. The
page card fixture keeps the base's skill and result text and the plugin
recommendations entry in its catalog. The plugin kind gains its invitation
in the next commit.
The model sometimes wrote the skill's invitation sentence without calling
propose_action, so users read "click below" with no card. Each card kind
now registers its invitation, and only an accepted call's result carries
it: "Card shown below your answer. Do not restate it. <invitation>".
The personalized-pages skill drops its invitation sentence and says the
call's result tells how to end the answer; the Web fixture is refreshed
for the new skill and result text.
An enable cut off by a plugin reload can still land. The kind now uses the
shared reconcile step: before every action on an unconfirmed card, including
Not now, it checks the profile and records enabled when the plugin is on, so
the card is not dismissed or enabled again.
Takes the action-card fixes: kinds reconcile before every action, only live
roots get cards, the tool refuses while messages are queued, and bodies no
longer receive ready. The plugin card drops ready, its queued-card test goes
with the suppressed phase, and the shared-row limitation follows the base's
new limitations.
- An enable that a plugin reload cuts off records unconfirmed; the card
offers a retry and Not now, and a retry that finds the plugin on records
enabled because this card's change landed.
- A rejected profile change records failed with operation-error and keeps
the retry instead of failing the click; overridden and cancelled are gone
because enabling a bundle only reports applied, restart-required or failed.
- A refused or lost catalog lookup keeps Not now and offers Try again, with
separate copy for each; a settled card keeps its outcome after its plugin
leaves the catalog. Only the clicked button shows Working, the details
label is interpolated, and the reason and description stay its
accessible description.
- The Host entry exports its inject list, so the configuration catalog lists
its services; the skill keeps its rules without the examples.
- With both experiment bundles on, the shared action-card rows cannot be
switched or configured on the Plugins page; the READMEs say so and a
Loader test pins it while the bundles still switch.
- The unused intent fixture is removed and the evaluation set expects a
create_personalized_page card for the counter.
Replace the literal "Approval policy: ask." runtime-context sentence
with a statement parallel to the never-policy sentence, and refresh the
current-generation fixtures that persist it.
Co-authored-by: Tianyi Cui <[email protected]>
Update the Web permission-policy snapshot, the config catalog line
reference and README text for the new switch notice; pin both switch
directions in the unit test.
Co-authored-by: Tianyi Cui <[email protected]>
Name each policy by its meaning in the model-visible switch notice so a
bare "never" is not read as "approval is never granted".
Refs #6496
Co-authored-by: Tianyi Cui <[email protected]>
- Kinds can reconcile a card before every user action, including Not now;
the page kind confirms uncertain runs against the installed profile, so an
installed page keeps Undo instead of being dismissed.
- Only a live root's direct skill load activates propose_action; calls from
subagents or from code are refused.
- The tool refuses while queuedMessageLimit messages wait, so the model is
never told a hidden card was shown; the suppressed phase is gone and the
projection moves to state version 2.
- record() refuses actions no kind registered and the derived replaced phase.
- Not now dismisses an unstarted card whose kind is no longer registered.
- The unused ready prop and dead locale keys are removed, and the READMEs
state the card and row rules as implemented.
The plugin fixture now offers the card with a propose_action call, the
tool schema pin records the tool addition after the skill load, and the
card goldens name the region after the card title as the shared frame does.
The page fixture's skill catalog lists the plugin recommendation bundle.
Plugin recommendations now proposes through the shared propose_action tool
instead of a dsh-action answer block. The Host registers the
enable_official_plugin kind with the action card service: the
official-plugins skill, details holding the plugin name, the Enable verb
with global access, and the enabled, already-enabled and failed phases,
whose data carries the application outcome and the management error code.
The package drops its own projection, Remote act, status notice and
persisted record; it keeps the describe Remote for card text. The bundle
inserts the shared card rows beside its own, as Personalized pages does.
The browser half registers a card body in the shared frame that keeps the
catalog text cache, the reserved loading lines, the single details target
and the Enable and Not now footer. The skill's submission section now asks
for one propose_action call.
A reviewer blocked the one-shot boolean access read the stop shortcut used:
the client should not expose a render-time access answer as a boolean API.
The Esc-Esc sequence submits its cancel again, and a Host refusal surfaces as
the composer failure the Stop button would have prevented. Send keeps the same
treatment: the access snapshot withholds the buttons, the Host refuses the
request, and the composer reports it.
The access snapshot still withholds the Send button, Stop, and file intake, and
the Esc-Esc stop path still reads its own answer before sending a cancel. A
keyboard submission, however, once again reaches the Host, which refuses it and
reports the failure to the composer; gating that path needs a larger redesign
of the composer keyboard face.
ui-chat goes back to origin/master as a whole package: the footer branch forks
through ctx.sessions.fork with its own atSeq and analytics again, and Workspace
navigation takes no ForkSessionOptions. The package is identical to
origin/master, which drops the served-page branch assertions and README lines
added on this branch; they pinned behavior master already has.
ui-workspace restores master's forkSession signature and implementation
(allowMigration only, increaseTitle: true, selection untouched) and drops the
ForkSessionOptions type. uiSession leaves the inject list because the removed
session/rename probe was its only consumer. The row fork keeps passing
{ allowMigration: false }, which master already does, so forking from a shared
page never starts source-format migration.
Regenerate the client API catalog, restore the README fork contract (fork does
not navigate; allowMigration carries migration permission), re-record the
translation pairing, and return the ui-chat unknown-cast baseline count to 2.
`increaseTitle` renames the child, not the source, and whoever may fork a Session also holds `session/rename` on the child it creates; the source's access answer therefore never decides the child's title. Remove the source-rename probe, the listed-branch wait, and its refresh-failure notice: `selected` opens the child immediately and `listed` leaves the selection alone. Update the public READMEs and the client API catalog.
Enter, Mod+Enter, and accelerated queue steering now read the same prompt
answer as the Send button, and the fixed Esc-Esc sequence reads the live
session/cancel answer before it consumes a press. The composer locks for a
denied prompt, the README states both paths, and tests pin each gesture.
Read the branch-naming answer through uiSession.access instead of the
cross-kind source, drop the unused openListedBranch method, give the branch
list refresh its own notice, and gate the search result restore control like
the archive row. The forkSession contract now states its navigation and throws
behaviour, present documents its 2x2 landing table, and the README describes
the real branch policy and row gating.
The Session kind owns its remoteAccess source, so other plugins get one
non-Hook read from this service instead of reading the source themselves.
Navigation uses it for the branch-naming answer.
The client inspect catalog follows the seam signatures, the unknown-cast
baseline drops the two casts this branch retired, and the README pairing
records match the merged prose.
Master's rows and menus carry no answer of their own, so the served-page seams
thread the Slot-standard access Hooks through the workspace browser and the
session actions: New Session, workspace rename/delete/reorder, and a Session's
rename, pin, archive, and reorder appear only while their own resource allows
them. The rows spec keeps master's pointer-armed rename helper and supplies the
allow-all answers as props.
- The Conversation binding tracking returns to master: the retainInfo subscription and the
plugin-owned binding effects are a separate fix, not a served-page seam.
- The deliverables opener drops the ownerHostRoutes parameter no caller passes any more.
- Assertions on existing connection and HMR behavior, the menu-open-state spec, and the
settings-general roster splice return to master.
- Workspace shortcuts no longer re-read Session access through source(); the Host refuses a
denied rename, fork, or archive.
- The sidebar New Session button, the window-chrome New Session control, and the expanded
brand shortcut render only while useRemoteAccess('session/create') allows it.
- The composer decides file intake from the Session-scope useAccess('fileUploads/upload')
answer, like Send and Stop. The optional fileIntake hook seat, the InputHub fileIntake
entries, and the ui-slots optional-hook typing are removed.
- The fixed Stop shortcut no longer re-reads session/cancel through a shared stop; the
button stays hidden by useAccess and the Host refuses a withdrawn cancel.
- uiConversation.noticeBranchRefusal, branch.ts, ForkRefusal, and message.branchRefused are
removed; a failed Chat branch leaves the source view unchanged, as on master.
The owner-baseline gating commits are superseded by master's whenAccess seams,
so the remaining records revert to the master shapes: the deliverables opener
takes no owner answer, the Japanese dictionaries carry the surviving copy, and
the test splice and owner assertions match the current services.
Read the slot injection through its real rest-parameter function type and invoke it directly, so the static gate sees no new assertion to unknown. The client inspect catalog's expected uiWorkspace signature follows the generated catalog after the fork options became ForkSessionOptions.
P1 keeps only the client/host extension seams; the requestId deduplication,
the cancel recheck, and the named fork child are deferred to a later change.
The package, its README pair, and the persistence schema lines return to the
master state, so the branch adds no session-controller behaviour.
Type the tracked binding disposers by their real shape and let a disposed
context's shared stop surface its own loud unavailable error instead of
reporting a withdrawn permission.
The button re-read the live session/cancel answer but the fixed shortcut
received the raw stop, so a withdrawal still sent Esc-Esc cancellation. Build
one gated stop used by both entry points and cover the shared gate.
A rejection may be null, undefined, or any non-object; reading rpcError through
it threw a TypeError and replaced the branch-refusal notice with a crash. Narrow
the value first and cover the non-object rejections.
The long-lived plugin effect wrapped every Session-scope effect, so a released
binding's Context stayed referenced until plugin unload. Track the binding-scope
effects in a map that the binding cleanup and the plugin unload both drain;
nothing long-lived closes over a released binding.
The recheck used allows(), the list-filter view that never sees call arguments,
so a policy narrowing cancel to args.request refused a legitimate caller as
access-withdrawn forever. Ask decide() with the principal and the request, keep
the policy's own refusal reason, and cover both an args-independent role and an
args-dependent condition.
A first attempt that materialized the child and then failed at attachSession
was reported as failed, but its retry adopted the stored child and returned
success before attaching it, leaving the child ungrouped. The adoption path now
completes the missing attach and reports the same session/workspace-attach-failed
if that still rejects.
The Gateway already admits each call; P1 no longer re-reads the caller's access
after prompt admission. Cancellation still refuses delivery when the caller
aborts during admission, and the requestId dedup/conflict, cancel recheck, and
fork naming behavior stay. The README pair follows.
The published UiWorkspace no longer requires openListedBranch: that wait is an
internal navigation helper, and the service forkSession takes the branch
boundary and presentation choice as optional inputs. The Chat branch surface
now supplies only its branch point and analytics and lets Workspace navigation
decide whether the child may be named and when it becomes presentable.
A refused branch now reports itself on the owner's own page: the Chat
injection writes the notice on the addressed Session and the composer bar
renders it as an alert, so the owner-visible change has an assertion at both
seams.
The composer hook source and the drop gate now resolve the same live intake
answer from InputHub, so the policy and its two readers cannot drift; the
caller keeps ownership of the rejection copy.
A bar registration that cannot prove live file-intake permission omits the
source; the bar then offers no file controls, matching the no-session
placeholder's fail-closed answer. PropsHooks keeps required hook seats intact
and lets an optional source leave its seat undefined.
The composer notice store has no production reader through the published
SessionInput seam: the bar renders it through ComposerBarInjected.hooks.notices
and the only other reader was a test. Leave the store on SessionInputShell,
which the hook wiring uses, and assert the bar's hook in the Chat spec so the
contract surface only publishes members with real consumers.
The model-visible catalog inherited two versions of the same JSDoc sentence,
one of which contradicted the other. Describe the blank reuse once: the first
reusable listed blank, the requested preset or its default, one shared attempt
per Workspace and preset. The generated client inspect catalog follows.
Close the Session Controller's remaining per-file coverage debt: a named
fork adopting the child its earlier attempt stored, refusing a name another
Session holds or one seeded at a different cut, and the named-child
observation failures; prompt admission sharing one in-flight requestId and
refusing a duplicate from another caller; the retry read from a drained
splice; the access-withdrawn and aborted-admission delivery paths; cancel
after the caller's grant is gone; and the Assistant settlement that appends
past the last entry. Test-only: no production behavior changed.
The Gateway admits a prompt before the controller sees it, so a binding narrowed while the prompt waited must not still deliver: the Remote method passes a predicate that re-reads the caller's access after every await and immediately before delivery, and cancel re-reads it in the same synchronous step. One requestId still produces one message; a retry from another principal is refused as session/request-conflict. Fork callers may name childSessionId so an interrupted attempt resumes the child it stored; any other occupant of that id is refused as session/fork-conflict. The agent-controller admission pipeline this previously built on is not part of the current master, so the prompt keeps the direct admission path and the tool-execution turn carrier is gone.
The Workspace tree gains the Host-published branch projection plus the
access-snapshot reads its rows, menu entries, and shortcuts consult; the
Conversation package moves branch handling into its own module and exposes the
input and slot declarations a page-local plugin composes. Chat, sidebar,
deliverables, and open-in-app publish the slot surfaces those readers fill, and
the document-relative route and HMR endpoint seams keep the served page's own
base.
The creation fixture now offers the card with a propose_action call, the
tool schema pin records the tool addition after the skill load, and the
card goldens follow the shared frame and its Show more and Show less
controls.
Personalized pages registers the create_personalized_page card kind with
its create, keep, undo, cancel and restore handlers and drops its own
projection, Remote and status notice. The skill now ends with a
propose_action call. The Client package contributes only the page card
body. The persistence record moves from the page status source to the
shared action-cards source and decision record.
action-cards owns the propose_action tool, the actionCards projection of
proposals and decisions, the act Remote and the card status notice; card
kinds register an action name, skill, details schema, verbs and handler.
The tool is admitted per Agent only after a registered kind's skill loads.
client-ui-action-cards draws the card frame below the completed answer,
lets kinds register a body per action and adds the propose_action
process row.
Personalized pages no longer proposes cards through a fenced block in the
answer, so the chat stops hiding dsh- fences and the block parser package
goes away with its registrations.
Update the capability decision rule, both READMEs, the EventMap JSDoc and generated catalogs. Add the bug-fix Agent Note that records the incident evidence, the decision, rejected alternatives and consequences, and cross-link it from the in-history decision note.
An in-history route carries prompt updates as later system nodes while node 0 stays stale. A surface replacement (compaction, tool-result prune, image offload) starts a new request series, and the projection used to re-baseline node 0 even when the rendering already matched the latest surviving node: it emptied that node and wrote identical text into node 0, so the request differed at its first message and the provider prefix cache missed from the first token (#6973).
Re-baseline node 0 only when the effective text must move: an incapable route, an empty rendering, or a series start whose latest surviving non-empty node differs from the rendering. A capable series start with matching text emits no system event; the loop still logs the request series and rebuilds declarations. Retry compaction still folds the prompt to the head when it shadows the latest node.
A compaction replacement after an appended in-history prompt starts a new request series, and the projection folds the prompt back into node 0 although the effective text is unchanged. The request moves the system segment to wire message 0, so the provider prefix cache misses from the first token (#6973).
The regression fails before the fix: the third request carries one system text ("prompt two") instead of keeping the appended node behind the cached prefix.
* refactor(llm-deepseek): share the /models listing machinery
Move the account route's `/models` request and decoding, its
credential-scoped listing cache, and listed-catalog resolution with the
version gate into the shared DeepSeek Messages library, so a second
route can follow the same listing. Names drop the account prefix, the
cache takes each access's endpoint settings with the call, and it gains
`invalidate()` for a forced reload. `isBuiltInCatalog()` recognizes the
catalog an uncustomized `models` setting resolves to.
The account route keeps its behavior; only its imports and the
override diagnostic wording ("model listing") change.
* feat(llm-deepseek-api-key): follow the official /models listing
While `models` equals the built-in catalog and the Messages origin is
https://api.deepseek.com, `deepseek-official` serves the official
`GET /models` listing, authenticated with the API key in `x-api-key`.
Loading, refresh, fallback, merging, and the client-version gate match
the account route: the first access waits up to `modelsTimeoutMs`, a
listing older than `modelsMaxAgeMs` refreshes in the background on the
next access, a failure keeps the last good listing or the built-in
catalog, and listed models this build cannot serve are refused before
network I/O.
A customized `models` list replaces the catalog and requests nothing.
Switching between a customized catalog and the listing discards the
cached listing, so Restore defaults reloads it on the next access.
Suites that boot the route on the official endpoint now answer the
listing themselves instead of reaching the network.
* docs: describe the official route model listing
Document when `deepseek-official` follows the official `/models`
listing, its timing fields, customization precedence, and the forced
reload after Restore defaults in the API-key README, the shared
transport README, and the provider guide. Record the decision in a new
Agent Note, keep the account note's statement of where the shared
listing code lives current, and regenerate the configuration catalog.
* test(llm-deepseek-api-key): pin the once-per-listing hidden-entry diagnostic
* docs: regenerate module and event graphs for the shared listing
* fix(llm-deepseek-api-key): report credential failures on the model request
On the official endpoint, `connect` waited for the listing view, whose
credential lookup rethrew a malformed key or a credential-store failure
before the agent loop recorded the prompt. A failed lookup now resolves
the connection from the current listing view, so `resolveAuth` reports
the failure on the model request and the turn keeps the prompt and the
failed attempt. A caller abort still rejects.
* docs(llm-deepseek-api-key): name which hidden listing entries are logged
* test: keep unit suites off the official model listing
Suites that boot the DeepSeek routes with a dummy or inherited key now
request `GET https://api.deepseek.com/models` on the official endpoint.
A unit-lane setup file rejects that request at once, so such a suite
serves the built-in catalog instead of reaching production or waiting
out the listing deadline on a network that never answers; suites that
exercise the listing answer `fetch` themselves. Other requests pass
through unchanged.
* feat(llm-deepseek): read tool_update from the model listing
Both DeepSeek routes now take a listed model's Messages tool update mode
from `api_capabilities.anthropic_messages.tool_update`, alongside the
system prompt mode. `in-history` and `addition-only` replace the
bundled mode; any other value reads as `leading-only` and removes it.
An absent or `null` mode keeps the bundled one, so a listing that does
not declare the field leaves `deepseek-flash` on `addition-only`.
`system_prompt_update: null` likewise keeps the bundled mode now; it
previously read as `leading-only`, which a serializer writing empty
values as null would have turned into a cache-unfriendly downgrade.
* fix(llm-deepseek): sync the built-in context window with the official listing
The official `/models` listing declares a 1,048,576-token context window
for `deepseek-flash` and `deepseek-v4-pro`; the built-in catalog said
1,000,000, a decimal-versus-binary mismatch. Both built-in entries now
carry the listed value, so offline starts and listing failures size the
context the same way the listing does. The Models page shows the exact
count for these rows, since 1,048,576 has no decimal K/M spelling.
`defaultContextWindow`, the fallback for model ids the catalog does not
describe, stays 1,000,000.
* test(llm-deepseek-api-key): reject the stubbed listing request with an Error
* test(cli): keep the built SDK smoke off the official model listing
The SDK profile's initialize now resolves the deepseek-official catalog,
which requests GET https://api.deepseek.com/models on the official
endpoint. With the smoke's fixture key that request answers 401 and the
route warns on stderr, so the test's empty-stderr assertion failed in the
e2e and snapshots lanes. Point the run at a loopback mock and assert it
received no model call.
* test(llm-deepseek): compose the malformed-key turn without the native executor
release/dsh-0.2.1 predates @deepseek-ai/dsh-tool-executor-native; its tool
runtime executes tools itself. Compose the official-route turn the way
account-routing.spec.ts does on this branch.
* fix(llm-deepseek-api-key): gate nothing when the credential lookup fails
The listing cache switches scope only after it reads a credential, so a
failed lookup left `connect` serving the previous credential's listing.
After a key whose listing refuses a model was replaced by a malformed one,
`admit` refused that model with CLIENT_UPGRADE_REQUIRED before the turn
recorded the prompt, instead of `resolveAuth` reporting the credential
error on the request. Serve the built-in catalog without listing gates
when the lookup fails.
* test(llm-deepseek-api-key): pin the once-per-listing diagnostic across request preparation
The hidden-entry diagnostic test repeated the same discovery assertion to
prove a second pass reports nothing new, which read as a duplicate. Assert
the single warning after the request preparations instead; they resolve
the same listing, so dropping the per-listing deduplication still fails
the test.
* docs(llm-deepseek-api-key): note that a list matching an earlier built-in catalog counts as customized
Customization is judged against the running version's built-in catalog,
so a saved `models` list equal to an earlier version's catalog stops
following the listing once the built-in catalog changes, until Restore
defaults. Record the consequence in the Agent Note and the README's known
limitations.
* fix(ui): separate navigation pins from selection and show menu icons
* fix(ui): simplify More menus and fold conversation views on resize
* test(ui): fix navigation CI regressions and refresh catalogs
* refactor(ui): render sidebar panel icons directly
* fix(ui): keep Chat visible and stop persisting navigation pins
* refactor(ui): drop unreachable pin validation from in-memory stores
The composer model seat shows a catalog model's badge after its name in
the trigger, the root-menu value, and each option: a Tag in the badge's
tone whose text is resolved for the active locale through
ctx.locale.resolveText. A conversation.input.model.label contribution
replaces the name and badge together and receives the badge in its
owner props.
Remove ui-deepseek-model-label-1017, which hard-coded `1017` beside
DeepSeek-V4.1-Flash for two providers, and its Web bundle row. The badge
now comes only from the model listing, so the build ships none of its
own; the upgrade guide covers profile patches that still target the
removed row. The Web e2e replaces the fixed-badge case with replay
catalogs that declare literal and translated badges, and the replay
adapter validates and advertises a configured badge.
The shared DeepSeek listing decoder reads an optional per-entry
`badge: { text, tone }`. Text is one literal or translations keyed by
lowercase language id with a required English entry, each trimmed to 1
to 12 characters on one line; tone is neutral, info, success, or
warning, and an absent or unrecognized tone reads as neutral. An absent
or null badge declares none; an unreadable one is dropped with a listing
problem and never hides its model.
resolveListedCatalog keeps the badges of offered models, both DeepSeek
routes attach them through catalogModelInfo, LlmRuntime.listModels
detaches them, and the Host model catalog forwards them as
ModelCatalogModel.badge. resolveModelInfo omits the badge, so no model
request, Session event, or model-facing tool carries it.
Shipping plugin recommendations as an optional official bundle adds its entry
to the official-plugin catalog that the personalized-pages skill appends, so
the recorded skill result of the page card replay lists it.
Catalog text comes from an asynchronous Host lookup, so entering a Session
showed the package name and then moved the card when the title, description
and actions arrived. The browser contribution now keeps returned catalog text
by plugin name in a store owned by its UI lifetime, so a revisited card
renders it at once while its own lookup refreshes the selection, refusal or
lost reply. Until a plugin's first lookup returns, placeholder lines and the
disabled actions hold the title, description and footer in place.
The card takes the deliverables card border and layer background. Its title,
reason and description stay one details button, which now highlights as a
whole on hover and keyboard focus with the interactive hover token instead of
underlining a separate "View details" hint; the hint copy is removed and the
Web goldens lose it from the button text.
The official-plugins catalog entry now also triggers when the user asks how
to do or use something in this app, asks whether it can do something, or says
a capability is missing, and names tools, automation, access, badges and
signatures besides the earlier categories. At 495 characters it stays within
the skill catalog's 500-character limit; the previous 535-character entry lost
its exclusions to truncation. The Web replay fixture records the new catalog
line.
The recommendation projection skips the events a forked Session inherits,
records the turn that admitted each proposal and publishes the proposals in
its client view. Card actions and descriptions look proposals and decisions up
by own keys only, so inherited member names such as toString are unknown ids.
The card reads its proposal from the projection view by turn and appears once
that turn ends for any reason; the answer parser and the hidden conversation
node are removed.
Master now limits CSS hover styles to hover-capable primary input, opens
tooltips from pointer events, requires a model on every Agent and a model
selection on agent/pre-step, and requires Japanese plugin metadata.
- The panel's hover styles move under @media (hover: hover); expanded,
pressed, and focus-visible styles stay outside it.
- The hover tests enter with pointer events.
- The test Agent carries an unsupported model, and proposed steps carry a
model selection.
- The panel and the forge bundle ship Japanese titles and descriptions.
The parent branch now carries master through #6426, including the
agent-controller revert.
- Package manifests keep both sides: the ./types and ./locale/*.json
exports of the forge packages, and the Web app's forge bundle and
message quotes dependencies.
- The type manifest drops the removed agent-controller entries and keeps
the forge panel entries.
- The event matrix and the capability-seams pairing are regenerated.
- The forge bundle stays on the main plugin list and now ranks before the
held-back developer tools; the plugin page expectations follow.
The agent-controller admission hook was reverted on master, so the forge
panel now holds the next Turn with Agent maintenance started from the
agent/inbox/inserted notification. The message stays in the inbox until
the hold ends.
- A message sent before the requested worktree exists waits while the
panel creates it. After a failed or stopped attempt the message keeps
waiting until the card retries, through the new
forgePanel.retryWorktree, or withdraws the request so the message goes
on in the project directory.
- A message sent after the Session's worktree was removed waits on the
missing card until the worktree is restored or the Session returns to
the source checkout.
- Restoring a worktree reports its prepare and checkout steps. The card
shows them in place of its actions, and the tab's restore action shows
a spinner while it runs.
- The panel state names what a waiting message waits for and the running
restoration; the agent-controller dependency is removed.
The branch merge from master brought four scenarios added after the prompt
refresh (background-wait-steer, session-resume, model-switch-compaction,
web-search-unconfigured); their system-prompt sidecars still show the
guidance without the restored sentence, so the keyless replay fails. Apply
the same sentence to those six expected lines.
The App token cannot update a run the job token created and vice versa, so
selecting runs by `app.slug === 'github-actions'` missed every App run: each
phase created another run, a published App success was never revoked, and a
head with an older job-token run made the App patch fail. Select runs by the
publishing app slug instead, pass `vars.DSH_APPROVAL_APP_SLUG`, and set the
external_id marker on the setup-phase run too.
Cover the App-owned update and the job-run coexistence, and align the note with
the measured earliest-suite rule and the App slug variable.
The dedicated-App edit changed the note's decision section without re-recording
its translation sidecar, and the client-id replacement also hit the issue
lifecycle workflow assertion. Re-record the pair and restore the issue App's
variable names in that test.
The DeepSeek search and Search/Fetch API providers now report readiness
from credential presence alone, on any model route: the account token
first on the deepseek-account route, then a literal apiKey or a
configured apiKeyEnv reference. A conversation on another provider's
model keeps web_search and web_fetch while a DeepSeek key is configured,
as on master, so the route refusal WEB_PROVIDER_ROUTE_DISABLED and its
upgrade guide are removed.
The pi-ai-conversation-updates and deepseek-messages-system-prompt
snapshots replay their master recordings again, the headless keyless
smoke points its search key reference at an unset variable, and the
readiness Agent Note records the rejected route and endpoint rules.
pnpm 11 refuses to prepare a git-hosted dependency with
ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED instead of reporting ignored build
scripts. Classify that error as build-blocked and record the allowBuilds
key pnpm suggests, so the existing approval-and-retry flow applies.
Fixes#6837
Vitest resolves the shim's `buffer` import to Node's built-in module, so
the differential spec patched and then compared the same implementation.
Mock node:buffer with the npm package the Worker bundle uses. Also keep the
UTF-8 encoding check symmetric, call the package methods directly, and
document that the patch applies to every Buffer user in the Worker.
The branch label left the Session header, and finding which Sessions
work in their own worktrees, or which of their change requests need
attention, meant opening each Session's tab.
- A Session row shows a branch glyph while the Session works in the
worktree the panel created for it, and the state glyph of its most
urgent change request with a dot for its checks. The row's hover card
names the worktree branch and its base, then up to three change
requests with their state and checks.
- The forgeWorktree projection follows the Session's working directory;
its client view is the created worktree while the Session works in
it. The forgeChangeRequests projection gains a client view with the
bindings, so the Session summary carries both without loading a
Session.
- The forgePanel.changeRequestStates stream serves the states of the
change requests every listed Session binds from one Host run. It
polls each until it is merged or closed and stores every change in
the forge_panel_change_requests storage domain, so a restart shows
the last known states before the next poll.
- A new Agent Note records the decision; the READMEs, the forge
subsystem page, and the catalogs follow.
A user who gives DeepSeek search a key of its own has chosen what that key
pays for, so the route check now applies only to the shared
DEEPSEEK_API_KEY. A literal apiKey, or an apiKeyEnv other than
DEEPSEEK_API_KEY, opens every model route for Messages search and for the
Search and Fetch APIs; a configured endpoint does not, since the search
still sends the shared key. The Web search settings page saves its key
under the section's apiKeyEnv, DEEPSEEK_API_KEY by default, so a key saved
there keeps serving only the DeepSeek routes.
The route refusal now names the settings that give search a key of its
own, and the READMEs, the readiness Agent Note, and the upgrade guide
describe the exception.
The SDK profile's initialize now resolves the deepseek-official catalog,
which requests GET https://api.deepseek.com/models on the official
endpoint. With the smoke's fixture key that request answers 401 and the
route warns on stderr, so the test's empty-stderr assertion failed in the
e2e and snapshots lanes. Point the run at a loopback mock and assert it
received no model call.
web-search-unconfigured declares exactly the tool catalog that web-fetch
already pins, so it names web-fetch as its toolSchemasSource instead of
committing a second copy.
The Web preview Worker converted multi-megabyte combo scripts and source
maps with the buffer package's JavaScript UTF-8 codec, and the page
re-encoded each source map to Base64 in JavaScript before running the
bundle. Use TextEncoder/TextDecoder for whole-buffer UTF-8 conversions
and FileReader for the inline source-map data URL.
Replace the layout effect that forced a closed style with an opening marker derived during render. A @starting-style rule under the marker starts items mounted by the opening at the closed position. The marker clears when a transition ends, the panel closes, or the panel leaves the screen.
Review found two faults in the endpoint and configuration checks. The
providers took the official chat route's endpoint from the first active
dsh-llm-deepseek-api-key Loader row, so a composition that isolates several
instances answered for an unrelated one: a correct route lost search, or a
gateway's key reached DeepSeek. And a key saved on the Web search settings
page lands under the default DEEPSEEK_API_KEY reference, so the inference
that search had its own configuration never saw it.
Both DeepSeek web packages now serve only the deepseek-account and
deepseek-official routes, whatever key they are configured with, and no
longer compare the chat endpoint with their own. ready() checks the route
and then credential presence as before; the API-key resolver repeats the
route check and refuses with WEB_PROVIDER_ROUTE_DISABLED. The packages no
longer read Loader rows or depend on dsh-llm-deepseek-api-key, so the
lockfile, the module graph, and the keyless smoke expectations that the
endpoint check had changed return to master's.
An upgrade guide covers conversations on other providers' models, which
lose DeepSeek web search and, with the Search and Fetch APIs selected,
web_fetch.
* feat(webserver): add resource routes and in-process readResource
A webserver route or the fallback seat may now answer through a resource,
a function from a Fetch Request to a Response, besides the existing
node:http handler. register accepts either route form and registerFallback
accepts a handler or { resource }; existing handler callers are unchanged.
HTTP GET and HEAD requests reach a resource; webServer.readResource(request,
peer) follows the same match order and reaches only resources, so handler
routes stay unreachable to in-process readers.
client-modules registers /plugins as the fetchBundle resource, and
frontend-static claims the fallback seat with a resource that renders the
index for a supplied Peer, or runs Connection's existing authorizeIndex for
an HTTP request and renders for the browser Peer.
* fix(webserver): flush resource headers and keep one drain listener per response
Resource responses send their status and headers before the first body
chunk, register one drain/close listener pair per response so the gzip
middleware's zlib stream does not accumulate listeners across backpressure
waits, and readResource drops the body of a HEAD read as HTTP does. HTTP
requests and readResource share one responder lookup.
* chore(scripts): prune the retired client-modules unknown-cast baseline entry
* feat(frontend-static): let browsers revalidate dist files except the index
Every dist file other than the rendered index now carries
cache-control: no-cache and a weak ETag from a SHA-1 of its bytes; a
request whose If-None-Match equals that ETag receives an empty 304. The
index keeps sending no cache headers. In-process reads through
webServer.readResource revalidate the same way.
* fix(webserver): stop reading Host for resource URLs and copy no held body
A resource request's URL is the request target resolved against the same
placeholder origin the route match uses, so a missing or unparsable Host no
longer turns a dist or /plugins request into 400. The webserver ends a
resource response itself and treats any earlier close as an abort, which
also covers the Web Worker tunnel marking an aborted response ended first.
client-modules bundle bodies and frontend-static file bodies are the held
bytes themselves instead of copies, and frontend-static no longer exports
its internal serveStatic helper.
* docs(webserver): document resource route types and the handler-or-resource fallback
Paste WebResource and WebResourceRoute beside WebRoute on the web-server
subsystem page and link the catalog signatures to it, replace the remaining
'fallback handler' wording now that the seat takes a handler or a resource,
and note why the drain listener removal is a no-op under gzip.
The official `/models` listing declares a 1,048,576-token context window
for `deepseek-flash` and `deepseek-v4-pro`; the built-in catalog said
1,000,000, a decimal-versus-binary mismatch. Both built-in entries now
carry the listed value, so offline starts and listing failures size the
context the same way the listing does. The Models page shows the exact
count for these rows, since 1,048,576 has no decimal K/M spelling.
`defaultContextWindow`, the fallback for model ids the catalog does not
describe, stays 1,000,000.
Both DeepSeek routes now take a listed model's Messages tool update mode
from `api_capabilities.anthropic_messages.tool_update`, alongside the
system prompt mode. `in-history` and `addition-only` replace the
bundled mode; any other value reads as `leading-only` and removes it.
An absent or `null` mode keeps the bundled one, so a listing that does
not declare the field leaves `deepseek-flash` on `addition-only`.
`system_prompt_update: null` likewise keeps the bundled mode now; it
previously read as `leading-only`, which a serializer writing empty
values as null would have turned into a cache-unfriendly downgrade.
Replace the FadeText measuring component with a self scroll timeline: it is
active only while a box overflows, so the end mask applies to clipped text
alone. Browsers without scroll-driven animations keep the ellipsis.
Model and effort text in the composer trigger, root menu values, and option
rows now clips and fades over its last 24px while it overflows, following the
measured-clip mask used by dockkit tab titles and PathLabel.
Move the default bottom offset into a zero-specificity :where(.panel) rule and
correct the README description of which properties center and animate the
toolbar.
Reset the transient showZoom value during render on the first committed zoom
change, document the toolbar data attributes and the owner className scope,
and give the handle its own @param ref.
Derive the displayed zoom during render instead of syncing the prop through
an effect, reference DOCUMENT_ZOOM directly in both packages, cover the
unfitted non-preset state, and list ZoomControls among localized primitives.
Move the floating zoom controls from the document preview into
ui-primitives with the shared scale limits, so every document renderer
offers the same controls. Document preview renders them through its zoom
viewport with fit width as the optional fitting action.
The Web search switch selects the DeepSeek Search and Fetch APIs together,
and both reuse the DeepSeek chat key by default. Neither provider answered
readiness, so a step without a usable key was offered web_search and
web_fetch whose every call failed, and a conversation on another provider's
model or behind a gateway sent the chat key to DeepSeek.
dsh-web gives WebFetchProvider an optional ready(llmProvider) and adds
ctx.web.fetchReady(), which asks only the provider fetch() selects, as
searchReady() does for search. tool-web registers web_fetch with a step
activation condition on fetchReady(), so a step that cannot fetch leaves the
tool out of declarations, guidance, and PTC bindings and refuses a call to
it as UNKNOWN_TOOL; without web_fetch the search guidance uses its
search-only text. The shipped HTTP fetch provider has no ready() and stays
admitted.
web-deepseek-api applies the API-key rules of Messages search to both APIs:
without a literal apiKey, an apiKeyEnv other than DEEPSEEK_API_KEY, or a
baseURL other than the default, the chat key goes only to the DeepSeek
routes and only to an API base on the official chat route's origin. The
refusal sits in the key's only resolver, and both providers' ready()
answers presence in the order an operation resolves credentials. The
transport repeats these checks so the package still does not depend on
dsh-web-search-deepseek.
* ci: run native Windows PR jobs in a separate workflow
GitHub re-runs failed jobs only after a whole run finishes, so slow Windows jobs blocked re-running failed Linux jobs. CI Windows now owns the native Windows jobs and the Windows x64 Python runtime target, with its own required 'windows checks passed' verdict.
Refs #6893
* ci: run Python PR jobs in a separate workflow
Python rarely fails while the Windows lanes run long, so the Python SDK suite and the Linux/Windows x64 runtime matrix move into CI Python. The three pull-request workflows can now be re-run without waiting for each other, and branch protection gains "python checks passed" beside the existing verdicts.
Refs #6893
* docs: record the three PR verdicts in the failover runbook
* test: pin the shared environment across the PR workflows
* test: read the python SDK lane from CI Python
* test(sdk): parse session JSONL frames in the keyless smoke
Node 24.19 returned only the first frame of a concatenated zstd log, so the single JSON.parse saw just the header; 24.22 returns every frame and the JSONL body broke the parse. Read frames explicitly and select the main session by its header so both versions agree.
Suites that boot the DeepSeek routes with a dummy or inherited key now
request `GET https://api.deepseek.com/models` on the official endpoint.
A unit-lane setup file rejects that request at once, so such a suite
serves the built-in catalog instead of reaching production or waiting
out the listing deadline on a network that never answers; suites that
exercise the listing answer `fetch` themselves. Other requests pass
through unchanged.
On the official endpoint, `connect` waited for the listing view, whose
credential lookup rethrew a malformed key or a credential-store failure
before the agent loop recorded the prompt. A failed lookup now resolves
the connection from the current listing view, so `resolveAuth` reports
the failure on the model request and the turn keeps the prompt and the
failed attempt. A caller abort still rejects.
Profile templates and the default, optional, on-demand, retired, and
installation-owned bundle lists move to the new data-only package
@deepseek-ai/dsh-official-bundles, so editing a bundle list no longer
touches app-boot.
Document when `deepseek-official` follows the official `/models`
listing, its timing fields, customization precedence, and the forced
reload after Restore defaults in the API-key README, the shared
transport README, and the provider guide. Record the decision in a new
Agent Note, keep the account note's statement of where the shared
listing code lives current, and regenerate the configuration catalog.
While `models` equals the built-in catalog and the Messages origin is
https://api.deepseek.com, `deepseek-official` serves the official
`GET /models` listing, authenticated with the API key in `x-api-key`.
Loading, refresh, fallback, merging, and the client-version gate match
the account route: the first access waits up to `modelsTimeoutMs`, a
listing older than `modelsMaxAgeMs` refreshes in the background on the
next access, a failure keeps the last good listing or the built-in
catalog, and listed models this build cannot serve are refused before
network I/O.
A customized `models` list replaces the catalog and requests nothing.
Switching between a customized catalog and the listing discards the
cached listing, so Restore defaults reloads it on the next access.
Suites that boot the route on the official endpoint now answer the
listing themselves instead of reaching the network.
Move the account route's `/models` request and decoding, its
credential-scoped listing cache, and listed-catalog resolution with the
version gate into the shared DeepSeek Messages library, so a second
route can follow the same listing. Names drop the account prefix, the
cache takes each access's endpoint settings with the call, and it gains
`invalidate()` for a forced reload. `isBuiltInCatalog()` recognizes the
catalog an uncustomized `models` setting resolves to.
The account route keeps its behavior; only its imports and the
override diagnostic wording ("model listing") change.
Master's step-scoped conditional activation resolves each tool's condition
before a model step assembles, and both the declarations and dispatch read
that admitted set. Prompt assembly no longer carries tool declarations, so
tool-web's system-prompt/assemble listener could not remove web_search any
more, and removing a declaration there never stopped a repeated call from
running.
tool-web now registers web_search with a when condition that asks
ctx.web.searchReady() about the route of the step's model selection, and its
guidance section renders from the step's admitted set. A step that does not
admit the tool leaves it out of declarations, guidance, and PTC program
bindings, and refuses a call to it as UNKNOWN_TOOL without reaching a
provider. Tests that execute web_search directly now run inside a resolved
step, as the executor requires for conditional registrations.
Docs, the readiness Agent Note, and the event producer/consumer table follow
the new mechanism; the tools README gains an explicit conditional-tools
anchor for cross-locale links.
Master declares exit_plan_mode only in plan mode, so this branch's own tool
schema sidecars for web-search-unconfigured and pi-ai-conversation-updates
drop it. The merge took master's pi-ai-conversation-updates session, whose
request headers still listed web_search; the refresh records the moonshotai
route without it again.
Tool registration and scoped executors are now separate plugins, so a
composition without an executor cannot run the bash tool and the Agent
goes idle before its first model request. The forge-session Loader
composition now includes dsh-tool-executor-native, as the other real
composition tests do.
The Japanese plugin metadata gate requires every plugin package to carry
locale/en.json and locale/ja.json, and the three forge packages had no
locale directory. Each now has English, Chinese, and Japanese titles and
descriptions, exposed through exports and published through files like
its siblings.
Routing hints belong in the official-plugins skill, not in the
user-visible descriptions of thirteen other plugins; the plugin pages,
permission pages and the replay goldens return to their master text.
The fenced-block parser moves to the zero-dependency package
@deepseek-ai/dsh-util-action-block, which the client bundle inlines;
Personalized pages and Plugin recommendations both read answers through
it and no longer import or edit each other. Personalized pages yields:
a page block in an answer or turn that also carries another action's
block is logged but never offered, and a later other-action block
retracts this turn's undecided page card. Plugin recommendations never
yields and keeps one plugin card per turn of its own.
The recommendation card imports actionBlocksOf from the personalized pages
action-block subpath instead of keeping its own copy, and the Web replay
tool schema golden follows the merged master.
Replaces list_official_plugins, suggest_plugin and the routing prompt
section with the official-plugins skill, whose load appends the live
catalog, and an enable_official_plugin block at the end of the answer.
The card reads catalog text from the Host, Enable goes through the plugin
manager, and each outcome reaches the model as a status notice on the
next request. Adds the queuedMessageLimit option, en/zh/ja card copy and
a re-recorded persistence change and Web replay.
The Client card imports actionBlocksOf from the Host package's new
./action-block subpath instead of keeping a copy, and the client bundle
admits that pure parser as an inline-safe entry; the tool catalog test
no longer expects suggest_action, and over-long lines are wrapped.
An answer's last valid card block, page or official plugin, is its card,
and the first answer with a card holds the turn. A page block that is not
the turn's card is logged as suppressed so the creation card stays hidden.
Exports the shared block reader for the official-plugin experiment, covers
the remaining uncovered branches, and marks the Client block reader as a
per-bundle copy.
Store a frozen copy of ThemeDefinition.icons, treat null as absent,
require replacement element ids under the symbol id, document the trust
level and ignored root attributes, and boot a theme plugin through the
Loader to check the sprite swaps and restores icons.
Product icons drew fixed inline paths, so a theme could only recolor them.
Each glyph weight is now a dsw-icon-<glyph>-<weight> symbol: ui-primitives
keeps the default SVG documents and icons render one <use> of their symbol,
while ui-theme keeps a document sprite filled from the active theme's
ThemeDefinition.icons replacements or the defaults. Replacements may be
multi-color and paint with currentColor or --dsw-* tokens.
Refs #6894
A step's tool set no longer empties when the step is cancelled. The shared
pipeline already settles unstarted calls as cancelled; keeping admission lets
those calls keep their finalizers, and a wrapper result completed at
cancellation now reports cancellation instead of UNKNOWN_TOOL.
exit_plan_mode checks for a missing Agent explicitly instead of asserting it.
Document the activation types on the tools subsystem page, the turn/end code
for a failed tool condition, the replacement and no-set consequences in the
upgrade guide, and the admission rule in the parallel tool-call note.
* feat(ui-user-questions): show answered batches as shared message bubbles
* refactor(ui-primitives): share clipboard confirmation lifecycle
* test(web): include answered question bubbles in steering goldens
* fix(ui-user-questions): keep answered turns collapsible
* test(ui-user-questions): drop the removed compactAnswer expectation
master removed ChatTurnProcessPresentation.compactAnswer in aaeb344
("fix(chat): keep the reply gap on a folded final answer"); reply spacing
now comes from the adjacent-row rules. The rebase left this assertion
behind, so the parametrized replay/live/prepend cases failed on every CI
coverage lane even though typecheck stayed green: toMatchObject accepts
the stale property.
* fix(ui-user-questions): address answer bubble review feedback
* test(web): observe file card styles after both cards mount
---------
Co-authored-by: imccyu <[email protected]>
The tool executor merge added ToolBatchInput.toolSet; the subsystem page's type-equivalence block now matches it. The architecture turn-flow line names step-admitted tool schemas in one line so the page stays within its word budget.
The /api/file route bounds files by maxImageBytes, whose default is now
50 MiB, so the 20 MiB + 1 byte fixture no longer exceeded it and the
route served it with 200 instead of 413.
Check that the slide rules list the same docked items as the opening effect and that the settling rule overrides the open rule. Name the shared selector list on both sides and describe the opening step in the module header.
The proposal is a fenced dsh-action JSON object at the end of the final
answer instead of a suggest_action tool call. The projection reads the
last valid block of an assistant message, keeps one card per turn, and
marks a proposal written while queuedMessageLimit user messages are
queued as suppressed; the chat hides dsh- fences from rendered answers.
The Web replay fixture, tool catalog and READMEs follow the toolless
mechanism.
The first expansion of an empty column mounts the seeded tab already open, so it appeared in place instead of sliding in like later opens and every close.
The desktop top clearance pushed every portalled overlay at least 68px from
the viewport top, so menus opened from Conversation header controls inside
that strip landed about 30px below their trigger. Cap the clearance at the
position directly below a visible anchor.
Refs #6886
- tool-jobs: inline a completion notice only when the complete text fits inlineOutputBytes and the producer cap; otherwise point at job_output, whose result the spill policy bounds
- subagent: drop toolCallsThisStep; omit the closing text while the child's last logged tool call is its message to the parent
Both personalized page packages ship locale/ja.json beside en and zh, and
the browser package exposes its locale files like its siblings. The plugin
manager e2e expects the More list in the order the page declares. Refresh
the Web replay golden after the master merge.
A newer proposal in the same conversation replaces an unstarted card; the
next user message no longer expires it, so one unstarted card exists per
conversation (projection state version 7, phase replaced).
queuedMessageLimit (default 2) refuses a card while the user has that many
messages queued for later turns.
The card shows supplied initialContent as folded data below the plan.
The personalized-pages skill is rewritten around the chosen scenarios with
a shorter catalog entry that loads before any file reading. Paired sampling,
five runs per input on the same build: 63/90 to 81/90 cards on the
regression set with zero false cards; the log-tab inputs went from one to
four of five to five of five with two tool calls each.
Regenerated the config, cordis and plugin package catalogs, re-recorded
README pairing, and refreshed the Web replay golden.
Linux CI lays the title-only header at 470px with the actions beside the
title, while macOS wraps them, so that width depends on the platform
font. The title-only case now records 1280, 600, and 390px; the tabs case
keeps all four widths.
Follow the tool executor refactor: the tool/ptc-dispatch event type now comes
from dsh-tool-executor-ptc, and the tests invoke tools through dsh-tool-testkit.
Regenerate the doc graphs, tool catalog and persistence schema after the merge
and re-record their translation pairing.
Anchor the desktop-locale overflow probe to the locale selector's nearest horizontal scroll container instead of nav's next sibling. Master moved the settings header between nav and options, so the old positional target put the probe in a fixed header row and the negative control could not overflow.
The scenario arrived from master recorded with exit_plan_mode in a Session that never enters plan mode. Its fixture cannot be refreshed until #6710 lands, so the schema is removed by hand to match the replayed request.
The default per-image limit is 50 MiB and the default per-side limit is
65,535 pixels, but the admission summaries in the attachment subsystem
page and the attachment-local README still named 20 MiB and 8192 pixels.
The session-controller note on the /api/file byte limit and the tool-fs
note on read_image source caps also named the old 20 MiB maxImageBytes
default.
Both revocation cases restated the same grant and revoke helpers; one module-level pair keeps the two
cases reading the same install and disposal order.
Mint the check-run token from a dedicated approval App instead of a shared
automation App, so the identity that owns the decision check suite is specific to
this gate. The workflow reads `vars.DSH_APPROVAL_APP_CLIENT_ID` and
`secrets.DSH_APPROVAL_APP_PRIVATE_KEY`, and the token stays scoped to
`checks: write`.
Add the Japanese quote action dictionary and register it with the existing Chinese and English dictionaries. The package entered master alongside the Japanese locale lane without a Japanese entry.
The SDK background-wait-steer fixture was authored on a branch that predates master's present description change (1ec651f2098). Refresh only its expected present tool description; committed Session generations and product behavior stay unchanged.
A refused image thumbnail named its reason only through a native title,
which browsers show late or not at all, so hovering it showed nothing.
The refused and the failed image thumbnails now use the shared tooltip:
the Host's refusal opens on hover or keyboard focus and a tap or click
pins it, and the retry hint of a failed upload opens on hover or focus.
Keep the rendered Header and browser scenarios as the copy-action coverage, and describe the backend converter as used by the Session Markdown copy Host route.
Rename the Header menu item to Copy Session as Markdown (复制会话为 Markdown) so it states that the whole selected Session is copied. Update Header selectors, browser coverage, controller JSDoc, and the bilingual README; success toast wording stays unchanged.
Master's tooltips react to pointer events. Locator hover scrolls its
target into view, and scrolling this list moves the header controls
from under the pointer, so the narrow-width tooltip checks now point
at each control once the resized header settles. After Tab moves focus
to the icon-only Add plugin button, the touch case expects that
button's focus tooltip to stay and checks that the hovered ones leave.
Disclose the exit tool progressively instead of following every plan-mode
transition. The plan projection records whether a logged plan/mode ever
activated plan mode (stateVersion 4), and the tool's condition admits it
for a step whose selected state is active or once the Session has entered
plan mode. Leaving plan mode now changes only the guidance section, so an
addition-only route no longer drops a declaration from its cached prefix.
A call while plan mode is not committed still fails as unavailable outside
plan mode, and a Session that never entered plan mode does not list the
tool. The Web plan-review fixtures return to master's recording because the
request tool lists no longer change on exit.
Integrate exact origin/master b9bdd062c8ffd3dc234ebea7f5dff55ff26d87ad. Preserve the Session Markdown copy lifecycle and dictionary while adopting the Japanese locale, regenerate the client slot catalog, and add the Japanese quote-removal string required by the merged locale type.
The background-wait-steer pinned tool schemas still carry the pre-reword present description, so the snapshot header no longer matches the shipped tool.
Normalization already downscales long sides, so the default per-side
limit rises from 8192px to 65,535px, the largest side a JPEG carries,
and the decoded-pixel limit alone bounds admission. The default
per-image limit rises from 20 MiB to 50 MiB.
Address the review of this pull request:
- A failed image upload keeps the Host's attachment refusal reason. The
thumbnail of a refused image names the reason instead of offering a
retry that cannot succeed, and Enter while uploads hold the send names
the first failure; a transport failure still offers retry, and an
image without a file name uses the pending-image label.
- An image upload stops reading at the smaller of the per-image and
per-message byte limits.
- A carried image draft moving to a Session that sends images inline
drops its upload instead of staging it again.
- The image upload ready state no longer carries an unread image ref.
- Docs describe stored-image admission and the command image path, and
the attachment rail test builds typed props instead of casting through
unknown.
The decision check run kept its job-token check suite out of the pull request's
merge box: GitHub associates check runs with a pull request through the check
suite of the workflow run, and a `pull_request_target` run is not associated.
Mint a token from the repository App scoped to `checks: write` and publish only
the check run with it, so the merge box lists the label; the commit status gate
keeps using the job token and is unaffected when the token or the write fails.
Pin the token step, its single secret reference, and the client split in the
workflow and approval tests, and record the measured association limit in the
Agent Note and review-ownership README.
The quote plugin's dictionaries predate the Japanese locale merge, so the locale dictionary parity gate rejects its object-form dictionary without Japanese copy.
The Japanese dictionary landed without the quote removal copy its English and Chinese dictionaries already carry, so the conversation dictionaries do not typecheck against the current master.
A collapsed question or description keeps its full line budget and only
masked its dropped line, so that transparent line still took clicks: it
covered the first line of the question detail and the top edge of the
custom answer row. clip-path now removes the line from hit testing as
well as from view, and Web e2e hit tests pin both targets.
Expansions also record the question they belong to and apply only while
that question is shown, so a position change from another surface of the
same Session no longer carries them to a different question. `.title`
returns to its base margin; `.questionTitle` owns the flex sizing.
Option names made the toggle tooltips as long and unpredictable as the
option labels themselves. Every question and description toggle now uses
the same Expand and Collapse copy, and the question toggle, like the
description toggles, is described by the text it controls.
A long question with long, width-sensitive, and short option descriptions
is driven through the transcript width handle at its narrowest and widest
positions, an opened and collapsed right sidebar, and a smaller and
restored window. At each settled width every collapsed copy follows its
own overflow, the expanded description stays expanded, and the actions
stay reachable; collapsing the sidebar or restoring the window returns
the wide state exactly.
The expand and collapse controls reuse the composer's 24px icon button
with the existing downward and upward chevron icons instead of text. Each
carries a localized accessible name, which a portaled Tooltip shows on
hover. The fade at the end of clipped copy narrows to the 24px button.
The question composer expands long copy in place, so no caller uses the
callout variant, openOnClick pinning, describeAnchor, or the
preview-to-anchor pointer handling this pull request added. HoverCard,
its stylesheet, tests, and README return to their merge-base state.
A question shows in full up to three rendered lines and an option
description up to two. Longer copy keeps one line fewer, fades at the end
of that line, and offers a "More" text button that expands it in place;
expanded copy offers "Show less" on its own line.
CSS scroll timelines decide which copy overflows, so the composer no
longer measures layout in an effect. Each box keeps its full line budget
plus a 2px glyph allowance, and a negative margin returns the dropped
line, so the overflow reading never depends on the collapsed layout.
Navigation resets scroll and expansions from the navigation handler.
Prompt admission counted stored images only toward the image count, so
two uploads that each fit alone could exceed maxMessageImageBytes once a
prompt cited both receipts. A staged image now records the byte length
of its upload, and admission counts stored and encoded images together
against both per-message limits before storing anything.
An image upload cancelled after its last chunk, or while its image was
stored, still received a receipt. The upload now checks cancellation
after the read and again before staging, as the file stream path does;
an image whose storage began stays stored, but no receipt is issued.
The quote composer specs and README from master described optimistic
sending: the draft cleared on Enter and a failed send restored it. Here
the draft and its quotes stay in the read-only editor until the Host
accepts the message, a failure leaves them in place, and the sink also
receives the acceptance callback.
PR #6298 now fixes each step's model selection before prompt assembly and
agent/pre-step and passes it as modelSelection. This branch is rebuilt on
that master and keeps only conditional tool admission. The earlier agent/model
event, agent.step, step-boundary handling, prompt-assembly and
runtime-context reordering, and their snapshots are superseded, so this
merge records the earlier commits as ancestors and keeps the rebuilt tree.
Keyless session, SDK, ACP, and Web snapshots, the subagent-inheritance
expected output, and the Python dynamic-tools snapshot no longer list
exit_plan_mode outside plan mode, and the collapse-timing goldens count one
fewer added tool. In plan-review, the approved exit now removes the tool on
the next step: its header records a change that starts a series and a
tool-removal developer message, which the expanded Web timeline shows.
cordis-inspect-jsdoc records the new tools service signatures. The pwsh
tool-turn pins are edited by hand because pwsh is unavailable for a local
refresh; their only change is the removed schema.
The merge combined master's pointer to the DeepSeek Search and Fetch APIs
with the readiness sentence, which put the Summary at 118 words against the
100-word limit. Keep both facts and drop the restatements.
The web e2e scaffold pinned the snapshot replay DEEPSEEK_API_KEY for every
keyless run, so a UI-only run rendered a configured key. Master's web search
settings page golden records the page without one. Pin the placeholder only
when the scaffold replays recorded model calls, whose recordings ran with a
real key; other runs keep the launching environment, as their goldens do.
Refresh web-search-unconfigured after the merge: master now records the bash
call's job/registered and job/settled events.
The release trigger treats a user-sourced inbox insertion as a user steer and
only this wait responds to it. Both are known approximations for the
short-term fix: a shared steer signal should let every waiter decide locally
and let the input's producer own the decision. Mark both spots for the
follow-up and keep the public jobs contract unchanged.
The recorded-session fixture is a scenario-owned plugin that imports
`@deepseek-ai/dsh-llm` at runtime. Declare the workspace package at the root
so the snapshot lane resolves it from a clean install instead of relying on a
local node_modules layout.
`snapshots/sdk/background-wait-steer` replays a keyless SDK session whose
`job_output(wait: true)` is released by a user steer: the fixture steers once
the waiter registers and the producer has written its barrier line, and the
scenario asserts the early return with `user steered`, the surviving producer,
and exactly one completion notice for the settlement that the released read
did not consume.
The authored session takes its job id from the live request with
`{{fromRequest:(bash-[0-9a-f]{16})}}`, so an opaque id needs no fixture edit.
ctx.tools.register(definition, { when }) adds a synchronous or asynchronous
condition. AgentLoop resolves conditions once per proposed step with the
agent, the model selection that step preparation captured, and the turn
signal, before prompt assembly and agent/pre-step. The resulting
ResolvedToolSet governs tool declarations, Native dispatch, PTC bindings,
and nested calls for that step and its retries, and the turn disposes it
when the proposal is rejected or fails, when no step opens, and after the
step. A false condition removes the tool everywhere; a thrown condition
ends the turn with TOOL_ACTIVATION_FAILED. Calls whose registration was
replaced or removed during the step return UNKNOWN_TOOL.
system-prompt/assemble now transforms PromptPresentation without a tool
array, so tool declarations stay provider-owned. exit_plan_mode is declared
only for steps whose selected plan state is active, the same state that
renders plan guidance; it still rejects a call before the selection is
logged.
Model selection stays as master defines it; this change adds no model
selection event or Agent field.
Registry-level cases pin the release claim, the settlement the read carries,
the withheld notice a cancelled read returns to delivery, parallel waits on one
job, and the model-killed settlement that must not repeat. A real AgentLoop
case covers the user steer releasing the wait while the producer survives.
A `job_output(wait: true)` wait now ends when the user steers the current
step, returning the job's real state and the output already read; the
producer keeps running and the pending input stays queued. The wait is ended
by a controller the tool owns, so the registry's abort semantics — and every
other consumer of `wait` — stay unchanged. The model sees why a running job
came back early in the unchanged status line (`user steered`).
A settlement that lands between the release and this call's own read is
carried by that read instead of a second notice; if the read never commits,
the notice is delivered when the claim releases. Settlements already delivered
elsewhere (the model's own `job_kill` result or another waiter's collection)
are not repeated.
Master moved the step's model route into the assembly context: the agent loop
fixes it per step and registers the prompt's provider variable from it, and
installModelSelection no longer takes a mutable selection. The tool-web
readiness fixture now registers that variable and passes the step's
modelSelection to each assembly.
AgentRegistry now needs the session projection registry, so the
web-search-deepseek initiator fixtures and the Loader composition in
chat-endpoint.spec.ts mount it, as master's own fixtures in this package do.
Links whose target this clean removes, or whose target loops or passes through a file, are residue. A node_modules directory resolving outside the repository is not scanned.
master no longer has the agent-controller admission stage or the
session/prompt-rejected error, so the composer stops special-casing that
code. prompt-admission.e2e.ts now holds the prompt request in the browser
instead of through an admission listener and keeps its read-only sending,
no-echo, and acceptance assertions; queue-actions already covers a refused
prompt keeping its draft.
Brings in master a8d675ecc92, which reverts the agent controller of #6418,
together with the composer's image upload on add.
The agent-controller message delivery Agent Note follows master's deletion.
The ui-conversation README keeps the read-only sending paragraph and takes
the image upload sentences. Service orchestration keeps both new sendSession
cases, and the refused-send reference case takes master's newSession
submission fact. README pairings are recorded again.
The composer returns to a read-only sending phase. Enter captures the draft,
its reference chips, and its attachments; the editor and the attachment rail
stay read-only while Send shows progress; and the Host's acceptance clears
the draft and its attachments in one transaction before the echo renders. A
refusal or failure returns the draft unchanged. A running Session still
shows Stop beside the sending control, and Workspace selection still leaves
a draft whose message is in flight in its Session.
This reverts the editable-while-sending behavior of a7af0509ab5 and the
in-flight attachment accounting of e36c3f9a395, which only that behavior
needed.
An ordinary Session's composer now uploads each image draft through the
background upload queue as soon as it is added. The raw upload route stages
the body as a prompt image when the request names its media type: the Host
reads at most the per-image byte limit, then validates, normalizes, and
stores the image as prompt admission would. The prompt cites the receipt in
a file part; prompt admission resolves it to the stored image, applies the
image-input check, and counts stored images toward maxImagesPerMessage.
Send waits for every image receipt, and a failed image upload turns its
thumbnail into a retry control. Commands and subagent continuations keep
encoding images inline.
Record the sentence-case rule for English UI copy and plugin titles, sync remaining README label references, and keep the session-inspector Chinese dictionary unchanged.
Refs #6790
Co-authored-by: Magolor <[email protected]>
The README now states the delivery mechanism that makes ending the turn
safe, with links to the subagent notice behavior and the host wait loop.
An Agent Note records the #6057 observation and the controlled probe
(sleep 0/300 with the sentence, 29/300 without it) so a later prompt
trim does not remove the sentence again.
* feat(analytics): track navigation entry clicks, preset switches, and new-session sends
Rebuilds the click events of #6600 on the region-owned More menus in
release/dsh-0.2.1. Exposure events, creator_mode_enter, and the
ui-workspace onOpened observer are not included.
- sidebar_menu_click gains position plus the new_session and more entries:
New Session (sidebar button, brand, titlebar), Plugins and Automation
rows, the left sidebar More button, and entries opened from its menu.
- more_menu_item_click records Browse other plugins and Create your plugin
per region.
- agent_preset_switch reports applied or unbound staged picks; the seat
controller now returns an explicit apply outcome.
- code_work_view_toggle reports a successful change of the setting.
- send_button_click adds is_new_session and the Session's preset category.
Co-authored-by: imccyu <[email protected]>
* test(analytics): cover navigation, preset switch, toggle, and send analytics
Co-authored-by: imccyu <[email protected]>
* docs(analytics): document click events and regenerate catalogs
Co-authored-by: imccyu <[email protected]>
* test(ui): reuse the developer tools row accessor without a new unknown cast
Co-authored-by: imccyu <[email protected]>
* fix(analytics): classify preset switches by preset id only
agent_preset_switch now maps the preset id the same way send_button_click does: cordis is creator, ptc, minimal and standard keep their ids, and any other id is other; a published preset name no longer changes the category.
Co-authored-by: imccyu <[email protected]>
---------
Co-authored-by: dingyifan <[email protected]>
Co-authored-by: imccyu <[email protected]>
The persistent bash tool types each wrapped command into an interactive
bash, which applies history expansion before parsing. A `!` after a single
quote made bash reject the whole line with `event not found`, so neither
marker printed and the call waited for the full timeout; `!!` silently
substituted the previous history entry.
Disable history expansion when the shell is initialized, as OpenHands does
for its interactive terminal. Raw control characters other than newline and
carriage return still reach readline as typed keys; the README records that
limitation.
Closing the control pipe after the result rejected outstanding birpc
calls; an unawaited binding promise then crashed the child and its trace
reached the result logs. Once the result is returned or the pipe closes,
binding calls now never settle, including those the closure rejects.
Move the identical in-memory child used by the per-call and persistent
host specs into tests/fake-child.ts, and move readProgramResult next to
the ProgramResult type it validates in protocol.ts.
Keep the stream side owned here: line bounds, the leading-brace check,
the write-queue limit and closure. On the birpc side, drop the strict
envelope validation, falsy-rejection normalization and fatal UTF-8
decoding. Calls to methods an endpoint does not own are answered with
birpc's error and unknown messages are ignored; the resolver still runs
only own methods and none after the endpoint closes.
The Plugins page now shows the Experimental badge only for the official
bundles it lists, so the forge bundle joins that list and the More list
expectations.
With the sidebar open the native window controls live in the sidebar, so the compact
bar only needs its own 16px inset. Collapsing the sidebar moves those controls above
the page, and the compact bar then adds the frame's top clearance so its controls stay
below them instead of underneath.
The style-driven motion between the expanded and compact bars still needs work; it lands
in a follow-up.
The check run is a label, not the gate, so a failed write is logged and leaves
the commit status untouched; a replayed workflow token without the checks
permission therefore cannot break the gate. Mark the runs the publisher creates
with an external_id so a same-named job check run from a pull request is not
adopted, and revoke only the publisher's own success.
Record the unchanged status behavior against the archived decision, clarify the
measured context name, and state the pending-write residual in the note.
Only add the `weighted approval decision` check run: the required
`weighted approval` commit status keeps its `pending`, `success`, and `error`
states exactly as before, and branch rules keep requiring it. The check run
reports the same decision as a conclusion label and is not required, so it
never blocks a merge.
The Agent Note and README now state the status semantics as unchanged and the
measured reason a required check run is not available here.
The changes view cut each changed path from its end, so a long path lost
its file name, and the Session header's branch label crowded the actions
beside the title.
- A changed file in the files menu, a file's header, and the local
changes card shows its name, then its directory in smaller subdued
type. The directory shortens first, then the name shortens in the
middle and keeps its end; hovering shows the complete path, and both
paths of a renamed file. Assistive technology reads the complete path.
A rename badge names the old file name, or the old path when only the
directory changed.
- The checkout row draws a folder for the project directory and a
branch for a worktree.
- The Session header no longer carries the branch label; the tab's
checkout row names the branch, the kind of checkout, and its path.
- The README describes the collapsed strip of a large file, and the
forge bundle README lists the gh commands and branches that bind
change requests.
Below 768px the panel fills the viewport and the rail becomes the horizontal
section strip the Web product uses: the title shares the first row with the
header actions and close control, the registered section cells scroll sideways
on the second, and the active section fills the rest. Cells keep their labels
whole and the strip scrolls instead of truncating, so a registrant's label
length or a longer section roster cannot wrap or clip a name.
The panel places its four seats (title, header, navigation, options) on one
grid, so the desktop rail keeps its 188px track and 64px first row. Preference
rows drop their 48px control gutter and the Appearance cubes share one row at
that width.
The required check run introduced previously is not matched by this repository's
branch rules, so the gate could not be satisfied. Keep the required
`weighted approval` commit status as the gate and publish the
`weighted approval decision` check run as the label: action_required while the
policy is unmet, success when it holds, failure on setup or evaluation errors.
The status completes as success or failure instead of waiting as pending, so CI
watchers end.
Record the measured check-run limit, the revocation and recorded-conclusion
design, and the alternatives in the Agent Note; update the review-ownership
README, the workflow permissions, and the approval tests.
The sidebar nav-item hover token resolved to the dark settings panel fill, so hovering a settings tab changed nothing. Use the interactive hover overlay that the main sidebar rows use and drop the now-unused token.
Refs #6717
The rendered tool guidance now ends with the end-turn sentence, so every
recorded system prompt and the bilingual package README fence that show it
carry the same text: 83 system-prompt sidecars and 2 README files.
Restore the subagent guidance sentence that #6348 removed: when only a
delegated result remains, the model ends its turn instead of sleeping or
polling, because a finished subagent wakes the idle parent.
A controlled single-request probe (deepseek-v4-flash and deepseek-v4-pro,
150 samples per arm) measured a bash sleep in 0/300 samples with the
sentence and 29/300 without it; any waiting tool call in 7/300 versus
120/300. Unit expectations for the rendered guidance follow the restored
text.
- Reject a control line that does not start with "{", so another
release's length-prefixed frame fails as a protocol error instead of
waiting for a newline until the deadline.
- Bump SSH_PROTOCOL_VERSION to 3: executable helpers embed the PTC
worker, so an older helper is now rejected while connecting.
- Send a small error instead of a late binding result from a finished
persistent evaluation, so it cannot overflow the pipe shared with
the next evaluation.
- Leave per-call binding waits pending after the result instead of
rejecting them; unawaited calls crashed the child and leaked the
trace into the result logs.
- Pin birpc to 4.2.0 so the host and the bundled child agree, and
regenerate THIRD_PARTY_NOTICES.md.
- Update stale frame wording.
The composer publishes a message's echo only after the Host accepts it, so
holding the prompt request kept the echo from appearing and both cases timed
out. Agent maintenance keeps the accepted message in the inbox instead, so
the fold settles before the new Turn starts and the scroll assertions run
unchanged.
The Host's Inbox projection can reach the client before the prompt receipt.
Until the receipt published the echo, QueueDock showed the message as a
queued row, and in "On next message" mode the conversation followed the
grown tail and then folded back.
An Inbox row carrying the request id proves that the Host accepted the
prompt. The Session now publishes the echo and leaves the blank layout at
whichever of the receipt or the row arrives first, and calls the new
onAccept callback in that update. The composer settles inside that callback,
before the echo renders, so the fold starts from the shrunk composer instead
of depending on microtask order.
While a message waits for the Host, its attachments stay in the draft until
the Host accepts it. The image intake counted them against the limits of the
next message, and the rail offered a remove button that the input refused
without feedback.
InputState now lists the attachments of the message being sent. The intake
pre-check counts only the images added for the next message, and the rail
shows the sent attachments without a remove action.
Bring master 45d1196d3fe into the release/dsh-0.2.1 squash commit of #6247
so the release commit stays an ancestor of master.
Conflict resolutions:
- apps/web/tsconfig.json, tsconfig.host.json: keep the entry-customization
e2e and master's Computer Use e2e entries.
- docs/subsystems/slots.{md,zh.md}: keep both added paragraphs; re-record the
slots, ui-primitives, and ui-workspace README translation pairs.
- ui-sidebar SidebarRoot.tsx and locales.ts: keep the More menu imports and
copy next to master's version-copy toast.
- apps/web/tests/agent-preset-selection.e2e.ts: keep the New Session
blank-reuse assertions, read presets through master's
sessionProjections.checkpoint() instead of the deprecated stateOf().
Follow-ups on master's side:
- ui-sidebar sidebar-root spec: give master's version-copy render the entry
pin props that SidebarRootInjected now requires.
- snapshots/web/steering/trajectory.expected.md: add the More conversation
views trigger to master's new Trajectory golden.
A required check accepts success, neutral, and skipped, and any workflow in the
pushed branch can name a job after the required check, so revoke every passing
conclusion instead of only the success this publisher writes. Take the
conclusion writer from main() so tests no longer append to the runner's
GITHUB_OUTPUT file.
Record the measured naming risk, the edit and re-run migration paths, and the
boundary of each cancellation measurement in the decision note and README.
* fix(ui): avoid tooltip trigger overlap when a side fits
* feat(ui): add navigation entry customization
* fix(test): keep tooltip geometry independent of JSX types
* fix(ui): align customization catalogs and integration fixtures
* test(ui): complete customization lifecycle and release integration coverage
* fix(ui): return entry discovery to the installed plugin list
* docs: refresh module graph for entry customization
* build: refresh workspace links for the moved entry customization package
* docs: regenerate catalogs and pairing hashes for the moved entry customization package
* test(web): cover default-loaded entry customization in the Web e2e
* test(ui): describe entry customization as a browser plugin in the host entry spec
* build: order entry customization publication files as workspace constraints require
* test(release): drop the moved entry customization package from the experimental family list
* style(ui): use the shared focus ring color on entry customization triggers
* test(web): re-record goldens for the default-loaded More navigation menus
* test(web): add the More conversation views trigger to the remaining CI-reported goldens
* docs: record region-owned pins for plugin entry customization
* refactor(ui): rebuild entry customization on region-owned pins and More menus
- Each navigation region (left sidebar, Conversation header, right sidebar
guide) persists its own unpinned list under
dsh.slot.manual-order.<list slot key>.v1, filters its own launchers, and
draws its own More button and Menu around its actions slot.
- ui-entry-customization only registers the shared menu rows (entries with
pin buttons, Browse other plugins, Create your plugin) into the three
actions slots and keeps no state.
- Remove ctx.layout.entryVisibility, the plugin store, left-sidebar drag
reordering, and agentPresetNavigation; ui-layout and ui-agent-preset match
release/dsh-0.2.1 again.
- Keep the release <nav> and Conversation tab-bar visibility conditions.
- Move the More glyph into ui-primitives as IconAppsAddOutline{Regular,Medium}.
* docs: compile the entry customization owner props example
* docs(ui): describe the wrapping Conversation tab row in the header comment
* fix(ui): return New Session to the Workspace blank and its unsent draft
- New Session (startSession without options) takes the blank-reuse path
again instead of creating a fresh Session on every call, which hid the
previous blank and its unsent draft since a5c9c2aaeef (#5775).
- A request that names an Agent preset skips blanks listing a different
preset, so Creator entries no longer take over an ordinary draft.
- Record the change in a v0.2.1-rc.2 upgrade guide; the Host refresh of a
stale loaded blank stays deferred (see the Agent Note).
* docs: regenerate the Cordis inspect catalog for New Session blank reuse
* fix(ui): keep the selected entry visible while unpinned
- Left-sidebar rows and View tabs keep the selected entry, with aria-current or aria-selected, until another entry is selected.
- Entry menu Creator action takes no region argument; the registration's region selects the prompt.
- Document the 2px panel-row and 32px View-tab gaps; drop commit hashes from the New Session Agent Note.
* fix(ui): leave a blank of another preset unstaged when starting Creator
startCreatorDraft stages cordis only when the main blank lists no preset or already lists cordis; navigation opens a separate Creator blank otherwise, so a Standard draft blank keeps its preset.
* feat(ui): choose whether a draft prompt replaces, appends to, or keeps an existing draft
- DraftInitializationOptions gains whenDraftExists ('replace' | 'append' | 'keep', default 'keep'); clearPreviousDraft stays and maps to 'replace' only when whenDraftExists is omitted.
- Append adds the prompt as new paragraphs after the existing text and references; attachments stay in every mode.
- The three Create your plugin entries append their regional prompt.
* test(web): align e2e with New Session blank reuse and the visible selected entry
* refactor(ui): share the draft paragraph writer between setDraft and appendDraft
---------
Co-authored-by: Yif <[email protected]>
Co-authored-by: imccyu <[email protected]>
One pipe delivers each evaluation's messages before its result, and the
child refuses calls from finished evaluations, so the per-message
evaluation id protected nothing. Remove it with the checks, counters and
helpers it required, measure outgoing messages only when posting, and
replace rethrowing validation blocks with early refusals.
The evaluation failure title was preserved by matching details_url, a field
GitHub may rewrite for check runs created with the workflow token, so the
setup-failure step could replace the specific title after all. Record the
conclusion the publish step wrote in a step output and run the setup-failure
step only when no conclusion was recorded; a published decision now survives
a later failure or cancellation without relying on an API field.
Record the measured timeout cancellation path and the re-run migration limit in
the decision note, and scope the pre-push guidance to ACTION_REQUIRED so a
failure conclusion is not read as an approval wait.
Replace the length-prefixed JsonChannel and hand-written request/reply
correlation with typed birpc methods over newline-delimited JSON. The
host calls the child's run(); bindings call the host's invoke(); logs
and output-limit reports are notifications. The transport bounds
incoming lines and queued writes, validates UTF-8 and exposed methods,
and rejects outstanding calls when the pipe closes.
Drop logic made obsolete by the new transport, including the 32-bit
frame-length bound on maxMessageBytes.
The panel colored merged change requests with the brand blue, which the
theme offered in place of the violet the panel design uses, and drew a
draft with failed checks, requested changes, or conflicts as needing
attention instead of as a draft.
- ui-theme adds the violet-400 and violet-600 static steps and the
--dsw-alias-state-done-primary alias for finished work: violet-600 in
the light palette and violet-400 in the dark palette.
- The merged glyph, the collapsed merged line, and the expanded status
row of a change request card use the new alias.
- An open draft always draws the draft glyph. Only an open change
request that is not a draft is drawn as needing attention, so a draft
no longer lights the header button's red dot.
The setup-failure step runs after an evaluation failure has already concluded the
check run as failure with a title that names the failure, so its generic title
replaced the specific one. Keep a failure that already points at the current run
and update every other conclusion.
Record the transition gaps and the filtered list count in the decision note: the
combined status resolves a context to its latest status, so the rollout retires
the earlier pending status instead of leaving it for CI watchers.
- forge-session recognizes `gh pr view`, `gh pr edit`, and `gh pr checkout`
as binding evidence with the new `referenced` origin. It binds the URL
given as the subcommand's first argument and the URL the output prints
for that change request: gh's `url:` field, a URL alone on a line before
a description, or a JSON `url` member. Links in a description do not
bind. Pending calls carry this evidence, and the projection's state
version moves to 2, so existing Sessions fold their logs again.
- forge-session adds `discoverBranch(session, remote, branch)`, the lookup
that follows a push, for a branch that a caller reports.
- The panel reports the checkout's upstream branch when a provider
recognizes its remote, once per remote and branch until a refresh, so a
Session on a branch with an open change request shows it without a push.
- The empty panel names every way a change request becomes linked.
A large file in the changes view started behind a notice and an outlined
button. It now starts as one strip drawn and opened like the collapsed
unchanged lines, which names its changed line count. Binary files and
files too large to show use the same strip without an action.
The forge panel opens a changes view in the right sidebar for the
checkout's local changes and for the diff of each change request.
- ForgePanelController reads local diffs in the branch, uncommitted,
unstaged, and staged scopes through Git in the Session's read-only
sandbox, change request diffs through the forge provider, and the text
of a changed file to expand unchanged lines. Change request patches stay
cached by head commit and base branch within maxCachedDiffBytes. A local
diff over maxDiffBytes fails as forgePanel/diff-too-large, and a provider
read over its output limit fails as too-large, which the view explains
with a link to the code host; a gh timeout fails as unavailable.
- forge adds the diff, fileText, and fileUrl provider methods and the
too-large failure code, and forge-github implements them with gh.
- The panel shows a local changes card that opens the view and asks the
Agent for a change request. The view collapses files past a line
budget, draws lines side by side or in one column with optional
wrapping, expands unchanged lines on request, and collapses or expands
every file from its toolbar; file headers use a bare chevron.
- The checkout row copies the worktree or project directory path, the
refresh glyph turns while a refresh runs, change request cards keep
their actions while collapsed, and the header entry uses the shared
compact button.
- client-ui-forge classifies changeRequestKey and FsError as
peer-required Host imports, which keeps forge and dsh-fs as its peers.
The DeepSeek Search API returns a short `snippet` for display and a longer
`summary` written for model reading. Carry `summary` on `WebSearchSource`,
map it from the Search API, and render it in place of the snippet in
`web_search` output while the search card keeps the snippet.
`tool-web` collapses summary whitespace and caps each summary at the new
`searchSummaryMaxChars` setting (800 characters by default, the upper end of
the guide's typical range; live summaries measured 1,000-2,300). The cut keeps
surrogate pairs intact and ends in an ellipsis. The PTC tool output type gains
the optional field, so the affected system-prompt sidecars are refreshed, and
the web search round now exercises a multi-line summary.
The HTTP fetch provider resolved each hostname, rejected any non-public
answer, and pinned the connection. That refused every page behind
TUN-mode proxies with fake-IP DNS and did not confine a model that has
shell network access. Requests now go through the installed proxy
dispatcher and the system resolver with no address restriction.
HttpFetchResolver and the HttpFetchProvider resolver parameter are
removed; the upgrade guide covers the migration.
Co-authored-by: turtle1999 <[email protected]>
Dismiss focus when an accepted submission empties the mobile composer, preserving desktop focus and retained drafts. Rename the shared device predicate to isMobileDevice and update its consumers, documentation, and focus regressions.
verify-package-dependencies now covers experimental Client packages, and the
forge panel's Host face imported four workspace values that no policy entry
classified. appendPluginRecord writes through the Session class's private log,
and readers recognize a deadline's TimeoutReason only by instanceof, so both
need the provider's shared instance. pluginRecordOf and generatedWorktreeName
keep no state; classifying them as peer-required keeps the panel's existing
Session and worktree peer edges.
With the exports classified, the fixer keeps worktree, Session, and timeout as
the panel's only workspace peers, moves its type-only relationships to
devDependencies and dsh-typert-protocol to dependencies, and regenerates the
lockfile and the module graph.
verify-plugin-record-callers counts a string literal that spells
appendPluginRecord as a caller, so it now admits the dependency policy file,
which names the export to classify it and never calls it.
A launcher masks the icon it puts on the home screen, and the install manifest
advertised the bare whale favicon: an SVG mark drawn edge to edge on a
transparent canvas, with no tile and no background of its own. Handed to a
mask it loses its fins, and iOS reads no manifest icon at all, so an installed
Web App showed a generic tile.
Ship four rasters rendered from the desktop application tile: 192px and 512px
`any`, a 512px `maskable` whose artwork is scaled into the circle a platform
mask is guaranteed to show, and a 180px `apple-touch-icon`. Request
`display: standalone` so the phone keeps its status bar, and declare `png` in
the static MIME table so a launcher receives an image.
Agent Note: .agents/notes/implemented/feature/2026-10-13-web-install-icons-and-launch-display.md
An expanded card now marks a draft ready for review and merges a change
request that the host would merge now:
- The forge seam gains provider actions `markReady` and `merge`, which
return a typed `ForgeActionFailure`; the registry polls a watched change
request at once after either settles. Snapshots carry `mergeReady` and
the `mergeMethods` the repository allows, the user's usual one first.
- GitHub marks ready with `gh pr ready` and merges through the REST merge
endpoint with the head SHA the card showed, so new commits refuse the
merge; it never enables auto-merge, joins a merge queue, or deletes the
head branch.
- The panel Remote acts only on visible bindings of the Session, and the
card offers 标记为可评审 for drafts and a 合并 menu with the allowed
methods and a confirmation, reporting each outcome in a toast.
- The forge panel e2e replaces the worktree branch before the ARIA
capture normalizes durations, so a random suffix no longer breaks it.
Call every bound item a change request, whatever its code host calls it,
and rebuild the panel around the redesign:
- State glyphs for open, needs attention, draft, merged, closed, and
unknown change requests; an open one with failed checks, requested
changes, or conflicts needs attention, as the header dot does.
- A card whose title opens the change request, with a plain number line,
a collapsed status summary, and expanded checks, review, merge, and diff
rows; the checks row opens a list with failed checks first.
- The only open change request of a Session starts expanded.
- The checkout row names the branch or detached commit and the kind of
checkout, with Restore for a removed worktree; the Host home shortens
paths.
- Checkout inspection reports linked worktrees and the HEAD commit.
Generated worktree names now join the dsh- prefix, the first eight
hexadecimal digits of the UUID in the Session id, and four random
hexadecimal digits, such as dsh-6b1f02c4-9a3e. A Session id without a
UUID gets eight random hexadecimal digits after the prefix. The worktree
runtime exports generatedWorktreeName, uses it for omitted
create_worktree names, and defaults namePrefix to dsh-. The forge panel
names its Session worktrees with the same function and defaults
worktreePrefix to dsh-, so checkouts no longer nest under a dsh/
directory.
The create_worktree name parameter asks for a few lowercase words joined
by hyphens that describe the task, and the tool description drops the
defaults that its parameters already state.
The forge panel shows the pull requests a Session created or pushed in a
right-sidebar tab, with a Session header button and branch label, and lets
a new Session start in its own Git worktree from the New Session options
row. The forge bundle ships the panel with the forge registry, the GitHub
provider, the Session bindings, and an isolated worktree service.
The panel listens to the agent-controller/admission stage. It holds the
first message of a Session with a worktree request while it creates and
enters the worktree as Agent maintenance, and refuses messages while the
worktree the Session works in is gone. A failed or stopped creation
returns the message to the composer: the card above the composer shows the
failure, sending again retries with a new branch name, and Continue
without a worktree withdraws the request. A removed worktree can be
checked out again or left for the source checkout. A message that enters
without admission still gets its worktree at the first step proposal.
A polling round started through a caller's ctx.forge runs on that caller's
cordis shadow receiver, and the loop schedule() -> setTimeout -> this.poll()
-> this.fetch() -> this.schedule() wrapped one more shadow around it on every
round. Within a few hundred rounds a write such as `this.timer = ...` in the
tail of fetch() overflowed the stack, the rejection went unhandled, and
app-boot exited the whole process with "fatal load failure". At the default
intervals that is a few hours of watching a change request without activity.
The timer now calls a class-field arrow function, which captures the instance
at construction, so each round starts from the instance and the receiver
chain no longer grows. A watch test polls 1,000 rounds through ctx.forge.
Add the experimental forge capability seam:
- dsh-experimental-forge: provider-neutral repository and change request
references, a provider registry, and shared status polling. Watchers of
one change request share one loop; each forge has one batched fetch in
flight, and the cadence follows check, mergeability, and lifecycle state.
- dsh-experimental-forge-github: GitHub provider that runs the GitHub CLI
on the host with a scrubbed environment and reads every due pull request
of a host in one GraphQL query.
- dsh-experimental-forge-session: a host-only projection derives Session
bindings from gh pr create and git push shell results and from
plugin:forge-session/binding records; push results trigger head-branch
discovery of open pull requests, and Session watchers poll bound change
requests through ctx.forge.
AgentAdmissionRejected now extends HarnessError with the fixed code
AGENT_ADMISSION_REJECTED. The Session Remote recognizes a refusal by that
code and imports only agent-controller types, so its mapping also holds for
an error from another copy of the module; its literals are typed by the
agent-controller constants, so a changed value fails the build.
Fold room takes output growth before any scroll, like the empty space below content that fits, so the tail is pinned only when no room remains.
Refs #6637
A row whose ancestor finished closing sits under hidden="until-found", which keeps its own size but removes it from the flow. Finish such a row instead of driving it in a second batch that scrolls the view for content that occupies no space, and release held reveals when no closing member remains.
Refs #6637
Describe async generator yields, key-conflict reads, and macrotask timing as implemented, restore the API controller and mods bridge sentence in the upgrade guide, record the rejected plugin-disposal alternative, and pin the async generator behavior with a test.
The Ralph illustration headline is the product name. The persistent terminal page says that the terminal tools keep processes running in the background and carry the current directory and variables between tool calls.
Record the deprecated registration and keyed-read compatibility in the retained-reader decision instead of a separate note, and remove the 2026-10-19 compatibility note.
A legacy plugin may store the registration result as a disposer or ignore it,
so a failed registration became an unhandled rejection that ends a dsh process.
The registry now attaches its own handler: once the current turn ends, a
rejection nobody observed through then/catch/finally is logged through the
calling plugin's logger while the plugin stays active, and one whose owner is
no longer loading or active is dropped. Observed rejections are unchanged.
The team illustration shows the conversation whose title bar holds the Agent Team button. The terminal and Ralph pages say plainly that these are the agent's tool calls and what each round sees. The plugin market page describes a market as an index URL you add, without implying who owns it.
- register() returns the registration's effect disposer with then/catch/finally
attached; the original body moves unchanged into a private acquire(), keeping
synchronous installation and the asynchronous handle handoff.
- Legacy stateOf(session, key) logs one ctx.logger.warn per key per registry;
registration and calls to its result no longer warn.
- Containing an ignored legacy registration failure is deferred and recorded
under Known Limitations.
Move the session projection handles guide from the released v0.2.1-alpha.3
directory to the current v0.2.1-rc.2 directory and fold in the callable
registration and deprecated keyed-read notes, replacing the separate
session-projection-registration guide.
Ten experimental bundles get a user-facing detail document in English and Chinese. Each starts with one 640x300 SVG feature illustration drawn to the plugin preview standard, then covers how to use the plugin and what to know before turning it on.
Reference serialization and transport failures dispatched the same
sink-settled failure inline; route both through one failSink method so the
duplication gate passes.
The composer stays editable while a prompt is sending, so waiting for an
editable composer no longer waits for the round trip. Consecutive sends in
the queue layout and queued image scenarios now wait until the composer
clears, which happens only after the Host accepted the previous prompt.
At narrow widths the non-shrinking toolbar grew to the update note's
width and pushed the add menu past the window edge; the toolbar now caps
at the head's width and the note wraps. The collapsed bar keeps the page
heading for assistive technology, the bar and body share the same inset
margins, and every head row reads one top-inset variable.
Master's async activation makes AgentRegistry inject sessionProjections and
makes createSessionTestRemote async. Install SessionProjectionRegistry in the
agent-controller and prompt-admission harnesses and await the test Remote in
the image admission tests.
verify-md-links and verify-md-wrap now scan packages/*/*/docs/*.md, the
pairing documentation records why detail documents stay outside the
pairing gate, and check-workspace-constraints reuses the runtime
meta.detail path rule, requires an existing file in a subdirectory, and
rejects malformed or missing declarations. The detail section drops its
border and inset padding so images meet the page's rounded corners.
Collapsing the page bar grows the list's scroll container. A list that
scrolled only a few pixels then fit, the browser clamped it back to the
top, and the bar reopened, so every scroll flipped the layout. The bar
now reopens at the top only while the list still scrolls, and an upward
wheel reopens it over a list that fits only under the collapsed bar.
Co-authored-by: Yifffan <[email protected]>
Report a missing digest prefix explicitly, normalize line endings for change-record
snapshots, make the key-rename test deterministic, align the cookbook and zh wording
with the node-table layout, and record the layout decision in its Agent Note.
Plugins bundle pages and Discover entry pages show the plugin's long
description first, as Markdown with images, in a height-limited region
without its own heading. The document is the file locale meta.detail
names, otherwise the package README, otherwise (market entries only)
the declared repository's README.
The new dsh-plugin-detail library selects documents and reads local
package directories and npm file CDNs without state. plugin-manager
reads installed and offered bundles through readBundleDetail; plugin-market
reads market entries through readEntryDetail, single-file APIs, and a
size-limited partial clone cache serialized across processes. Raw HTML is
omitted, relative links stay text, and relative images load from Host
routes with a sandbox CSP.
The Wine gate compiled the Host face with one `tsc -b tsconfig.host.json`,
which holds the project-reference graph and the aggregate program in a
single V8 process and aborted at 4063.4 of 4088.3 MB. The supported build
splits those steps, and the native Windows build in the same run compiled
the references at 4096 and reached the aggregate without running out of
memory.
Compile the referenced projects first, then type-check the aggregate, both
at 4096. Assert the two commands and their order, and reject the fused
invocation.
Co-authored-by: turtle1999 <[email protected]>
A sticky bar let reverse keyboard navigation focus controls hidden under
it. The page bar and the More list's head now sit above a separate scroll
container, so focus and scrollIntoView always land in view. The tests read
the bar and body through data hooks, and the README pair documents the
pinned bar.
Store one node table keyed by the 16-hex digest prefix of each node's
canonical subgraph instead of per-root graphs with numeric indices, so a
type change rewrites only the changed nodes and their ancestors.
Refs #6597
The Plugins page title, its actions, and the Installed/Discover tabs now
stay at the top of the page while the cards scroll beneath them. The More
list's back-and-title row stays pinned the same way.
The shared formatter renders byte-identical strings for every epoch a
workspace record can receive, and the two inputs it would refuse (a
fractional epoch, an extended year) are unreachable from Date.now() and
from a SessionHeader epoch. Adopting it therefore added a module, a
dependency, and a writer test for an error branch that cannot occur, so
this reverts that increment and records the site as the fifth deliberate
exclusion in the Agent Note.
The session-format migration and its committed acceptance test remain.
Enable now marks the added bundle for scrolling, and the page also
selected Installed for that mark, so enabling from Discover left the
market tab. The mark scrolls only to a card on the current page, and
activation guidance renders only beside the Installed list.
- validation.spec.ts now accepts the four-digit-year bounds and refuses
each non-canonical spelling (year zero, 2026-02-30, a four-digit
fraction, a numeric offset, surrounding whitespace) with the released
error message, so the accepted set is guarded by a committed gate
rather than by a review-time measurement
- the Agent Note cites that test instead of describing a differential
- session-format-v0-to-v1 declares dsh-util-time only in dependencies,
matching dsh-util-values and the sibling migrations
- util/time lists the migration among its consumers
The copy handler no longer stops propagation; the brand button skips New
Session for clicks inside the local-build fallbacks instead. The copied
label now overlays the 12px title row so the target keeps its width, and
repeated clicks during the feedback are ignored.
createdAt and updatedAt were written with the platform's toISOString, which
truncates a fractional epoch and writes an extended year past 9999, so a
durable record could hold an instant the four-digit-year profile every
other boundary reads refuses. The writes now go through
formatFourDigitYearInstant and a local storedInstant that raises a
RangeError for the two inputs the profile cannot represent, which are
unreachable from Date.now() and from a SessionHeader epoch. Every
representable epoch renders byte-identically.
The first-prompt flag is still set before the receipt, so a turn that
starts ahead of it clears the flag, but the Session snapshot reports
awaitingFirstTurn only once the Session left blank, which happens when the
Host accepted the prompt. A snapshot rebuilt while the prompt waits no
longer reports a first turn that nothing accepted yet.
session-controller registers its resolver through `ctx.fileUploads`. Inside
that call Cordis returns a new proxy for every function-valued property read
from `this`, so the disposer's identity check never matched and the slot was
never cleared. Any restart of session-controller, such as a profile patch that
changes session-query-sqlite, then failed with "Agent resolver is already
registered" and left every sessionController dependent pending.
Store the resolver in a plain holder object, as the commands receipt resolver
already does, and test registration and disposal through a plugin fiber.
The Agent controller now finishes disposal only after every delivery it
stopped has settled, and a sender that cancels stops waiting at once, also
while its message waits behind a held one; the message keeps its place and
is dropped at its turn.
An image prompt takes the Session's image admission turn when its
preparation starts, in the Agent's delivery order, and keeps it until the
prompt settles. Image and text prompts therefore enter the inbox in arrival
order, and a model selection waits only for the image prompt being
admitted, not for one still queued.
The core page documents the delivery types, and the architecture overview
lists the controller and its admission event.
The client bundle rejects a cross-plugin value import for any package it
does not list as inline-safe, and dsh-util-time is not on that list because
it imports the Temporal polyfill at module scope. The offset therefore
stays computed in packages/client/ui-settings-account, and the Agent Note
records it with the same standing as the other three sites that are not
copies of this vocabulary.
This reverts the localUtcOffsetSeconds entry, its consumers, its tests,
its README rows, and the two lockfile importer entries.
- session-format-v0-to-v1 reads the shared canonical-instant profile
through fourDigitYearEpoch instead of its own regular expression and
round trip, with the accepted set pinned by a differential against the
pre-change predicate (3,508 inputs, 0 divergences)
- localUtcOffsetSeconds holds the seconds-east conversion two clients had
each written, so the offset a client reports has one home
- the Agent Note records the three sites that stay, and why each is not a
copy of this vocabulary
The title truncates before the suffix, the row tooltip shows the full path, root paths no longer get an empty suffix, and the labels are derived only when the list renders.
Enter still sends one message at a time and waits for the Host, but the
editor stays editable meanwhile: typing, paste, completion, and new
attachments go to the next message, and only another send waits. Once the
Host accepts the message, its attachments leave the draft and its text
leaves the editor: the whole draft while it still equals the sent text,
only the sent text and the whitespace after it when the user added text
after it, and nothing when the user changed the sent text itself. A
running Session keeps Stop beside the sending control, and Workspace
selection leaves a draft with a submission in flight in its Session.
Directory entry names reach the same display-path helper, so expansion
moves to resolve and lstat. Replacing only the prefix keeps physical
parent traversal; ~\ expands only on Windows.
Refs #6548
- timeZoneError and browserTimeZone switch over TimeZoneRejection instead of
a ternary: each reason that shares a diagnostic is its own case, and the
default arm assigns the reason to never so adding a reason fails the build
(assertNever where the package already imports it). The unsupported cause
is still forwarded.
- the request-zone suite now exercises the blank refusal, so every case the
switch lists is covered rather than sharing one ternary branch.
- Duration documents that a span is signed: a negative count builds and
decompose() refuses it, so the caller states its own sign policy.
Resolutions:
- packages/util/time/package.json keeps this branch's description and takes
master's 0.2.1-rc.2 version.
- packages/util/README.i18n.yaml is re-recorded after the merge.
Extract the specification version from the skill in the template test,
check the exact placeholder badge URL, and drop duplicate marker and
old-format assertions.
Clarify the highest-level rule and table-header language, remove the
duplicate n/a rule, make the placeholder badge symmetric, and document
how to migrate an old Human and Agent Roles section.
Rename the PR description section to AI Usage and replace the level
legend and underlined stage lines with the AI-DECLARATION badge and a
stage table. Define AI involvement as the AI's participation in a
stage, not code volume or time.
The template policy test now checks the heading, marker block, badge,
table header, row order, and old-term removal.
A manifest with "private": true keeps its version out of the index. A Git
package that is private on the default branch is not listed at all, and the
generator warns when every bundle package of a repository is private. The
cache version is bumped so cached private releases are rebuilt.
Expose the pure Host formatSessionMarkdown(events, sourcePath?) converter at the package entry. Persistence stat/list now report the selected materialized JSONL artifact path, and the Markdown copy route includes that exact optional path after the title. Frontend progressive display and Session format remain unchanged.
Adding the `ProjectionKeySelection` import to the projection cache moved its
`Config`/`inject` declaration down one line, so the config catalog's source
reference is regenerated. Only the source location changes.
The fold blank matrix counted every band that no row box covered, including
a band whose rows on both sides had already faded to opacity 0. Such a band
shows the same background as those rows. Kept intermediate replies move with
the layout while closing groups stay in place, so that band could exceed the
transient limit in side/composer/steps without any visible difference.
A band now counts when a visible row borders it on either side, with the
viewport top and the composer treated as visible. A synthetic-DOM case keeps
a band beside a visible row failing the measurement.
- Export `ProjectionKeySelection` (the read faces' key selection) and reuse it
from the projection cache instead of restating the union twice. The Cordis
catalog can now resolve the type its generated signatures reference.
- Make `wire.summary` a plain boolean: omitted means `true`, and a key whose
map entry carries the summary mark declares `false` so the runtime key set
and the client view type agree. The type no longer forbids a declaration.
- Describe the mark accurately: it has no runtime representation; `wire.view`
and `viewSchema` are typed with `SessionProjectionViewValue`, which strips it,
so the registration erase only widens the state type.
- Say plainly in the package README, the subsystem page, the client field
comments, and the Agent Note that a list row carries the summary projection
and never the full projection: a connected Session's store may hold more
values, but those are outside the list contract.
- Document the summary vocabulary on the subsystem page with `ts type-equiv`
blocks for the mark, its stripping, the excluded-key test, the summary value
type, and the key selection; split the prose paragraph.
- Revert the behavior-neutral cache-double refactors in three specs, and record
in the Agent Note why no upgrade guide accompanies the wire change and how a
consumer migrates.
The group-tree JSDoc and the ui-chat README stated that every reply stays outside whole-Turn folding and named only the collapse-timing setting. They now distinguish All replies from Final answer only and link the new setting.
The seeded-history check measured the folded final answer 16px below the Turn control. Hidden process rows separate the two, so the answer now keeps the 12px reply gap.
The producer/consumer matrix points at the declaring line of each event. Adding
the `imageLimits` JSDoc and map-entry wrap moved the `api-session/*` declarations
in `packages/api/session-controller/src/types.ts` down by four lines, so the
graph pair is regenerated. Only source locations change.
`imageLimits` is a boot constant every Session shares: the unit stores no
per-Session state (`stateSchema: z.null()`, `apply: state => state`) and its
view returns `ctx.attachments.imageLimits`. A list row therefore repeated one
host-wide capability fact on every row. It now carries the summary mark like
the three log-derived units, so a summary read skips it while an opened Session
still receives it through `session/follow`, the control baseline, and
`session.projections`.
No other logic changes: the registration, its schema, its constant view, and
the host-side prompt validation keep reading `ctx.attachments` directly.
A folded Turn gave its final answer the control's 16px clearance through
compactAnswer and data-turn-process-answer, because hidden process rows
keep the answer from matching the control's adjacent-row rule. With every
reply kept, the final answer no longer follows the control, so that 16px
only widened the gap above it. In both choices the margin also switched
from 12px to 16px when the closing rows became hidden at the end of a
next-message fold, moving the answer down about 4px.
A reply separated from the control by folded rows now keeps the 12px reply
gap in both choices; only a row directly following the control receives
16px, and no reply changes its spacing when a fold finishes.
Settings goldens gain the Replies After Collapse row; folded-Turn aria
goldens for plan review, goal turns, and turn-tail actions include their
intermediate replies. The folded layout checks measure the intermediate
reply that now follows the Turn control at the 12px reply gap.
Whole-Turn folding chose the final answer by position, so a Turn that
continued after answering (a notice reply, record keeping, or a tool call)
hid the real answer with the process. A folded Turn now hides only its
process; every assistant-step reply row stays visible.
Settings -> General -> Replies After Collapse (ui-chat.foldedReplies,
default "all") switches back to the previous final-answer-only rule; the
choice applies immediately and is hidden in Verbose.
The note records why a Session-list row carries a summary key set instead of
every registered client view: the type-only exclusion mark with its
registration interlock, the derived stable key set reused through the existing
key-taking read faces, the nullable-wrapper rule for `todos`, and the estimated
payload effect of omitting `turnOutline`, `sessionStats`, and `todos`. It lists
the rejected alternatives (a summary-specific read face, a hardcoded key list,
post-hoc filtering, opt-in summaries, and lazy per-value reads) and the costs
the decision accepts.
The catalog pages embed the declaring source location of each documented type.
Adding the summary-exclusion import and map-entry JSDoc to
`packages/todo/tool-todo/src/types.ts` moved `TodoItem` and `todo/write` two
lines down, so both catalog languages and their pairing record are regenerated.
No type fingerprint changes: `verify-persistence-changes` still reports 65
roots matching 16 history records.
A second `gen-persistence-catalog` run is required after a schema change: the
page and the machine inventory are generated in one pass, and the page reads
the inventory as it was on disk.
`docs/persistence-schema.json` records the declaring source location of every
persisted type. Adding the summary-exclusion import and map-entry JSDoc to
`packages/todo/tool-todo/src/types.ts` moved two declarations down by two
lines, so the generated catalog is regenerated. No persisted type, field, or
history record changes: `verify-persistence-changes` reports 65 roots matching
16 history records, and the release/format catalogs are unchanged.
A Session-list row no longer carries every registered client view: the three
units whose values a list row never renders (`turnOutline`, `sessionStats`,
and `todos`) are excluded, which removes the whole-log turn outline and the
figure and todo payloads from every row. An opened Session is unchanged —
`session/follow`, the `session/control` baseline, and `session.projections`
still serve every projected key.
The exclusion is one type-level mark plus one registration interlock:
`SessionProjectionSummaryExcluded<T>` marks a map entry, and
`ProjectionDefinition.wire` requires `summary: false` exactly on a marked key
and rejects it everywhere else, so the mark and the declaration cannot drift.
A nullable entry keeps `null` outside the wrapper, so `todos` stays
`TodoItem[] | null`. `summaryKeys()` returns the derived set, stable until a
registration or its disposal changes the key table, and the existing
key-taking read faces (`cachedSnapshot`, `viewCheckpoint`) accept that set
directly, so summaries need no separate read face and no per-read key copy.
`packages/api/session-controller/src/list.ts` passes the set to the live and
cold cached faces; `cachedPredecessorTitle` is untouched.
Client types only: `SessionSummary.projectionValues` narrows to
`SessionProjectionSummaryValues`, `SessionProjectionSnapshot.values` keeps
every view value with the mark stripped, and no wire field or client name
changed. The cache, subsystem page, and package README document the summary
rule and the two read faces.
Set the autonomy ranges to hint 0-10, assist 15-25, pair 30-50, copilot
55-85, and auto 90-100 in the skill and the template level line, and
refill the example accordingly.
Sharpen the stage criteria where trial runs disagreed: grade design by
who supplied the adopted structure, count only the author in the first
four stages, ignore process and ordering instructions, define the main
change, keep review at n/a until a comment is handled, and separate
copilot from pair by whether every non-wording item got a human
response. Clarify the Changes categories, test evidence, disclosure
placement, language, and when to update the description.
Refs #6034
Correct the downlink-write activity contract for compressed frames: a write
that does not complete at once counts, and a frame above the threshold
deflates asynchronously so its completion always counts. The Host compresses
only its own outbound frames; uplink compression remains the peer's choice.
Stabilize the compressed-write liveness test with a 500 ms heartbeat interval
and assert the bounded half: after the downlink stops, missing Pongs still
terminate the socket.
Refs #6476
Start the template's review line as n/a, as the skill requires at PR
creation, and prompt for an Issue reference under Motivation. Read the
skill's stages only from its Stages and criteria section and reject a
stage name that does not pair one English word with a Chinese name.
Point the GIF disclosure row at record-browser-gif instead of copying
part of its list, merge the calibration notes into one TODO, replace the
design skeleton wording, and reduce the root AGENTS.md rule to a pointer.
Refs #6034
Restore the `ws` default `maxPayload`: the pre-change mux passed no limit, so
the 1 MiB ceiling was an unrelated breaking change. Remove the exported
constant and the oversize-frame test, and drop the matching docs.
Pin the per-frame compression threshold and the accepted compressed-write
liveness consequence with regression tests, correct the queued-write
documentation, move the Agent Note to `implemented/`, and sync the Remote
duplex stream note with `websocketCompression`.
Refs #6476
Replace the pr-declare skill with dsh-pr-description, a repository-only
skill (user-invocable: false) that owns how deepseek-harness PR
descriptions are written and updated: section rules, Issue references,
test design, change-specific disclosures, and the Human and Agent Roles
section with its levels, stages, grading rules, and update timing. The
skill no longer fetches an external specification, asks the user for a
level, or adds badges.
Reduce the pull request template to a skeleton that points to the skill,
point root AGENTS.md at the skill, and make the template test check that
the template's role level line and stage placeholders match the skill.
Closes#6034
Add a `websocketCompression` Gateway config field (`'deflate'` by default,
`'none'` to disable) and negotiate `permessage-deflate` on `/api/remote.mux`.
Frames whose JSON text reaches 1024 characters are compressed in the mux send
path, because `ws` ignores its `threshold` option under the default context
takeover. `maxPayload` is bounded by `max(streamInboxBytes, 1 MiB)` so one
compressed frame cannot inflate past the fixed ceiling.
Fixes#6476
Remove the unused SESSION_MARKDOWN_EXPORT_PATH package re-export while keeping the internal routes definition and Host import. Read the constant directly from routes in the same-package route test. SESSION_LOG_EXPORT_PATH remains public.
Describe the direct session/title field read and same-click deferred clipboard request, cover Markdown copy in the selection guidance, and tighten the Chinese Blob and compaction wording. Re-record the README pair.
Update the client and Host module descriptions and apply JSDoc to mention the authenticated Markdown copy route alongside ZIP download and feedback. Comment-only change.
Preserve click activation by admitting a promised ClipboardItem write synchronously, own its preparation and write promises, and distinguish preparation from clipboard failures. Fold the title from the single readSession snapshot, preserve indentation, close unfinished assistant fences, and restore the shell.overlay props contract. Update the README pair and browser fixture inventory.
The navigation-panes recorded-fixture inventory now lists the owner-local copy-markdown.expected.md file. No assertion was weakened; no snapshot or production code changed.
Type the Header and toast test fixtures with the standard Session/global props they render with, and read slot injections through a narrow object helper. Prune the four retired unknown-cast baseline entries. No product behavior changes.
Add Copy as Markdown to the Session Header more-actions menu. A new authenticated /api/session.markdown route reads complete live-preferred history through sessionQuery.readSession and renders append-only user, assistant, and tool events as Markdown. Compaction surface replacements, reasoning, injected context, and request metadata stay out of the transcript. One plugin-wide copy operation owns the browser clipboard, with an overlay toast for success and failure.
After a stop, steering still pending is claimed with the next prompt and the
AgentLoop logs it first. Once the first of those rows is durable, the
remaining echoes follow the new Turn's process control, which renders empty
while the Turn runs. The 16px clearance after that control applied to them
and moved each echo by 10px before its durable row replaced it. The clearance
now applies after a visible control to every row, and after any control only
to rows that are not local echoes, so the echoes keep the input gap.
Also state that a switch lifted within a move's duration plays the rest of
it, that the steering entrance approximates the status's previous position,
and that the runtime-context notice placement follows from the README rule.
* fix(agent-instructions): budget the user-global and project chains separately
The user-global and project instruction files shared one maxBytes and the user-global files were the broadest, so a large project chain omitted them first. Each chain now renders under maxBytes on its own and the results share one system-reminder frame: unchanged output when everything fits or one chain is empty, at most twice maxBytes otherwise. The project chain keeps its omit-broadest-first, truncate-last rule; reconciliation batches follow the same split; the maxBytes key and the baseline identity are unchanged.
Tests cover the fast paths, both chains fitting only separately, each chain over its own budget, the 2 × maxBytes boundary at exact and tiny limits, multibyte content, reconciliation batches, and a resumed single-budget baseline receiving the user-global file as one transition. The agent-instructions-budget snapshot is refreshed and agent-instructions-budget-chains is added. README, Config.maxBytes JSDoc, the configuration catalog, a new Agent Note, and an upgrade guide state the per-chain bound.
* fix(agent-instructions): keep loaded order in merged frames and note the unshared chain budget
A merged frame now lists sections, omissions and truncations in the loaded order, so a reconciliation batch renders its items in one order whether or not it fits a single budget. The guard comment states only the invariant and points to the Agent Note; the intro selection states its rule. The README names the unshared budget between chains.
---------
Co-authored-by: ZiyaZhang <[email protected]>
The running status now renders after the transcript rows and before the
steering echoes that are still waiting, so the mid-steer accessibility
snapshots list the status ahead of the interjection echo. Refreshed with
DSH_SNAPSHOT=refresh on the steering scenarios; no other golden changed.
A pinned tail zeroed both running status moves. Following scrolls absorb
output growth, so the status keeps its on-screen position for the first
output, but admitted steering still moves the status past its pending
echo below it: in a long transcript at the floor the status jumped the
height of that echo with no motion. The input-fold switch keeps zeroing
both moves; the pinned switch now repeats only the first-output slide's
structure, so the entrance after an admitted steering row keeps its
duration while the page scrolls by the added slot. Update the README and
the CSS check that the pin applies to the slide structure alone.
The steering entrance and the first-output slide were selected through
`:not([data-input-fold]):not([data-chat-tail-pinned])`. Removing either
attribute added the animation name back while the structure still
matched, so a finished move replayed: scrolling away from a long running
transcript and back short of the floor, or the end of any fold batch,
faded the status in again and slid it one row. The structure alone now
names each move, wrapped in `:where()`, and the two switches only set
`animation-duration: 0s`; turning a switch off changes the duration of a
move that already finished, and turning it on completes a running one.
The tail pin now uses the test fold batches use for a tail landing:
follow intent with no unsampled reader movement, over content that
overflows the scrollport excluding fold room. A reader scroll keeps follow
intent until its 500ms sample settles while growth is not followed, so
the old pin claimed a held status there and skipped a needed move.
ChatReading recomputes the pin where follow intent and sampling settle,
the viewport recomputes it after scroll, scrollend, and each resize's own
follow scroll, reusing the scroll metrics or the resize's clean-layout
measurement, and the attribute is written only when the pin changes.
Record the decision to precompute the steering batch start in Definition
state with process-evidence and reader.previous as an Agent Note.
The first-output slide set its 6px default through a selector that
outranked both variants, so a response (12px) and a new Turn's first
output after the empty process control (16px) travelled 6px and started
with a 6px or 10px jump. The default now sits on the single-class
`.running` rule, which every variant outranks.
When the transcript overflows the viewport and follows its bottom, the
follow scroll of the same resize absorbs new rows and the status keeps its
on-screen position; replaying a move there lifted the status 28-44px and
slid it back. The viewport now marks the column `data-chat-tail-pinned`
while the reader follows overflowing content, updated after each resize's
follow scroll and on scroll, and neither the steering entrance nor the
first-output slide plays under that mark. Update the README and add
viewport and CSS checks.
While a Step has no output yet, the running status sits directly below its
input. When the first process row, group header, or response appears, the
status now slides from that position into its slot below the row instead of
jumping. It travels the row's gap plus one font-scaled 24px row: 6px for a
process row or group header, 12px for a response, and 16px after the running
Turn's process control, which renders empty until the Turn closes. The move
reuses the steering entrance technique with the standard easing over 110ms,
runs once per input-to-output change, and is skipped under reduced motion and
during an input fold.
Group header titles take the process-row line height, so the travel matches
the inserted row in every display mode and font size. Update the README and
the CSS checks that keep the travel equal to the rows that cause it.
After a stop, steering still waiting in the next-step queue is claimed
together with the next idle submission, and the AgentLoop logs it first.
Echoes before the first transcript echo now render with that submission as
the next Turn's opening inputs above the running status, and move ahead of
the new Turn's empty process control together, so the echo order matches the
durable rows. Update the flow-tail spec and README for the echo order.
Render the running status after the transcript rows and opening echoes and
before steering or Inbox echoes, so its position shows whether a waiting
steering message has been consumed. The status uses the completed Turn's
actions-row slot, its divider no longer takes layout space, and it hides once
the Turn tail is rendered.
The first steering row of each next-step claim keeps that 44px slot above it.
A state-only process-evidence Definition records each Step with durable
visible output, and the message Definition marks a claim's first human
message as a batch start when the latest earlier evidence belongs to the same
Turn. Rows claimed together stay 6px apart.
A handle left open after the application tree disposed kept the Host alive
until the shell's SIGTERM at the 10 s graceful deadline, so the update
handoff refused installation even though teardown had completed.
Refs #5492
Extract the focused Office guidance from PR 5374 and regenerate its recorded skill outputs against the pinned base. Keep the existing real-API content, formatting, and no-package-inspection assertions.
The composer keeps a sent message, its references, and its attachments
read-only in a sending phase until session/prompt resolves, so an
admission listener can hold or refuse a prompt before it appears as sent.
The Session publishes the local echo and leaves the blank layout only
after acceptance; a refusal or failure keeps the draft, and
session/prompt-rejected with presented: true adds no toast.
This carries the client half of deepseek-harness/deepseek-harness#6178.
Add @deepseek-ai/dsh-agent-controller, composed in the base bundle, as the
entry through which a sender delivers a message from outside an Agent into
its inbox. deliver() runs the sender's content preparation in the Agent's
delivery order, asks the agent-controller/admission waterfall for a
decision, rechecks cancellation and registration, and appends the message
with followup() or steer(). dsh-agent and agent-loop are unchanged.
The Web session/prompt Remote delivers through it: the image model check,
upload receipt resolution, and attachment storage run as prepare, the
receipt binding runs as beforeInsert, and refusals map to
session/prompt-rejected. The Web client keeps its existing echo.
This replaces the Host half of deepseek-harness/deepseek-harness#6178,
whose admission stage lived in dsh-agent.
* fix(web-search-deepseek): disable thinking for auxiliary search requests
The provider discards the generated text of the auxiliary Messages turn,
so reasoning tokens have no consumer. DeepSeek enables thinking by default,
which adds latency and output tokens to every search.
Fixes#6099.
* feat(web): add opt-in traditional Search and Fetch APIs
* test(web): verify API settings persistence and refresh Session evidence
* fix(web): require an explicit Search API base with its route prefix
* docs(web): document direct Search and Fetch API decisions
* fix(web): keep Messages search default behind the new Web Search API switch
- Rename useTraditionalApi/traditionalBaseURL to useSearchApi/searchApiBaseURL and
label the switch "Use the new Web Search API"; Messages search stays the default.
- Default the Search / Fetch API base to https://api.deepseek.com/v1/tools.
- Authenticate the Search API with an API key only: DeepSeek Account tokens
returned an empty HTTP 404 on /v1/tools/* when probed on 2026-10-16.
- Remove the count setting, which tool-web's maxResults always overrides, and
the undocumented DeepSeek-API-Version header.
- Name the active API's base URL field and the current settings path in
endpoint guidance; re-record the endpoint guidance Session.
- Keep WebFetchResult.statusCode required: DeepSeek Fetch reports HTTP 200 and
drops the page title, so the fetch-metadata widening and its upgrade guide
are removed.
* fix(web): accept account sign-in on the live Search API
The public Search and Fetch routes went live on 2026-10-16 and accept the
DeepSeek Account token, so account-route Sessions send it to the Search API
as they do for Messages search, and the settings copy no longer says account
sign-in does not apply.
Record the live behavior in the README and Agent Note: summaries of
1,000-2,300 characters, an HTTP 500 for an unresolvable Fetch target, and
migration notes for gateways without /v1/tools routes. Test doubles now use
the live response fields and RFC 3339 offsets.
* feat(web): configure Search API result count and send the triggering question
- Add web-search-deepseek.count (1-50, default 10, the service default) and
show it as "Results per search" in Search API mode, where "Max searches per
request" applies only to Messages; a smaller request maxResults still wins.
- Send the initiating Session's latest human prompt as ori_question, with
whitespace collapsed and cut to the API's 128-character limit; blank or
absent prompts omit it, and sendOriginalQuestion: false disables it. The
settings hint states that the question is sent.
- Match the web search double on the request's query field, since
ori_question now carries every query in the prompt.
* fix(client): unify web search endpoint override controls
* feat(web): configure registered search and fetch providers through shared settings
* feat(web): include Exa and Perplexity in provider settings
* test(web): cover provider settings branches and refresh plugin snapshots
* revert(web): drop the provider dropdown, schema-driven form, and Exa/Perplexity settings
Revert aed8c5cb609, d88c47dcd80, and 036a5a337d3. The Web search settings
page returns to the DeepSeek toggle; the DeepSeek Search and Fetch API split
is reintroduced as one plugin in the following commit.
* feat(web): move the DeepSeek Search and Fetch APIs into web-deepseek-api
The new web-deepseek-api plugin registers deepseek-search-api and
deepseek-fetch-api over one credential and API base, and exports the
authentication and redirect-rejecting transport that web-search-deepseek now
reuses for Messages search only. The web service reads searchProvider and
fetchProvider for each operation, so the Web search settings switch selects
both APIs together on save and restores Messages search with local HTTP fetch
when turned off. The switch hint links to the DeepSeek search and fetch guide.
* refactor(client): keep the web search endpoint fields on the shared override controls
Drop the always-visible reset and the inherited-address placeholder from the
Web search page, restoring ui-primitives to its base. Each endpoint field shows
the selected section's effective value and offers Reset to default only for an
override, like every other settings field.
* refactor(web): keep Messages search independent of web-deepseek-api
Restore dsh-web-search-deepseek to its own credential and transport code,
keeping only the disabled-thinking request and the current settings guidance,
so the Messages plugin no longer depends on the Search and Fetch API package.
dsh-web-deepseek-api keeps its transport internal; the regions that repeat the
Messages helpers carry jscpd:ignore markers, with the rationale recorded in the
Search and Fetch API Agent Note.
* refactor(web): keep the web-deepseek-api request type module-private
---------
Co-authored-by: LegGasai <[email protected]>
Record the six added default SDK tools in the dynamic-tool history. Keep the existing custom snapshot, recovery, and restart compositions independent of the desktop defaults using the same disabled rows as the TypeScript legacy context patch. Validate the original failure and the following scenarios through the supported built CLI path.
agent/request now rejects reasoning-effort changes, so the keyless mock
records off effort with ctx.agentModel.select() after the first step's
tool call. The headless session expectation gains that model/selection
event, and the sdk-minimal built config dump lists dsh-agent-model.
AgentRegistry no longer injects sessionProjections, so it loads at its
master position again and the archive dialog lists the turn before the
background job, as it does on master.
Pass execution-specific phrases directly to the run_code flavor factory and render SDK instructions from explicit program-format branches. Keep all emitted text byte-identical while removing coupling to exact shared prose. Validate the owning tests with full scoped coverage, focused session/SDK replays, and a complete build.
Add @deepseek-ai/dsh-agent-model. It provides ctx.agentModel
(resolveForNextStep, select, applyConfiguredRoute) and owns the
modelSelection projection, which the Agent registry no longer registers.
dsh-agent-loop now injects agentModel; the base and SDK-minimal bundles
and the Python SDK runtime include it.
The provider keeps the projection registered until consumers that are
still unloading finish their cleanup. The model-switch notice becomes an
opt-in per-Agent plugin at @deepseek-ai/dsh-agent-model/notice, and
agent/request now also rejects reasoning-effort changes after step
preparation.
Mount the provider in every composition that loads dsh-agent-loop, and
update consumers, the switch-notice snapshot driver, docs, and the
upgrade guide.
Set the required normal retry mode so the Loader accepts the full provider patch, and type-check the policy before JSON serialization. Assert the effective request settings and successful warm-up turns, report failed attempt causes immediately, and inherit suite retries for transient external API failures.
Accepting 198.18.0.0/15 unconditionally opened that range to direct
connections on hosts without a fake-IP proxy. Operators now list their
proxy's ranges in fakeIpRanges (IPv4 or IPv6 CIDR, default empty);
invalid entries fail at load.
TUN-mode proxies with fake-IP DNS (Clash/Mihomo, Surge, sing-box) answer
every hostname with an address in 198.18.0.0/15. web_fetch rejected those
answers as non-public, so every page failed. Treat a hostname answer in
that range like a proxied hop; an IP literal in the range stays blocked.
While the right sidebar is collapsed, its docked hosts are translated past
the frame's right edge and widen the frame's scrollable overflow. Outside
macOS, PageUp in a text field moves the caret and reveals it against the
start edge of every scrollable ancestor, so the `overflow: hidden` frame
scrolled sideways and the whole UI shifted left.
Clip the panel's overflow. `overflow: clip` does not make the panel a scroll
container and does not clip the fixed-position floating panels, whose
containing block is the viewport; the DockLayout ancestor contract now says so.
Fixes#6341
The page clock failure depended on the real-to-fixture distance modulo
2^32 ms, so a regression run on today's date alone passes against the old
fixture for half of every period. The test now shifts the Host clock across
eight phases of that period; the page.clock fixture fails every phase,
either with stopped page timers or with a Date that does not advance.
pinHostClock replaces Date.now in the Vitest worker, where Playwright's
server also runs. page.clock.setFixedTime therefore recorded the fixture
day, and after a navigation the page clock replayed the gap to the real
day. The resulting negative timer delay was truncated to a 32-bit integer
and, from 2026-10-15T13:45:20Z, became a delay of weeks that stopped every
page timer, failing the steering and seeded-history suites.
pinBrowserClock now replaces only the page's Date so it reads the fixture
day while native timers and animation frames keep their real schedule; a
regression test navigates twice with both clocks pinned.
State why every plugin manager operation drops every cached catalog, and
list two remaining gaps among the known limitations: on-disk SKILL.md
changes forward no event to an open session, and draft skill highlighting
waits for the next catalog fetch after an invalidation.
Derive the picker's checked state from the list at render so a row drafted
during the fetch is not removed. Disable Update list when it would empty a
non-empty list, because an empty list serves the whole catalog. List a
repeated candidate id once and treat rows without an id as unconfigured.
The fetched-model picker now starts with the configured models checked and
Update list adds newly checked candidates and removes unchecked configured
ones. Configured models the provider does not list stay. Select all and
Deselect all change only visible candidates so a hidden configured model is
not removed unseen.
Refs #6290
The Chat running indicator kept counting while the Client connection was
disconnected or reconnecting, which read as the agent still working. The
flow now reads the connection state and holds the clock until the
connection is back.
Address the ds-review-bot round on #6272: the README summary, completion
notice, token effect, and Known Limitations lines no longer call the
payload the final answer; the empty-result error reads "without an
answer"; the ordering spec also interleaves commentary; the partial_answer
branch cites its upstream source.
The browser skill source cached each Session's catalog until a preset
switch or connection reset, so an open Session kept listing the skills of
a plugin switched off on the Plugins page and missed those of a plugin
switched on. Clear every cached catalog on the forwarded
plugin-manager/changed event, which the Host emits after the operation's
reload.
Fixes#6268
The release-shaped sdk-snapshot smoke records an image message that a
pre-step listener adds. The runtime-context snapshot now follows the
messages that agent/pre-step admitted, so it moves after that image and the
image/offload target seq changes from 13 to 12. The previous CI run stopped
at the authoring snapshot before reaching this one.
Re-recorded with --update-snapshots through apps/cli/lib/bin.js; the local
result.json diff matched the linux-x64 and win-x64 CI diffs exactly. The
scheduler-recovery, restart, minimal, minimal-in-history, and dynamic-tools
snapshots re-record unchanged.
The reasoning-level editor hardcoded pi-ai's seven levels, so a level a
pi-ai upgrade adds would be missing from the page and a stored key outside
the list would be dropped by the next edit. The levels now come from the
llm-pi-ai namespace schema, the key union of reasoningEfforts, read the
way protocolChoices reads the protocols, and travel explicitly from the
Models section and the provider editor through the model list to each row.
A stored key the schema does not list keeps its row and stays selectable.
The reasoning control now appears wherever that list is non-empty instead
of being inferred from a missing catalog provider.
The goal domain e2e runs over the shipped headless profile, whose base
bundle mounts goal-round-driver. GoalService.create() arms the goal the
fixture seeds, so the driver queued round 1 when the task turn went idle
and the test's headless driver disposed the context mid-round. The
assertions held only while the aborted round's turn/end missed the log
before disposal; an extra await in the agent loop's pre-step path (#6024)
let it land and the test failed deterministically.
Disarm the goal right after creating it. Activation is process-local, so
the persisted goal/change snapshot is unchanged and the driver starts no
round. Also assert a single turn/start, which records a started round
even when disposal aborts it before its turn/end is persisted.
The reasoning-level editor kept the levels it switched off, its row order,
and typed text in component state, while the model list keys rows by
position, so deleting a row handed that state to the next model: turning
the survivor's switch on wrote the deleted model's levels into it. The
editor now renders only from the model; rows follow the stored order,
switching on always starts from the defaults, and only the focused field
keeps its typed text until the field is left.
The reasoning check moves out of the shared model validator into the two
cards whose rows edit it, so DeepSeek and catalog routes are untouched,
and it now mirrors every pi-ai refusal: a valueless field, a missing value
on a level besides off, and an empty value. A refused value marks its
field, and leaving that field repairs it with the level name.
The Providers guide now points custom model API users to the page before
the YAML, and both package READMEs describe the new behavior.
cua-native and cua-ptc were recorded on master while exit_plan_mode stayed
registered outside plan mode. With conditional admission the tool is
declared only in committed plan mode, so the refreshed tool schemas and
PTC prompt omit it; no other content changed.
master bumped the root version to 0.2.1-alpha.3 after alpha.3 shipped
without this change, so the alpha.2 directory is frozen and the guide
describes the upgrade from alpha.3.
The release-shaped authoring smoke records the first request's user blocks.
The runtime-context snapshot now follows the messages that agent/pre-step
admitted, so the skill catalog precedes it. CI on the previous head reported
exactly this reorder for linux-x64 and win-x64; the content is unchanged.
agent/pre-step already runs before step/start, and tool resolution and prompt
assembly now follow step/start, so plan-mode can keep committing pending
selections after downstream pre-step listeners accept the step. Tool
conditions and plan guidance still read the committed state, and a rejected
proposal keeps the selection pending as on master. No agent/model listener
depends on plan mode, so the separate serial event had no consumer left.
The loop now claims input, runs agent/model, and then agent/pre-step. The
agent/model order test replaces the boundary tests; plan-mode tests cover
the rejected-proposal case again. Docs, the Agent Note, the upgrade guide,
and generated catalogs follow.
Codex app-server 0.162 adds `partial_answer` to the agentMessage phases
(stable answer text that later assistant output or tool calls may follow).
The wire treated every phase other than final_answer, commentary, and null
as fatal, so one such message failed the whole delegation. Record the
latest partial answer and select final, then partial, then unphased text;
unknown phases still fail the run. The pinned @openai/codex 0.153.4 payload
never emits the phase, so behavior with the shipped binary is unchanged.
The help tooltip now says that Off needs no value but keeps and sends a
value already written in the configuration, matching the disabled field
that shows it. Both READMEs add the rule that a custom value carries over
only between two thinking levels, so changing a row to or from Off resets
it. The Models settings e2e header comment is rewrapped.
The persisted draft now records the leading command chip's claim token
(DraftSnapshot.command). Restoring the draft asks the trigger pipeline's
new resolveClaim, which polls the optional InputTriggerSource.matchClaim
hook: the command source awaits its catalog and answers only a
leadingInput claim, never opening a popup, running an action, or
executing the command. The input rebuilds the chip once the claim
resolves, only at the revision the restore produced and merged into the
seed's history entry; otherwise the literal token stays and Enter still
adjudicates it.
A model row on a hand-declared pi-ai route now edits its reasoningEfforts
from the Models settings page instead of only through cordis.patch.yml.
A switch turns the field on or off; when on, each row pairs a level
select with the API value sent for it, which defaults to the level name.
Off only turns reasoning off, so its value field is disabled and a value
already stored for it is kept. Saving refuses a list without a level
besides off, and a help tooltip beside the label explains the values.
Catalog routes and the DeepSeek card are unchanged.
Refs #6260
The packer images the web template bundles, every optional bundle, and an installation manifest instead of a dumped composition, and the Worker boots that profile through app-boot like dsh web. Package-local lazy client chunks move into content-addressed archives that the VFS fetches on first asynchronous read; client-modules reads chunks asynchronously.
The Worker replaces node-addon-require-builtin with Node v24.18.0 internal-module interfaces and reports Node 24, so plugin metadata, the Cordis Loader, and HMR reach one cascaded loader backed by the Worker loader. Resolution failures carry Node error codes, the empty load cache lets HMR apply profile changes, and every optional bundle switches on and off live. Platform stubs throw ERR_FEATURE_UNAVAILABLE_ON_PLATFORM.
Copy each plugin's manifest repository as its web page and package
directory, converting shorthands and Git URLs with hosted-git-info. Parse
options and generate help with commander.
Generate a validated format-1 plugin market index from a list of npm package
names and https Git repository URLs, without running package code.
- List every non-deprecated npm bundle version, and Git versions at release
tags and the default branch, each with its engines.dsh range.
- Read display fields, keywords, homepage, and icons the way DSH reads
installed plugins; inline small icons up to the format's 32 KiB limit.
- Cache results per immutable input and rewrite output only when it changes.
A Discover install passes the entry's localized title and version with its
spec. Every install dialog screen names the plugin and version, and shows the
spec, such as a pinned git+https URL, below in smaller monospace text.
The Installed tab panel now wraps its loading, unavailable, and empty states.
Custom plugin markets joins the bundles the More page holds back until the
profile enables them, and the repository field and its directory rule are
documented.
Indexes may give each plugin an optional repository: the web URL of its
source repository and the package directory inside it. The Discover entry
page links it as Source code, and the plugin_market tool returns it.
Read configured plugin market indexes on the Host, search them with fuzzy
multilingual matching, and install a chosen version from the Plugins page.
- dsh-plugin-market-index validates format-1 indexes and builds install
arguments; inline icons are capped at 32 KiB.
- The pluginMarket service fetches configured http(s) URLs, parses bodies in
a Worker Thread, caches documents, and pages filtered, ordered results with
installation status and engines.dsh compatibility.
- Discover is an opt-in experimental bundle; the Plugins page gains a
plugins.tab slot and confirmed installs.
- The plugin_market tool lists indexes, plugins, and versions for Creator mode.
- Plugin compatibility reads engines.dsh before DSH peer dependencies.
A Client plugin loaded after the page starts fetches its bootstrap once. The Host now registers that route before starting the Worker and answers once the Worker is ready, so enabling Developer Tools on a running page opens the bottom DevTools without a reload. A failed start answers 503.
When the platform cannot run the Worker (ERR_FEATURE_UNAVAILABLE_ON_PLATFORM), the Host warns once and stays active with only the 503 bootstrap route; serve-static and open load after the Worker starts. Every other startup failure still fails the fiber.
verify-package-dependencies now covers every packages/*/* manifest, experimental included, and reads each package's tsdown build entries so Worker and child-process entries count as Host runtime sources. Experimental Client packages no longer declare browser and type relationships as peers.
Package modules that other code imports must not suspend evaluation at module scope. A syntax-aware gate scans packages/*/*/src and excludes only executables (a shebang or a package bin target). The SenseVoice worker, the SSH helper entry, and the Inspector worker entry now run an explicit main().
The provider's Linux decisions now live in LinuxScopeSelector, a state machine
over injected observations: the deep probe, the user-manager listener, the
manager confirmation, and the systemd-run binary identity. Each decision
carries its reason and probe trigger, the runtime logs it at debug level, and
table-driven scenarios cover every transition.
- A positive verdict probes again when the systemd-run found through PATH
changes device, inode, size, or modification time, so an in-place upgrade
past v254 cannot reuse options that no longer keep argv literal.
- The listener is read before the probe, so a manager that starts during a
failed probe counts as a new listener.
- The kernel socket table is decoded as UTF-8, matching runtime directories
outside ASCII.
- LinuxScopeNotStartedError drops its unused code field.
A cached positive verdict let a hung user manager that still listens fail every
later command, and a cached negative verdict ignored a manager that started
later until the provider restarted.
- A scope launch whose bootstrap never consumed its launch request now fails
with LinuxScopeNotStartedError, and the runtime clears the verdict it
launched under, so the next eligible spawn probes again and records the
fallback when that probe fails. A generation counter keeps launches from a
superseded probe from forcing another probe.
- After a negative verdict, the runtime records the /proc/net/unix listener on
$XDG_RUNTIME_DIR/systemd/private and probes again only when a different
listener, meaning a new manager instance, appears.
OpenAI GPT-5.6+ places implicit cache breakpoints only at message ends, and
Anthropic-style routes mark the final message. The review request was one
system prompt plus one growing user message, so those routes could reuse only
the policy and re-read the whole history on every review.
Send the environment, each retained item, and the pending call as separate
user messages. The pending call uses the history form, and a tool-schema item
precedes the first call that used each reviewed schema; the integration keeps
those schemas per live Session so later reviews repeat them in place. Each
review now begins with every message of the previous review.
The real-socket test rejects on a listen error instead of hanging, the table
fixture comment names the accepted-connection row it models, and the remaining
linux-scope module mocks provide confirmLinuxManager. The README notes that
the socket-table read matches only listeners in the same network namespace and
costs time proportional to the table size.
systemd closes the private listening socket on shutdown without unlinking its
path, so the socket file outlives a manager stopped in place. The fast path now
reads /proc/net/unix, where the kernel lists a bound socket only while a
process holds it open, and accepts the manager only when a process listens on
$XDG_RUNTIME_DIR/systemd/private; otherwise the systemctl query decides. The
scope startup error names an unreachable manager as the cause, and the spawn
test again asserts that Windows launches never reach the fallback.
Without a per-spawn check, a user manager that stops after a positive probe,
such as after a logout without lingering, made every later scope launch fail.
Each eligible spawn now confirms the manager: its socket file at
$XDG_RUNTIME_DIR/systemd/private disappears when the manager stops, so its
presence answers with one stat; otherwise the restored systemctl --user show
query decides and the spawn falls back while it fails. A crashed or hung
manager that leaves its socket file still fails the scope launch with the
existing restart hint.
Project instructions loaded mid-session were inserted into a section ahead of
the filtered history, so every nested AGENTS.md load changed the review prefix
and invalidated the provider's cached history. Render them in surface order
inside FILTERED_HISTORY with their constraint role, so each review's text
extends the previous review's text through its last history entry.
The probe always passes --collect, which systemd-run rejects before v236, so those hosts use the fallback regardless of the --expand-environment=no retry.
With the probe cached for the provider lifetime, a user manager that stops
after a positive probe makes every later scope launch fail. The startup error
now says to restart the provider to probe native containment again. The README
no longer lists older user-systemd among fallback hosts and notes the second
probe attempt for a systemd-run that rejects --expand-environment=no.
The README says the provider also keeps a failed or timed-out first probe and
names the user manager as reachable rather than live, since it is checked once.
The probe cache documents why no later spawn repeats the probe, and the spawn
test now starts two Windows commands to match its per-spawn Job recheck title.
systemd-run before v254 rejects --expand-environment=no, so the scope probe
always failed and those hosts used the weaker fallback. Its scope mode never
expands argv, so the probe retries without the option only when systemd-run
reports it as unrecognized, and scope launches reuse the probed options.
systemctl before v252 rejects --kill-whom. Use --kill-who, the older
spelling, which newer systemctl accepts as an unambiguous prefix.
Every Linux spawn() and spawnTerminal() ran a synchronous spawnSync probe
before launching the command: the full systemd-run scope probe until it first
succeeded (a failed verdict was never cached), then a systemctl manager recheck.
spawnSync blocks the host event loop until the probe exits, so hosts without a
usable user manager paid the full probe on every grep, glob, and shell command.
Keep the first verdict, positive or negative, for the provider lifetime and
drop the per-spawn manager recheck.
Plugin Manager hardcodes feature previews by package name, like its
experimental bundle lists, instead of reading a package manifest field.
The DSH badge skill bundle shows an English or Chinese illustration
below its description. Client bundles embed imported SVG, PNG, and
WebP files as data URLs through the shared tsdown preset, which
replaces the account package's own asset loader.
Co-authored-by: ZiyaZhang <[email protected]>
The package API carried members and result types ahead of any caller. The
span now publishes fromMilliseconds and decompose, the two entries
dsh-time-context calls; the seconds constructor, the zero identity, the
arithmetic and ordering operations, the millisecond getter, and the four
fractional conversions land with the caller that needs them, recorded in
the Agent Note and the README limitation.
The package entry names its exports instead of re-exporting both modules,
so the three result types and DurationParts, which no consumer names, are
no longer part of the published surface. Every remaining new name has a
named consumer: schedule imports the nine parser and bound names plus
four rejection types, and canonicalizeTimeZone has seven consumer files.
conversation.hero.options seats compact Session options at the right end of
the New Session row, after the workspace and agent-preset controls. It is a
session-scoped list slot rendered only while a Session exists, so plugins can
add choices such as a worktree toggle without displacing the shipped controls.
Reject case variants of shipped profile names, detect a concurrent winner by
the target's state instead of errno, warn instead of failing when staging
cleanup fails after a successful replacement, and cover the restore paths with
deterministic tests. Update the profile Agent Note, reference recovery path,
and upgrade-guide migration steps.
Repeated rescue runs such as `dsh rescue --from-default-profile web` failed
because the target profile already existed. The option now assembles a fresh
template copy in a staging directory, moves it over the target, and deletes the
previous profile; a failed move restores it.
A revealing row that ran on its own CSS transition and was then taken
over by a batch entered the landing twice: the measured starting layout
held the height it had already reached, and the growth amount added its
full height again while the batch restarted it from zero. The extra
height raised the tail target above the real floor and stayed as bottom
room. Rows revealed while a batch ran kept their own transitions and were
taken over this way by the next batch.
- A row that starts revealing while a batch runs waits at zero size like
a held closing row; the next flush drives it in a batch or starts its
own transition when nothing closes.
- A batch continues every member from its current size: closing rows
shrink from the height they have now, and revealing rows grow from the
height they reached, so only the remaining growth enters the landing.
A row that started closing while a fold batch ran kept its own CSS
transition and outlived the batch. During that window following moved to
the floor while reclaimBelow held still, so the bottom room was followed
in full instead of being consumed by the content that arrived, and it
stayed under the reader afterwards.
- A row that closes while a batch runs keeps its size without a
transition until the batch settles; the next batch starts at once and
drives it. Without a driver at that flush the held row finishes at once.
- A batch takes over a closing row at its current size and finishes a
row that has no size left.
- The tail landing reads the committed layout when it finishes: it lands
at the larger of the target and the real floor and keeps only the room
that target needs.
- A tail request counts only for closing rows that can start a batch,
using the same membership rule as the batch, and detaching clears it.
- A batch keeps the reader landing while reading movement awaits
sampling, so an unsampled scroll away from the tail is not undone.
- Reader scrolling during a reader landing moves the reference row's
recorded position, so the final correction keeps only layout changes.
- The blank-area matrix releases a partly opened world, fails a case on
cleanup errors, mounts only the provider catalog for the Turn that fails
before its model call, names its gap as a layout gap, and labels the
steering case as a no-fold control.
- The note records the pending-sampling rule and the opacity of a row
that joins the travelling set after fading.
contextBreakdown kept one entry per retained surface node, so its
checkpoint grew with the message count (7.13 MB across 836 local Sessions,
up to 103 KB for one) and every cached Session listing validated it. The
state now holds the surviving system prompts, one surface total, and at
most one shadow-price claim. Appends add their price; a replacement
subtracts the adjacent compaction/summary or compaction/prune price and
drops the system prompts its shadowedSeqs name; a system-prompt rewrite
subtracts the retained prompt price. Other unmetered replacements fold at
zero delta, as in contextPressure. State version 6 discards positional
rows. Folding all 836 local logs with both versions gives identical
figures after every event; retained state drops to 110 KB.
Every `@` candidate query labeled each listed Session through three
service lookups, and each lookup and method read through a Cordis service
proxy allocates wrappers, so the labeling step grew with the Session count.
The resolver now resolves sessions, projections, and the projection cache
once per call, indexes attached Sessions in one map, and binds
cachedSnapshot once for cold Sessions.
list(), the root encoding check, and historical corpus fingerprints read
project directories, Session directories, headers, and stats one at a time.
On a network filesystem every listing paid the summed round trips. These
reads now run through one p-limit limiter per backend (listConcurrency,
default 3), shared by concurrent listings; results and the first reported
failure keep the sequential order.
The queued and steer cases held the model call at a global call index and
waited without bounds, so any shifted or missing call stalled the case
until the 240 s test timeout. The hold now targets the first call in the
case's Session that streams the case's marker text, every wait has an
explicit timeout whose error lists the observed calls and the Session's
latest events, scroll settling is bounded, and the cases use the web
lane's default timeout.
- A tail request counts only while a fold batch runs or is scheduled,
so rows still closing on CSS transitions cannot strand own input.
- A reader-content-still landing adds the reader's own scrolling between
frames to the position it keeps still.
- A newer tail request that takes over a running batch recomputes which
closing rows travel with the content.
- Symmetric cancel and resume guards; Set-based travelling bookkeeping.
- The blank-area matrix holds the subagent continuation route for child
sends, writes per-frame evidence only on failure, and labels the parent
message case as a no-fold control.
- The group-tree note now links the single fold motion for input without
an echo on this page.
Folding on the next message reserved the whole closing height as bottom
room and kept scrollTop whenever the input had no transcript echo on this
page: a message from another tab, a queued message delivered after the
previous Turn, or a send from a subagent child in the right Sidebar. A
reader below the fold was left on an empty viewport.
Every batch of closing rows now runs on the viewport's frame-clock driver.
It lands at the tail for this client's own input or a following reader and
otherwise keeps the reader's content still, installing only the room the
landing lacks. Subagent child sends register a local echo and pass its
request id to subagents.prompt, so the child's recorded message retires it.
With HMR, installing, enabling, disabling and removing bundles take effect live. Each profile recomposition compares
the loaded modules below the profile directory and its linked targets with disk, stops the plugins whose files
changed, and recomposes the profile through app-boot's recomposeProfile(): the rows the next generation drops are
removed first, the latest runtime resolution is published once, and the generation is applied and judged. Afterwards
HMR evicts the modules below the mappings the recomposition dropped.
- app-boot: recomposeProfile(); PluginPackages.resolution; ResolutionRestartRequired; the resolver accepts in-place
version changes and relinks, and relocates Node's cached link real paths.
- plugin-manager: with HMR, installBundle refuses an installed package (already-installed), so an upgrade is a
removal and an installation; every restart-required result carries a restartReason; removal uses the registry the
package was installed from.
- ui-plugin-manager: the Official Update removes and then installs; restart prompts name their reason.
A resized scrollport or a wrap toggle can move the marked line, so the band is
removed instead of marking another line. Document the exact timing and why
reduced motion keeps the opacity fade.
Opening a file link at a line now marks the landed line in both the code and
plain-text renderers with a band that holds briefly and fades out over two
seconds. The band lives in the scrollport, so syntax highlighting replacing
the code lines keeps it. The plain renderer's persistent target background is
removed.
* fix(schedule): keep timing and execution notes out of task titles
* fix(schedule): avoid repeating task title guidance
* fix(schedule): keep title guidance examples in English
---------
Co-authored-by: ZiyaZhang <[email protected]>
- rename stepToolCalls to toolCallsThisStep
- move omitClosingText and toolCallsThisStep to the local activation resource, the only kind that sets them
subagent-agent-preset no longer declares exit_plan_mode outside plan mode, and the seeded Web fork admits its runtime-context snapshot after the time context.
The runtime-context snapshot now follows the messages that agent/pre-step admitted, so recorded sessions swap it with pre-step additions such as time context and skill notices. cordis-inspect-jsdoc records the new agent.step and agent/step-boundary declarations.
Each proposed step now dispatches the serial agent/step-boundary event
after claiming input, then agent/model, and publishes the chosen model
selection as the optional agent.step until the step ends or its proposal
is rejected, fails, or is cancelled. agent/pre-step listeners, tool
conditions, prompt sections, and the provider and model variables read
agent.step, so the pre-step payload, AssembleContext, and
ToolActivationContext carry no model selection field.
Plan mode commits pending selections at the step boundary, before model
choice, and still narrates the switch in the first admitted step. The
system prompt assembles once after step/start, including runtime context,
and system-prompt/prepare is removed. The runtime-context snapshot is
admitted after the step's accepted messages, so a changed runtime context
alone no longer opens a step.
The macOS chooser ran AppleScript's `choose folder`, whose panel belongs to an
osascript helper that has no application menu. A native panel resolves
⌘C/⌘V/⌘A/⌘X as main-menu key equivalents rather than as behavior of the
focused field editor, so Go to Folder, Search, and Tags could not be pasted
into even though the panel's own ⌘⇧G worked.
Run one JXA script that installs the standard Edit menu and then opens
NSOpenPanel with the previous configuration; untargeted items let AppKit
enable them against the responder chain that owns the panel's field editor.
The prompt stays argv data, and a cancel now prints an empty line, so the
stderr "User canceled" sniffing and its helper are gone.
The README pair re-records its consistency record for the two edited sections.
Re-serializing a document with a foreign integer beyond 2^53 no longer rounds it;
the reload warning is tested; the GITLAB_TOKEN test no longer depends on the host
environment; README and JSDoc describe the tolerated top-level keys.
Switching on an experimental bundle from the More page left it only on
that page, so a plugin the profile had enabled was missing from the main
Experimental plugins group. Both lists now read one order over the
offered bundles: the main list holds the always-held ones plus the
held-back ones the profile enabled, and a pinned bundle keeps its
More-list position. A bundle's details opened outside the lists return to
the list that shows it.
The root-session descendant-count dropdown registered at order -30, which put
it ahead of the preset label at the start of the header actions band. Order 10
places the catalog between the preset label (-10) and background tasks (20),
after Team navigation (-20), and off the list slot's default 0 that unordered
registrations share.
The web e2e assertion and header golden that pin these contributors' relative
order move with it.
Enable image reading and automatic context compaction in Minimal GUI and SDK profiles, with /compact in the GUI and per-tool filesystem configuration. Include image-budget recovery, cancellation handling, documentation, and updated runtime snapshots.
- office-render: report inspection results in text and never link or embed
removed previews. Desktop and Web replies otherwise embed deleted preview
images, because their file-reference guidance encourages inline images.
- office-export-pdf: validate with the command result, nonempty output, and
%PDF- signature; do not search for PDF readers unless the user requests
deeper checks. The bundled runtime has none, so the old conditional made
the model probe system Python and command-line tools.
- Assert that the PDF export e2e does not probe PDF reader tools.
- Replace stale "structural checks" wording in the Desktop Office plugin
JSDoc and the skill package description.
Ordinary mode no longer declares exit_plan_mode, so the office scenarios that master recorded before this change pin the tool list and PTC SDK guidance without it.
Rename agent/route to agent/model and make its result a complete
ModelSelection, so each step fixes its provider, model, and reasoning
effort before prompt preparation, agent/pre-step, tool conditions, and
every request attempt. agent/request may change only sampling controls;
returning another provider, model, or reasoning effort fails the step.
installModelSelection installs one agent/model listener and
ModelSelectionRef drops assembled. The pre-step payload, AssembleContext,
and ToolActivationContext carry modelSelection. Webhook initial
selection and the CLI mock effort switch move to agent/model.
- tool-jobs: inlining is decided before any read from the job's whole stream, so larger jobs keep their output and retention in the registry; a capped inline notice keeps the output's tail; job_output withdraws a pending notice from the agent now registered for the owner session
- subagent: track the relay through logged tool calls, which tool policy cannot skip
- snapshots: order the background-job-notice settlement with a sentinel file
The eight snippets in this note are before/after sketches: two import the
Remote source modules this change deletes, and the rest are fragments without
their surrounding context. They were never type-checked, yet each one counted
against the repository-wide opt-out ratio, which now sits above the 50% ceiling
that `doc-typecheck:contracts-ready` enforces.
Label them as text so the ceiling reflects blocks that could be checked.
The Typert host program analyzes packages/api/session-controller/src/commands.ts
on a clean checkout, where only tsconfig paths resolve
@deepseek-ai/dsh-client-file-upload/types; without the mapping the dependency
policy gate fails with TS2307.
The caller-connection work — forwarded-event opt-in, physical socket
ownership, and the Node/MCP artifact-only consumer fixture — moves to a
stacked PR on top of this one. This branch now changes only how Remote
definitions are generated (Typert artifacts, lazy method info,
consumer-selected input strictness, tool-schema projection) and how the
existing Registry consumes them.
- Add the agent/route waterfall, dispatched once per proposed step before
system-prompt/prepare and agent/pre-step; model selection captures its
choice there, and a later selection applies from the next step.
- Pass the chosen StepRoute to prompt preparation and assembly, the
agent/pre-step payload, and tool conditions; remove Agent.currentRoute().
- Run agent/request and prepareCall() for each attempt after step/start and
prompt assembly; agent/request may change only call controls, and another
provider or model fails the step.
- Resolve conditional tools and assemble the prompt once per step; retries
reuse the route, tool set, and rendered assembly.
- Update documentation, Agent Notes, generated catalogs, tests, and the
cordis-inspect-jsdoc snapshot.
Add a placement table to the Definition section: which `groupTree`
position a Chat Node declares for an opening human input, another Turn
input, a Turn notice outside folding, an independent folded row, and
ordinary process content, with links to the contract and the built-in
positions, and a pointer to `exclusive` claims.
`observedInputs` now reads every `input`-position Node, and a Node's
payload is not guaranteed to be an object. Check the payload and its
`source` before reading the composer `rpcId`, so an input Node without a
message payload no longer throws while pending echoes are matched.
The position-order case includes `input`. A Turn without opening input
whose control anchors after a position-less row still renders the control
before the group that holds that row.
State in the `exclusive` JSDoc and the Conversation reference that the
claimed target's fallback does not run and that a fallback's own claim
has no effect. Reword the `input` position as the Turn's opening input
and separate the finalized-answer exemption from position-less
`assistant-step` rows. Point both package READMEs at the claim and the
group-tree positions.
Assembler cases cover a claim in either registration order and on live
append, other targets and target-less Definitions, the skipped fallback,
and both dispatch failures. Chat grouping cases split the step run by
position regardless of kind and regroup on a position change; the late
reply produces one Chat Node through a real assembler.
Add the exclusive Conversation matches Agent Note; bring the group-tree
note up to the `input` position and the migrated kind lists, and the
timed-question note up to claim-based reply deduplication. Pair the
Chinese Conversation reference and Chat grouping README with the
English updates.
Chat grouping, whole-Turn folding, and Turn-input detection read each
Node's declared `groupTree` position instead of the `INDEPENDENT` and
`TURN_PROCESS_INDEPENDENT_KINDS` kind lists and the user/steering/
turn-trigger checks. `ChatGroupTree` gains an `input` position between
`exchange` and `turn`; the built-in Definitions declare the positions
their kinds had, so built-in rows keep their placement.
The late question reply claims its message on the Chat target, so the
generic message Definition no longer projects a duplicate trigger and
grouping drops the message-id aggregation. Its placement is unchanged.
A match result may set `exclusive: true`. The assembler evaluates every
match of an event before accepting any, so a claim is independent of
registration order: other Definitions of the claimed target build no
Context for the event and the target's fallback does not run, while
Definitions of other targets and target-less Definitions still receive
it. Two claims on one target, or a claim without a target, throw.
The responsive change had moved `.pageIntro` off flex, which put the information
icon 1.06px off the subtitle's vertical centre and failed the existing geometry
assertion in `plugin-manager.e2e.ts`. Restore the flex row and the button's
`flex: none`, which keeps the 4px gap and the centring. The header still wraps
its action group onto another line, which is what this change is for.
Pin the wrap threshold in both header scenarios. Each records whether the action
group sits beside or below the heading, the plugin scenario asserts the wide and
narrow sides explicitly, and the plugin scenario launches its own scaffold so an
install task left by an earlier test cannot move the threshold between runs.
- Compute each group's baseline watermark once per render.
- Skip the row-motion reset when folding drops no raised watermark.
- Document that the watermark is a row count that a reorder can outrun, and
that any unmount of the grouped tree resets it; pin both in tests.
- Cover raise-to-current, keep-after-leaving, and fold reset in the keyless
Web folding scenario.
The page header keeps the title at its natural width and moves the New action
onto another line once the two no longer fit, so a narrow content column never
splits the title across lines.
Register the new browser scenario in both web programs: the host aggregate owns
files that boot the host spine, and the client-registered app project excludes
them.
The scenario asserts the title stays on one line, the action separates when the
column narrows, and focus survives the change.
The page header wraps its action group onto another line when the title and the
actions no longer fit together, so the title keeps its width and the actions keep
their labels on one line. The information button follows the subtitle text
instead of a flex row, which keeps it beside the copy at every width.
Cover the header in the plugin-manager browser scenario: the action group stays
inline when it fits, moves below when it does not, keeps its labels on one line,
stays inside the header, and retains focus across the change.
Add `.agents/skills/dsh-responsive-ui`, the repository standard for adapting
client surfaces to narrow available widths: the 390 CSS px acceptance minimum,
the order in which space and information yield, text truncation, titles,
icon-only controls, mobile hover behaviour, mobile tooltips, and focus
retention across width changes.
Link it from `dsh-client-ui-ux` so the existing client UI/UX guidance routes to
the new standard.
- subagent: a send_message that shares its step with another tool call no longer omits the closing message
- tests: read settled job results through job_output and give job-owning test agents a mutable inbox
The subagent guidance tells the model to end its turn while it waits for
delegated results. With an armed goal, the round driver would then queue a
new round at every idle point, spending the round budget while the agent
only waits. The driver now joins the agent's progressing descendants
through the optional subagent service before it reserves a round, and stops
waiting when the plugin unloads.
- tool-jobs: a completion notice carries the job's unread output when it fits inlineOutputBytes (default 2048); job_output withdraws a notice still pending, and the label is its first line bounded to 120 characters
- tool-bash, tool-pwsh: the promotion result keeps only the still-running marker
- subagent: a settlement notice omits the closing message when the child's last action was a message to its parent
Each Workspace shows a contiguous prefix of its Sessions up to a watermark.
The watermark rises to cover running, waiting, unread-completion, and
current Sessions within the first 50 rows, and to a search reveal target at
any row. It never falls on its own; Show more raises it past 50, and Show
less or folding (including an ancestor) resets it.
Route fields and list_subagent_models are now registered only by the
tool-subagent instance configured with modelSelectionSettings, which keeps
one fixed definition per composition for Web presets while headless and SDK
profiles return to their previous schemas. Discovery registers with that
instance instead of a separate list-models plugin entry, so the delegation
description never references an absent tool. modelSelectionSettings on a
provider that inherits the parent conversation now fails the mount.
The subagent guidance now tells the model to end its turn when only waiting
for delegated results remains, since each result starts a new turn. The read
guidance names sed, head, and tail alongside cat and covers line ranges.
The compaction-output-reserve and compaction-summary-headroom context windows
grow by 40 tokens to keep their triggers between the history and its
condensed replacement.
Resolutions:
- packages/util/time/package.json keeps this branch's description and the
polyfill dependency, with master's 0.2.1-alpha.2 version.
- docs/module-graph.md and .zh.md are regenerated: master's graph plus
this branch's context/time-context and schedule edges to util-time.
PowerPoint and Excel tasks in PTC mode wrote inspect.py, which shadows the
standard library and forces a delete-and-retry step. Apply the Word naming
rule to both skills, listing the libraries each one imports.
- Restore the office-docx new-document example from master. #6040 concerns
edits, and no Word creation case covers its removal.
- Tell direct package writers to copy each member once into a new ZIP;
python-docx, python-pptx, and openpyxl all reopen packages with duplicate
members without error.
- Anchor the script-name assertion so hyphenated names such as edit-docx.py,
which shadow no module, do not fail the Word e2e.
#5938 turned @deepseek-ai/dsh-session-persistence-jsonl into a function
plugin without a default export, while the SDK resume spec from #5988
still default-imported it. Typecheck failed with TS1192 and the spec's
six cases mounted an undefined plugin, which kept the coverage, snapshot
and Windows build checks red for every pull request.
Users of v0.2.1-alpha.2 who saved an account catalog through the Models
page editor must move single-model changes into modelOverrides, because
a models field now stops llm-deepseek-account at load. pi-ai routes that
name a missing credential now list no models.
The account README now says that a prerelease orders below its release,
that listed capabilities do not bound an override, that an override for
a refused unknown model is checked once the model becomes available, and
that an account whose listed models are all refused shows the generic
empty state. resolveAdapterOptions documents that resolved models keep
the input order, which the account catalog relies on.
The listing deadline now comes from dsh-timeout and carries
MODEL_LISTING_TIMEOUT, so a listing that misses modelsTimeoutMs fails
with TIMEOUT and "timed out after <n> ms" instead of ABORTED. Rescope
and disposal aborts keep reporting ABORTED.
The account route no longer accepts a models catalog, so paid Flash
translation compares Account modelOverrides (Official keeps models) when
it checks that the owner's model configuration is unchanged before
dispatch. The paid fixture and the Web e2e serve the account GET /models
listing instead of configuring models on the account entry.
Reuse read_image and automatic compaction in the standalone profile without
adding SDK slash-command handling. Update profile guidance, upgrade steps,
and startup and recorded-session coverage.
Product profiles mount no console exporter for ctx.logger, so the
listing failure warning never surfaced. The account route now writes
each loaded listing, the first failure of a failing streak with the
catalog it falls back to, and hidden listing entries to the console
under the [llm-deepseek-account] tag, as the account Platform plugin
does. Hidden entries are logged once per listing on every path, not
only during model discovery.
The account route always reads /models at the Messages origin; the
modelsURL option is removed so a configuration cannot point the listing
elsewhere. Model refusals now report "current version is <version>"
instead of "this build is", since users usually run a downloaded release
rather than a local build, and override diagnostics name the built-in
catalog instead of the build.
The session.create change is not perceptible to users: its only caller is the
Web client that ships in the same release. Remove the guide and the
cross-reference added to the New Session upgrade guide.
The analyzer normalizes its root with fs.realpathSync, which keeps a
Windows 8.3 short name such as RUNNER~1 in the runner's TEMP, while
TypeScript reports module-resolution results through
fs.realpathSync.native, which expands it. The guard compared the two
spellings, found the resolved lib/ declaration outside the workspace,
and let a missing alias through on Windows. It now canonicalizes the
root and every file with realpathSync.native and reports paths spelled
under the caller's root; the guard specs also run with the workspace
root spelled through a directory link.
Refs #5852
doc-sync, test:docs, hygiene, and check:all run at most 8 gates in CI as
well; the constant, the development guide, and the Agent Note now say so.
The Note also states that the source-only Typert guard rejects unresolved
workspace imports, so a missing alias fails before or after host-src.
Refs #5852
uniquePrefixMatch is exported and covered for unique, shared, last,
exact, absent, and empty cases, and a fixture repository with two commits
whose names share a seven-digit prefix shows that the shared prefix is
accepted while a longer unique prefix is rejected.
Refs #5852
rejectBuildOutputs caught a missing paths alias only when the package's
lib/types already existed. On a tree whose packages are not yet compiled,
as when host-typert runs beside host-src on a clean checkout, the import
resolved to nothing and checkDiagnostics: false hid it. The guard now also
fails when a face program cannot resolve an import of a workspace package,
found through its node_modules link, and names the paths entry derived
from the package's exports types condition.
Refs #5852
gen-doc-graphs states that its probe memo patches the system and needs a synchronous, non-nested caller; the typecheck graph comments why host-check does not wait for host-typert; the API gateway guide names the CI build lanes as the bundling Typert path; and the build-split Note marks its host-libraries measurement as superseded by host-contracts.
Refs #5852
The new Agent Note records why type checks generate Typert declarations
without bundling, why pre-commit leaves third-party notices to the test
lane, how the local worker budget is chosen, and how the documentation
gates and type-model.spec avoid repeated work, with the measurements and
the evidence that outputs stay the same. Notes whose facts these changes
superseded now describe the source-only Typert step and the test-lane
ownership of notices freshness.
Refs #5852
gen-cli-help launched its twelve source-mode dsh --help processes one
after another, each spending most of its time waiting on profile boot
I/O; they now start concurrently within the default worker budget, each
with its own temporary DSH_HOME, and the existing comparison consumes
them in the original order. gen-doc-graphs memoizes ts.sys file, directory,
realpath, and directory-listing probes for one run. Generated pages are
byte-identical; CLI help drops from about 52 s to 7 s and doc graphs from
about 47 s to 33 s.
Refs #5852
uniqueRepoFiles read every directory once per pattern and ** level and
resolved every file with realpath. One walk now lists each directory
once across patterns, resolves only paths reached through symbolic
links, and lets doc refs skip non-leading lib directories, whose files
it always excluded. markdown wrap, doc refs, and package paths return
the same file lists with about half the directory reads.
Refs #5852
markdown links parsed anchor targets twice more and probed existence
without a cache; translation pairing reparsed every document after link
normalization and globbed four times; the README model-experience and
limitations checks parsed each README three times; type equivalence
parsed all 1,835 documents; Session format references reparsed each pair
four times. Each gate now parses a document once: links and anchors come
from one tree, pairing reuses the original tree when every rewritten
destination keeps the block structure and falls back to a full reparse
otherwise, the README checks share one tree, a text prefilter skips
documents that cannot hold a source-equivalence fence, and the
persistence renderer passes its trees on. Outputs are byte-identical on
the repository, and seeded faults are reported identically.
Refs #5852
Each of the 61 cases copied the fixture onto disk and ran a full analysis
whose four TypeScript programs reloaded the DOM library, @types/node, and
zod v4; about 22,000 file-system probes per analysis dominated on a
network filesystem. The spec now mocks the node:fs calls the analyzer
makes and the ts.sys host for an in-memory workspace, stubs zod and
@types/node except in the Emitter case that runs real zod, drops the DOM
library from the fixture, and shares the pristine analysis read-only.
The file drops from about 316 s to 15 s with the same 61 cases and
assertions; the snapshot's external zod path no longer names a pnpm
store version.
Refs #5852
Browser inputs make every package source file a generator input, so the
pre-commit job ran the 16-second generator on nearly every commit while
few commits change its output. gen-third-party-notices.spec.ts already
asserts the committed bytes in the test lane, including the required
node 24 / coverage pull-request lane, and names the regeneration command
when they are stale. The generated preamble, the notices decision, and
the development guide now describe that ownership.
Refs #5852
verify-repository-references asked git cat-file for each of about 26,000
abbreviated hexadecimal candidates, which took 135 s on a network
filesystem. One --batch-all-objects listing (about 1.2 million objects,
0.6 s) now feeds an in-memory prefix search; a candidate still counts
only when its prefix names exactly one available object and that object
is a commit. The gate drops from 166.8 s to 15.7 s, and both
implementations classify 27,050 real and synthetic candidates
identically.
Refs #5852
os.availableParallelism() reports host CPUs rather than a container's
CPU quota (256 against a 64-CPU quota here), so local defaults spawned
255 Vitest forks (55 GiB peak RSS) and oversubscribed every scheduler.
scripts/parallelism.ts keeps the CPU count in CI and caps other runs at
12, or 48 for Vitest forks and the local coverage budget; documentation
and hygiene aggregates run up to 8 gates instead of 4. Explicit
DSH_GATE_CONCURRENCY, DSH_OXLINT_THREADS, DSH_COVERAGE_MAX_WORKERS, and
--maxWorkers still win.
Refs #5852
Type checks only need Host declarations and Typert-generated
declarations, but typecheck, lint, lint:fix, doc-typecheck, and the CI
typert-contracts gate rebuilt the whole Host tsdown pass, Desktop bundle
included, to obtain them. A source-only scripts/generate-typert.ts now
runs the same generator and artifact writer as the tsdown plugin, beside
Host package compilation: Typert reads only sources once the missing
@deepseek-ai/dsh-client-file-upload/types path alias exists, and
rejectBuildOutputs fails the pass when a workspace lib/ declaration
enters its program. typecheck runs as a build.ts scope that checks both
aggregates in build mode after their own face compiles.
Refs #5852
Share locationCoordinates between the Chat Builder and GroupTreeSegments,
find the last opening Turn with a loop instead of spreading every key,
and pass the resolved Location through chatNode so message Nodes resolve
it once. The notice e2e now waits for observable barriers (each Step's
row, the notice Turn's start, the notice row) instead of fixed sleeps,
asserts the settled tail through polling plus a later-frame recheck
instead of one absolute blank threshold, and fails on console warnings.
Record exchange in the terminology table and keep Goal Round in English.
Under "On next message" folding, a Turn woken by a notice (settled
subagent, goal round, schedule, background job) advanced the bottom Turn
and folded the finished Turn without an own-input driver, so the generic
fold room left a following reader looking at blank space.
Chat Nodes now declare a group-tree position (`groupTree`, ordered
`exchange` > `turn` > `process`). Human input claimed in Step 1 marks its
Turn as opening an exchange; notices and later steering carry no
position. `GroupTreeSegments` splits the loaded Turns at opening Turns,
and `bottomSource` covers the whole latest exchange, so notice-woken
Turns no longer fold earlier ones while the next human message folds the
exchange through the own-input path. Only `exchange` is read today; the
`turn` and `process` positions are reserved for the existing kind lists.
- WebServer.port reads number | undefined instead of masking the unbound
listener with an assertion; tests that dial it narrow the bound port.
- LegacyPrompt stays module-private; the web-app type import is a
devDependency only, since the emitted declarations never reference it.
- Copy: --public-url help names runtime context again, the public
deployments guide, web-app JSDoc, Config.publicUrl consumers, the Agent
Note matching rule, and three Known Limitations in the package README.
The web-runtime row provides webApp.getAdvertisedUrl(): the row's
configured publicUrl, otherwise the listener origin. harness-dev-context
reads it instead of webStartup.publicUrl, so a profile override of
publicUrl reaches the model as it already reaches DSH_WEB_URL and the
startup URL. The new package no longer injects webServer or webStartup,
and the startup flag provider returns to its master behavior.
- WebServer exposes getOrigin() instead of an origin getter, and it fails
loud before listen binds a port.
- The earlier Web-surface paragraph is a frozen literal, so later guidance
edits cannot stop earlier Sessions from matching; the projection reads a
prompt version with the loop's single-text-block rule.
- web-app drops its unused dsh-system-prompt dependency and stale
prompt-section wording in its description, README, patch comment,
--public-url help, and the round-trip test title.
Each recorded runtime-context snapshot with optional contexts gains the
tokenized checkout and Web GUI URL lines, matching the refresh output of
the code-language scenario, where only that message changed. The
minimal-preset snapshot suppresses optional context and stays unchanged.
The harness checkout path and Web GUI URL now reach the model as runtime
context from the new dsh-harness-dev-context plugin, so a process started
on another port, checkout, or installation no longer rewrites a Session's
logged system prompt. A Session whose prompt already embeds the earlier
value-bearing paragraphs keeps them verbatim through a host-only session
projection.
dsh-host-webserver gains WebServer.origin and bindUrlHost(); web-app keeps
only DSH_WEB_URL, the startup URL, and the browser handoff, and its root
declares the webStartup service type. app-boot drops
addHarnessSourceSection and HARNESS_SOURCE_SECTION.
build:artifacts produces every artifact, including the tsdown bundles,
the Desktop bundle, and Web, so naming it after sources undersold it;
build:check checks scripts, benchmarks, and website code besides tests.
The build.ts scopes, aggregate step ids, the Python builder flag
(--build-artifacts), workflows, callers, docs, and the build-split Agent
Note follow the new names. The note also records the naming
alternatives.
Refs #5852
- docs/development.md gains a situation-to-command table for build:src,
build:test, build, typecheck, lint and doc-typecheck (Chinese pair
updated).
- Note A states the typertPlugin() compatibility facts without discussing
an upgrade guide.
Refs #5852
- Note B: final medians of two interleaved samples (build 317.1 -> 169.1 s,
build:src developer view -51.6%, lint prerequisite 159.8 -> 90.9 s), the
CI lanes that run the parallel build, and their concurrency settings.
- Both notes: medians with sample counts instead of raw sample lists.
- Note A: why the typertPlugin() hook changes need no upgrade guide; final
serial stage times.
- Typert Remote note: the top-level build now runs the scripts/build.ts
step graph; build:lib and build:lib:host keep their remaining callers.
- docs/development.md agreement fix; packages/client/AGENTS.md rule 8 names
the manifest globs the gate checks.
Refs #5852
verify-package-paths reads root-relative packages/* strings in tests and
rejected the fixture's packages/generator, which names the real
packages/typert/generator leaf in the wrong group. The fixture now mirrors
that layout.
Refs #5852
- 2026-10-11-lossless-build-speedups: the React type packages declared only
at the root, the five Typert discovery/worker changes with the transform
filter, and the client tsdown preset manifest read; each item states its
purpose, change, measured effect, why outputs are unchanged, and its
trade-offs.
- 2026-10-11-build-src-test-split: build:src / build:test / build, the
dependency graph and scheduling, callers and CI lanes, which command
detects which error, measurements, and the intentional trade-offs.
- 2026-10-05-pr-artifact-typechecks: one-line adjustments where this change
replaces --artifacts-only with build:src and renames the Python flag.
Refs #5852
pnpm run build ran every step in one serial chain, including the two
noEmit aggregate programs (tests, scripts, benchmarks, website) that no
artifact step consumes, so the Host aggregate check alone delayed tsdown by
about 66 s.
- build:src (scripts/build.ts --scope src) builds every artifact in the
existing order and writes the client build record; it replaces the
removed --artifacts-only flag and the libraries CLI mode.
- build:test (--scope test) type-checks only the Host and Client aggregate
programs with tsc -p, concurrently, without compiling references or
checking prerequisites.
- build runs both as one dependency graph through run-gates' new
runAggregate: each aggregate check starts once its face's packages are
compiled, and Client compilation stays after the Host bundle that writes
the Typert /remote declarations. DSH_GATE_CONCURRENCY=1 serializes it;
DSH_GATE_FAIL_FAST=1 stops the remaining steps at the first failure.
Passing steps print one PASS line (DSH_GATE_VERBOSE=1 shows their output).
- PR artifact builds (e2e, release, preview, Node 22 compatibility) and the
Python builder (--build-src) use build:src; dev:web and dev:desktop use
build:src. test:*, bench, typecheck and the required consumer/Windows
lanes keep the complete build.
- lint, lint:fix, doc-typecheck and the Typert contracts gate prepare with
host-libraries (Host package compilation + Host bundle) instead of
build:lib:host; their own checks never read the aggregate root or the
Desktop bundle.
Parallel and serial build produce byte-identical lib/, Web dist and client
build record; a test-only type error fails build and build:test while
build:src passes.
Refs #5852
The client tsdown presets found a package's own manifest by name: a glob of
every packages/*/*/package.json, parsed until the name matched. tsdown's
native config loader imports each package config without module cache, so
the module-level cache never hit and all 82 configs repeated the glob
(40-125 ms each) synchronously on tsdown's main thread, where it delayed
every other package build. It was 34.5% of the client pass's main thread.
- clientBundle, staticLinked and clientLibrary take the package directory
(import.meta.dirname at every call site) and read <dir>/package.json
once; the package name, loader id and externals come from that manifest.
- A missing, unreadable or nameless manifest throws an actionable error.
- The glob, the name search and the module-level caches are removed.
tsdown client pass 12.78 s -> 8.73 s (median of 3 interleaved runs each,
-31.7%); all 11,566 lib outputs byte-identical; all 82 configs resolve the
same externals and banners.
Refs #5852
TypeScript builds a synthetic signature for every JSX intrinsic element and
computes a module specifier for @types/react (index and jsx-runtime) per
importing file. computeModuleSpecifiers visits every symlinked location of
that file and scans all 491 tsconfig paths for each; pnpm gave 65 packages
their own node_modules/@types/react link. Client test-aggregate Check
followed 26.9 + 0.494 * N seconds for N locations.
- Remove @types/react and @types/react-dom from all 67 workspace manifests
and declare them once in the root devDependencies; packages keep declaring
the react and react-dom they import (ui-slots gains react).
- verify-package-dependencies rejects either package in any workspace
manifest and requires the root declaration, so a new package cannot add
the link back.
- packages/client/AGENTS.md states the rule.
Client aggregate Check 59.1 s -> 26.5 s; the 76 client-only package
projects 54-57 s -> ~44 s wall. File set (2,613) and diagnostics unchanged.
Refs #5852
The Host tsdown pass ran Typert synchronously inside the first package's
writeBundle, blocking every other workspace build's JavaScript hooks for
about 12 s. Discovery dominated that time: it expanded the Host aggregate's
2,064 include entries, parsed all 362 referenced tsconfigs (Client ones
included), and walked 322 packages although only 28 declare a Typert export.
- Select packages by their manifest exports before any source walk.
- Parse face aggregates without expanding their file lists.
- Parse package tsconfigs lazily, only for analyzed packages; tsc -b keeps
validating every referenced tsconfig.
- Resolve the workspace root as the nearest ancestor holding both
tsconfig.host.json and packages/.
- Run workspace generation in a Worker Thread started at the first
buildStart; writeBundle awaits it once and fails the build with
TypertWorkerError on any worker failure.
- Filter the decorator transform hook by id so only TypeScript modules
cross into JavaScript.
tsdown host median 22.6 s -> ~10 s; all 743 hashed lib outputs are
byte-identical except the generator's own bundle.
Refs #5852
The scenario stamps its own prompt times from the Host wall clock, which
`support.ts` pairs with `pinHostClock`/`pinBrowserClock` and a fixture `createdAt`
so the calendar fact belongs to the scenario instead of the run, as
`seeded-history.e2e.ts` already does on the same fixture. With both clocks on the
fixture day the message and render instants cannot land on different days, so the
snapshot no longer depends on which side of local midnight the run falls.
Refs #5997
Hold cleanup of an older retained process while a newer call is waiting, then unload the provider. Require the pending call to reject after disposal without starting another process.
Validation: 305 focused tests passed, one skipped; persistent.ts, index.ts, and policy-processes.ts have 100% statements, branches, functions, and lines. Removing the shutdown guard makes the new regression fail.
Preserve the persistent runtime package description with master's alpha.2 version and locale exports. Refresh the two PTC prompt snapshots for the current plan-tool result type.
Validation: full build, 434 focused tests (one skipped), two built-runtime tests, two selected snapshots, package metadata, and all 43 doc-sync checks passed.
--no-lazy-fetch exists only in Git 2.45+, so older Git exited 129 before
creating a worktree. The environment variable is also honored by the
2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, and 2.44.1 maintenance releases.
Vitest reports an unexpected worker exit either as "Worker exited unexpectedly"
from the exit event or as "Worker coverage-forks emitted error" when the channel
closes under a send. The record describes the exit, and the error is logged
before it, so only the first form can order the record ahead of the report. The
previous assertion named one hardcoded message; #5900 widened it to whichever
form appeared and so claimed an order the error form cannot satisfy.
The case name no longer claims that order, and the report lookup relies on the
assertion above it instead of repeating the check.
Refs #5813
The root file passes the 1,960-word ceiling on the branch alone but exceeds it
once master's newest standing order is merged in, which is what `node 24 /
static` reports. Raise the ceiling to 2,080 and update the documented target in
the same change, per the "a too-low ceiling is a budget bug" rule.
- package-surface: split the two plugin forms (a function plugin named-exports
the Loader four, a service plugin default-exports its class), keep Host
Service Definition exports and the Client `/client` export discipline, replace
the wrong example that quoted live production code, state that the static
client libraries and `packages/util/*` are closed to new members, and drop
census numbers that rot on the next package.
- client-components: use the real Slot API — the inject face with the reserved
`hooks` compartment, the parent's derived `renderSlot`, `registerFactory`
scope declarations with local components at `renderFactorySlot` — drop the
string seat, pass the injected `useResource` explicitly with a protocol key,
and describe persistence as the spec's framework-run `persist` key.
- conversation-and-session: rewrite the reasoning example on the real
`conversation.chat.reasoning.body` seat and the published `reasoning.content`
Factory, and drop status annotations and future-tense spec-speak.
- remote-and-api: scope the JSON requirement to the wire payload so
`@Remote({ mode: 'stream' })`, lookup arguments, and a trailing `AbortSignal`
stay valid; drop a leaked Chinese parenthetical from the English page.
- general: measure through `benchmarks/` (`test:bench`, `check:ci:bench`,
`test:bench:memory`) instead of an invented command, state the baseline
without presuming a hook, and drop a leaked exception line.
- api-gateway: link the Remote and API rules instead of restating them.
- development.zh and AGENTS: drop an orphan anchor and widen the standing
order's trigger to the directory's scope.
The earlier "retired routing skill" claim was wrong and is dropped: that skill
was never committed, so the diff deletes nothing under `.agents/skills/`.
Move `docs/defensive-patterns.md` into `docs/defensive-patterns/`, one page per
artifact plus a README router, and state each rule as its requirement, the
condition a reviewer judges it by, its boundary and approver, and a correct and
a wrong example.
- `general.md` (the moved page): the existing bug-class rules plus timing,
value representation, shared-state ownership, decentralization, performance
evidence, and migrations.
- `package-surface.md`, `remote-and-api.md`, `client-components.md`,
`conversation-and-session.md`: the review requirements for those artifacts,
linking type definitions and semantics to `docs/subsystems/` instead of
restating them.
- `README.md`: the habits behind the rules and the route from artifact to page.
- `dsh-code-review` reads the owning pages before judging a diff; the
`dsh-architecture-discipline` routing skill is retired in favour of the
directory, and every inbound reference is repaired.
- Chinese counterparts, pairing records, and the documentation tier table are
updated together.
A write that completes at once only reached the local send buffer, so
counting it delayed dead-peer detection until that buffer filled. Only a
write that waited in the full buffer now resets the count, and the
connection owns all three activity signals.
A congested remote.mux link can hold the Pong behind data frames, so the
Host terminated sockets that were still moving data and the Client then
reconnected and resent. Any received frame or completed downlink write now
resets the missed-heartbeat count.
Name the original size when the store downscaled the image, keep repeated
whitespace in the path, localize the Chinese size line, and gate the card
on the envelope separately from collecting extra text.
The expanded read_image row no longer repeats the file name above the
image or prints the raw <path>/<type>/<content> envelope below it. It now
shows the full recorded path and each image's WxHpx and byte size in the
small code font; text appended by post-execute hooks stays visible.
Register calls before awaiting prior process cleanup. Carry policy cancellation into both Node execution modes and retain each admission until its call settles. Track persistent calls during provider disposal as well.
Cover unchanged-mode temporary escalation and policy changes that return to the original mode while cleanup is pending. Document the admission guarantee.
Validation: 308 focused tests passed, one skipped; both changed source files have 100% coverage. Two built-runtime smokes, two selected Session snapshots, all 43 doc-sync gates, and typed lint passed.
Add a parameterized admission regression for per-call and persistent-in-memory execution. Change the Session policy synchronously after submitting the runtime call and require cancellation before spawn.
The two new cases intentionally fail on the reviewed PR #5035 head: execution succeeds with danger-full-access after the Session becomes read-only. The 47 existing host-protocol and policy-process tests pass. No production changes.
A dismissed review now returns a successful exit_plan_mode result, so
the plan policy must not treat any success as leaving plan mode. Also
update the user-facing description of a dismissed review.
Decide the command chip's selecting step on deletion input events as well
as the character-deletion command, so iOS ranged deleteContentBackward no
longer removes the chip in one press. A selected chip now clears only
after a keydown that produced no character deletion, which keeps platform
shortcuts such as macOS Ctrl+H working.
A failed command submission settles to the leading chip like every other
transition, so submit-settled no longer carries the draft. The claim event
reuses the same handler. The seat rule runs as chip and paragraph
transforms instead of walking the whole document on every update.
Document the reload limitation under Known Limitations and assert that a
chip ending its block does not grow the composer.
Group built-in settings before optional and installed plugins, and open the full experimental catalog on a separate page.
Preserve detail navigation and unsaved configuration when installation finishes, and use the visible More label as the accessible name.
Choosing "Request changes" on a plan review rejected the question, and
exit_plan_mode turned that into a failed tool result asking the model to
stop. The loop then spent one more model request only to have the model
wait. A dismissed review now returns { approved: false } and concludes the
turn, so the user's next message starts the following request.
A claimed command is now a CommandChipNode on the draft's leading seat
instead of styled literal text. The submit machine follows the chip: it
holds the claim while the chip leads the document, releases it when the
chip is deleted or displaced, and re-enters claimed when history
restores the chip. Deleting at the chip's edge takes two steps: the
first Backspace or Delete selects the chip, the next removes it.
The claim-token decoration transform and the text-reference precedence
rule are removed with the literal token.
The Python SDK profile keyless smoke, the web keyless CLI smoke, and the
Python runtime dynamic-tools snapshot point DEEPSEEK_BASE_URL at a local
mock. Since the endpoint check, the DeepSeek chat key of such a route is not
sent to the official search endpoint, and search there has no configuration
of its own, so the model request no longer offers web_search. CI reported the
three stale expectations in the e2e, web browser snapshot, and Python
runtime lanes.
A written apiKeyEnv: DEEPSEEK_API_KEY matches the shipped row and keeps the
DeepSeek-route and endpoint checks, but a written baseURL counts as search
configuration even when it names the default endpoint. The README limitation
and the Agent Note said "default values", which wrongly covered baseURL too.
Replace the `routes` allowlist with the user's own configuration. A search
whose key or endpoint the user configured (a literal apiKey, an apiKeyEnv
other than DEEPSEEK_API_KEY, baseURL, or $DEEPSEEK_SEARCH_BASE_URL) serves
every model route without the route or endpoint check. Without such
configuration the key is the DeepSeek chat key: only the DeepSeek account and
official routes may use it, and only toward a search endpoint on the official
chat route's origin. The account token rule stays as before.
Both refusals now name the settings that give search its own setup.
Silero cannot back-date the first segment of a cold detector, so it
reports a start index several frames after speech actually began. Every
recording therefore lost its opening audio: measured across 50
utterances the median loss was 102 ms and the worst 230 ms — a full
syllable, which surfaced as dropped leading words ("麻烦把发票…" →
"把发票…", "用 Python…" → "写一个 Python…").
Only the first segment is affected; later segments aligned within 3 ms
because the detector retains history by then. Tuning cannot fix it:
lowering minSpeechSeconds from 0.25 s to 0.05 s left the median loss at
110 ms, and lowering the threshold to 0.2 still lost up to 174 ms while
risking false triggers.
Restore the dropped onset from the recording itself, bounded by the new
vadOnsetPaddingSeconds (default 0.3 s, zero disables). Measured on the
same corpus with identical DSH settings, this recovers the full no-VAD
accuracy and in the technical domain exceeds it, since segmentation also
trims silence:
语料 条件 无VAD VAD丢起音 VAD+回填 改善
audio clean 12.50% 16.33% 12.50% 23.5%
audio noisy10 17.74% 19.15% 17.94% 6.3%
audio_tech clean 10.34% 15.65% 9.81% 37.3%
audio_tech noisy10 25.73% 30.50% 26.26% 13.9%
Inference cost is unchanged (2.6 s vs 2.6 s on both clean corpora).
Update the blank reuse Agent Note and the writer acquisition note for the
review fixes: arrival-order claims with directory checks before preset
resolution, restoration from the logged preset, latest-connection coalescing,
and the registry select that leaves an already composed blank unchanged.
The Creator entry names cordis in its session.create request, and its chip may
still select cordis when the Session list updates before the new projection
arrives. select recomposed and logged unconditionally, so that race appended a
second agent-preset/selected record and announced tools/change again. select
now leaves a blank Session that records the preset and runs its current
revision unchanged; a replaced definition still recomposes and logs. The
Creator Web scenario pins a single selection record.
Keep one Workspace navigation options type: StartSessionOptions now carries
agentPreset, and openWorkspace and connectWorkspace take its preset field.
A connection joins the latest in-flight connection to its Workspace only when
both name the same preset, so a superseding request always reaches the Host,
and the map is keyed by the branded WorkspaceId instead of a composite
string. The fresh New Session path no longer accepts a preset it would drop.
Restoring a saved blank reloads that Session's projections first, because
listed values are cached hints that can lag the log after an unclean exit.
The New Session upgrade guide points to the session.create reuse guide.
session.create resolved the requested preset before queueing on the named
identity, so a later request whose preset resolved first could run first, and
an undeclared preset masked the directory conflict the README promises.
Queue first, check the named Session's directory and ownership, then resolve
the preset inside the queue, and report the preset each request left the
Session running instead of reading it after the queue moved on. The no-roster
conflict message now names its actual cause.
DeepSeek native search is served by DeepSeek's endpoint, so two checks now
gate the API key, in ready() and again in the key resolver of every search:
- Route: a model request on a route other than deepseek-account,
deepseek-official, and the new `routes` setting is refused with
WEB_PROVIDER_ROUTE_DISABLED, so another provider's conversation does not
bill DeepSeek unless a deployment lists the route.
- Endpoint: the official chat route's own key reference goes only to a
search endpoint on that route's chat origin, read from the active
dsh-llm-deepseek-api-key Loader row with that package's resolver;
otherwise WEB_PROVIDER_ENDPOINT_MISMATCH. A literal key, a separate key
reference, or a search endpoint on the chat origin passes.
The provider passes a resolver's own WebError through unchanged. A real
Loader composition pins the endpoint check. The pi-ai-conversation-updates
scenario gets its own tool sidecar without web_search, and the legacy
deepseek-messages route loses web_search in deepseek-messages-system-prompt.
Use the package's own `SubprocessTerminalActivity['state']` instead of a derived
alias, label the samples as `state:revision` so a reader cannot mistake the
suffix for a count, name the summariser's bound as a group count, and state only
the two observables the prompt count supports.
Refs #5755
An activity poll that times out reports only "unknown" or "Matcher did not
succeed in time". The Linux standby has failed that way twice, at different
polls, and the log shows nothing about what `inspect()` read, which returns
`unknown` for several distinct conditions.
Every activity poll now records the state and revision it samples and counts the
prompts printed while it waits, so a timeout names both. Repeated samples
collapse and the printed list is bounded. Timeouts, intervals and expectations
are unchanged, and where the poll budget equals the test budget the test timer
can still preempt this message.
Refs #5755
An unexpected fork exit can close the worker's channel under a send, which
Vitest reports as a runner-level worker error instead of the clean exit. It
then tears the worker down before the ChildProcess exit event, and
DiagnosticForkWorker treated that teardown as an orderly shutdown: it cleared
the observer and marked the exit expected, so the coverage log lost the pid,
file, code and signal it exists to report.
A worker error observed before a stop now keeps the observer, and a stop
requested after that error no longer marks the exit as expected.
Vitest reports one such exit either as the clean exit path or as a
runner-level worker error, so the spec accepts both forms and compares the
record against whichever appeared.
Refs #5813
The page no longer ships with the Web app, and review noted that the
web_search_20250305 requirement is not text a user should see. The hint
returns to master's wording, so this PR no longer changes the page's copy;
the endpoint requirement stays documented in web-search-deepseek.
The provider's endpoint must serve DeepSeek's native web_search_20250305
search, so the shipped Web app no longer mounts ui-settings-web-search; the
web-search-deepseek section is configured only in cordis.patch.yml. The key
the page wrote is the same DEEPSEEK_API_KEY the Models page stores, so a
session on any route can still search once that key exists.
- web-app bundle: drop the page row; keep the package dependency so a
deployment's Web profile patch can mount the page again. The package is
registered as an optional product package.
- web-search-deepseek: endpoint failures no longer send the user to a
settings page; they name DEEPSEEK_SEARCH_BASE_URL and
web-search-deepseek.baseURL. The endpoint guidance snapshot is refreshed.
- Web e2e: the official group lists three pages, and a new case mounts the
page through a patch overlay and checks its endpoint requirement hint.
master added the working-directory runtime context and changed the headless
prompt and tool schemas. The scenario's session now matches tool-call-turn
again, and its pinned sidecars still differ from the default class only by
the withheld web_search schema and guidance.
openWorkspace and connectWorkspace accept NewSessionOptions, so the Client
Cordis inspect catalog spec pinned outdated signatures and failed both
coverage lanes. Declare openWorkspace on one line so the generated catalog
signature carries no collapsed line breaks, regenerate the catalog, and pin
the new signatures.
session.create now reuses a named Session only while it is a reusable blank,
runs the requested or default preset, and creates a new Session otherwise.
Record the migration for JSON-RPC clients and Client plugins that name a
sessionId, including the removed session/writer-held result and the
existingPreset detail.
origin/master removed the runtime invariant plugins and the package rule
that asked a README to justify the absence, so the text that cited that
mechanism no longer refers to anything:
- the Agent Note states the elapsed-rendering change without the reading
invariant it used to cite
- the same note no longer says the durable reading format is one an
invariant validates
- the util/time README no longer explains why no invariant companion is
published, and its module JSDoc no longer claims the library formats
nothing while listing a canonical instant renderer
Resolutions:
- packages/util/time/package.json keeps this branch's description and the
polyfill dependency, with master's 0.2.1-alpha.1 version.
- packages/util/time/README.md and README.zh.md keep this branch's
structure and content, with master's model-experience sentence about
the zone instruction and timestamp. The re-recorded i18n sidecar
follows.
- docs/module-graph.md and .zh.md carry master's graph plus this
branch's context/time-context and schedule edges to util-time.
Master now creates a fresh Session for a plain New Session, and the Creator
entry names its preset in the session.create request instead of a separate
agentPresets.select call. Wait for that request in the Creator scenario and
count the startup blank in the outdated-cache scenario.
pi-ai sends Anthropic tool changes natively only when the initial tool list
has an active declaration. When every projected declaration is deferred,
prepend a non-deferred DeferredToolPlaceholder instead of failing the request.
Document the placeholder, the catalog-owned update capabilities, and the
image role limit as separate README entries.
Master removed `backgroundMode` and the `run_in_background` argument, so
every delegation starts a managed activation. Mount the working-directory
owner SubagentRuntime injects and the JSONL persistence root the spawn
provider requires, and synchronize on the child's cancellation, which the
parent teardown or the manager drain raises instead of a parent-only cause.
The Typert workspace pass scans the analyzer's symbol table, and every
symbol asked `registrationForFile`/`packageNameForFile` for its owning
package. Both looked up the real path and then scanned every registration
with `isWithin`, and `isWithin` re-ran `path.resolve` through `realPath`
for both arguments on each call. A CPU profile of the host pass put
17.0 s of the 30.9 s sampled in that scan, almost all of it in
`realPath`/`resolve`/`existsSync`.
The registration set and the analyzer's face are fixed for the analyzer's
lifetime, so each source path's answer cannot change: memoize both
lookups per analyzer. `resolve` depends only on the requested path and the
process working directory, so memoize the normalization step too; the
existing canonical-path cache keeps its "existing paths only" rule.
tsdown host pass, interleaved A/B: 39.89/37.18 s -> 25.70/25.06 s.
Isolated generator phase: discover 8.69/8.59 s -> 7.33/7.44 s,
generate 17.19/16.96 s -> 4.21/4.21 s. Every emitted `typert.*` file
hashes identically before and after each run.
waitForTitleAfterTurnEnd and waitForEventAfterTurnEnd now name the session,
expected record, and deadline when the deadline passes before the first log
harvest settles, and keep the vi.waitFor failure as cause. Previously they
surfaced Vitest's generic 'Timed out in waitFor!', which failed the title
diagnostic spec on the macOS Sandbox lane at master 090348e4.
The title diagnostic spec uses isolateDiagnosticTimeout like its siblings,
replacing the Windows-only 5s timeout.
Refs #5631
The upload warns instead of silently ignoring missing files, and the spec
pins the upload after the benchmark step. benchmarks/AGENTS.md and the
report Agent Note now name the artifact CI publishes.
Refs #5840
The node-24-bench job uploads benchmarks/.dsh-report after the benchmark
step, including when a budget assertion fails, so the report the Vitest
globalSetup renders survives the runner. #5838 deferred this step because
the authoring token had no workflow scope.
Refs #5838
Extension failures, unreadable package identities, a blocked session-log
upload, and degraded Messages replay recur on every request. Log the first
occurrence per field, route, module, or blocking event instead.
Co-authored-by: turtle1999 <[email protected]>
Request-extension fields are auxiliary. A contributor whose preparation
throws is now logged and omitted while the other fields are still sent,
and a post-2xx acceptance failure is logged without failing the request.
Package inventory is best effort: a named manifest without a version, or
a bare package whose manifest is missing or unreadable, reports version
"unknown" instead of failing preparation.
A failing request-extension contributor surfaced only
'DeepSeek request extension preparation failed'; the cause stayed on
LlmError.cause, which the turn failure record and retry notice drop.
Append the cause chain to preparation and acceptance messages.
Every recorded case states what it measures and which user scenario it
affects, shown on hover in the report. Endpoints whose workers report
process CPU time default to the measured non-CPU share and busy
parallelism; the Session corpus worker now reports CPU time per
endpoint. Machine profiles carry logical CPU counts, and the page
shows each default share with its source and can reset overrides.
The General font-size row gains a More font settings disclosure that expands
a font field for each of text, code, and the sidebar terminal, plus code
(10-16 px) and terminal (10-20 px) size steppers. Font lists are normalized,
stored in the ui-theme namespace, embedded by the boot script, and placed
ahead of each role's built-in stack; the code size moves the code typography
tokens; the terminal applies font and size live and refits without replacing
the shell. ThemeRuntime adopts Host sections only after its own writes settle.
Refs #5217
Two fixture helpers in surface.spec.ts returned ': SessionEvent', a
declaration-merge-extensible mapped union. Spreading such a value (the
rejection cases build '{ ...event, data: ... }') materialises an anonymous
union per fixture, and the following 'as SessionEvent' casts then compare
union against union, which dominates the root type-check program.
Return the single variant each helper actually builds, spelled as the
canonical indexed access SessionEvent<'system/message'> /
SessionEvent<'user/message'>, drop the casts that only existed because data
was a union, and trim the comment of the member count that drifts with every
declaration merge.
Measured on the host build: check 110.9 s -> 84.6 s (median, -23.7 %),
wall -17 % to -24 %; fixture types alone (clean buildinfo, root program):
check 53.4/45.8 s (Extract alias) vs 45.3/49.1 s (indexed access).
Two declaration forms relied on a checker binding a name the permissive way:
- cordis-host-runner declared 'export function CordisDynamicPluginId'
alongside 'import type { CordisDynamicPluginId }' of the branded type, so
the call sites resolved through the type-only import. Export the four
constructors under separate local names; the public names, JSDoc and the
type names in signatures are unchanged, and the typert signature metadata
keeps the original type names.
- views-type-chain.client.spec.tsx spread one slots.register call over three
lines, which lets a checker anchor the rejected overload on the argument
line instead of the call line, outside the @ts-expect-error directive.
Keeping the call on one line keeps the negative assertion effective.
Let a title provider replace one that is still draining, so switching the
titles bundle during an in-flight request no longer leaves no provider.
Omit group container rows from bundle inventories, since they have no
plugin entry to switch. Drop the obsolete preset-target product-use case,
fix the Claude Code row id example, and refresh stale Agent Note text.
Session restore and projection run after the file closes, so they use
no storage share; the page keeps one share per endpoint. Record the
repeat projection-list budget, drop the post-GC page heap from the
memory view, remove the unused profile group, and add the owning
Agent Note.
Remove the `{ preset, insert }` / `{ preset, id, ...override }` profile patch
operation added in #5773, together with the app-boot compiler and reload drain,
config-editor filtering, plugin-manager preset row inventory and retained-module
removal checks, the read-only preset rows on the Plugins page, and the
agent-preset-registry row identities that served them.
Session search, Ralph, persistent terminals, Codex, and Claude Code bundles now
insert ordinary Host rows whose tools register in the global tool layer, like the
earlier optional bundles. Every preset, including minimal, sees them, and toggling
a bundle updates live Agents without new composition generations.
Record budgeted benchmark endpoints and peak memory, and render a
self-contained interactive report that rescales measured times to
reviewed laptop and cloud profiles by single-thread CPU rating and
default-disk latency, and compares peaks with 4 GB and 8 GB of
available memory.
The packed rehearsal now names each stage on the child's stdout and bounds the
manager's removal, so an operation that never settles reports the profile lock
and the still-live pnpm process instead of only a test timeout. That evidence
located pnpm 11.7.0 leaving its worker pool alive after a short-circuit return
(pnpm issue 12297, fixed in 11.23.0 and carried by this stack's base).
Three attempts to keep pnpm off that path — a private pnpm store, installing
both bundles before removing either, and pre-declaring the profile's age
exemptions — did not change the outcome, so none of them remain.
- The summary lists only the catalog roots as installable specs; the other 29
archives stay in the run manifest, where the installer resolves them itself.
- Only a pnpm entrypoint receives pnpm's arguments, a catalog root counts as a
required edge for platform admission, and a signal that stops packing reports
the interrupted exit instead of an exception.
- The packed rehearsal names the Agent SDK's musl artifact on musl hosts again,
and its comments match what the fixture does.
- The cache test registers its pnpm children for termination, and a new case
keeps one profile and its real lockfile: pnpm refuses a new run's URL with
ERR_PNPM_TARBALL_URL_MISMATCH until the stale resolution is cleared with
pnpm's own `pnpm clean --lockfile` remedy, which the desktop README now
documents for same-version iteration.
The teardown asserted the Web process's SIGTERM exit inside `finally`, so a
body failure was reported as a shutdown timeout instead of itself. The
assertions now run only when the body passed, the earlier failure is rethrown
after teardown, and the listener readiness became a named step that no longer
clones the release pack coordinator's listen idiom.
Both are failure paths the registry owns: a signal that stops packing must
report as a cancellation rather than as a pack failure, and a client that
disconnects mid-tarball must not stop later requests. execa reports the first
either as a resolved canceled result or as a thrown error, so the packing step
now names both.
A packaged application installs an Official on-demand bundle as
`name@<running DSH version>`, and the plugin manager asks a custom registry
alone, so the unsigned test DMG cannot install a locally built provider before
its release reaches npm: each packed manifest still names the rest of the
repository by version, and ordinary bundle tarballs therefore resolve against
a registry that does not have them yet.
`pnpm run dev:bundle-registry` validates the Official catalog and the workspace
inventory, builds the official artifacts, packs the catalog's complete local
dependency closure with the release families' own payload and manifest checks,
records the run in `dist/test-bundles/<run-id>/bundle-registry.json` as its
completion marker, and only then serves it from 127.0.0.1 on an allocated port
under a fresh namespace. Repository-owned names are answered from this run or
refused locally; third-party packages keep npm's real metadata and bytes
through a fixed redirect. The run publishes nothing, changes no global
npm/pnpm configuration, and leaves DMG packaging untouched.
The packed installer rehearsal now installs that closure into an isolated
profile with no `file:` override, checkout link, ignore list, or scoped
registry standing in for a package the registry should answer, and it asserts a
transitive repository package served only by this run.
The fixture workspaces declare packageManager, so corepack resolves that
version when pack-release runs pnpm pack inside them; leaving 11.7.0 there
would exercise the version this change replaces.
pnpm 11.28.5 runs verifyDepsBeforeRun before a script, so `pnpm run install`
inside the installed node-pty directory first installed node-pty's own
dependencies into the package and ran its `prepare` build. Both reached the
packaged payload: the SEA blob then carried a node-gyp tree and tripled pkg's
file records, and postject aborted while injecting it. The step now runs the
package's install script alone, as it did with pnpm 11.7.0.
pnpm writes allowBuilds placeholders for blocked dependency scripts only when
it can prompt, so a managed run that always captures output left
pendingBuilds empty and the approval flow could not offer anything. The failed
run's own report is the surviving record: the profile policy now records those
names, which keeps approval, persistence, and the wildcard and decision guards
unchanged.
pnpm's legacy deploy links the deployed project into the target's node_modules
when the target sits inside that project. Materializing that link copies the
payload into itself and fails with ERR_FS_CP_EINVAL, which broke the
release-shaped Python runtime matrix on Linux and Windows. The staged payload
never carries the project source, so the staging tree's owner drops the entry
and leaves the deploy root's files alone.
pnpm 11.7.0 can finish its work, print `Done in Xs`, and then never exit
(pnpm/pnpm#12297, pnpm/pnpm#13617): finishWorkers() clears the worker pool
reference, and a later worker API call recreates a pool that is never
finished, so idle worker threads keep the event loop alive. The upstream fix
(pnpm/pnpm#13226) shipped in 11.23.0, and 11.25.0 fixed the hoisted-linker
rename race as well.
The hang surfaces in this repository as a packed-profile rehearsal that runs
`pnpm remove` through the plugin manager and then waits for the test deadline,
holding the profile write lock for the whole time.
Bump packageManager and devDependencies.pnpm in the root, the pinned pnpm in
apps/desktop, and the native/system packageManager; relock; exempt the fresh
package manager from the release-age window; follow the development guide
pair.
Review found the same Host profile write plus inventory reload chain still
uncovered in worktree-opt-in.e2e.ts, and still written as 10_000 literals in
plugin-manager.e2e.ts. Both now use PLUGIN_TOGGLE_SETTLE_MS, the README keeps
only the convention, and the constant's JSDoc names the store's load() as the
reader that republishes the switch.
A plugin-card switch republishes `aria-checked` only after the Host writes
the profile and the panel re-reads its inventory. That chain measured
0.5-0.8 s on an idle host and 2.0-4.8 s across 32 samples in a 16-worker
lane, so Vitest's 1-second `expect.poll` default truncated it and failed
the switch assertions of the CoT translation scenarios in CI.
Every poll that follows a plugin-card switch click now passes the shared
PLUGIN_TOGGLE_SETTLE_MS budget; assertions, retries, and product code are
unchanged.
A reasoning route always declares at least one level, so the adapter's
"no floor" path is defensive; the resolver rejects an empty list before any
consumer sees it. Mark that branch with the repo's v8-ignore convention and
state why.
`purpose` is a label for replay and transport metadata, so no adapter should
branch on one caller's value. Exact-model metadata now reports
`reasoning.floorEffort`, the least effort a route accepts, and the title
service selects it for its request. `llm-pi-ai` and `llm-deepseek` dispatch
the effort they receive and no longer recognize `session-title`; the
`minimizeReasoning` field is gone. A route with no registered adapter, such
as the recorded replay lanes serve, reports no floor, so the title request
keeps the adapter default instead of failing before dispatch.
Replaces the `minimizeReasoning` field from the previous commit.
`purpose` is a provider-neutral label for replay and transport metadata, so
an adapter must not branch on one caller's value. `GenerateOptions` gains
`minimizeReasoning`, which any auxiliary caller sets when reasoning would
consume the output budget it reserved for a short visible result; both
shipped adapters dispatch such a request at the least reasoning the model
supports, and `session-title-llm` sets it instead of relying on the
adapter recognizing `'session-title'`. The pasted type in the subsystem
page and the generated Cordis API catalog follow.
Prompted by review: llm-pi-ai must not know about session-title.
A request body also carries the session log, whose recorded title event
embeds the framed prompt, so a body-wide marker search matches the main
request too; both mocks now read the request's own messages. The headless
scenarios also assert the dispatched cap, which is the base-bundle ceiling
on the 256000-token route and the route override's 1024 in the pi-ai
compatibility scenario. The extraction cases cover asterisks that are not
emphasis.
The lowest-level dispatch keeps reasoning off the title's output ceiling,
not a small cap's visible text, and it deliberately skips the
requested-effort check. The README pair records that the dispatched cap
is the smaller of the configured ceiling and the latest folded
request/header, including the tighter-main-cap and override consequences,
and the accepted-title comment states the deliberate whole-line emphasis
rule.
Headless stream-json and session expected outputs record the title
request's maxTokens, and every one of them still recorded the previous
base-bundle cap.
The README pair states that an accepted result is the first non-empty
line of the model text, with one wrapping emphasis pair removed, and that
the dispatched cap is the smaller of maxOutputTokens and the cap the
routed adapter declares. The pair is re-recorded with both sides.
The headless and Web mock providers recognize a title request by its
max_tokens, which still assumed the previous 256-token base-bundle cap.
The recorded expected outputs carry that cap too and follow with it.
The prompt asks for a short title, so the cap only stops runaway output:
reasoning a model cannot switch off also counts as output, and 256 tokens
truncated titles on the HFAI gateway. The measured worst title response
was 153 output tokens, so 4096 is about 25 times the observed maximum.
Claude wraps some titles in asterisk emphasis and writes the title, a
blank line, then an explanation when the messages say little. Joining the
text blocks made that explanation part of the saved title. Take the first
non-empty line, drop one emphasis pair around it, and ask the model for a
short best-effort title instead of an explanation.
The dispatched cap is now the smaller of the configured cap and the cap
the session's current main request recorded, so a route the deployment
capped below the shipped ceiling is never asked for more than that cap.
A session-title request dispatches off exactly as a selected off does,
which on protocols that omit the reasoning field leaves the gateway
default in effect. The README now says so instead of implying reasoning
is always switched off. requestReasoningLevel follows the
resolveReasoningLevel it calls and names when it returns no level, and
the Loader composition helper takes provider config and further entries
as separate parameters.
Headless stream-json and session expected outputs record the title
request's maxTokens, and the headless and Web mock providers recognize a
title request by its max_tokens. Both still assumed the previous 64-token
base-bundle cap.
The base bundle capped title generation at 64 output tokens, sized for a
route that disables thinking. Models whose reasoning cannot be switched
off spend output on it even at their lowest level: on the HFAI gateway,
GPT-6 Sol and GPT-6 Astra used up to 87 and 121 output tokens for
five-word titles at reasoning low, so Sol still finished with max-tokens
on most first prompts. Raise the shipped cap to 256; routes that disable
thinking stop after the title and are unaffected.
Session-title calls carry a 64-token output cap and rely on the adapter to
keep reasoning out of it. llm-deepseek maps purpose 'session-title' to
thinking disabled, but llm-pi-ai ignored the purpose, so pi-ai routes sent
title calls at the route's default effort. On HFAI's adaptive-thinking
Claude models (profile reasoning: max) the thinking consumed the cap, the
call finished with max-tokens, and the session kept its fallback title.
The pi-ai adapter now dispatches a session-title request at the model's
lowest supported level: off when the model offers it, otherwise the
lowest declared level. GenerateOptions.purpose documents that obligation
for every adapter.
A successful verifier message was treated as terminal even though the
Worker Thread was still alive. The parent immediately terminated the
worker and detached cancellation, so an error, nonzero exit, or caller
cancellation after that message could be ignored and verification could
resolve successfully.
Keep the first successful response pending until an observed natural exit
with code 0. A missing response or nonzero exit rejects after the worker
has already exited. Error and abort callbacks retain the existing
terminate-and-join path, including its first-error and AggregateError
behavior. The scheduler stays unchanged: its permit remains held until
the verification promise settles, now after successful worker quiescence.
The worker already closes its parent port in finally, so success needs
neither a forced stop nor another protocol message.
Replace success-termination expectations with deterministic message/exit
barriers and cover post-response errors, nonzero exit, cancellation, and
permit handoff. Remove the obsolete hand-written termination thenable and
its retired unknown-assertion baseline entry. Add real source workers for
plain and Zstandard input, and require the built plain-Node migration smoke
to complete with zero termination calls. Document the settlement condition.
Native Windows CI recorded process access violation 0xC0000005 while a
migration fixture was active. Removing unnecessary successful-worker
termination is consistent with that evidence, but this commit does not
claim that the native faulting module or mechanism has been established.
The deterministic regressions prove the lifecycle defect independently;
the next native CI run must assess whether the observed crash recurs.
Validation:
- Original source failed all new message-to-exit regression scenarios;
the updated focused lifecycle file passes 19 tests with 100% coverage.
- Node 24 owning package: 19 files, 741 passed, 1 skipped; every included
package source file reaches 100% statements/branches/functions/lines.
- Real source workers passed for none/zstd; built plain-Node smoke passed
with zero terminate calls and no timeout or process signal.
- Exact Node 22.19 source-mode none/zstd workers naturally exited 0 with
zero terminate calls, exercising the async Module.register fallback.
- Host TypeScript build, focused lint, no-new-unknown-assertion gate,
README translation pairing, and all 42 doc-sync gates passed.
Related to #4387 and #4394.
The master cwd integration updated the shipped headless profile, but three
current snapshot scenarios merged without textual conflicts and retained
expectations from before the directory service was composed. Full CI
replay found the stale product-subagent-both persona and missing current
working-directory context in the no-message-tool and structured-parent
parent logs; those two scenarios also owned stale child/header sidecars.
Refresh only those three scenarios through the real built headless profile.
Record the required runtime cwd section in their four parent/child V4
logs, remove static cwd text from three prompt sidecars, and include the
new cwd start parameters and working_directory tool in three schema
sidecars. Preserve every model response and event count. No production
code, scenario input, workspace oracle, or historical V0-V3 fixture changes.
Validation: selective refresh passed 3/3. Full DSH_EXAMPLE_MODE=lib pnpm
run test:snapshot passed all 8 files: 197 passed and 2 PowerShell scenarios
skipped. The first full local run selected macOS CPython 3.9.6 and failed
the two Python PTC scenarios; the final full run prepended the existing
CPython 3.12.13 bin directory to PATH, with no runtime or fixture workaround.
SHA256 guards confirmed all 363 retained historical inputs unchanged;
JSON comparison confirmed the four changed logs differ only by cwd context.
TextMate scanning cost grows superlinearly with line length, so a
generated line of tens of thousands of characters blocked the page for
seconds when the sidebar previewed the file. Lines of 1,000 or more
UTF-16 units now render as one plain run in every highlighted surface.
Integrate the observed master checkpoint 7ab215e23e5d977aae7eb5d4fb91782d39969dbb without rewriting the earlier published checkpoints. Master adds current-directory events, directory-aware consumers, and retained Git worktrees; its old subagent startup paths overlapped the unified activation implementation.
Resolve directory selection within managed startup after acquiring parent ownership. Preserve the original Session origin while setting each new local child directory, retain persisted directory state on cold resume, and pass a required absolute cwd to external providers. Keep unified local/external ownership, full completion notices, parked-input host completion, SDK wait/error/shutdown behavior, and ACP cancellation semantics. Retain removal of the old in-process driver and continuation managers.
Combine SDK wait with the new directory requests, preserve the new master directory/worktree fixtures, regenerate derived catalogs from the combined sources, and refresh only the four stale prompt/schema sidecars. Preserve every protected historical schema, archived note, catalog-v2 acknowledgement, and recorded predecessor input.
Validation: full build; 59 CI static gates; 855 subagent tests with 100% coverage on changed core/external sources; affected consumer suites including 119 repaired-fixture tests; SDK 11 and headless 16 recorded scenarios; two local headless expected cases; six built nested SDK/ACP cases; lint, strict cast inventory, workspace constraints, and whitespace checks. Native Windows worker diagnostics remain additive and require the next CI run to classify the original crash.
Repeated native Windows coverage runs stopped a Vitest fork while a JSONL
migration suite was unfinished. Vitest's generic unexpected-exit error
discarded the process exit code and signal, preventing classification of
the failure despite identifying the missing test file from the inventory.
Reuse the public ForksPoolWorker diagnostic implementation and protocol
fixtures from independently reviewed PR #4388, pinned at
77e215ff76711ec75ed8aa08aa5b414780e539ae. The runtime helper is unchanged.
It reports PID, project, worker identity, outstanding file request, code,
and signal before stock Vitest reports the original failure. It clears
ownership only on the typed testfileFinished response, suppresses expected
stop, and leaves cancellation and failure handling with the original pool.
Wire that existing pool into generated coverage partition configs. Keep
the original worker counts, partition scheduling, test timeouts, coverage
thresholds, and failure verdicts. No environment, raw argv, or test object
is serialized. This commit adds diagnostic evidence; it does not claim to
repair the still-unidentified Windows crash. PR #4388 remains the separate
reviewable owner; no duplicate diagnostic framework or PR is introduced.
Adapt the copied fixtures to the current no-new-unknown-assertions rule:
declare the private preload exit function, validate consumed logger fields
with the public logger type, and assign matcher/rejection values to typed
unknown locals without assertions. Add a concise bilingual testing note.
Validation:
- Diagnostic suite: 10 passed, including a real configured Vitest fork
exiting 23, stock-pool negative control, successful silent shutdown,
unexpected exit 0, early exit, independent forks, and signal metadata.
- Coverage coordinator suite: 51 passed.
- Targeted lint and focused strict TypeScript check passed.
- pnpm exec tsc -b tsconfig.host.json passed.
- verify-no-unknown-casts passed; 1430 existing assertions unchanged.
- doc-sync passed 40 gates; the two initially failing gates were repaired
and rerun successfully: doc-typecheck and verify-doc-budgets.
- Translation pairing and git diff --check passed.
Refs #4387, #4388, #4394.
Co-authored-by: Chinesezjc <[email protected]>
The cwd regression used a fake Context cast through unknown. Updating its service lookup for descendant shutdown changed the exact legacy assertion fingerprint, which the no-new-unknown-casts CI gate correctly rejected.
Exercise initialize, prompt, and wait with the real Context, Agent registry, Session store, and a scripted LLM adapter. Spy on the real service methods to keep the cwd, reasoning effort, and token-limit assertions. Remove both obsolete unknown assertions and prune only their recorded allowances; do not add or broaden an exception.
Validation: the cwd regression passes; all 54 SDK server tests pass with 100% server coverage. The full check:ci:static aggregate passes 59/59, including the strict unknown-cast inventory. No production behavior changes.
The gated final-flush fixture awaited the real flush but dropped its boolean return value. The regression ran correctly under Vitest, but the full Host build rejected the mock against Sessions.flush Promise<boolean>.
Return the real flush result after the gate. This retains the observation order and matches the service signature without a cast or altered production behavior.
Validation: targeted terminal-capture-failure regression passes; the complete build is rerun after this typing correction.
SDK shutdown disposed its root Agent handles without stopping managed
Activations below those exact roots. The manager owns descendant handles
in a separate context, so an interrupted child with parked input remained
registered after shutdown resolved. Its settlement watcher could then
outlive the SDK root and race later projection teardown.
Close scoped descendant admission and await child-first drain before
releasing root handles or the server adapter. Keep draining limited to the
server's exact root Agents so unrelated parent trees remain live. Collect
drain failures without skipping the existing root/adapter teardown, and
preserve the final single-error or aggregate-error result.
Add real AgentLoop/SubagentRuntime regressions for parked children at
one and two levels, child-first disposal, preservation of an unrelated
parked tree, and descendant/root teardown failure aggregation. Correct an
existing Context.get test stub to return its LLM only for the LLM service.
Document the lifecycle order in the server JSDoc and bilingual README.
Validation: 52 SDK server tests with 100% server.ts statements, branches,
functions, and lines; four final shutdown regressions; host TypeScript
build; full lint; 21 quick documentation checks; staged pairing/diff checks.
Doc-sync passed 41/42 checks; the pre-existing config catalog source link
for subagent-acp/index.ts is stale at base and left to integration refresh.
Interrupting a local child can preserve unclaimed steering while leaving the Agent idle. Activation residency intentionally continues in that state, but completion barriers joined its result forever. The real SDK server reproduced the hang for both direct children and a nested parked leaf.
Join progressing work and cleanup while retaining parked inboxes and their activation results. Observe local activity and maintenance, external execution, unpublished ownership holds, and materialization; rescan after changes. Recheck resumed Agents after concurrent idle observations. Inbox insertion and ownership publication wake pending observations, so late non-waking injection cannot strand a result wait. Existing descendants remain responsible for their own work; no second state store or polling timer is introduced.
Document that persistent SDK/ACP hosts keep these children available for later wake-up, while headless shutdown discards unclaimed input. Simplify the final settlement recheck to retry changed readiness uniformly. Update generated API and event references from their sources.
Validation: real SDK negative controls fail at both depths on the prior manager with clean teardown; 545 tests pass across 27 files. Manager, local activation, and headless runner each reach 100% statements/branches/functions/lines. Six deterministic races cover revival, preparation publication/rollback, flush-time injection, and late children. doc-sync 42/42, targeted build, lint, and whitespace checks pass.
Removing the duplicate ACP directory helpers moved its Config declaration by one line. The generated English and Chinese catalogs still referenced the old line, so the exact-source freshness gate rejected the otherwise unchanged configuration.
Regenerate only the affected source links. No configuration fields, defaults, examples, or translated prose change.
Validation: pnpm run gen-config-catalog produced exactly these two link updates; the combined doc-sync run verifies freshness.
A child completion can wake the parent after its first completed turn. If
that summary cannot append turn/start or turn/end, AgentLoop reports an
agent/error and contains the rejected driver. Whole-agent idleness then
resolves, but the headless runner previously reused the older completed
terminal and exited successfully, sometimes printing the older answer.
Retain failures from the exact owned Agent with the current Session log
offset. Only a later terminal committed by the same Session clears that
failure. After work and persistence drain, fail the run before emitting a
final answer when no such terminal exists. Dispose both observers with
the run. Ordinary durable error outcomes and later successful recovery
continue to use the log's final terminal.
Add real AgentLoop regressions for missing summary start/end commits in
plain and JSON output, ordinary hook failures with and without recovery,
recovery after persistence failures, and unrelated Agent errors. Update
the bilingual exit contract and generated event consumer matrix.
Validation: 106 headless package tests; 100% runner statements, branches,
functions, and lines; 9 focused terminal-failure tests after the typed
append wrapper correction; package TypeScript build; full lint including
host build; 21 quick documentation checks; 42 doc-sync checks; diff check.
Local activation results were derived only from committed Session events.
When the first turn/end append failed, no ending existed and the result
defaulted to completed. When the first turn/start append failed, the initial
message remained unclaimed and kept the idle activation resident forever.
Both paths emitted agent/error but had no durable terminal to project.
Retain the log offset of the latest exact-Agent live failure on the local
activation. Clear it only when the same Session commits a turn/end at or
after that offset, so a later recovery can supply its own outcome and a
reentrant older terminal notification cannot erase a newer failure. The
child scope owns both observers and removes them with its Agent handle.
Capture error while that live failure remains. Let the failed local
activation settle despite its own unclaimed inbox, while preserving the
existing requirement to wait for owned descendants. Wake its settlement
observer when a live failure changes readiness. No public API, raw Agent
idle semantics, or descendant teardown policy changes.
Add regressions through real local activation creation for first start/end
append failures, recovery by later durable endings, exact-Agent isolation,
and an error emitted reentrantly during an older terminal notification.
Update the bilingual package contract and generated event consumer graph.
Validation:
- Both first-append regressions reproduced before the fix: turn/start
remained pending; turn/end returned completed instead of error.
- Six focused behavior cases passed after the fix.
- 423 subagent package tests passed; activation.ts and manager.ts reached
100% statements, branches, functions, and lines under scoped coverage.
- pnpm exec tsc -b packages/subagent/subagent/tsconfig.json passed.
- Focused source/test oxlint and git diff --check passed.
- doc-sync passed 41 gates; its sole stale event-graph failure was corrected
with gen-doc-graphs, then verify-doc-graphs passed for all seven graphs.
- README translation pairing regenerated and passed the doc-sync check.
Caller delivery changes result ownership, but does not make local workflow children private or remove their continuable catalog entries. The workflow README stated durable discovery without making the message and cold-resume consequences explicit.
Document that resident workflow children accept continuation and that cold continuation requires persistence and Session query. An ephemeral child therefore returns NOT_RESUMABLE after disposal. This describes current supported behavior and does not add fallback storage or a new child mode.
Validation: checked against startActivation, sendMessage, and cold-resume admission; English and Chinese pairing updated. Full doc-sync follows the combined review fixes.
ACP retained a private copy of the external-provider directory helpers after the other providers adopted the shared implementation. The copies differed on absolute-path validation and imposed separate filesystem branches and maintenance.
Use resolveChildCwd and validateConfiguredCwd from the existing subagent package. Preserve configuration-time relative-path resolution, parent workspace inheritance, missing-directory failures, and ACP diagnostic normalization. This deletes the duplicate directory implementation without introducing an abstraction or dependency.
Validation: 85 passing tests across the ACP provider and shared out-of-process helper suites, including real child process cwd, configured overrides, and invalid-directory rejection.
Parent completion notices now always carry the child closing answer, even when the child can send progress messages. Two assembled headless expectations still asserted the removed omission and made the snapshots-and-artifacts CI lane fail.
Require CHILD_RESULT in the settlement assertion and refresh only the owning parent and stream output expectations. Preserve released replay inputs, event ordering, sandbox denial evidence, and the recorded model responses.
Validation: DSH_EXAMPLE_MODE=lib pnpm run test:expected apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts apps/cli/tests/profiles/headless/tests/subagent-inheritance.expected.e2e.ts (18 passed).
The subsystem result paragraph still said that a parent log records the
final cleanup-failure status and that the result had already been returned.
The manager instead captures the execution result, performs cleanup, sends
that preserved result in the parent notice, and then resolves the public
result. Cleanup failure separately rejects dispose and marks the live
subagent/end event as error.
Correct the bilingual paragraph to name those actual recipients and timing.
Do not imply that the successful execution notice becomes a failed notice,
or change the runtime's independent execution/cleanup outcomes.
Validation: the updated bilingual pair passes. The statement is checked
against finishDisposal/notifySettlement and the existing cleanup-failure
regressions; final documentation gates run before publication.
The initial-cancellation regression supplied a synchronous content array to
defineContentToolFixture, whose executor contract requires a Promise of
content blocks. Vitest executes the fixture, but the strict repository
Host build correctly rejects its signature with TS2739.
Return the same blocks through Promise.resolve. Keep the deterministic
stream/output gates and assertions unchanged; do not widen the shared
fixture API merely to accept this one caller.
Validation: the focused initial-cancellation regression passes. The full
Host build is rerun before publication to validate the fixture signature.
Cancelling during the prompt's initial whenIdle() wait could retain its
slot indefinitely. If a child delivered a result while the aborted root
was unwinding, Agent.whenIdle() followed the replacement driver and waited
for the newly autonomous summary. The earlier child-wait recheck could
not help because settlement had not yet reached that child wait.
This is an inherited latent issue: the pre-PR ACP bridge also awaited the
same replacement-following whenIdle() after cancellation. Existing
continuable spawn children could expose it; the unified asynchronous fork
default makes the ordering possible for fork delegations as well.
Give the existing InflightPrompt one cancellation-completion promise,
replacing the local cancellation wake-up and its listener. The private
admission AbortSignal is the cancellation flag instead of duplicated
boolean state. The exact root's emitted status identifies the interrupted
activity's retirement and synchronously adopts that output queue. Later
root work and later output cannot replace the first captured completion.
Record whether cancellation began at public idle. Maintenance has that
public status too, so its next running transition establishes release of
work behind maintenance; the ordinary whenIdle promise provides a
fallback when no transition occurs or plugin disposal detaches observers.
Both observations settle the same promise. Settlement races that promise
against initial idle and child waits, then waits only for the interrupted
activity/output on the cancellation path. No future work is re-cancelled,
child admission remains open, and session close keeps its separate full
quiescence and descendant teardown.
Add two deterministic real-Agent regressions. One gates aborted model
cleanup, previously queued image delivery, and the later autonomous
summary independently. The other gates cancelled maintenance cleanup and
the later summary. Both failed before this fix; both now wait for old work
and output, return cancelled while later work remains gated, and permit a
subsequent ACP prompt to execute another real local delegation. Existing
plugin-disposal tests also verify the idle fallback after observer cutoff.
Update the bilingual ACP semantics and generated event-consumer matrix.
Validation:
- Both focused regressions reproduced pending cancellation before the fix.
- pnpm exec vitest run packages/acp/acp/tests --coverage --coverage.include=packages/acp/acp/src/session.ts --coverage.include=packages/acp/acp/src/index.ts --coverage.reportsDirectory=/tmp/pr4394-acp-owned-cancel-89ec33e5788-consumer-v2
(150 passed; both changed source files have 100% statements, branches,
functions, and lines)
- pnpm exec tsc -b packages/acp/acp/tsconfig.json
- pnpm exec tsdown --config-loader native --env.DSH_BUILD_FACE host --filter '@deepseek-ai/dsh-acp'
- DSH_EXAMPLE_MODE=lib pnpm run test:e2e packages/subagent/subagent-dsh-sdk/tests/nested-delegation.e2e.ts -t '^external tasks.*acp'
(3 passed, 3 unselected)
- Focused lint, named translation pairing, generated graph verification,
and git diff --check passed.
Independent ACP rereview found no remaining issue, passed seven focused
turn/disposal cases, and verified a prepended idle listener can start a
new hanging root before ACP handles the old idle event without retaining
the cancelled prompt.
Preserve the published 78ae4fc2 integration checkpoint and merge the later master tip separately. This master delta changes only the browser-GIF skill to use the managed DSH credential store through normal application configuration; it changes no product source, schema, or test behavior. The existing credential-provider recording overlay already follows that guidance.
Seed a fixed POSIX effective directory before the first request and disable ambient instruction discovery in the two pressure fixtures. Preserve the original project and existing output, headroom, retention, and summary limits while keeping shadowed token counts independent of temporary workspace path length.
Supply the required directory collaborator to current runtime fixtures, verify absolute result navigation and deployment fallback, and retain the valid V4 working-directory recording instead of the unreleased V3 input that contains a V4-only event.
The completion coverage audit left two uncovered paths: replaying an ACP
abort that occurred before listener registration, and ignoring an Agent
error from outside the SDK server's owned root sessions.
Remove the redundant ACP abort replay. The private cancelPrompt method
is the sole owner of admissionController.abort(), sets cancelRequested
first, and never resets it. Settlement checks that sticky cancellation
state after its initial idle observation and before awaiting the local
cancelled promise. A pre-listener abort therefore never needs to resolve
that promise; the listener still handles cancellation during child waits.
Add a real local subagent failure regression for SDK ownership. The child
emits agent/error through the normal AgentLoop path and returns an error
result, while the SDK root's wait and a subsequent prompt both complete.
The test also rejects observer warnings, so dropping the ownership guard
fails on the swallowed TypeError rather than merely executing the branch.
No fake Agent identities or private-state mutation are used.
Validation:
- Focused descendant test passed; removing the ownership guard as a
temporary negative control failed on the unexpected observer error.
- pnpm exec vitest run packages/acp/acp/tests packages/sdk/server/tests packages/subagent/subagent-dsh-sdk/tests --coverage --coverage.include=packages/acp/acp/src/session.ts --coverage.include=packages/sdk/server/src/server.ts --coverage.reportsDirectory=/tmp/pr4394-completion-coverage-00243b2f89e-consumer
(251 tests passed; measured statements, branches, functions and lines 100%)
- Focused lint and git diff --check passed.
The early-cancellation audit also reproduced a separate initial-idle wait
liveness issue. It is intentionally left for its own authorized follow-up
commit rather than being combined with this coverage change.
The SDK subagent provider now uses session/wait to keep a delegated child
runtime alive through nested work. A deployment that explicitly selects an
older dshBin can still initialize and accept a prompt but cannot satisfy
that completion request; it must report an execution failure rather than
silently treating the first idle as success.
State the required operation in the provider's owning failure/recovery
contract and update the current activation upgrade guide to tell users to
upgrade a separately configured runtime with the provider. This adds no
capability negotiation, compatibility fallback, or new runtime behavior.
Validation: upgrade-guide structure/word budget and both bilingual pairs
pass. The requirement matches the provider's direct session/wait request
and the SDK server's explicit unknown-method rejection.
A summary can fail while appending turn/start or turn/end and still leave
the root idle with a stable Session sequence. The SDK wait operation then
returned {}, letting the external provider treat the preceding completed
terminal as the result of the entire task. A listener installed only for
the wait would also miss failures between prompt admission and the wait
request.
Retain one latest live failure on each existing SDK Session record, scoped
to the exact owned Agent. Record the Session's next log offset when the
failure occurs. A turn/end from the exact owned Session clears it only
when that terminal was committed at or after that offset. This preserves
failures raised during terminal publication, keeps ordinary represented
turn errors in the durable outcome, and permits later successful activity
to recover. At stable root/descendant completion, session/wait rejects any
remaining failure. Raw session.status and HarnessSession.run behavior are
unchanged; no generic failure history or new notification is introduced.
Add seven owner-local cases for later start/end failures before and during
wait, subsequent successful prompts, represented errors, and publication
ordering including an undefined thrown value. Six failure cases returned
success before the fix. Strengthen listener teardown coverage to assert
all actual subscriptions are disposed after a disposer fails.
Extend the existing recorded subagent-continuable SDK scenario to exercise
session/wait. It still asserts that run() returns DONE at parent turn 1,
then requires child completion and parent turn 2/idle plus its final
summary to be delivered before the wait response. Bypassing the wait made
that ordering assertion fail. No recorded Session or golden output was
invented or refreshed. Update the protocol/server bilingual READMEs and
regenerate the event-consumer matrix for the new error listener.
Validation:
- pnpm exec vitest run packages/sdk/server/tests/wait.spec.ts before the fix:
6 failed, 1 passed (the represented-error case)
- pnpm exec vitest run packages/sdk/server/tests/server.spec.ts packages/sdk/server/tests/wait.spec.ts (40 passed)
- pnpm run test:e2e packages/subagent/subagent-dsh-sdk/tests/nested-delegation.e2e.ts packages/subagent/subagent-dsh-sdk/tests/loader-composition.e2e.ts (8 passed)
- DSH_EXAMPLE_MODE=lib pnpm run test:e2e packages/subagent/subagent-dsh-sdk/tests/nested-delegation.e2e.ts packages/subagent/subagent-dsh-sdk/tests/loader-composition.e2e.ts (8 passed)
- pnpm run test:snapshot snapshots/sdk/sdk.snapshot.ts -t 'replays subagent-continuable through dsh --profile sdk' (1 passed, 24 unselected)
- pnpm run doc-sync: Host compile/bundle, doc-typecheck and 40 other gates
passed; the generated event graph was stale, then regenerated and passed
pnpm run verify-doc-graphs (all 7 graph docs current)
- pnpm run lint:contracts-ready and focused lint of all changed SDK code
- named translation pairing checks and git diff --check
Independent SDK rereview and 7/7 focused tests found no remaining issue.
The parent task owns unchanged Python advanced/recovery validation on the
combined branch; this commit changes no Python or high-level SDK results.
Master adds the claude-code-mods recorded scenario, whose full assembled
prompt and tool-schema pins still describe foreground fork calls and the
removed run_in_background switch. Git merged this new scenario cleanly,
but its actual tool composition uses this PR's managed activation tools,
so CI rejects the stale request header and shared delegation guidance.
Refresh only the scenario's system-prompt and tool-schema pins. Preserve
its Session recording, model replies, Mods behavior, and runtime code.
The expectation remains a strict comparison with the actual shipped tool
assembly; no comparison rule is relaxed.
Validation: the owning lib-mode scenario passes refresh and then strict
replay. The original mismatch is recorded in the current-head snapshots
and artifacts CI job.
The two-stage real-stack workflow test still expected an empty parent
catalog after the caller-delivery discovery fix. That obsolete assertion
fails deterministically in both Linux and Windows coverage jobs: the two
local children now correctly leave continuable membership records.
Compare catalog identities and modes with independently observed workflow
agent-start identities. Keep the assertions that neither parent followup
nor steer was called, and that both child Agents reached disposal. This
checks the intended separation between durable discovery and result
notification rather than restoring the old missing-navigation behavior.
Validation: all three workflow integration cases pass. The original empty
catalog assertion is the exact failure in both current-head coverage logs.
A later summary can fail while appending turn/start, before AgentLoop
advances phase.turn. Its agent/error event therefore carries the previous
completed turn number. ACP ignored that matching number and reported the
old completed outcome. A failed turn/end append was also ignored and
returned cancelled despite no cancellation.
Retain every live Agent failure observed while the prompt owns queued
work. A subsequently committed turn/end supersedes that live failure and
provides the authoritative terminal reason. If the start/end append fails,
no terminal event clears the error, so ACP rejects the prompt. Remove the
unused turn-number argument from the bridge callback; numeric equality is
not evidence that a failure has a durable outcome.
Add deterministic regressions for later turn/start and turn/end append
failures after an earlier completed turn. Both failed before this change:
start failure returned end_turn, while end failure returned cancelled.
Normal represented model/turn errors retain their existing error mapping,
and the existing cancellation/recovery cases remain covered. Update the
bilingual ACP behavior documentation.
Validation:
- pnpm exec vitest run packages/acp/acp/tests/turns.spec.ts -t 'rejects a later'
rejected both pre-fix outcomes (2 regressions reproduced)
- pnpm exec vitest run packages/acp/acp/tests (148 passed)
- pnpm exec tsc -b packages/acp/acp/tsconfig.json
- pnpm run verify-translation-pairing --write packages/acp/acp/README.md
- git diff --check
The ACP completion loop previously observed root idle and no children,
then awaited outputTail outside that loop. An autonomous root turn could
start while an earlier image update was blocked in conversion. Turn
correlation adopted the new turn and cleared endReason, but settlement
did not wait for that turn. Releasing the old image therefore returned
cancelled without any cancellation while the root was still running.
Keep committed output delivery inside the normal completion observation.
After output drains, re-read root status and Session sequence before
settling; any new root activity returns to the idle/descendant checks.
Read mutable cancellation and idle state through local observation
functions so each post-await decision uses the current values. Preserve
the separate cancellation path and its prompt output drain.
Add a deterministic regression that blocks the initial image update,
allows the first idle/no-child check, starts a gated autonomous root turn,
and releases the original image. The prompt remains pending until the
later turn completes, then reports end_turn. A subsequent ACP prompt
runs another real local subagent through the shared delegation fixture.
The bilingual README defines work accepted during output draining as
part of the still-open ACP activity interval.
Validation:
- The new focused regression failed before the fix: it observed cancelled
while the later root turn remained gated.
- pnpm exec vitest run packages/acp/acp/tests (146 passed)
- pnpm exec vitest run packages/acp/acp/tests/turns.spec.ts (39 passed)
- pnpm run test:e2e packages/subagent/subagent-dsh-sdk/tests/nested-delegation.e2e.ts (6 passed)
- pnpm exec tsc -b packages/acp/acp/tsconfig.json
- pnpm run lint:contracts-ready
- pnpm run doc-sync (41 gates passed; doc-typecheck identified an optional
Agent in the extracted test fixture, corrected with an explicit guard)
- pnpm run doc-typecheck (Host build and all 79 documentation blocks pass)
- pnpm run verify-translation-pairing --write packages/acp/acp/README.md
- git diff --check
Independent rereview confirmed both completion races are fixed and that
an original image-delivery failure remains attributed to the prompt even
when a later root turn has already started.
An ACP prompt can be waiting for descendants while its root is idle.
Cancellation aborts that wait and calls agent.cancel(), but a child's
settlement message can wake the root in the next microtask. The wait race
then returns with the root running, causing settlement to enter another
whenIdle() before checking cancelRequested. An unrelated long-running
summary consequently retains the cancelled prompt slot indefinitely.
Recheck cancellation immediately after the descendant wait, before any
new root idle wait. Cancellation stops work present at the cancellation
call and releases that prompt; child messages accepted afterward remain
autonomous work. Do not re-cancel those later turns or drain descendants,
which would either race further wakeups or close future child admission.
Document this cancellation boundary in the bilingual ACP README.
Add a deterministic regression that delivers a child message in the
microtask after agent.cancel(), gates the new root turn, and verifies the
original prompt returns cancelled while that turn is still gated. After
releasing the autonomous turn, a second ACP prompt invokes a real local
subagent activation through a tool and completes without another cancel.
Declare the test's subagent dependency and retain only its workspace
importer change in the lockfile.
Validation:
- The new focused regression failed before the fix: the prompt result was
undefined while the late root turn remained gated.
- pnpm exec vitest run packages/acp/acp/tests/turns.spec.ts (38 passed)
- pnpm run verify-translation-pairing --write packages/acp/acp/README.md
- git diff --check
A registered provider can be used in a composition without the agents
service. startActivation checked the absent registry against the supplied
parent first, so it reported UNAUTHORIZED instead of identifying the
missing runtime dependency with CONTINUATION_UNAVAILABLE. This misdirected
callers toward parent identity even though no activation manager existed.
Require the manager before checking the live parent. Keep provider lookup,
capability validation, and parent identity enforcement in place; provider
startup still cannot run in an incomplete composition. Document the two
failure conditions in the owning bilingual README.
Validation: the new missing-runtime regression failed with UNAUTHORIZED
before the change and passes afterward. All 51 service tests pass, including
unsupported providers/capabilities and invalid parent identity. The changed
README pair verifies successfully.
The unified delegation tool returns as soon as an activation accepts its
prompt. SDK and ACP child runtimes could therefore reach root idle while
an admitted fork was still running. Both external providers interpreted
that idle edge as successful task completion and disposed the runtime,
returning a waiting message while cancelling the nested work.
Add the opt-in SDK session/wait request for existing SDK-owned sessions.
It waits for root idle, managed descendants, and any resulting root turns,
then requires stable idle state and Session sequence across the final
check. Preserve raw session.status notifications and HarnessSession.run's
receipt-to-next-idle API; only the task-owning SDK provider uses the new
completion operation. Subscribe before prompt admission, validate and
fold queued root events through the FIFO wait response, and retain
accepted partial output on cancellation or transport failure.
Keep ACP prompt ownership through descendant completion and later root
summary turns, including their stop reasons and output-delivery failures.
Race child waiting against the existing prompt cancellation controller;
cancellation releases the prompt without permanently closing descendant
admission or repinning the original model selection onto later turns.
Session close retains child-first descendant teardown.
Add real Loader/profile regressions with a gated nested fork for SDK and
ACP completion, cancellation, and final-summary failure. Add focused
coverage for unknown/malformed wait requests, SDK root summary ordering,
ACP cancellation followed by another prompt, and later-summary image
output draining/failure. Update the five owning bilingual README pairs.
Validation:
- pnpm run build
- pnpm run typecheck
- pnpm exec vitest run packages/subagent/subagent-dsh-sdk/tests/subagent-dsh-sdk.spec.ts packages/sdk/server/tests/server.spec.ts packages/acp/acp/tests/turns.spec.ts (123 tests at initial fix)
- pnpm exec vitest run packages/acp/acp/tests/turns.spec.ts packages/sdk/client/tests/sdk-client.spec.ts (80 tests)
- pnpm exec vitest run packages/acp/acp/tests/turns.spec.ts packages/sdk/server/tests/server.spec.ts (70 tests)
- pnpm exec vitest run packages/acp/acp/tests (144 tests)
- pnpm run test:e2e packages/subagent/subagent-dsh-sdk/tests/nested-delegation.e2e.ts (6 tests)
- DSH_EXAMPLE_MODE=lib pnpm run test:e2e packages/subagent/subagent-dsh-sdk/tests/nested-delegation.e2e.ts (6 tests)
- pnpm run test:docs (21 gates)
- pnpm run doc-sync (42 gates)
- pnpm run lint:contracts-ready
- git diff --check
The unchanged SDK next-idle API remains covered by its existing client
tests; no raw notification or persisted Session event format changes.
A structured local activation now accepts continuation messages, but its
terminal predicate checked only delegated children. A correction accepted
during the model request could therefore remain in either Inbox queue while
the earlier response committed structured_output. The loop later consumed
the correction, but the terminal tool guard prevented revising the captured
value, so callers could receive the obsolete answer as completed work.
Require both Inbox queues to be empty as well as all owned children to be
released before staging a structured result. Keep input admission closed
from that synchronous staging point through authoritative result policy,
including the enclosing PTC result. Derive this admission state from the
existing staged, pending, and captured records instead of introducing a
second lifecycle controller. Failed results delete their stage and reopen
input; successful capture keeps the existing terminal behavior. Caller-owned
delivery, complete final text, descendant ownership, and cold resume remain
unchanged.
Add deterministic barriers for accepted steering and queued input, and for
Native/PTC post-execute acceptance and rejection. All six new cases failed
against the unchanged runtime for stale results or incorrectly accepted
late input, then passed with the fix. Extend the authored headless structured
scenario to reject answer 41, consume a parent correction, and commit 42.
Its two own schema sidecars also need the current master bash/edit/write
definitions: retaining their previous definitions fails verifyHeaders on
this pinned base. Update the owning bilingual result-admission documentation.
Validation:
- pnpm run build:native-system
- pnpm exec vitest run packages/subagent/subagent/tests/structured.spec.ts
packages/subagent/subagent/tests/continuation.spec.ts
packages/subagent/subagent/tests/external-activation.spec.ts (214 passed)
- pnpm run test:snapshot:refresh snapshots/session/headless.snapshot.ts
-t subagent-structured-parent
- pnpm run test:snapshot snapshots/session/headless.snapshot.ts
-t subagent-structured-parent (1 selected scenario passed)
- pnpm run test:docs (21 gates passed)
- pnpm run doc-sync (42 gates passed)
- pnpm run lint completed its host build; after correcting test deferred
generic types, pnpm run lint:contracts-ready passed
- git diff --check
SubagentRun.id previously promised uniqueness only within one parent,
but the unified manager indexes every external activation by that id in
one runtime-wide resident map. Publication also checks the live Agent and
Session registries. Two compliant-looking provider results could therefore
collide even when they belonged to different parents.
Document the existing shared Session id namespace across all parents,
providers, and local Sessions. Update the package reference, bilingual
type-equivalent declaration, and the current upgrade guide so custom
providers know to replace parent-local counters with fresh execution ids.
The shipped ACP, DSH SDK, Codex, and Claude Code providers already mint
UUIDs; no runtime mapping or additional retained identity state is needed.
Add a cross-parent collision test through startActivation. It proves that
publication rejects the duplicate, disposes only the new external handle,
leaves the second parent catalog empty, and preserves the first catalog
entry and execution result through normal cleanup.
Validation: all seven external-lifecycle tests pass, as do scoped bilingual
pairing, verify-upgrade-guides, doc-sync, and full lint. Cordis catalog and
inspection-catalog regeneration produces no tracked artifact changes.
The activation refactor removes tool-subagent configuration keys, changes
the model-visible result from foreground or Job-backed output to an
activation receipt, and removes a published in-process driver package.
Updated package references describe the new behavior but do not tell an
existing deployment or package consumer how to migrate those surfaces.
Add the bilingual v0.2.1-alpha.1 upgrade guide and pairing record. Explain
which cordis.yml keys and tool arguments to remove, how to consume parent
completion notices, when host code should await caller-delivery results,
and how publication changes cancellation ownership. Name the existing
Spawn/Fork providers and prepareContinuable API as the driver replacement
without adding a compatibility adapter or promising a foreground mode.
Validation: verify-upgrade-guides, scoped verify-translation-pairing,
verify-md-links, and doc-sync pass. A temporary runtime probe executed the
guide's exact YAML and TypeScript fences and confirmed the caller result,
catalog membership, and absence of a parent notice. The four existing
parent-result tests pass. The probe was removed after execution.
The retained continuation decision still claims a public followup method,
a bare MessageId start result, no activation result/cancellation ownership,
and no human Queue/Steer operations. Those statements contradict the current
startActivation receipt and adjacent-Agent/host message operations already
documented in the same record. The subsystem introduction also says the
activation result can settle before cleanup, despite the manager resolving
that result after teardown and notification.
Correct the current realization in the English/Chinese active documents.
Keep the original single-inbox and residency rationale, distinguish accepted
message identity from the activation receipt, and state the actual result
and disposal timing. Do not change implementation, archived decisions,
provider-level result timing, or runtime APIs.
Validation: doc-sync passed 41 gates on the first run. Its remaining pairing
gate found one Chinese README target using the English locale; correct that
target, re-record the pair, and verify both changed pairs successfully.
The two subagent scenarios introduced by this PR retain tool-schema pins
from before master's Bash deletion/path guidance and filesystem argument
ordering changes. Their actual runtime behavior and recorded model replies
still replay, but strict assembled request-header comparison now rejects
those stale schema descriptions and required-argument order.
Refresh only the three owning schema-pin files against the merged shipped
profile. Preserve every Session recording, model stream, event reference,
timestamp, prompt, and runtime implementation. This keeps the real header
assertion instead of weakening the normalizer or rolling back master tools.
Validation: both affected headless scenarios pass in refresh mode and then
in strict lib-mode replay; the other 33 selected replays passed unchanged.
The recording workflow currently points only to a repository .env file.
A valid key can instead live in ~/.dsh/.credentials.yaml, so missing
DEEPSEEK_API_KEY and .env do not establish that real-model recording is
blocked.
Name the managed credential source and route it through the existing
credentials-local path override when the recording uses a scratch
DSH_HOME. Preserve application-state isolation and keep secret resolution
inside the normal provider rather than printing or manually extracting
key values. This changes only recording instructions.
The collapsed Windows caption toggle and New Session kept a 50% circle after
the unified radius standard moved compact icon buttons to --dsw-radius-sm, so
the toggle's hover fill changed shape when the sidebar collapsed.
Integrate master 78ae4fc2d4d8ecaebb4b674028f781a358b92cc9 after the four
independent review fixes. Keep this base update separate from those fixes
and from subsequent review changes so the integration is independently
reviewable and the observed-master checkpoint remains preserved.
Retain activation-owned execution, caller-independent local discovery,
and unconditional parent final-answer delivery. Preserve master's preset
scoped scheduling tools and all delegated-child schedule deny rules. Move
the new scheduling regression from the removed driver package into the
surviving subagent package and run it through a real Spawn activation.
Preserve master's removal of runtime invariant plugins, dependencies,
exports, and test mounts. Keep context disposal before fixture directory
cleanup. Combine Python workflow ordering with activation/catalog events
without inventing unsupported source-plane import paths.
Keep all frozen Agent Note archives byte-for-byte identical to master;
do not accept Git's automatic edits to renamed archived notes. Retain
current lifecycle and delivery facts in active documentation, repair its
links, and regenerate catalogs/persistence schemas from merged source.
All 62 master persistence roots remain; only subagent/catalog gains the
PR's external membership extension. Keep master's third-party lock graph
and update only workspace dependency changes.
Validation before this checkpoint: 683 focused tests passed, seven
Windows-only cases skipped; 2,772 archived artifacts verified. Generated
catalog and active-pair checks passed. Fresh artifact build and remaining
build-dependent documentation checks continue before publication.
A local child can have send_message available and still finish with a plain
text answer or use the tool only for progress. Selecting completion content
from tool availability drops that captured answer and leaves the parent
with a status-only notice. The recorded spawn case already demonstrates
this: its child returns CHILD_OK without calling the available tool.
Remove the includeClosingText policy and pass every captured final text
through the existing text-only notice renderer. Preserve structured
results, safe diagnostics, external continuation wording, and caller-only
result delivery. No delivery ledger or additional lifecycle state is
needed. A child that sends its final answer explicitly may repeat it in the
completion notice; that cost is preferable to making result delivery
depend on model compliance.
Extend the real-loop parent-result regression with an available-but-unused
messaging tool, restore the unconditional lifecycle expectation, and pin
text alongside structured results and diagnostics. The new regression
fails on the prior implementation because CHILD_RESULT_42 is missing.
Update the owning bilingual descriptions and the exact parent notice
content in headless and TypeScript SDK recordings. Keep replay streams,
released generations, and unrelated recorded clocks unchanged.
Validation: 317 focused lifecycle/workflow tests; full build; 26 focused
headless/SDK replays; Python SDK advanced/recovery smoke (unchanged
fixtures); test:docs (20 gates); doc-sync (42 gates); full lint;
git diff --check.
Caller delivery previously suppressed both settlement messages and local
catalog membership. Workflows therefore stopped publishing the durable
parent-child edge that the parent header and recursive discovery require.
The workflow panel only opens running members, and the ordinary sidebar
hides subagent Sessions, so completed workflow transcripts had no normal
navigation path even though their logs still existed.
Record every successfully admitted local child in its parent's catalog,
independently of the result recipient. Membership answers which local
Sessions belong to the parent; delivery answers who consumes this activation's
result. Keeping those decisions separate restores completed-child and
descendant discovery without duplicating workflow completion messages or
adding return guidance to caller-owned work. Publication failures retain
the existing rollback transaction for both delivery modes.
These local children intentionally retain the unified continuable mode:
list_agents includes them, the parent catalog opens their transcripts after
reload, and the existing direct-parent controls can cold-resume them. No
one-shot execution path or additional lifecycle state is introduced.
Caller-owned external executions still use their consumer's membership
records because they have no local Session to open.
Update the existing bilingual service/workflow documentation and decision
records, refresh the owning workflow/Ralph/advanced Session recordings and
Python SDK event expectations, and preserve unrelated recorded stream times.
Validation:
- Full repository build passed.
- 443 subagent, workflow-host, and Ralph tests; 14 list_agents tests passed.
- Four focused headless workflow/advanced snapshot refreshes and replays passed.
- Three shipped-Web workflow tests passed, including completed-child catalog
navigation after reload and the continuable composer.
- Python SDK advanced and scheduler-recovery snapshots refreshed and replayed
through the built dsh CLI with Python 3.12.
- Three discovery regressions fail with the original catalog exclusion and
pass after restoring this fix.
- test:docs (20 gates), doc-sync (42 gates), lint:contracts-ready, Host and
Client TypeScript builds, and git diff --check passed.
Portal the session-header job popover to the document body and place it
with useAnchoredPosition, so the clipping center column and the right
sidebar no longer cut off its right edge.
Restore six expected-output files to the PR merge-base versions so the
subagent activation refactor does not carry unrelated recording churn.
The persistent-tools SDK notifications contain the same parsed records;
only JSON object key order changed. The multi-turn, empty-response-retry,
error-finish, packed-chunks, and text-turn writer oracles were refreshed
from V3 to V4 representations together with volatile stream clocks and
hook timing. These cases do not exercise the changed subagent behavior.
The snapshot harness explicitly accepts older supported writer oracles
and restores them through the strict Session catalog before comparison.
Keeping the existing outputs retains the same assertions and historical
coverage without rewriting canonical released Session generations.
Validation:
- pnpm install --frozen-lockfile completed.
- pnpm run build passed, including the host addon and runtime artifacts.
- Six focused lib-mode keyless replays passed: SDK multi-turn and
persistent-tools; headless empty-response-retry, error-finish,
packed-chunks, and text-turn (2 files; 6 passed, 155 filtered out).
- Parsed persistent-tools protocol records are equal before and after.
- All six files exactly match merge base 8af775c480d73c4692813387622fe16bf8eadf37;
no canonical Session recordings or production files changed.
- git diff --check passed.
Remove the second child_process mock added during subagent integration.
The existing mock already isolates Git from concurrent workspace writes
and reads the fixture's sourceCommit and dirtyFiles controls. The later
factory replaced those controls with a constant commit and clean status,
so the Windows tests could no longer detect changes made while awaiting
packaging confirmation.
Keep the original mock and its fail-loud command handling. This restores
the existing git-head and git-status rejection cases without changing
packaging behavior or adding a second fixture abstraction.
Validation:
- Owning Vitest file: 3 passed, 7 Windows-x64-only cases skipped on macOS.
- Prior isolated duplicate-mock probe: 2 failures with the duplicate,
2 passes with only the original state-controlled factory.
- Original exact-head Windows CI fails the same two Git-change cases.
JavaScript object enumeration moves canonical array-index property keys ahead
of other string keys. Describing every numeric-looking Loader ID as reordered
is too broad: leading-zero and other noncanonical numeric strings remain
ordinary string properties.
Name the exact key category in the inventory fixture's local comment. The
inventory-* IDs exclude every canonical array-index key, and the real Loader
activation, fixture order, output assertions, and production code are unchanged.
This addresses the automatic review's nonblocking terminology clarification.
Validation:
- Type-aware Oxlint passed for the owning inventory.spec.ts.
- git diff --check passed.
- No behavior or test inputs changed, so the already observed 46-test and
74/74-branch evidence remains applicable.
`collectCliHelp` stops propagating an alias when it reaches a page
already on the current path, so a `help [command]` row that prints its
parent's help no longer recurses until the stack overflows. `serve|s`
command rows are split into separately collected names.
The CLI reference and upgrade guide describe the forwarded-argument
boundary that Commander applies, including a leading pnpm option, and
args.spec.ts pins that `--profile` placed after a leading pnpm option is
forwarded. Generated pages use the repository's two-line generated
header, and docs/AGENTS.md lists the CLI help among the generated
references.
Refs #4114
`scripts/gen-cli-help.ts` runs the source `dsh` launcher with temporary
Harness and Agents homes and captures the launcher, `dsh plugin`, and every
shipped profile's text help (profile names come from `PROFILE_TEMPLATES`).
It recursively discovers subcommands from each page's `Commands:` section,
shows identical alias help once with every invocation, and writes
`docs/cli-help.md`, its Chinese page, and their pairing record. The record
resolves links between the two pages as written, so a first run already
matches `verify-translation-pairing`. `verify-cli-help` checks all three
files and runs as the `cli-help` doc-sync leaf, which the static CI lane
also runs on an unbuilt tree.
`dsh plugin` now owns `-h`/`--help` and reads its own options only before
the forwarded pnpm arguments: `dsh plugin --help` prints its help instead of
failing on the missing `--profile`, while everything after the pnpm command
(including `-h`, `--help`, and `--profile`) reaches pnpm verbatim. A
`--profile` placed after the pnpm command is no longer accepted; the
v0.2.1-alpha.1 upgrade guide covers the migration.
Refs #4114
The parameterized versioned/name-only inventory test reversed plugin arrival
order but left Loader entry IDs random. EntryTree generates hexadecimal IDs
and enumerates its object-backed store with Object.values(). Numeric-only
IDs become JavaScript integer property keys and enumerate before other keys,
so the fixture's declared arrival order did not determine the comparator's
operand order. Both parameter cases could exercise the same orientation
while retaining the correct sorted output, intermittently leaving the right
version's nullish fallback uncovered by the per-file 100% CI gate.
Use the typed root-group update API with fixed non-integer inventory-* IDs
for this fixture. Both requested arrival orders now reach the inventory
collector without integer-key reordering. Keep real Loader imports and
activation, duplicate entries, and the existing output assertions. Explain
the non-obvious identifier requirement locally in the test. Production
sorting, package identity rules, and request fields are unchanged.
A controlled negative uses numeric IDs for versioned entries: all 46 tests
pass, but package source branch coverage is 73/74 (98.64%), with index.ts:186
uncovered exactly as in the observed node 24 coverage failure. The final
non-integer IDs pass the same owning file with 74/74 branches (100%). No
global Math.random interception, retry, timeout, or coverage exception is
introduced.
Validation:
- pnpm install --frozen-lockfile --ignore-scripts installed the existing lockfile.
- pnpm exec vitest run packages/llm/plugin-package-inventory-deepseek/tests/inventory.spec.ts --coverage --coverage.include='packages/llm/plugin-package-inventory-deepseek/src/**/*.ts' --coverage.reporter=text --coverage.reportsDirectory=/tmp/dsh-merge-5719/inventory-negative
reproduced the controlled coverage failure with 46 passing tests.
- The same command with reportsDirectory=/tmp/dsh-merge-5719/inventory-fixed
passed 46 tests and 100% statements (80/80), branches (74/74), functions
(15/15), and lines (68/68) for the package's executable source.
- pnpm --silent run change-scope --base 70996a53b84212db9efafe21a4db3dddd46b47ec
confirms the sole changed path is the owning inventory.spec.ts.
- git diff --check passed.
The capture clone shares one source with the caller's body stream, so the
caller key alone keeps the Request reachable on every path, including when
capture has already stopped at its byte limit. Cover that path in the
regression test and document the process-wide --expose-gc flag.
Refs #5614
When a visible shared file became a content duplicate, reconciliation emitted
a removal notice and discarded its metadata. Its durable state then remained
remove, while the metadata fast path accepted only candidates without any
previous record. Every subsequent unchanged pass therefore reread the file,
even after a later read had populated the cache. This also affected the path
where an edited earlier winner made an unchanged later file a duplicate.
Retain the still-present duplicate's metadata with the removal's deferred
version update. Pass the already-cached state when removal follows an unchanged
metadata probe, and the newly read state when the duplicate's content changed.
Apply this metadata only when the associated removal survives rendering, using
the existing exact-transition filter; confirmed absence still clears metadata.
Allow both never-rendered candidates and previous removals to skip content reads
when unchanged provider metadata and an earlier kept digest identify the file as
a duplicate. Continue probing metadata. Once the winner changes or disappears,
read and promote the shared file normally, then suppress unchanged follow-ups.
Document the metadata guarantee in the local cache types and bilingual README.
Model-visible messages, source records, ordering, and byte budgets stay the same.
Add four production-plugin regressions covering duplication after either file
changes, then promotion after the winner is edited or deleted. They inspect the
provider's actual content reads across two unchanged passes and require exactly
one shared read for promotion, rather than trusting the context's self-report.
Validation:
- All four new cases failed before the fix because each unchanged pass reread
the shared file despite unchanged metadata.
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts -t 'caches a removed duplicate': 4 passed after the fix.
- README pairing was rerecorded; git diff --check passed.
- The removal regression narrows its source kind and compares the change as a
plain typed value; no matcher carrying any is assigned into an expected record.
- Type-aware Oxlint passed for the three affected packages and the new
metadata-failure fixture; focused cache regressions passed again after the
assertion correction.
A content-deduplicated shared file has no visible change record. If its
metadata became unavailable while the harness-home winner changed or vanished,
the reconciler skipped the failed candidate and still published the winner's
replacement or removal. Guidance that remained in the shared file disappeared
from the model's effective instructions. Content-read failures had the same
partial-group behavior even when metadata probing succeeded.
Rollback the probed candidate group whenever any metadata probe is unavailable
or its bounded content read cannot complete. Include candidates without a
visible predecessor and candidates previously removed as duplicates. Reuse
one rollback operation for proposed messages, deferred version updates,
metadata mutations, and retained digest bookkeeping, so a later successful pass
can reconstruct the complete group independent of cache warmth.
A filesystem path can also appear as a project instruction when the Harness
home is the project root. Releasing observed paths on rollback let that later
alias publish the very content withheld by the failed global group. A transient
failure of the first member also left failed and unvisited paths unreserved.
Factor the existing scope-to-file path calculation and reserve every eligible
member's absolute path for the rest of that pass when its group rolls back.
Project aliases therefore cannot bypass group preservation, without additional
filesystem operations. The shared resolver keeps probing and rollback path
calculations identical. Add metadata, content-read, and one-shot first-member
failure regressions for this supported same-file layout and its recovery.
Keep cancellation propagating to the caller. Keep explicit baseline-budget
exclusions outside observation rollback, because their removals are deliberate
policy decisions. No new session fields, baseline identities, polling, retries,
or process-global state are needed. Clarify the metadata/content and hidden
candidate guarantee in the bilingual README.
Add four real-plugin outage/recovery tests for metadata or content failure while
the retained home file is edited or deleted, plus a cold-cache reconciliation
regression. Add an authored headless session scenario with instance-local
provider failure injection: request two keeps baseline A while shared metadata
is unavailable; request three receives the home B replacement and shared A
addition together after recovery. The fixture restores the provider method on
disposal and asserts the real home/shared files before restoring observation.
Declare its test-only filesystem dependency without changing runtime packages.
Regenerate the persistence catalog's source anchors after the shared path
helper import shifts AgentInstructionSource by one line. Its persisted fields
and SHA-256 type fingerprint remain unchanged; no type acknowledgement or
Session migration is required for a source-location-only update.
Validation:
- All five new regressions failed with the intended partial-group emissions
before the source fix.
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts -t 'hidden duplicate has|cold global group|unavailable active candidate|unavailable scope': 8 passed.
- pnpm exec vitest run packages/context/agent-instructions: 174 passed.
- The focused authored headless snapshot refresh and replay passed.
- Restoring the early skip for an unavailable hidden candidate makes the
headless snapshot fail with the premature harness-home replacement.
- README translations were updated together and their pairing rerecorded.
- Three project-alias regressions failed on the initial group rollback fix,
then passed after reserving failed and unvisited candidate paths.
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts -t 'frozen across a project alias|hidden duplicate has|cold global group|caches a removed duplicate': 12 passed.
A baseline can deduplicate identical harness/shared instructions before the
byte renderer omits their retained winner. Removing every deduplicated scope
from excludedScopes then made the shared copy eligible on the next unchanged
step. It injected the broader instructions the baseline had deliberately
omitted, contradicting the retained-baseline budget policy. Project sibling
copies had the same problem.
Allow a duplicate to leave the exclusion set only when the included baseline
contains its candidate group and trimmed digest. Match the digest as well as
the group: a different sibling may fit the budget while the duplicate's winner
does not. Use the included files' original content so truncated and empty
represented winners retain their ordinary duplicate-promotion behavior.
Copies of omitted content inherit that omission for the visible baseline.
Duplicates of represented content remain probed and can be promoted when their
winner changes or disappears. Keep both README languages, the existing shared
root decision, and the local result-field documentation consistent with this
rule. No durable event fields or baseline identities change.
Add plugin regressions for identical global copies across repeated steps and
resumes, and an omitted project digest with a different retained sibling. Add
an authored recorded-session scenario that runs the shipped headless profile
with identical 1900-byte global files and a 700-byte budget: its two model
requests retain one project-only baseline and never inject the shared copy.
Validation:
- Both new plugin regressions failed on the reviewed implementation with two
contexts instead of one, then passed with the fix.
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts -t 'duplicate budget-omitted|different digest fits|content-deduplicated shared|changed shared file': 4 passed.
- pnpm run test:snapshot:refresh snapshots/session/headless.snapshot.ts -t agent-instructions-budget: passed.
- pnpm run test:snapshot snapshots/session/headless.snapshot.ts -t agent-instructions-budget: passed.
- Reverting only src/index.ts to the reviewed head makes that snapshot fail
with an extra agents-global set and 304 bytes of omitted global content.
- pnpm run test:snapshot scripts/session-snapshot-corpus.corpus.ts: 3 passed.
- Scoped bilingual pairing was rerecorded and verified; git diff --check passed.
The shared-root Agent Note still describes agentsHome as an accepted row field
and gives explicit row configuration precedence. The decision retained those
statements from the configurable-root proposal, although the instruction loader
now exposes neither dshHome nor agentsHome. Maintainers could therefore add an
unsupported row override or mistake the skill provider's root options for the
instruction loader's API.
State that instruction loading resolves the harness home from DSH_HOME or
~/.dsh and the shared agents root from DSH_AGENTS_HOME or ~/.agents. Keep the
shared resolver and its tilde/blank-environment behavior, while distinguishing
dsh-skill-filesystem's retained explicit home fields for its own skill roots.
Update the English and Chinese Decision/Consequences passages together and
record their confirmed pairing hashes. Root order, durable scope keys, and the
other decision rationale are unchanged.
Validation:
- pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.md
- pnpm run verify-translation-pairing .agents/notes/implemented/architecture/2026-10-05-shared-agents-root-instructions.md: one named pair consistent
- pnpm run verify-agent-note-format: all 276 Agent Notes conform
- git diff --check, scoped to the shared-agents-root-instructions EN/ZH/sidecar triplet: passed
The user-global instruction scope now reads two roots: $DSH_HOME/AGENTS.md
first, then the shared agents root that other agent tools use
($DSH_AGENTS_HOME, else ~/.agents). Both resolve from the process environment
through @deepseek-ai/dsh-home-paths; no config field is added, because the
stack base (PR #5718) removed the per-row home override.
The two files are candidates of one candidate group: identical trimmed content
renders once from the harness home, an unobservable candidate preserves the
group's last-good state, and reconciliation probes both roots so external
edits, removals, and new files become visible change notices. A candidate
dropped as a duplicate keeps being reconciled, so deleting or changing the
retained candidate promotes it. The harness-home file keeps its recorded
`user-global` scope key; the shared file carries `agents-global`.
A user-global delta states `These user-global instructions apply to all work.`
instead of naming its reconciliation scope, and a project path whose first
component would collide with a user-global scope directory renders with a
leading `.` so it keeps its own scope.
The removed dshHome row key still redirected instruction loading away from
DSH_HOME. Schemastery's non-strict object validator preserves unknown keys,
and resolveConfig forwarded the validated row wholesale to the library
discovery normalizer, which intentionally accepts an already-resolved home.
Removing the public field and schema entry therefore left the old runtime
override active and contradicted the upgrade guide.
Copy only the declared discovery controls when normalizing a plugin row.
Home resolution now follows process policy even when the row retains a stale
dshHome or another undeclared home field such as agentsHome. This allowlist
also applies when the shared-agents-root stack layer adds its internal home
parameter, without widening the deployment-facing configuration.
Keep the exported discovery and baseline-loading helpers' explicit home
parameter: it carries a library owner's already-resolved path, rather than
granting a plugin row its own home. Extend that regression through baseline
loading to preserve this distinction. Document the ignored stale row key in
both package READMEs and refresh their pairing record. No Session format,
candidate ordering, budget, or instruction rendering changes are required.
Add a production Cordis/schema regression that mounts a row with both stale
home keys and checks model-visible baseline and refresh content. Before the
fix, its baseline contained the stale row instruction instead of the process
home instruction. Both stages now use the process home, and the same test
will reject an agentsHome leak after propagation into the upper stack layer.
Validation:
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts -t 'ignores a stale row home'
failed before the source fix with the intended content mismatch.
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts -t 'ignores a stale row home|uses an already-resolved home'
passed both focused tests after the fix.
- pnpm exec vitest run packages/context/agent-instructions/tests/agent-instructions.spec.ts
passed all 157 tests with both stale row keys present.
- pnpm exec tsc -b packages/context/agent-instructions/tsconfig.json passed.
- pnpm run doc-sync passed all 42 gates.
- pnpm run test:snapshot snapshots/session/headless.snapshot.ts -t 'agent-instructions'
passed the selected recorded-session replay.
- pnpm run verify-translation-pairing --write packages/context/agent-instructions/README.md
refreshed the bilingual record; doc-sync verified it.
- git diff --check passed.
`resolveDiscoveryConfig` accepted `DiscoverOptions.dshHome` but resolved the
home from the environment alone, so a caller passing an already-resolved home
silently received the process home while the option comment claimed otherwise.
It now normalizes the passed value, which keeps the plugin's mount-time
resolution authoritative for discovery and reconciliation. A test pins that an
owner-resolved home wins over `$DSH_HOME`.
Review follow-ups:
- The guide claimed the removed field was the last per-row home override;
other providers (skill-filesystem, shell-env, credentials-local,
subagent-dsh-sdk, attachment-local) keep their own fields, so it now states
that the removal covers the instruction loader, and step 1 also names the
home-level `$DSH_HOME/cordis.patch.yml` layer.
- `DiscoverOptions` regains an already-resolved `dshHome` that `apply()` passes
from its mount-time `resolveConfig()`, so baseline discovery and
reconciliation share one resolution point instead of reading the environment
separately.
- The package README says the loader reads the process home rather than "the
same home as sessions, skills, and storage", and the resolver Agent Note
states what the skill provider's fields actually select.
- `discoverBaselineInstructionFiles` JSDoc no longer lists a removed option.
The agent-instructions row accepted `dshHome`, letting one consumer read a
different harness home than sessions, skills, and storage. Home is process
policy: the plugin now resolves `$DSH_HOME`, else `~/.dsh`, through
`resolveDshHome()` from `@deepseek-ai/dsh-home-paths`, and the config field and
the library's explicit-home option are gone.
Tests and both snapshot fixtures pin the home with `vi.stubEnv('DSH_HOME', ...)`
and the harness's existing `DSH_HOME` export instead of row configuration.
`dsh-skill-filesystem` keeps its own `dshHome`/`agentsHome` fields.
The removed cordis.yml key gets an upgrade guide.
Node's fetch forwards a caller's AbortSignal only while the Request it was
given is reachable. The fetch observer creates that Request locally, so after
garbage collection an abort after response headers no longer cancelled the
body: capture never finished, Network.loadingFinished was never sent, and the
connection stayed open.
Fixes#5614
Review follow-up: `const closed` beside the boolean `this.closed` reads as the
flag, so name the promise `closing` at every site; the test-side comment
repeated the production mechanism verbatim, so each test keeps only the
ordering assumption its fake encodes.
The EPERM path in the Windows coverage failure also matches the HMR
exact-config watcher: it watches the temp harness home with chokidar's
default 2 s write-settle window, and that spec constructs it on the very
directory its afterEach deletes. Apply the same containment to that
watcher and to the skill-filesystem root watcher, the remaining owners
that enable awaitWriteFinish.
A sloppy-mode .cjs or .js file can spell the name as '\141ppendPluginRecord',
which TypeScript decodes to appendPluginRecord, but the prefilter only
removed the backslash and skipped the file. The prefilter now decodes a
legacy octal escape as TypeScript does, taking three digits only after
0 to 3, so the value stays within 0o377. The spec rejects two spellings
that use three-digit octal escapes, and tests the decoder itself for
the digit limit, which no spelling of the name, whose letters are all
0o1xx, can exercise.
chokidar's close() drops every listener while a scheduled write-settle poll
can still run. That straggler stats a document the home teardown is
deleting, which Windows reports as EPERM, and an 'error' emission with no
listener is rethrown as an uncaught exception: the whole coverage
partition fails while every test file passes.
Re-attach the provider's error listener across the close so the straggler
stays inside the provider, and make it a no-op after disposal.
The caller gate parsed only files whose text held appendPluginRecord or a
\u escape, so a release package could reach the function through
S['\x61ppendPluginRecord'], a \u{61} code point escape, a needless
character escape, or a line continuation, which TypeScript reads as the
same string. The gate now also parses a file when its text with every
escape unescaped holds the name, and its spec rejects each spelling.
- Make the record commit an ES private method, so appendPluginRecord()
is its only runtime entry.
- Document PluginRecordType and PluginRecord on the session subsystem
page, and state in the README and JSDoc that the V3-to-V4 edge renames
unknown ignorable V3 events into the plugin: namespace and that plugins
outside this repository must not call the writer.
- The caller gate parses only files that contain the name or a \u
escape, documents that wildcard re-exports are not reported, and its
spec reads a temporary repository instead of this checkout.
- Cover Session.fromRestore in the record test and name SessionEventMap
in the catalog generator's diagnostic.
classShape dropped only #private properties; methods and accessors with a private name reached the declaration text the cordis_inspect catalog serves. It now drops every member whose name is a private identifier, as the public-api projection in verify-type-equiv does.
Add appendPluginRecord(), which appends one ignorable event whose type is
`plugin:` followed by lowercase slash-separated segments, and
pluginRecordOf(), which reads such an event back. Records are not
SessionEventMap members, so the persistence catalog is unchanged; a build
that does not recognize one retains and skips it, and records never enter
the model-visible surface. Resume and fork carry them with the log, and a
format migration keeps them on a best-effort basis.
Only production source under packages/experimental/ may call the writer.
The verify-plugin-record-callers hygiene gate checks every reference in
repository sources, and the persistence catalog generator rejects a
SessionEventMap member in the plugin: namespace.
Session.append() and the record writer share one commit path, so a record
follows the same reentrancy, detach, and observer-containment rules. The
ignorable-events decision, the session README, the format-version
cookbook, and the plugin-author practices describe the records.
A class's static initialization block has no type-level meaning, and the
public-api projection that verify-type-equiv checks already drops it.
The generated declaration text, which the model-visible cordis_inspect
catalog serves, printed it with the class's public members.
pi-ai 1.0.1 and 1.0.2 bring model catalog updates and adapter fixes:
Anthropic native tool changes define later tools inline, Bedrock binds
replayed thinking blocks, OpenAI-compatible requests can pick sampling
parameters by thinking level, and "model is at capacity" is retried.
The runtime dependencies change only in @anthropic-ai/sdk (0.124.0 to
0.129.0) and @earendil-works/pi-telemetry (^1.0.2).
1.0.2 still re-parses the whole accumulated tool-argument JSON on every
stream delta (earendil-works/pi#9265), so the patch is regenerated
against the 1.0.2 sources: it removes the same six per-delta parses as
the 1.0.0 patch, and only the bedrock-converse-stream.js hunk moves, by a
line.
State the Pi-to-DSH direction of the built-in tool translation, how setActiveTools treats Agent-scoped extension tools, that module-scope extension state is shared by concurrent Sessions, which format edges retain plugin records, and that SessionStartSource already declares clear and compact. Date the npm package count and narrow the plugin note's opening sentence.
Record two proposals from the Pi 1.0.0 compatibility investigation.
The Pi extensions bridge note states the design of an experimental bridge
that loads unmodified Pi extension sources on existing DSH extension
points, and ranks the DSH core mechanisms that are narrower than Pi's
extension API.
The Pi plugins note defers a compatibility layer for Pi's Chord-facet
plugins, whose API upstream declares unstable, and defines six levels of
support with the upstream trigger and the DSH work for each, plus the
runtime differences the plugin model exposes.
pi-ai 1.0.0 adds Sign in with ChatGPT to the `openai` provider, and that
login refuses to start unless the app supplies a stable installation UUID
through LoginOptions.getDeviceId. The harness keeps no installation ID
meant for a third-party account sign-in, so the route offers its API-key
login only; a Loader-composed test pins the offered methods.
catalogProvider(), catalogModels(), and catalogProviderIds() now read one
index that leaves out providers without a chat model, so a hand-declared
route under such a key inherits nothing from pi-ai. The browser-worker
stub gains the builtinModels refusal llm-pi-ai imports and drops the
getBuiltinProviders reader nothing imports. The tool-argument streaming
spec also covers the patched Anthropic Messages path.
The chat-model filter left a provider out whenever pi-ai listed no chat
model for it. The browser-worker preview replaces pi-ai with a stub that
lists no models at all, so every provider was dropped and the empty
directory registration failed the llm-pi-ai mount. Only a provider whose
catalog lists models but no chat model is left out now; the stub gains
the `getAllBuiltinModels` reader the filter calls.
pi-ai 1.0.0 adds classifier and image models to the built-in catalog and
ships `typesafe` with classifier models only. The adapter dispatches chat
requests only, so a catalog provider without a chat model gets no entry in
the configurable-provider directory and no sign-in flow.
Move the pi-ai provider adapter from 0.87.1 to 1.0.0 and re-create the
local tool-argument patch for the new dist files. pi-ai 1.0.0 still
re-parses the whole accumulated argument JSON on every stream delta in
the Anthropic, Bedrock, Mistral, OpenAI Completions, OpenAI Responses,
and pi-messages adapters (upstream earendil-works/pi#9265), so the patch
removes the same six per-delta parses; arguments are still parsed once at
toolcall_end.
The release-age exemption moves to the exact 1.0.0 pi-ai and
pi-telemetry versions, and the generated third-party notices and README
links name the new patch file.
Replace the persisted background marker with a client-only rule. A
foreground run writes run-end before its Tool Step ends and a background
run outlives that Step, so only a Turn closed after a crash or at a fork
boundary shows a run without run-end as interrupted.
The examples subpath alias of the mods bridge points at TypeScript entries
that ship no declarations; a documentation fence never imports them, so the
mapper keeps the authored path instead of failing the gate.
The aliases leave tsconfig.base.json, which doc-typecheck maps to built
declarations, and live in the Vitest projects' resolve.alias; the examples
subpath maps to itself there because example plugin entries ship no
declarations. The README's wrapper fence declares its register import so
the fence compiles on its own.
The coverage partitions list *.spec.ts files only, so the published
*.test.ts files reached no partition and the test kit's mount paths went
uncovered there. examples.spec.ts imports them by computed path; the kit
resolves the mod under test from the outermost describe when the file runs
through a spec.
The band's bordered boxes and buttons draw the theme's 0.5px hairline, as
the elevation gate requires; KNOWN_EVENTS is built from ENGINE_EVENTS
instead of repeating the list.
- Disposal cancels detached runs before the engine waits for timer callbacks,
so a callback parked in a $ call ends instead of blocking unload.
- A forgotten band wakes and ends its watch streams; a refresh asked for
during a pass joins one more pass that settles after it; the Web band drops
an ended stream so the next subscriber opens a fresh one.
- $ has Claude Code's namespaces: an unserved member rejects with
'no implementation for <namespace>.<member>' instead of a TypeError.
- A .catch handler's next makes the rewrite check; a tool rename is refused
like an argument rewrite; a null op answer is reported as no answer;
defineMod returns its disposer from apply; the live turn record is copied
before the chain freezes it; prompt.submit is raised only for batches with
a human message and names the submitting mod as origin.
- $.http.fetch bounds the body while streaming; bandColumns/bandRows are
Config; the client package drops its stale gateway edges; the source
overlay lives in the package and anchors its entries to the file, and the
dsh installation no longer depends on the experimental packages.
A scenario-local guard mod adds a context block after the prompt and
refuses a force push, beside Replay Theater and Token Weather from the
examples; the recording shows the context inside the user's message and
the refusal as the tool result. Blast Radius stays out of the headless
composition because it holds a command until a button press.
Hook results spread the typed result from beneath, element props accept an
explicit undefined as a JavaScript mod passes it, the band's registry
payload is narrowed by assertion, and the example wrappers join the Host
typecheck project.
docs/subsystems/claude-code-mods.md lists every way a mod behaves
differently through the bridge than under Claude Code 2.1.287 — packaging,
events, the chain, $ members, drawing, testing, and the example mods,
including the four official mods assessed by reading. The bridge README
describes defineMod, the band, and the test kit; the band package gets its
README; the group index, release families, config and client catalogs,
module and seam graphs, and the Cordis API catalog are regenerated.
A Client package mounts the bridge's Remote contribution, watches each
session's band through watchBand, draws the serialized tree in the input
dock with Claude Code's Box/Text/Button vocabulary on this theme's tokens,
and sends button clicks back through pressBand with the generation they
were drawn in. An opt-in overlay composes the bridge, the band, and the
three example mods for a source launch.
The bridge keeps one band per session: ui.render is raised through the
mods in load order, the tree's buttons keep their onPress host-side behind
per-drawing action ids, a $.state read during a render subscribes the band
to that slot, and $.ui.open/close/invalidate, the end of a tool.call chain,
and turn.complete redraw it. ClaudeCodeMods is a TypertRemoteService:
watchBand streams snapshots, pressBand runs a button and redraws. null is
an accepted hook answer (a surface drawn empty).
A background workflow run outlives the Tool Step that started it, so the
Web workflow node inferred interruption as soon as that Step closed and
showed live members as interrupted. Mark background runs on
tool-workflow/run-start and infer interruption only for foreground runs.
Refs #5638
A mod is now a plugin built with defineMod() around its register(on,
options); the bridge is the ClaudeCodeMods service (ctx.claudeCodeMods)
that keeps the loaded mods and raises their events. The plugin.json /
hooks.json loader, pluginDirs, and dynamic imports are gone.
prompt.submit context becomes text blocks appended to the human's own
prompt message and $.prompt.submit queues a user-sourced message, so the
bridge adds no message source kind: the persistence record and the
regenerated schema are removed and the artifacts match master again.
Engine correctness from the review round: next() is memoized and every
started run beneath is awaited before a hook's answer settles; a rewritten
tool argument skips the hook with a report pointing at the pre-tool input
rewrite proposal; timers belong to the session whose event started them;
$.tool.call injects a tool's deferred contexts; $.clock.sleep honors the
event signal; a built-in tool answered with { result } is validated against
its output schema before it becomes an error-shaped result; hooks on events
this host never raises are reported at load.
Examples: the three mods from the Claude Code blog post under examples/,
Token Weather and its test unchanged, Blast Radius and Replay Theater
completed from the published fragments, run by their own tests through a
claude-code/testing alias over the new test kit ($.ui.mount/find/press).
Review follow-up on the watchdog rewrite:
- Register the deadline reaction inside `next()` and detach it when the
demand settles. Racing against one watchdog-lifetime promise kept every
settled race reachable through that promise's reactions, retaining each
resolved `StreamChunk` for the length of the stream: a 10,000-value probe
kept 100/100 sampled values before this change and 0/100 after.
- Take the neighboring stall case's 1,000ms idle budget in the new
transport-recovery case: the retry performs a real local HTTP/SSE round
trip, and a 50ms budget would let coverage-lane scheduling decide it.
- Document the contract where it is described: `packages/util/timeout/README`
(both languages) and the bounded-recovery and timeout-library notes no
longer claim that only the transport observes the watchdog signal.
- prompt.submit sees and rewrites only the human's own messages, gains the
rewritten text on an image-only prompt, and keeps only typed result fields
- a mod's $.tool.call reaches only the mods loaded before it, attributed to
the caller, instead of re-entering every mod through the pipeline
- a .catch handler shares the failed hook's beneath state so nothing beneath
runs twice; a late next from an abandoned handler is ignored
- hook results are validated before use; detached runs report rejections
- session.end keeps $.state readable until its hooks settle; agent creation
cancellation abandons a waiting session.start hook; agents is read lazily
- a success a hook marks isError becomes a failure; replacement entries clear
on tools/result; per-agent registrations drop with the agent
- $.store writes are serialized per plugin and bounded in UTF-8 bytes;
$.http.fetch bodies are bounded; timers refuse rescheduling after unload
and unload awaits running callbacks; regex matchers reset lastIndex
An aborted read can stay pending forever: undici drops the error when the
abort lands on an in-flight response-body read (observed on the coverage
lane's Node v24.13.0), and the stalled body of
`llm-retry/tests/transport-recovery.spec.ts` then never settles. The idle
watchdog delegated termination to the iterator observing its signal, so the
request outlived its own deadline and the agent stayed `running` until
Vitest's 90s budget; awaiting the abandoned request generator's `return()`
queued behind that demand and would have re-hung the settled outcome.
`idleWatchdog.next` now races its demand against its own deadline and
rejects with the watchdog's TimeoutReason, so the deadline — not the
transport — decides when an outstanding demand ends. Both adapters that
consume the watchdog stop awaiting the abandoned generator's drain; the
abort they already issue owns socket and SDK teardown.
Evidence: instrumented stress harness at ~1s idle on Node v24.13.0 hung 4/160
iterations before this change (each with the abort delivered at ~1002ms and
the underlying read never settling) and 0/160 after; Node v24.19.0 never
hung. The new case in transport-recovery.spec.ts pins the behavior
deterministically: it fails (times out) with the watchdog change alone and
with no product change at all.
Root build scripts, the desktop bundle and the dev:web watcher pass the
native loader so tsdown never selects the undeclared unrun fallback. A spec
covers the build.ts rejection path.
Without process.features.typescript, tsdown falls back to the undeclared
unrun loader, which fails to import and, once installed, resolves
import.meta.url in packages/client/tsdown.client.ts to the entry config.
Refs #5622
Resolve expected module paths through the platform path module and keep
the signal-termination assertion to POSIX, where a self-killed child has no
exit code.
Type the mod tool's output as the answering text, read JSON into a typed
unknown, and replace the test doubles that went through unknown with a
real $ over a slow invoke, an Agent-comparable facts object, loosely typed
on() calls, and the Loader's own import path.
Add @deepseek-ai/dsh-experimental-claude-code-mods, an alpha bridge that
loads Claude Code mods (plugin directories whose hooks/hooks.json names a
hooks module), runs register(on, options) unchanged, and raises the mod
events from harness extension points: session.start on agent/created,
prompt.submit and turn.start on agent/pre-step, tool.call around
tools/execute, turn.complete on turn/end, session.end on agent/disposed,
and command.run from registered commands. The $ mods API is served over
composed services (commands, tools, user-questions, fs, subprocess,
storage domain, projections); unserved members fail by name.
Includes a middleware chain with Claude Code's failure rules and budget
clock, a claude-code/testing-style test kit, fixtures from the mods
tutorial, full-loop and Loader composition tests, the attribution-only
claude-code-mods message source with its persistence record, and the
regenerated catalogs.
Review follow-up: the developer message history is the net tool-list change
between two consecutive requests, not one entry per successful call, so a
remove/add pair batched into one step logs no message. Derive the expected
history from the recorded request headers, search for the later call after the
earlier one, and accept an already-removed tool in the removal prompt so the
REMOVED reply stays required.
The dynamic tool cache e2e asserted the exact recorded call sequence, so a
model that also removed the temporary tool inside the add turn failed an
otherwise valid run. Assert the calls the cache contract depends on and their
relative order instead, and derive the expected transcript registry history
from those recorded calls so one developer message per successful registry
change is still required.
A request without the file's current version gets an uncached 302 to
api/file?path=…&v=<fs version>, served private, immutable. Each newly
mounted Markdown image still requests a unique URL, while the Host
decides whether the browser may reuse cached bytes.
Moving a loader's element (a keyed list reorder) or showing it again
after a display:none ancestor restarts its CSS animations, and the mount
ref does not run again, so the loader left the shared phase. The loader
now pins its animations to document time zero on every animationstart.
Browsers reuse a same-URL image within one document despite no-store,
so a newly rendered reply showing an overwritten file kept the earlier
bytes. Tag each mounted rewritten local image URL with a per-mount load
number.
Split the single 'stats' conversation.composer.dock entry into
'activity' (counts, speed, time dialog) and 'usage' (tokens, cache hit)
so another plugin can replace one pill by id instead of reimplementing
the whole row. The rendered pills are unchanged.
The fixed 19387 listener fails when Windows (Hyper-V/WinNAT) reserves a dynamic
port range covering it, even though no process uses the port. Electron already
reads the bound port from the Host's ready message.
Ordinary plugins now show exported icons, and subpath plugins use
<subpath>/icon instead of a package.json. Update the display checklist
and nested-package gate cases to match.
Manifest icon diagnostics name the package.json the author edits.
verify-package-meta rejects a package.json export that resolves to build
output instead of reading it, and PackageManifest.exports uses a narrow
export-target type.
Desktop loads its profile with `loadProfileDirectory`, so the retired
bundle removal moves there from `loadProfile` and covers every loader.
A name in `dsh.profile.bundles` that neither the profile's dependencies
nor the installation holds had no uninstall on the Plugins page: the
button required `installed`. The Host now reports such a selection as
`removable`, and `removeBundle` deselects it without running pnpm. The
page shows uninstall for `installed || removable`.
`@deepseek-ai/dsh-experimental-schedule-bundle` shipped in dsh-v0.2.0-rc.1
and rc.2 and was removed when the Web composition started mounting
Schedule itself. A profile that switched it on kept the name in
`dsh.profile.bundles`, so every start reported an unresolvable bundle and
the Plugins page showed a failed entry with no removal action.
`loadProfile` now removes names listed in `RETIRED_BUNDLES` from any
profile's bundle list, alongside the existing installation-owned tuple
normalization, and rewrites the manifest only when the list changes.
Materialization tagged every untagged <style> in the document for the
materializing plugin, so styles inserted later by other owners (Cordis
dynamic plugins, runtime-injecting libraries) were removed when an
unrelated plugin was toggled.
Resolutions:
- `docs/subsystems/schedule.*` and `packages/client/ui-schedule/README.*` keep
this branch's shipped-composition text with master's newer wording (Rules and
Records tabs, the icon-button linked-session layout).
- `docs/event-producer-consumer.*` regenerated by `gen-doc-graphs`.
A check run that reached completed never returns to in_progress: GitHub
answers 200 and leaves the run completed, so the revoke write was a
silent no-op on every re-evaluation and a published success survived an
interrupted setup or history fetch. Revoke a published success by
concluding it action_required, start a head that has no decision in
progress, and drop the status-only check-run update.
The setup-failure step ran only when the revoke step succeeded, so a
failed or cancelled publisher left the earlier conclusion standing. It
now runs on failure and on a cancellation that precedes the decision.
The decision note, the review-ownership README, and the two related
notes record the measured transition matrix and the fallback condition.
Delete the now-unused llm-retry history helper, drop the unreachable
credentials-local refresh rejection handler, and add direct tests for the
gateway SRC skip of unprovided Services and llm-retry projection dedupe.
Delete @deepseek-ai/dsh-invariants, every package's ./invariant companion
and its tests, the invariant gates and Vitest setup, the scoped-event
resolver generator, and the INVARIANT-coded listener rethrow paths.
Update docs, READMEs, Agent Notes, and add an upgrade guide.
Only packages/typert/loader/tests/loader.spec.ts conflicted. Master's side
was kept (master's non-awaited ctx.loader.remove calls, restored by the revert
of the transactional Cordis reload changes) and this branch's two vi.waitFor
conversions were re-applied on top, so the merged file differs from master
only by those two polling assertions.
Subpath plugins are not packages, so they never read a package.json and
take their icon from the exported <specifier>/icon resource, like locale.
Package roots keep manifest text fallback and icon, with ./icon as the
fallback image. Drop the bundle-only reader option.
`@deepseek-ai/dsh-schedule` and `@deepseek-ai/dsh-tool-schedule` now depend on
`@deepseek-ai/dsh-subagent`, and the schedule package no longer imports the
Session controller's ownership predicate, so the committed module graph moves.
Typing at the end of the highlighted command token lands in the styled
node. The decoration split the overflow back out, but splitText copied
the token style onto it, so Lexical's normalization merged the halves
again and the transform looped until Lexical aborted the update. The
DOM kept the native insertion while the editor state rolled back, which
left the composer desynchronized for every later keystroke.
Clear the overflow style in the same transform pass.
Refs #4490
Review follow-ups on the delegated-child rule:
- Every one of the four tools refuses a delegated caller before dispatch,
reading `delegationDepthOf(exec.agent)` and returning the stable
`subagent_session` refusal, so `schedule_list`, `schedule_delete`, and a
content-only `schedule_update` are covered too. The preset `toolFilter.deny`
stays as the layer that keeps the tools out of a child's prompt.
- The service keys the arming refusal on that same delegation accounting
alone; `hasApiSessionSubagentOwner` returns to package-private and
`@deepseek-ai/dsh-schedule` no longer imports it.
- The preset child row is `time-context` again: the `preset-` prefix separated
it from a Host row that no longer exists, and `verify-cordis-config` passes
with the sibling-style id.
- Docs, Agent Notes, and the generated catalogs follow.
Move the auto-growing textarea into ui-primitives as InlineEditor and use it
for both the queued-message and goal editors. It also refits when its width
changes and treats keyCode 229 as IME composition.
A delegated child could arm reminders through the tools its preset mount
passes down, even though delivery can never reach a child's Session. The
refusal now reads the delegation-depth accounting the delegation cap itself
enforces, and the shipped presets deny the four tools to children outright:
- `reminderTargetRefusal` refuses when `delegationDepthOf(agent)` is above
zero, or when the Session is subagent-owned without a depth record.
- `standard`, `cordis`, and `ptc` set `toolFilter.deny` on both delegation
rows, so the four tools leave a child's prompt and reject execution.
`create` still rejects and `update` still returns the non-mutating refusal.
Tighten goal-round-driver docs and regression assertions for the withdrawn
queued round: continuation disarms when the cancelled turn belonged to other
work, and the removal is a durable canceled next-turn splice.
Render one Button for both layouts so crossing the fit threshold keeps focus,
anchor the tooltip on the wrapper so a disabled compact entry still names
itself, observe each tab, and rename the tab in the user and subsystem docs.
Rebind the scrollbar thumb to the l2 pair on the elevated goal strip, treat
keyCode 229 as IME composition, and re-measure the editor when the inline
error changes its width.
The classification was recorded before the subtree scan, so a run that found and
removed package ACEs under the requested directory still reported NOT_THIS_CLASS
or PRECONDITION with an empty packageObjects, contradicting README and SKILL. The
scan now runs first, so the verdict and packageObjects describe what the run
actually repairs.
A report-file write failure now prints REPORT_IO_FAILED with the path and the
error on stderr instead of silently leaving an incomplete report behind.
Shrink the linked Session entry to a chat icon button with a Linked session
tooltip when the detail strip cannot fit it, hide the tab list scrollbar,
and rename the English Delivery records tab to Records.
A goal round queued behind human work stayed in the inbox after Stop. The
next human prompt claimed that stale round first, pre-step rejected it, and
the driver exited with the human prompt still parked until another send.
The goal edit field was a single-line input: Enter always saved, a newline
could not be entered, and a long objective scrolled sideways on one line.
Use an auto-growing textarea capped at six lines, matching the queued-message
editor: Enter saves, Shift+Enter breaks the line, IME confirmation does not
save, Escape cancels.
Clarify acknowledgement and first-failure semantics, update configuration and timeout terminology, and explain request-side fixture checks without changing execution logic or recorded expectations.
The desktop archive probe called the script with only -Path, which the new
interface refuses, so it now passes -AllowRoot and -Out. The skill no longer
suggests running the repair confined: the confined token cannot write a DACL, so
that run would report the sandbox's own restriction as a missing right.
The subtree walk bounds its first enumeration too, and a directory whose stat
fails counts as unreadable instead of vanishing. The removal decision says
inherited copies follow their repaired source, and the pre-flight comment names
grant targets as well. Add the third behavior test the rewrite dropped: an
inherit-only FullControl ACE survives a grant.
The approval rule and the stop template are the text a user reads, so they now
name Windows file permissions and permission entries; ACL and ACE stay in the
model-facing technical sections and the report.
The stop paragraph now says only the user can lift confinement, names the term
the Chinese UI shows (完全权限), and offers both options that switch opens: keep
working under full access, or have the agent keep investigating the ACL problem
from the report's mechanism and evidence. A bilingual template carries the same
message, and the surrounding skill text is tightened to stay inside its budget.
The stop path told the agent to switch the session to full access, which only the
user can do. Ask them to switch it instead, keep the agent out of that decision,
and record the same wording in the windows-acl-skill snapshot.
Tool output keeps only its tail, so a long repair run lost its early observations
and nothing durable held the full record set. Every run now writes each REPORT
record to \`-Out\acl-report-*.jsonl\` and ends with a \`RECAP\` line carrying the
verdicts, changes, verifications, refusals and scans, followed by the report path
and the counts. Verification re-reads stop repeating an ACE list the run already
printed, and the localised icacls rendering leaves the record.
The skill now tells the agent what to do when a repair stops: name the blocking
object and right, unblock the user by switching the session to full access
temporarily (stating that confinement is off and that this is a workaround), and
ask for feedback with this session so the unhandled scenario reaches the team,
quoting the report records because only what reaches the conversation travels.
Also from review: the subtree walk reports directories it could not read instead
of claiming a complete walk, a grant target without effective WRITE_DAC is refused
before any change rather than failing mid-repair, grant targets require complete
observations, and repair sources are ordered ancestor first for scanned paths too.
The recorded session embeds the skill description and the loaded instructions,
so the review-driven edits to SKILL.md need the same two-line fixture update.
Review found the unified run had dropped the grant pre-check: a target without
effective WRITE_DAC was attempted anyway, failed, marked a recovery attempted, and
the rollback could not restore it either, ending in restore_pending_then_stop with
a command that cannot run. Refuse that target before any change, and gate grants on
complete observations the way package removals already are.
Repair sources are now ordered ancestor first for chain and scan-discovered paths
alike; the old reverse made a deeper scanned source come first. The subtree walk
reports directories it could not read instead of claiming a complete walk, and the
docs record the authorized-root trigger plus one recovery pair per change.
Restore the two behavior tests the rewrite dropped: a deny sharing the removed
allow's SID, and an inherited source outside -AllowRoot with an in-root explicit
child.
The recorded session embeds the skill's catalog description and the loaded
instructions, so the keyless replay diffed the previous two-step text against
the shipped one. Replace both with the shipped text; nothing else changes.
The note still described a diagnosis-then-repair workflow with a mode choice.
Record what shipped: one invocation for both repairs, the bounded subtree walk
under a directory the caller cannot provision, the authorized root repairing and
restoring itself, and the per-object recovery record plus script.
The script made the caller choose a mode, so one sandbox failure cost two
approvals: one to diagnose and one to repair. It now has no modes. A single run
adds the signed-in user's full-control allow ACE to the directories on the chain
that lack effective WRITE_DAC or WRITE_OWNER, removes explicit package allow ACEs
at their sources, ancestor first, and verifies every change by re-reading it.
A directory the caller cannot provision also has its subtree checked for explicit
package allow ACEs in that same run: the sandbox reports its provisioning failure
on the workspace root while the conflicting entry often sits deeper, and the walk
is bounded and reports truncation. The authorized root itself may be granted and
restored, so a workspace root can repair and roll itself back.
Recovery artifacts shrink to one record and one script per modified object; the
unused icacls save file and the duplicated command file are gone. The skill, its
README paragraphs and the script tests follow the single command: the former
-Fix, -GrantFullControl and -Compact switches are rejected.
Comparing whole DACL strings and whole icacls listings reported a successful
package-ACE removal as a collateral change: listing order, inherited entries
and the object's own entries were treated as one value. The package allow
filter also matched the rendered ACE row instead of the ACE's SID, so -Fix
could never verify a removal.
Compare the object's own ACEs and its inheritance protection instead, save and
restore own ACEs only so a parent that changes during the repair cannot make a
correct restore fail, and let -GrantFullControl accept the authorized root
itself so a caller can repair its own workspace root.
Use Gateway event stream availability before dispatch without changing Peer or manifest synchronization APIs. Keep the response deadline after disconnection and cover connected, offline, and disconnect-after-dispatch behavior.
The Bash tool accepts sandbox_permissions equal to the current mode with a
blank justification, and a blank justification alone. The terminal card
rejected both, leaving successful commands without an expandable body.
Escalation validity depends on the Session sandbox mode, which only the Host
knows; a rejected call already settles as an error result.
session.create treats a named sessionId as a blank Session to reuse while
the Host can verify it is still reusable: no turn has started, it belongs to
the requested directory, it is an unarchived member of the requested
Workspace, and no other owner writes it. The reused Session runs the
requested agentPreset or the configured default; its recorded preset is not
resolved, so a blank recorded under a preset that is no longer declared no
longer breaks New Session or startup restoration. A change is logged as
agent-preset/selected before the Agent is published. A candidate that is no
longer reusable stays unchanged and the Host creates a new Session, which
replaces the client's writer-held fallback.
The Web client restores a saved draft with its recorded preset and falls back
to the default when that preset is missing or fails to activate, passes the
creator entry's preset through creation instead of issuing a concurrent
select, and reloads the projections of a declined candidate so a stale blank
hint no longer hides a started conversation.
Related to #2566
Address the second ds-review-bot round on the bundle Source section:
- remove an http(s) URL's user information up to its last `@`, so a
username containing `@` no longer leaves the password behind;
- keep the dependency name before a local or git spec when the package's
own manifest name differs, so reinstalling restores the alias;
- accept scp-like git addresses with any user name;
- show Built in for a profile dependency whose loaded copy the
installation supplies, instead of hiding the section;
- align the PackageView, subsystem page, and README wording with the
shadowing rule and the kept query string, and assert the source of
not-bundle and unreadable bundles.
The collapsed dock renders the count header and no rows at all; Playwright text
matching does match elements inside a hidden list. State what the assertion
actually relies on.
Unmet weighted approval conditions previously left a pending commit
status that CI watchers treat as running work, so gh pr checks --watch
and similar monitors never finished. Publish the decision as the
weighted approval decision check run instead: action_required blocks
merging while completing the check, and failure reports evaluation
errors.
The scenario expanded the two-row queue dock by clicking whatever button
`[data-queue-dock]` exposed. Every visible row renders its own Edit, Remove,
and Steer actions, so that query also matches them, and Playwright's strict
mode rejects the click. Name the count header and pin the collapsed state it
is expanded from.
The dock spec states the same invariant directly: the collapsed dock exposes
only the count header, and the expanded dock adds one action group per row.
The install dialog is content-sized, so trimming the guide to its one
package-name entry leaves it shorter than the 520x600 viewport and centered
inside the same clearances; the caption-overlays case pinned y to the margin
and height to the full available box, which only held while the three-entry
guide overflowed. Assert the intent instead: the dialog stays inside the
Windows caption margin and clear of the mask.
Address the first ds-review-bot round on the bundle Source section:
- strip the user information of http(s) and git+http(s) URLs so a private
Git URL's token reaches neither the page nor the plugin_manager tool;
- expand `~` in file:/link: paths to the home directory as pnpm does;
- write jsr: aliases after the dependency name, like npm: aliases;
- give no source for a profile dependency the installation also supplies,
whose installation copy is the one that loads;
- label the English row "Code source" to match the Chinese copy and hold
for built-in bundles, and sync the subsystem page, READMEs, CSS comment,
and tool test.
Review follow-up: the guide shows one package-name entry, so the comments
and copy that still described three forms or a displayed Git/local-path
example no longer match. The Git and local-path template strings keep their
replacement reminder for a field that still holds them; the constants' JSDoc
and the package READMEs now say that instead of claiming a displayed example.
Also moves .installSafetyText below the rule its comment heads, and pins the
upgrade assertion to the trust box rather than the whole dialog text.
The install guide listed the package name, a GitHub address, and a local
directory as numbered steps; only the package name needs an example. Keep
that entry and drop the index badge, give the item's hint and example the
title's text color, and balance the container's vertical padding.
The trust box above Install also states that installed plugins do not update
automatically, that upgrading means uninstalling and installing the new
version, and that later releases will keep improving that experience.
`update` threw `ScheduleInputError` for a Session subagent routing owns, so the
Remote gateway turned it into a failed result and the Web editor rendered
`rule.error.unknown`; the `timing.subagentSession` message could never appear.
The refusal now travels the non-mutating `ScheduleUpdateResult` path, which the
editor already maps through the same `code` lookup as `schedule_not_found` and
`schedule_conflict`. `create` keeps rejecting because it has no result path.
The bundle page ends with a Source section: the spec that installs the
bundle elsewhere, as `pnpm add` accepts it, or Built in for an official
bundle the installation ships, followed by its current version.
The Host's listBundles carries the new `source` field for profile
dependencies: git addresses and URLs as recorded, file:/link: paths made
absolute against the profile, and registry ranges, tags, or aliases after
the package name.
The measured-p99 source (7,229 events) forks in 1,066.2 ms on hosted CI,
below the 1,485-1,523 ms of the former 99.3% source; its budget drops to
1,375 ms. Record the new higher maxima of the other endpoints.
Shell discovery keyed entries by resolved path. On merged-/usr hosts the
login shell /bin/bash from $SHELL and the PATH hit /usr/bin/bash for the
`bash` candidate are one file with two spellings, so the menu showed
"bash" twice. Key discovered shells by executable name, compared without
letter case or `.exe`, and keep the earliest entry so the default shell
stays first.
Moves the interface to the position SidebarRightBinding held, after the controller factory, so the change reads as one interface replacing the other. Its content is unchanged.
Upgrade guides now pair guide.md with guide.zh.md and guide.i18n.yaml under
the ordinary translation-pairing gate. verify-upgrade-guides checks the
Chinese sibling's metadata and its 变更/迁移 sections; the 500-word ceiling
applies to the English source. Remove the session-log-otel-collector guide.
Record the three externally perceptible breaks between dsh-v0.1.7-rc.2 and
dsh-v0.2.0-rc.1: Schedule rows moving into the Automation tasks optional
bundle, the legacy work-details value reading as Detailed, and Session-log
uploads requiring dsh-otel with a new collector host. The template no longer
asks for pull request links, which verify-repository-references rejects.
- Fork the measured p99 at rank 988, the highest top-level rank of that
anchor; rank 990 fell in the 99.3% anchor. Derive fork ranks from the
corpus size and pin their shapes in a unit test.
- Seed separate search and fork roots so fork children never reach the
search index.
- Bound child deadlines by the file limit and give every test a deadline
that outlasts its sequential children, so failures reap children before
cleanup.
- Budget peak RSS of the list, search, and fork processes, and check
every recorded median against its budget.
- Name a missing folded record, correct the list-order comment, state that
search models an opt-in deployment, and keep new dependencies sorted.
An install refused as incompatible keeps asking for a compatible version; an
installed plugin found incompatible now says to uninstall it and install a
version compatible with this DSH.
The case budget fires before eventually() can name the pending step, so the
native-delivery cases print the observed refresh values on failure. The
barrier JSDoc cites the libuv close-time wait and states that any directory
handle rebuilds the per-process stream; the transaction case takes the same
budget as its siblings; the hmr README records the darwin registration
window as a known limitation.
Chokidar reports ready once fs.watch() returns, but libuv on darwin builds
the per-process FSEvents stream later on its CoreFoundation thread, so a
write that lands first is never reported. The watch-config cases now close
a second fs.watch directory handle after registration, which blocks until
that stream is rebuilt with the remaining handles, and eventually() takes
the case's effective budget instead of a local 10 s constant.
Fixes#5414
On the EPYC 7763 runner the file took 294.5 s, 85 s of it single-process
seeding. Two preparation processes now author, validate, and fold
byte-balanced anchor groups in parallel, and a seed process writes the
corpora from their saved bodies and records. Budgets cover the higher
median of the 7763 and 9V74 runner models.
Resolves the semantic conflict with #5331: its ci-unit gate spread
coverageTestTimeoutArgs, which this branch retires; the gate is now a
plain vitest run and the darwin lane budget reaches vitest.config.ts
through the inherited DSH_COVERAGE_TEST_TIMEOUT_MS. The ci-unit spec
cases pin that shape under both budget values.
A bundle the installation ships is refused with a note that it upgrades with
DSH, since it cannot be uninstalled. The reinstall-to-upgrade sentence follows
an incompatibility once, however many packages it names, joined by a
locale-owned sentence separator.
Keep each case at its hardest setting that fits five minutes of hosted CI:
search and fork stay at 1,000 Sessions with the longest fork sampled once,
the list runs 3 samples over 3,000 Sessions, and seeding validates authored
bodies in memory instead of a separate verification pass. The file's last
case asserts the limit; the benchmark job timeout becomes 20 minutes.
Standard two-CPU hosted runs are 2.4-3.4 times the reference machine, above
the shared reference scale, so the budgets use rounded hosted medians with
the shared 1.25 headroom. The benchmark job took 14.4 minutes with these
cases; its timeout becomes 25 minutes.
Starting every frame compression at once kept one native Zstandard context
per pending frame alive and peaked the seed worker at 7.7 GB RSS, which
exceeds the standard hosted runner's memory. Bound compression like file
writes; the seed now peaks at 2.2 GB and writes identical bytes.
Add a required benchmark over synthetic corpora whose per-Session length
distribution is at least a measured local DSH corpus: list at 1,000 and
5,000 Sessions, cold and built content search and stratified forks at
1,000 Sessions, all through the real SessionController on built plain-Node
workers. Raise the benchmark job timeout to 30 minutes for the added cases.
* fix(webworker): load plugin manager and HMR in the preview Worker
The Worker disabled both rows, which left Creator mode's
tool-plugin-manager waiting for its service and the Plugins page without
a manageable profile. Only package commands are unavailable; the
services load. The Worker provides appReady from its own readiness
promise, resolved once the tunnel serves, and its process shim reports
no entry script, so HMR keeps only its profile configuration watches.
Fixes#5372
* fix(webworker): show xdg-open text files in a preview viewer
The Worker implements xdg-open as a platform executable that sends one
VFS text file to the page, which shows it in a read-only modal dialog.
Settings' "Open configuration file" now opens the profile patch in the
preview instead of failing on a missing desktop opener.
Fixes#5371
Introduce docs/upgrade-guide/v<version>/<item>/guide.md for externally
perceptible breaking changes. The dsh-create-upgrade-guide skill owns scope,
placement, maintenance, and format; verify-upgrade-guides enforces layout,
frontmatter, sections, and the 500-word ceiling. Guides are English-only and
registered as the upgrade-guide document kind.
The reminder stack no longer hides behind an optional experimental bundle.
`packages/bundle/web-app/cordis.patch.yml` inserts `schedule` and
`ui-schedule`, so a shipped profile mounts the task store, the delivery
runtime, and the Automation tasks page; the
`@deepseek-ai/dsh-experimental-schedule-bundle` package and its wiring are
removed.
Preset ownership is unchanged: `standard`, `cordis`, and `ptc` declare the
clock and the four reminder tools in their own scope, and `minimal` declares
neither, so a minimal session carries no reading and no reminder tool even
though the service is mounted.
`apps/cli` depends on `@deepseek-ai/dsh-tool-schedule`, and
`packages/bundle/web-app` declares `@deepseek-ai/dsh-schedule` and
`@deepseek-ai/dsh-client-ui-schedule`: preset and profile rows resolve plugin
names from the installation anchor, so a missing declaration leaves the row
without a fiber and every session creation fails with
`agent-preset/invalid`.
Documentation, Agent Notes, and the recorded Web fixtures follow the shipped
composition.
* fix(dockkit): keep floating headers below the Windows caption
* fix(windows): preserve caption gaps across dialogs and fullscreen
* fix(client): unify overlay clearance and preserve the Windows caption
* docs(desktop): explain fullscreen IPC platform guard
Review follow-ups: the Electron payload smoke allocates the way the product
does on Windows, so the packaged tree resolves the console host assets it now
depends on; the README states that dependency and its loud failure as a known
limitation; the terminal handle takes the platform this method already
resolved; and the note links the earlier tail-grace note, records why that
grace cannot cover a malformed tail, and drops the claim that the smoke
exercises the operating system host.
The per-platform case reads the third spawn argument to assert the console-host
option is absent on POSIX; an untyped vi.fn() declares no parameters, so the
indexed call argument fails typecheck.
The README, the Ctrl-C comment, and the bare-kill comment still described
Windows' own console host as the one backing the PTY. Name the host the code
now selects, record the exit-event behaviour of both teardown paths measured on
the pool machine, state that a missing conpty asset fails loud, and move the
note to the bug-fix class next to the other Windows console fix. The terminal
case now asserts the option key is absent on POSIX rather than not true.
Fixes the review findings on the work-budget change:
- unify the measured npm time range to 137-205 s in the note's problem
statement, which had carried the older 153-190 s range
- correct the peer-edge share to about three quarters (1874 of 2524),
which the sentence had called two thirds
- state the ratchet threshold as the packages-times-edges product, about
12% in packages and edges together
- derive NPM_HANG_GUARD_MS from MAX_RESOLUTION_WORK_UNITS so a raised
budget cannot shrink the guard's headroom, and state the guard's
guarantee as covering a runner four times slower than the measured host
- name the cost side of the hang guard in the note's consequences
The note records which categories carry this change: the per-platform unit
case, the master push's Windows standby run as the end-to-end signal, and the
desktop payload smoke for the packaged runtime tree.
The console host Windows provides, on the images the master standby pool runs
(Server 2022, Windows 10 22H2), replays a prompt line that scrolled out of the
viewport as `\ndsh>\x1b[1C`: the trailing space becomes a cursor move, so the
persistent-pwsh readiness path never sees its `dsh> ` tail and every send waits
out the silence tier. The same case passes on the Blacksmith Windows image,
whose console host emits the tail verbatim.
Allocate Windows PTYs with `useConptyDll: true`, so the PTY is backed by the
OpenConsole the node-pty package ships. The option is set only for `win32`;
the terminal spec pins it per platform.
Probing the pool machine with the bundled console host rendered the `dsh> `
tail for all seven prompts of the failing case's command sequence, and
`pty.pid` still resolves to `pwsh.exe` and equals the shell's own `$PID`.
The Dependency layout lane failed whenever the npm child process exceeded
a hardcoded 300 s deadline. That deadline measured the runner rather than
the graph: the same layout resolves in 137-205 s on an idle developer host
and exceeded 300 s on CI while the placement assertion reported no error,
so the failure carried no information about what had grown.
The gate now bounds the verified graph by resolution work units,
dshPackagesPerVersion * checkedDshEdges against MAX_RESOLUTION_WORK_UNITS,
and keeps the wall clock only as a hang guard derived from that budget.
Growth fails with the graph's own measured counts on any runner.
The resolution cost itself is unchanged. Measurement attributed 99.3% of
it to npm's peer-conflict placement, and cache reuse, graph splitting and
the placement flags were measured and rejected.
The off-state thumb reused the palette's primary foreground, which resolves
to near-black in dark mode; against the translucent track it read as
disabled, while a disabled control differs only by half opacity. Give the
off state its own thumb color through the new `--dsw-alias-switch-thumb`
alias: white in light mode and neutral-bluish 400 in dark mode.
The plugin management info button also becomes an 11px caption-colored icon
in a 20px square, keeping the 4px gap beside the subtitle.
Refs #5347
The rejection of a longer fixed wait or an unbound retry already lives in the
two linked notes; this note now keeps only what is specific to the case, that
`findByText` resolves on a commit that does not drop the panel.
The note links the two 2026-09-27 testing notes that record the same decision
family, and both link back. Line-number anchors give way to file and symbol
references, the deferred-refresh alternative the neighboring cases use is
recorded with why it was not chosen here, and the negative control states that
the close call is removed.
The diagnosis script suite asserted that repaired paths are owned by the invoking user. On an elevated Windows runner the fixture objects are owned by BUILTIN\\Administrators, so the assertion failed without any repair defect. Compare the owner before and after the repair instead, which keeps the stated owner-preservation guarantee without assuming the host token's default owner. Verified locally: 34 tests pass.
The fixture's poll case counts attempts instead of reading a clock, so a host
stall cannot turn a budget-ended poll into a pass; the control case reads the
poll's reported duration, which the 1000 ms default bounds from below. The
spawning spec acquires its temporary config in beforeAll, bounds the child
with a timeout and asserts no signal ended it, and counts the polled values it
inspects. CoverageTestTimeoutOptions is Vitest's own TestUserConfig members;
the rule's reach has one home in its JSDoc, which the config, gate, spec, and
note comments reference.
DSH_COVERAGE_TEST_TIMEOUT_MS expanded to --testTimeout, --hookTimeout, and
--expect.poll.timeout on the coverage and serial lanes, but Vitest forwards
only a fixed list of CLI overrides into inline projects and neither
hookTimeout nor expect is on it, so under the root config's two projects the
hook and expect.poll budgets stayed at Vitest's defaults on every lane.
vitest.config.ts now reads the variable through coverageTestTimeoutOptions and
spreads the three budgets into both projects; run-gates and the partition
coordinator pass no timeout flags, leaving one owner for the rule. A new spec
spawns vitest on the root config with a 200 ms budget and proves all three
waits end inside both projects, that unset keeps the defaults, and that a
malformed value fails at config load.
Fixes#5335
Related to #5325
run-gates.spec.ts clears DSH_COVERAGE_PARTITIONS and DSH_COVERAGE_MAX_WORKERS
before each case, so the coverage gates it builds take their shape from the
case, not from a partitioned lane that exports the variables to every child.
The ci-unit case derives its two gates from the `test` package script's
segments. The serial-reference note keeps only the lane fact; the mechanism
fact about inline-project inheritance is owned by the fix that changes it.
The case awaited the empty list's text and then read the panel once. The
detail closes through the effect that observes the removed row, one commit
after the render that replaces the list with its empty state, so that single
read could still see the panel. The assertion now waits for the state it
asserts, and a panel that never closes still fails.
Refs #5332
master now ships the reminder stack as the optional
`@deepseek-ai/dsh-experimental-schedule-bundle`, which inserts the rows the
Web composition leaves out. This branch keeps the preset-level ownership
beside it.
Resolutions:
- The bundle inserts `schedule` and `ui-schedule` only. It no longer inserts
`time-context`: the clock belongs to the `standard`, `cordis`, and `ptc`
presets, and a Host row for the same package would mount it in two scopes
and append two readings per step.
- `packages/bundle/web-app/package.json` declares `@deepseek-ai/dsh-time-context`
again: the presets reference it by bare name, so `verify-cordis-config`
requires the dependency.
- The bundle's patch spec, locale, package, README pair, the optional-bundle
composition spec, the plugin-manager component list, and the
`schedule-after` roster assertions describe the two-row bundle and the
preset-owned clock and tools.
- Documentation and Agent Notes follow the same split; the note master
archived stays frozen with its manifest hashes.
The unit-darwin job ran the whole unit inventory at Vitest's 5000 ms default
on a shared 3-vCPU macos-latest runner; the first two master runs after #5292
each timed out a different set of cases that pass in under a second on a quiet
host. Every other whole-inventory lane raises the budget through
DSH_COVERAGE_TEST_TIMEOUT_MS=90000.
The job now sets that variable and runs `pnpm run check:ci:unit`, a run-gates
aggregate that is `pnpm run test` (native build, then `vitest run`) through the
path that consumes it. ci-unit receives no CI worker settings, so the inventory
inherits the environment `pnpm run test` finds: on a 3-CPU host the defaults
would inject DSH_COVERAGE_PARTITIONS=2, which run-gates.spec.ts reads as a
partitioned coverage lane.
Fixes#5325
Read fields from the YAML syntax tree so non-string scalars and aliases keep
their authored text, show the verbatim block while the field chunk loads or
when it fails, close an empty block at its first delimiter, and refresh the
skill preview golden.
On the account route a search reads the account grant before any API key
and fails with WEB_PROVIDER_ERROR when that read throws; it never falls back
to the key. ready() swallowed the failed read and then accepted a literal,
stored, or environment key, so it answered true for a search that fails.
ready() now checks the account token first on the account route, answers
false when that read fails, and only then checks the literal key and the
credential reference. Tests pair the readiness answer with the real search
failure for a literal key and an environment key.
The bundled diagnosis skill told the model to run its script unconfined from the first call, which forbids trying the confined path and leaves no path but handing the command to the user. Run it in the current sandbox first, and request one escalated retry of the same call when a denial or an unwritable report directory prevents it; a refused or unavailable approval reports the path as undiagnosed. Refresh the recorded skill replay and re-record the README pairing hashes.
Packed consumers resolved ^3.1.0 to 3.3.2, whose source build fails under the Linux release check. Pin every consumer to the existing lockfile version 3.1.1 so published installs use the tested dependency.
Review round 1: the settle assertions build their message only when one
is about to fail, so a passing run never pays the host-facts shell probe;
send windows are bounded by event sequence numbers instead of
milliseconds, so two sends that hand over within one millisecond keep
their own events; the replay starts at the send's own input write and
ignores the emulator's terminal-protocol replies; a throwing foreground
inspection is recorded before the send rejects; a sanitizer is attributed
to the most recently spawned terminal, which the class documents as the
sequential-session assumption. A unit spec pins the replay rule against
the session's evidence states, the window boundaries, the reply/input
distinction, and the bounded, escaped rendering. Notes and comments drop
change narration and the unverified claim about the pool's build.
Seven cases, not nine, carried 90_000 before the change; the other seven
ran on the default and five of those spawn. Record the lane-flag
alternative, cite the archived describe-level budget notes and the
accepted risk, and bound the idle-host timing claim to the measured
cases.
Addresses ds-review-bot: the keyboard step now asserts that focus landed on
the sheet overlay before pressing arrows, the comment keeps only the local
why, and the Agent Note carries the measured counts (10 of 11 master runs,
7 of 38 probe runs, 26 of 26 keyboard runs, 10 of 10 local repetitions).
Five cases in scripts/oxlint-contract.spec.ts spawned oxlint or the
repository lint entrypoint on vitest's 5000 ms default while their nine
siblings carried the 90_000 ceiling from the Windows spawn-budget
alignment. The first darwin parity run on master (Sandbox run
36332053320) ran the file 2.2x slower than the passing run and timed out
`prints only the final diagnostics when a fix retry still fails` at
6309 ms. Give the five cases the same per-case ceiling and record the
decision in an Agent Note.
Fixes#2581
Related to #2677
The 2026-09-27 14:30Z master run carried the tail grace and took the same
20.8 s as the run before it, so the lane's mechanism is not a stalled
prompt tail; the composition keeps the default and the notes record the
open investigation, the native pwsh 7.6.6 evidence, the ConPTY repaint
re-emission of the 133;D mark as the leading hypothesis, and issue #5297
for the Windows pid 0 side finding.
The self-hosted Windows lane settles one or two of seven sends on the
controlled prompt and the rest at the plain silence bound, and the
settle reasons alone cannot say whether the marker was missing, its tail
was invalidated by later output, or the foreground comparison failed.
The case now records every decoded pty chunk with the sanitizer's marker
verdict and prompt tail, every foreground poll, every input write, each
send's settle reason and elapsed time, the session's prompt evidence
replayed from those chunks, and the host, pwsh, PSReadLine, and console
host versions; the settle assertions carry that timeline in their
failure message and onTestFailed prints it when the runner's budget ends
the case first.
promptTailGraceMs returns to the product default: master runs with and
without it took the same 20.8 s, so the lane's degraded sends never held
the state it covers, and a nonzero value there would only lengthen a
never-arriving-tail fallback.
The meeting-sheet step of document-preview.e2e.ts clicked the sheet overlay
at the cell FortuneSheet already selects on mount, so its polls passed before
the click committed, and the press resolved its cell inside a React state
updater that later renders re-execute against the reflowed grid. On loaded
Linux runners that re-execution landed after the first sidebar resize and
committed B1 (the two-column sheet clamps the stale pointer x to its last
column), failing the reflow loop with `expected 'B1' to be 'A1'`.
Select A1 through ArrowRight/ArrowLeft instead: keyboard moves compute the
target from committed state, so a re-executed updater yields the same cell,
and the B1 -> A1 transition verifies the interaction before the reflows.
Refs #5242
Review follow-up: name the parity job in the workflow header, point the unit
comment at ci.yml's Linux jobs instead of a nonexistent `checks` job, state the
budget as a completion ceiling and raise it to 60 minutes so the slowest observed
runner keeps headroom, and let the owning Agent Note describe the budget and the
workflow's statuses without restating numbers the workflow owns.
The seatbelt leg of the sandbox-e2e matrix also ran `pnpm run test`, and the
complete unit suite takes 16 to well over 20 minutes on macos-latest, so the
shared 20-minute job budget cancelled the leg on most master pushes — before
the Seatbelt confinement e2e ever ran. Move the parity run into a `unit-darwin`
job with a 45-minute budget; the four e2e legs keep 20 minutes.
Review round 1: the tolerance now requires the accumulated tail to remain a
prefix of the controlled prompt, so a prompt that arrived and was invalidated by
later output keeps the plain silence bound instead of waiting a tolerance with
nothing left to wait for. The field is validated as zero or at least one
`pollIntervalMs`, matching the handoff grace rule, and tests pin the extended
bound's expiry, the invalidated tail, and that rule. The owning readiness design
note records the new field and Tier 2 bound and cross-links this decision.
Windows sessions on the self-hosted lane settled one or two of seven sends on
the controlled prompt and charged the silence tier for the rest (issue 2487).
The marker is written by the shell's own prompt function and the printable tail
by the same render, so a tail that arrives past `idleSilenceMs +
handoffGraceMs` means a stalled delivery, not an absent prompt.
`dsh-terminal-bash` gains a validated `promptTailGraceMs` bound (default 0,
which reproduces the previous bound exactly). While a send has seen the marker
and its printable tail has not arrived, the silence bound grows by it. The
pwsh Loader-composition case sets 5000 ms, the host class the bound is for, and
still fails when no marker appears at all.
Review found two factual errors in the prose this change adds.
plugin-install-cancel: the scenario pauses the page clock before the
enable click, so the highlight's `setTimeout(clearHighlight, 2400)`
cannot fire while the status poll runs. The comment claimed a reload
could outlive that expiry, and the note explained the two CI timeouts
at the untouched highlight locator the same way. The cause of those
timeouts is not diagnosed, so both now say so instead of offering a
mechanism the paused clock rules out. The pre-change file reproduces the
same hang under the same lane command, which the note records.
workspace-new-session-folding: `nth(7)` is the first row the batch
reveals, not the last established one, and the reflowing `showMore.click()`
is above the comment, not below. Both are corrected, and the workspace-row
comment names what `:hover` reveals instead of restating a cell swap the
project row does not have.
turn-tail-actions: clear the pointer modality flag with `Shift`, which
moves no focus, matching focus-rings.e2e.ts.
The zh dictionary rendered subagent, list_agents, interrupt_agent, and
ralph tool cards with 代理 (proxy) for Agent. Use 智能体 like the goal hint
and wait_agent copy already do.
The self-hosted Windows serial lane failed 12 cases from one cause: the host
exported Git's indexed command-line configuration (`GIT_CONFIG_COUNT` with
`GIT_CONFIG_KEY_0` / `GIT_CONFIG_VALUE_0`), and the shared subprocess scrub
removes credential-shaped names, so a child inherited the counter without its
key and died with `error: missing config key GIT_CONFIG_KEY_0` before it read
any configuration file.
Both spec files now delete that group from their own environment before they
spawn Git, because they judge profile behavior rather than host state. The
product-side handling stays out of this change; it is preserved on the branch
`deferred/git-command-line-config-scrub-20260927` for a later product PR.
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.bare GIT_CONFIG_VALUE_0=true pnpm exec
vitest run packages/boot/plugin-manager/tests/github-connection.spec.ts
packages/boot/plugin-manager/tests/manager.spec.ts -> 12 failed at the parent
revision, 95/95 passed with the isolation.
The three-file lane run passes all three scenarios in three consecutive
local runs, and the install-cancel scenario keeps a residual exposure:
it finds the card through the highlight, so a reload that outlives the
highlight while the card is absent fails that locator. One lane run
failed there and it did not reproduce.
Master's 07dcdb46e5 moved the question step's settled title into the
`Ask question waiting` row of mid-steer.expected.md, so the button this
scenario waited for no longer renders. The wait therefore never resolved and
parked the scenario on the question page, producing the lane's cascade: `no
turn/end within 30000ms`, no live root session matching session.v4.jsonl, and
`llm-replay: fixture not fully consumed`. `captureStableAria` already polls
until two consecutive normalized captures agree, so the settled state is
captured without the extra wait.
DSH_SNAPSHOT=replay pnpm exec vitest run --config vitest.web.config.ts
apps/web/tests/steering.e2e.ts -> 7 passed (reproduced twice); with the wait
present the same command fails at its 10 s bound and again widened to 30 s.
Three scenarios captured an aria region while the state their golden
records was implied by the pointer, the keyboard, or an in-flight Host
read, so the capture could land on the other state.
workspace-new-session-folding captures two goldens of one sidebar, each
recording a hovered row that Rows.module.css renders with the row
actions in place of the relative time. Both hovered rows are now
established before their capture instead of inherited from wherever the
Show-more click left a stationary pointer. The serial self-hosted master
lane failed this scenario in every failing run observed between
2026-09-24 and 2026-09-27.
turn-tail-actions records a tooltip beside the focused Copy footer in
running.expected.md. Tooltip ignores focus while the last input came
from a pointer and only a keydown clears that flag, so the scenario now
establishes keyboard-owned focus and waits for the bubble.
plugin-install-cancel polls the enabled card's status instead of
sampling it once. The store marks the card and starts the directory
reload the Host answers, and the status flipped disabled -> running 61 ms
after the highlight in three local runs, which the single read sampled
inside.
Goldens, product code, and assertion strength are unchanged.
The fullscreen command needs to know whether the frame is narrow enough
that an expanded panel is fullscreen automatically. Reading it from a new
ctx.layout.viewportWidth widened the layout plugin's public face for this
one consumer. The seats already receive the frame width as owner props and
compute the rule they render with, so each seat now reports that verdict
through its inject face, as it reports its docking kit's room. The command
reads the latest report only when the user runs it, after the commit that
rendered the width has settled.
- Revert ctx.layout.viewportWidth and the test fakes that provided it.
- SidebarRightInjected gains reportAutoFullscreen.
Move per-request web_search withholding out of the DeepSeek provider:
- dsh-web: add the optional WebSearchProvider.ready(llmProvider) and
ctx.web.searchReady(llmProvider?), which asks only the provider that
search() would select; a provider without ready() and a selection
failure answer true.
- dsh-web-search-deepseek: implement ready() with the existing credential
check and drop the assemble listener together with its system-prompt,
tools, and tool-web dependencies.
- dsh-tool-web: remove web_search and its tool:web_search section in a
prepended system-prompt/assemble listener when searchReady() answers
false for the route model selection assigned to the request.
A composition that selects another search provider no longer loses
web_search when DeepSeek has no credential. The Agent Note is renamed to
2026-09-27-web-search-offered-by-provider-readiness and records the split.
ctx.sidebarRight acted on a binding the right Sidebar seat published from
passive effects. React runs a commit's passive effects in tree order and
the frame renders the Conversation column before the right column, so an
opener mounting in the commit that switched Sessions or returned from a
global panel ran while no seat was bound, and its open threw.
The plugin now names the on-screen Session itself: the selected Session
while the Conversation fills the main column, derived from the Sidebar's
Session views and ctx.layout.panelInfo. Both notify before React renders,
so `mounted` already names the arriving Session during that commit, and
its seat mints the Session's store in the same render. Public commands act
through the Session's adopted store; the seat reports only the room its
docking kit measured, and focus continuity and the auto-fullscreen rule
come from a host the plugin supplies.
- ctx.layout gains viewportWidth from the root layout store.
- SidebarRightBinding, controller.bind(), and the seat's bindService are
removed; the seat's inject face gains measureRoom.
- ui-plan's review opener returns to a plain open gated on `mounted`.
- The plan-review e2e expands the Workspace group by its aria state.
`operations.spec.ts` read the profile's run record from a 100 ms timer armed
before the refused installation whose repair it observes; a loaded runner
reached the repair run after that timer and the case failed with `null`
against the recorded run. The observing child now stays in flight until the
record appears, and the bounded wait starts at the launcher hand-over rather
than at test start.
The loader-composition case counts `stdin_read` settlements but reported only
the count, so its Windows failures could not say which tier settled which
send. The recorded reasons now ride in the assertion message; the threshold
and the assertions are unchanged.
The subagent-inheritance expected test and the web e2e scaffold replay the
shipped compositions keylessly against sessions recorded while web_search
was offered. Both now supply REPLAY_CREDENTIAL_ENV, like the snapshot suites,
so their tool lists no longer depend on whether the runner exports a
DeepSeek key. Scaffolds that deliberately mask the key are unchanged.
Snapshot replays now supply a placeholder DEEPSEEK_API_KEY through the shared
REPLAY_CREDENTIAL_ENV, so web_search visibility no longer depends on whether
the runner exports a key. The new web-search-unconfigured headless scenario
pins a request without web_search, the headless keyless smoke asserts the
same through the real Loader, and subagent-dsh-sdk-dynamic-route's keyless
dsh-sdk child now records its tool list without web_search.
The web search settings page's Endpoint hint now states that the endpoint
must support Anthropic's web_search_20250305 server-side search, since the
DeepSeek provider sends that native tool to whatever endpoint is configured.
The DeepSeek search provider now removes dsh-tool-web's web_search tool and
its prompt section from each model request whose search would have no
credential: no account token for the request's deepseek-account route and
search endpoint, no literal apiKey, and no configured apiKeyEnv credential.
A prepended system-prompt/assemble listener reads the route model selection
writes for the request, so a model switch or a newly stored key applies to
the next request through the existing dynamic tool updates. PTC
presentations and execution-time authentication are unchanged.
Historical team/message/queued and team/message/delivered records remain
decodable and projected, but Team no longer drains or acknowledges them
after restart. Remove the compatibility dispatcher, its disposal wait,
and its tests, and document that historical pending mail stays undelivered.
Extract settleRefresh() so the spinner-minimum hold has one settle point,
advance the e2e fake clock past the 400ms hold before asserting the button
restores, and drive the disposal-during-hold store test on fake timers for
both success and failure reads.
The install registry picker used MenuSurface and overrode the theme-owned
menu material tokens, which the shared-menu-material gate rejects. Return
the picker to a fieldset (its native group role) and paint an opaque
bg-layer-2 surface so the form controls stay readable without touching
menu tokens. This also restores the group's radios to the accessible tree.
Align plugin-install-registry.e2e and its snapshots with the PR's visible
text: registry option names drop the parentheses around the host, the
custom address field is no longer disabled, and the custom hint spells out
http(s) and ~/.npmrc.
Hold the manual-refresh spinner to a 400ms minimum so a fast read does not
flash it, clearing to idle (or the failure toast) only after the minimum,
and dropping a refresh that settles after disposal.
Prune the retired no-unknown-casts baseline entry for browser-plugin.client.spec.
Drop the plugin-manager refresh e2e to a single failure round: the store's
success and retry outcomes are covered deterministically by
manager-store.client.spec.ts, while the e2e keeps its unique value — real
500ms tooltip timing, a running spinner animation, aria-busy, and the
portaled failure toast over kept cards. Regenerate refresh.expected.md.
Remove the components spec tooltip-delay case; ui-primitives'
tooltip.client.spec.tsx already covers 499/500ms hover/focus delay, early
cancellation, and portaling. PluginManagerPage.tsx stays at 100% coverage.
The clock row is preset-level, so a `standard`, `cordis`, or `ptc` session
appends one reading per eligible step; the recorded sessions carry that
message and the identifier shifts it causes. The plugin manager loses the
clock wording from the bundle description.
Resolutions:
- `python/sdk-runtime/package.json` and `pnpm-lock.yaml` keep both sides'
additions (`@deepseek-ai/dsh-otel` beside the schedule packages).
- The generated graph pages are re-emitted from the merged sources.
Closing the provider editor confirms its write, but the browser directory
refresh lands after it, and the reopened editor copies the previous input
selection into a new draft — checkbox polling cannot correct a draft that
was already built. Run 36159502081 (job 108152262196) read a stale `true`
from that draft at models-settings.e2e.ts:395.
Wait for the saved-provider notice, which the refresh publishes, before the
third reopen. The adjacent reopen in the same test file waits on the same
notice.
The browser lane pins the browser to Asia/Shanghai, and formatMessageClock
prefixes clock.md / clock.ymd to the clock once a message's local calendar
day differs from the renderer's. Four scenarios left both clocks on the
wall clock while their message times are stamped during the run — a live
composer send by the Host, a `createdAt: 0` seed anchored from Date.now()
— so the job that began six minutes before local midnight rendered
`9/25 23:58` where their goldens record `{{clock}}` (run 36157253018, job
108144715986: steering, markdown-images, message-actions, and
reference-composer failed together, then passed in the next run).
Read WEB_FIXTURE_TIME on both clocks instead. Live-stamped steering suites
install pinHostClock(), a Date.now spy that advances from the anchor with
real elapsed time; pinBrowserClock() re-applies one frozen instant from the
anchor on an interval, because holding a single instant removes elapsed
time from the 150 ms process-title hold and the composer's 10 ms
composition guard, which then never elapse. Seeded scenarios anchor their
seed beside the pinned browser clock, which keeps the relative-age buckets
their goldens assert.
The steering mid capture waits for the settled question title its golden
records, and the whole-queue scenario waits for the running turn before its
queue gestures, whose decision resolves against an agent that reports busy.
Goldens, the Asia/Shanghai browser timezone, and product rendering are
unchanged.
Reading Git's path text verbatim to keep trailing whitespace duplicated the
line-terminator helper that scripts/change-scope.ts already owns, which the
duplication gate rejects. Canonicalizing the fixture-side common directory
with realpathSync.native removes the text parsing entirely: short names,
junctions, and directory symlinks all collapse onto the physical directory
the installer resolves, and the injected path stays exact.
Drops the trailing-space case: with no text trimming left in the
derivation, that path already matched the installer before this change, so
the case could not fail and proved nothing.
- the note says Duration overrides no coercion hook, matching the README
and the class doc rather than claiming it has no toString
- the elapsed change names the two samples that move (NaN and +Infinity,
not -Infinity, which the consumer still clamps to zero)
- the charter sentence names the files that keep the phrase
- the seconds-unit limitation separates a span from an epoch in seconds
master now ships the reminder stack as the optional
`@deepseek-ai/dsh-experimental-schedule-bundle`; this branch keeps the
preset-level ownership beside it.
Resolutions:
- The Host rows keep master's `disabled: true`. The optional bundle switches
`schedule` and `ui-schedule` on and no longer `time-context`: the clock row
is preset-level, so flipping the Host row as well would mount the plugin in
two scopes and write two readings per step.
- `standard`, `cordis`, and `ptc` declare `preset-time-context` and
`tool-schedule`; `minimal` declares neither.
- `tool-schedule` injects `tools` and resolves `schedule` per scope through
`ctx.inject`, so the row stays valid but produces no tools while the service
is off, and produces them once the bundle mounts it.
- The assembled-Web Schedule spec keeps master's bundle overlay and restates
the shipped `preset-standard` row instead of the deleted fixture, because a
top-level patch cannot reach a plugin a preset declares.
- Documentation and Agent Notes describe both layers; the note master archived
stays frozen with its manifest hashes.
git() trims its output, which also drops a worktree directory's own
trailing whitespace; the installer removes only the line terminator. Derive
the expected lock path through gitPath()/stripGitLineTerminator(), which
applies the installer's exact rule, so the same-string claim holds for
every path.
Adds the trailing-space injection case (skipped on Windows, which cannot
create such a directory); it fails with the same probe ENOENT under the
trimming derivation.
Merge origin/master and move plugin manager, artwork, and automation trigger changes to their independent PR. Cover keyboard-focused inline cards without warming the next pointer visit.
The five lock-access cases only diverged on a host whose temp directory
already carried a short name or directory alias. Route one case through an
aliased worktree root (a junction on Windows, a directory symlink
elsewhere) so the installer's resolved common directory necessarily differs
from the path this spec composes; the case fails with the same probe ENOENT
under the previous derivation on every platform.
The alias case shares the injection body through
expectInjectedLockAccessFailure, so the five existing case names and their
assertions are unchanged.
The lock-access cases injected a filesystem failure on a path this spec
predicted from the mkdtemp fixture directory. The installer resolves its
common directory against Git's own top-level path instead, and the host
spells that path differently: Git canonicalizes Windows 8.3 short names
and the macOS /var symlink. When the spellings diverged the injection
never fired, so the probe file was never written and all five cases
failed with ENOENT at the probe read - the signature seen in the Windows
coverage lane.
Resolving the relative common directory against Git's top-level, as the
installer does, makes the expected path identical to the one the
installer touches on every platform. The five cases fail deterministically
on macOS before this change and pass after it.
`ToolCallRecovery.observe` compared `entry?.turn` against the event's turn
before reading `entry.step`. For a `tool/result` whose callId never registered
as pending and whose event carries no turn/step, both sides were `undefined`,
the guard passed, and the `entry.step` read threw. A pending entry is now
required before the turn and step comparison.
The bundle no longer declares `dsh.bundle.rowSwitches`, so its page offers a
switch per row while it is on, as every other bundle does. The README records
that the three rows work only together, and the Agent Note records the
rejected lock.
With `dsh.bundle.rowSwitches: false`, `listPlugins` reports each row the
bundle inserts with the `bundle-switch` read-only reason, so
`setPluginEnabled`, the `plugin_manager` tool, and the Plugins page agree,
and the page draws no switch for such a row. `bundleRowSwitches` validates
the manifest field; `listBundles` reports a non-boolean value on the bundle.
`BundleInfo.rowSwitches` is removed.
- plus and minus construct through fromMilliseconds, so the documented
bound has one enforcement point; the negative control reddens the new
assertion
- the class and README say Duration overrides no coercion hook rather
than having none, and decompose says which parts are floored
- the note no longer calls the differential a review probe, records that
Schedule imports the bound constants, that both strict parsers refuse
year 0, that Schedule's suites do assert a few message substrings, and
that the util charter bans harness dependencies rather than external
packages
A stale-file response naming many file ids made RequestFiles.retry invalidate
each mapping through its own writer-lock cycle on files-v3.json. The lock waits
two seconds with a fixed backoff cadence, so concurrent contenders advance one
per round and most of them time out once a response names more than about a
dozen ids; the timeout surfaced as TRANSPORT and the replacement request never
left. DeepSeekUploadIndex.remove and DeepSeekFileStore.invalidate now take every
rejected generation at once and rewrite the index under one lock acquisition.
The language-switch case now reads the Automation tasks row's English title
and description, and the English guide writes the UI label as plain text like
the rest of the guide.
The visible id chip and the accessible name now share one check for whether
the entry id adds to the title, so an include: id that matches the title is
left out of both. The loading skeleton's status region carries visually
hidden text so screen readers announce it. The settings-chrome browser
scenario expects the preset group open and enabled rows without a tag, and
its two ARIA snapshots are refreshed. The row-partner CSS comment states its
two-column assumption.
The bundle README said the right sidebar shows the Automation tasks page. The
ui-schedule client registers that page as a `main` panel with a sidebar entry and
keeps the right Sidebar for the single-task detail tab.
The Web composition no longer carries `time-context`, `schedule`, and
`ui-schedule`. The optional bundle inserts the three rows and depends on their
packages, as the other optional bundles insert theirs, so the Plugins page lists
them under the bundle; `dsh.bundle.rowSwitches: false` keeps the bundle's own
switch as their only control. The three packages gain localized titles and
descriptions for that list.
A bundle whose rows work only together sets `dsh.bundle.rowSwitches: false`.
`listBundles` reports it as `rowSwitches`, and the Plugins page then lists the
bundle's rows with their state and offers only the bundle's own switch. A
bundle that omits the field keeps a switch per row.
The 0.1.7-rc.2 release bumped the root and every dsh-family manifest; the new
experimental bundle carries the same version so check-workspace-constraints passes.
The 2026-09-16 host-schedule-storage note now names the optional experimental
bundle as what mounts Schedule, since the Web composition carries the row disabled.
The opt-in note's Decision drops the sentence the Problem already owns, and the
assembled-remote mock states why its Schedule answers stay declared.
The overlay alternative now says only its insert form fails to override a shipped
row, since an id-targeted --patch overlay does set one. The composed assertion
compares the overridden row's package name with the shipped layer's name instead of
asserting a string.
- Duration rejects a count outside the exactly representable millisecond
range, which is what makes decompose's whole-part identity exact; the
postcondition is asserted over a sweep and a random sample
- the to* JSDoc no longer claims a round trip restores the count: each is
one division, so it answers the nearest double
- a test rules out a Symbol.toPrimitive coercion hook, the README names
both implementation modules, and the note records that the value type
ships its full operation set before its second consumer exists
Cards in one grid row now share a height, with title rows and descriptions
starting at the same offsets. The entry id shows only when it differs from
the title, as a code chip in the card's bottom-left corner; tags mark only
states other than plainly enabled; descriptions clamp to two lines until the
card expands; the preset group starts open; loading shows skeleton cards.
Group headers share one height, the subtitle separator is evenly spaced, the
title weight drops to 500, 12.5px text moves to 12px, and a container query
on the tab switches the grid to one column.
Cross-link the archived decision the opt-in note supersedes, state the Loader's one
entry per id and last-declaration-wins behavior in the overlay and extraction
alternatives, scope the missing-row warning to profiles that mount no Plugins page,
and move the switch-on-but-ineffective case to the list-order paragraph. Assert one
top-level composed row per id and correct the stale assembled-remote comment.
Archive the reversed 2026-09-24-web-default-schedule-composition triplet and name
the four bundles in the optional-bundles note. Rewrite the opt-in note's Problem to
the state at the branch base and state why the bundle switches time-context on with
schedule. Record the missing-row warnings, the bundle list order, and the bundle
detail page's empty state in the bundle README. Pin the composed Schedule rows in
scripts/optional-bundles.spec.ts and move the cli dependency entry into order.
- the immutability assertion checked coercion overrides instead of
stringifying the instance, which no-base-to-string rejects
- the config catalog is regenerated for the package description
Duration holds one finite millisecond count behind a frozen class: a
class rather than a branded number because TypeScript erases a brand
through arithmetic, so only an instance can stop seconds and
milliseconds from being added. It adds, subtracts, orders, converts to
larger units fractionally, and splits a non-negative span into whole
days, hours, minutes, and seconds. There is no valueOf and no toString,
so a reader always states its unit.
dsh-time-context reads its elapsed line through it and keeps the
wording: a backward clock reading still clamps to zero there. The
rendered text is byte-identical for every finite sample, verified by a
differential over more than eight thousand inputs. A non-finite sample
now throws from the span constructor instead of rendering 'NaNs', which
the package's own reading invariant already refused.
Add a path-check reminder to the bash and pwsh tool descriptions. pwsh
also warns against assigning automatic variables such as $HOME; bash
also asks agents to guard path variables with ${VAR:?}.
The row now carries the name of the sidebar entry it adds and a
plain-language description, and its icon is an alarm clock drawn in the
Official group's 36px style. The README and the user guide quote the new
title; the README names the sidebar entry instead of a right-sidebar page.
A denial this backend cannot explain — the confined child cannot open an object it
was granted, or provisioning itself fails with Win32 5 — reached the user as a bare
"Access is denied". The README documented both causes but shipped no way to tell
them apart.
Add the `diagnose-windows-sandbox-acl` skill. Its script reads unless a repair switch
is passed, and classifies the failing path and its ancestors before anything
changes; its two repair modes are the only supported ACL edits. `-Fix` removes a
foreign package-SID allow ACE, and `-GrantFullControl` supplies the
WRITE_DAC/WRITE_OWNER pair the mandatory-label write needs without ever changing an
owner. Both require `-AllowRoot`, refuse a target outside it, and refuse to run
together.
`dsh-sandbox-local` registers the skill on Windows through `ctx.inject(['skills'],
...)`, so the skill registry stays optional and the sandbox never depends on it. The
assets ship in this package's `files` list, which the workspace-constraints gate now
pins alongside the runner and emitted-type entries.
Tests cover the script's verdicts (foreign ACE, healthy object, inert capability
SID, inert DENY ACE), its surgical removal, the grant's owner invariant, and both
refusals; the catalog spec covers registration and disposal.
- the constants name one bound each
- resolveLocalInstant reuses an instance a caller already holds instead of
copying it per candidate date
- the README entry-point paragraph drops its duplicate sentence
- the note replaces an invalid reason for the zone mapper and a
review-vantage sentence with the facts
- isFourDigitYearInstant is the shared predicate; Schedule's five
representability guards delegate to it instead of re-deriving the range
- the reason for a field outside its calendar range is out_of_range in
both strict parsers, so year 0 no longer reads as a wall-clock problem
- LocalCalendarTime.year states which entries reject year 0 and which
accept it at the UTC edges
- the note counts the five removed expressions and records that the zone
mapper is a silent catch-all; the Chinese side mirrors the English
paragraph order
- the README no longer claims resolveLocalInstant answers a string
- the accepted-input table records the widened plain date-time input
- canonicalClientTimeZone is named as the wire-boundary form rather than
left outside a blanket claim about discriminated results
- the non-canonical scheduledAt diagnostic has one source
- resolveLocalInstant accepts an already-built plain date-time, so the
recurrence walkers drop their private copy of the disambiguation and
round-trip decision
- decodeInstant narrows its field explicitly and drops the assertion
- the model-input exhaustiveness fallbacks throw a plain Error, matching
the timing-change fallback, while durable decoding keeps
ScheduleLogError
- the library module and README state which entries answer a
discriminated result
- the guarded ignore covers only the uncovered branch point
- the note says two consumers copied the profile, counts copies rather
than consumers, and scopes the platform cause to the unsupported
rejection
- the note names the remaining instant-profile copy in session-format
time-context kept a third copy of the IANA profile: its own regular
expression and its own Intl canonicalization in request-zone.ts. It now
reads a request's reported zone through canonicalizeTimeZone and keeps
its stricter policy — an alias whose canonical answer differs from the
reported value is still refused, with the same three diagnostics.
The shared rejection now carries the platform error it caught, so the
unsupported refusal keeps its cause in both time-context and Schedule.
The scenario boots the shipped composition, which disables the Schedule
service and the clock, and the two reminder rows live inside
`preset-standard`. A top-level patch cannot address a plugin a preset
declares, so the spec builds its overlay from the shipped preset and restates
that row with `preset-time-context` and `tool-schedule` enabled, beside the
Host row enables. Directly created Agents mount the default preset so their
tool set comes from the product composition, and the shipped-roster assertion
covers both planes.
The static fixture is deleted: it restated only the Host rows.
A preset row that waits for a disabled service fails the boot audit:
`tool-schedule` cannot resolve `schedule` while the shipped bundle keeps it
off, and the Web preset suite boots exactly that composition. The three
presets now declare `preset-time-context` and `tool-schedule` with the same
`disabled: true`, so the arrangement is recorded while nothing
reminder-related activates; the preset rows are enabled together with the
Host rows when the stopgap is lifted.
`#5175` disabled the three Host rows (`time-context`, `schedule`,
`ui-schedule`) as a temporary stopgap and refreshed the Web fixtures for that
composition. Those rows and fixtures stay as master has them; this branch
keeps its preset ownership of the reminder stack, which takes effect when the
stopgap is lifted.
Resolutions:
- `packages/bundle/web-app/cordis.patch.yml` keeps master's `disabled: true`
on all three rows.
- The three presets declare the clock under `preset-time-context`: a row id
belongs to exactly one plane, and the Host row retains `time-context`.
- `apps/web/tests/schedule-after.e2e.ts`, `apps/web/tests/fixtures/
time-context-every-step.patch.yml`, `web-default-isolation.expected.e2e.ts`,
and the `minimal-preset` session fixture keep master's stopgap-era state.
The shipped Web composition carries `time-context`, `schedule`, and
`ui-schedule` disabled. This adds
`@deepseek-ai/dsh-experimental-schedule-bundle`, whose patch sets
`disabled: false` on those three rows and inserts none, and names it in
`OPTIONAL_BUNDLES` with a runtime dependency of `apps/cli`, so every
installation ships it switched off and the Web Plugins page offers it in
the Official group.
The two Web suites and the built-Web Schedule Remote scenario enable the
rows through that bundle instead of a scenario-local fixture.
`packages/bundle/web-app/cordis.patch.yml` inserted `time-context` as a Host
row, so every session in the shipped Web profile — `minimal` included —
received a per-step clock reading its composition never declared. The row
moves into the `standard`, `cordis`, and `ptc` presets; `minimal` mounts
neither the reading nor the reminder tools. The Schedule service row and the
`ui-schedule` client row stay Host-wide. 139a7eb379 carried the bundle,
preset, and runtime-closure half of this move; this commit carries the
fixtures, documentation, and Agent Notes that follow it.
The `minimal` session fixture is refreshed keylessly, the assembled-Web spec
builds its every-step overlay from the shipped preset because a preset plugin
cannot be addressed by id from a top-level patch, and the composition Agent
Note points at the new note that owns the preset-scoped reading.
`SubagentSessionError` shifts line numbers in the Schedule types these
generated pages cite; both generators re-emit them, and the
persistence-catalog pair is re-recorded.
Resolutions:
- `snapshots/web/minimal-preset/tool-schemas.expected.json` keeps this
branch's side: the four reminder tools are absent from a `minimal` session
under the new composition, so master's description refresh of those entries
does not apply.
- `packages/schedule/tool-schedule/src/index.ts` keeps this branch's plugin
shape and ports master's trimmed tool descriptions (20bea14129) onto the
moved definitions; `docs/tool-catalog.md` is regenerated from them.
- `docs/tool-catalog.zh.md` has its schema code block realigned with the
regenerated English side, and the pairing record is re-recorded.
`subagent_session` joins the update-result error union, so the client's
exhaustive mapping needs an entry: the timing switch returns a new
`timing.subagentSession` key and both locale dictionaries carry the copy.
The editor shows it when someone edits a task whose Session subagent routing
owns.
Review found three ways the takeover could let two writers overlap.
- A claimant that read an exited PID could remove the lock of a new
holder that reused that PID before the claim. The claimant now probes
the PID again under the claim, after re-reading the record.
- The browser Worker's process shim reports its own PID as absent, so a
second writer in the Worker took over the first one's live lock. A
record naming the contender's own process is never taken over.
- Takeover proves only that the holder exited, while a pnpm run it
started can still be writing the profile. Each profile operation now
records its pnpm run in .plugin-manager/run.json and removes the record
when the run ends; an operation that finds a record waits for the run
within the existing tree bound and otherwise refuses, naming the
process and the record, without running pnpm.
A failed removal of the exited holder's lock now waits instead of
failing the acquisition, the probe range is stated as int32, and the
tests inject exited PIDs instead of reusing real ones, which Windows
reissues at once.
A preset mount reaches the preset's whole subtree, so a `standard`, `cordis`,
or `ptc` subagent now sees the reminder tools the removed
`ctx.agents.roots()` filter kept away from it. A task bound to such a Session
can never be delivered — `ctx.sessionController.resolveAgent` refuses it — so
`ScheduleService.create` and `ScheduleService.update` refuse it with
`subagent_session`, in the operation that creates the obligation rather than
in each consumer.
`list` and `delete` keep serving those Sessions so a task stored before the
rule stays removable, and the tool maps the new code into its error output.
The Agent Note, both package READMEs, and the generated catalogs record the
subtree exposure and the enforcement point.
The tools pipeline's ask decision now carries an optional displayReason
that ToolRuntime forwards to the approval service, so the Auto review
prompt is localized while the audited reason stays English.
Adds the auto-review-approval Web snapshot for a user rejection after a
reviewer denial and for a reviewer failure, and updates the permission
preset pages, READMEs, Agent Notes, and child-agent JSDoc that still
described the shared never bundle.
The takeover note said no Windows binding exists for a kernel-released lock; the Session write lease already holds a named semaphore there through koffi.
skippedProfileBundles recomputed the selected-minus-loaded bundle set from
the manifest, a second home for what loadProfileDirectory already records.
Runtime resolution and generateConfigSchema now read
profile.skippedBundles, so generateConfigSchema no longer reads the profile
manifest and drops its binName parameter.
Optional request extension fields had no size bound. A very large field
could exceed the runtime's string limit while the request was serialized,
which failed every attempt, including retries.
- Bound the extension payload carried by one request (8 MiB by default,
configurable) and send the remainder with later requests.
- If the combined request still cannot be serialized, send the base
request without extension fields and log which fields were omitted.
- Add regression tests and update the related references and decision note.
The seat kept the pending row in local state, so a stale settlement after
connection/reset could clear a newer selection's spinner, a remount lost
it, and /model popup selections never marked a row. ModelDirectory now
publishes the submitted selection as pending under its generation guard.
The trigger spins whenever a selection is pending, so leaving the row's
pane keeps the feedback visible.
The hostname guarded only writers on several hosts sharing one file,
which no supported deployment does, and macOS changes its hostname when
networks change, so locks from before the change could not be taken
over. The nonce closed a race that needs the PID space to wrap between
two reads. Keeping the `<pid>\n` record lets processes of both releases
interoperate.
A preset now mounts `@deepseek-ai/dsh-tool-schedule`, so the executable
deploy manifest must supply it and every required workspace peer reachable
from it: the Python runtime manifest gains the tool package, the Schedule
service and the peers that service requires. The stale product/consumer and
module graphs are regenerated for the new package.
A process that ends without running withFileLock's finally left
<file>.lock behind, and every later writer timed out until an operator
deleted it. `dsh plugin` interrupted with Ctrl-C, `dsh web` exiting
right after disposal while a cancelled install still restores files,
and any crash all left the profile package lock this way.
The lock now records its holder's PID, hostname, and a nonce. A
contender that finds a record from this host whose PID a signal probe
reports absent claims that record through a wx-created claim file,
re-reads the lock, removes it only while it still holds the record, and
retries at once. A PID-only record from an earlier release counts as
written on this host, so locks left before this change are taken over
too. Empty, incomplete, foreign-host, and live-holder records are still
waited for.
The Host plugin registered `schedule_create`, `schedule_list`,
`schedule_update`, and `schedule_delete` on every live root Agent, so a
`minimal` session received four reminder tools its preset never declared. The
tools move to the preset-scoped Consumer `@deepseek-ai/dsh-tool-schedule`,
which injects `tools` and `schedule` and registers them in the scope that
mounts it: `standard`, `cordis`, and `ptc` carry the row, `minimal` does not.
`@deepseek-ai/dsh-schedule` keeps the Host service, storage, delivery, and the
Automation surface.
The five `minimal` assertions in the Web preset suite and the `minimal-preset`
tool-schema snapshot return to the bash-only table, the tool catalog is
regenerated under the new owner, and the Agent Note that recorded the previous
composition points at the new one.
loadProfileDirectory printed each skipped bundle on every call, and startup,
runtime resolution, the config editor, the plugin manager, and HMR all load
the profile, so one incompatible bundle printed the same warning six times at
startup and again on each Web page load. Loading now returns the skips in
Profile.skippedBundles, and the CLI and Desktop launchers print them once per
start with reportSkippedBundles.
session.selectModel can take seconds while the Host persists the default
model. The composer seat disabled its rows with no other feedback; the
chosen row now spins in its check slot, and the trigger spins in place of
its chevron while the menu is closed.
- State the contract precisely: the cut never introduces a lone high
surrogate, and an unpaired surrogate the input already carries is not
repaired.
- Document the new export in the package README: a character-budget preview
section naming the persistent bash and pwsh shells and str_replace_editor,
plus a Known Limitations bullet that no longer contradicts it.
- Drop the assertion restatement from the two shell test comments.
- Let the str-replace test helper reuse a root so the clipped context reads
its file inside its own working directory.
The Decision no longer says the renderers open with the fixed line: the bracketed
marker is the first line, and the shared line is the second. The snapshot
paragraph names both missing harness capabilities, clock control and seeding the
schedule storage domain, and the pinning sentence distinguishes the full-string
unit assertions from the Web assertion over the assembled request.
The snapshot paragraph now states what the tree does not have (no scenario patch
controls the wall clock delivery reads, and no Web scenario scripts a delivered
reminder) instead of concluding that the harness cannot support such a fixture.
The README attributes the presentation wording to schedule_create and the update
wording to schedule_update, and the note names the batch payload field alongside
the one-shot one.
The shipped Web bundle gives every live root Agent the Host Schedule
tools, and every other scenario in this file that boots the shipped
base/web bundle with the minimal preset expects ['bash',
...SCHEDULE_TOOLS]. This case uses the same bootWeb composition and adds
only a settings patch, which does not change tool composition, so its
['bash'] expectation failed on every PR.
Review of the previous commit found two inaccuracies it introduced. The
repeat-tool-reminder producer still writes `form: 'notice'` and its
`<tool> × <count>` summary — `src/index.ts` spreads them onto
`REMINDER_SOURCE` — so only the wrapper should have been dropped. The cron row
also claimed an `inject()` path that `dsh-schedule` does not have:
`runtime.ts` always delivers through `followup()` and flushes the session.
Link `MessageSourceMap` to the page that owns it, and write `V4` as the corpus
does for the format name. Both pairs are re-recorded.
The Agent Note now states what a model infers from the origin line and records
the residual risk of dropping the untrusted-content instruction as accepted, with
its reintroduction condition and the assertions that keep a later change
deliberate. It also records why no recorded-session snapshot covers a delivered
reminder, and the host note links back to it.
The package README keeps the creation-side contract in view: prompt stays the
content to present to the user when the target becomes due.
A reviewer denial now returns the tools pipeline's ask decision when the
Session's approval policy is ask, so the user can approve, reject, or
cancel the call. Selecting Auto writes the ask policy; a recorded Auto
selection still matches never, which delegated children pin, so their
denials stay final.
A reviewer failure now fails the call with its specific error instead of
presenting it as an Auto review denial.
Keep the timing rules that apply to every selector in the create
description once, move the cron day-field and fixed-rate alignment rules
onto their parameters, and drop parameter formats, result fields, and
Host compare-and-set details from the tool descriptions.
Drop the extension-less path hint from read_image and the
returns-before-stopped note from job_kill, and describe send_message
delivery without "resumes a turn". image-compaction lowers its context
window by the 30-token tool-schema estimate reduction.
Tool guidance sections keep only what the tool definitions do not say.
Apply review: reword interrupt_agent and list_agents, carry "a rejected
escalation stays denied" in the rejection error, pin
sandboxPermissionsDescription, and fix stale README and Agent Note
statements. Record the tool-definition rules in agent-experience.
Compaction threshold snapshots shift their context windows by the
370-token system-prompt estimate reduction; escalation-rejected moves to
a v4 fixture for the new rejection text.
Delete constraints the model learns from the call result, shorten
implementation detail, and move per-parameter rules into the owning
parameter descriptions. Bash, pwsh, and fs share one
sandbox_permissions description in dsh-sandbox.
The standard preset's first-turn prompt drops from 7985 to 6551 tokens.
Compaction threshold snapshots lower their context windows by the
1548-token tool-schema estimate reduction so each trigger keeps its
position; their fixtures move to v4 generations.
Broaden the skill description to cover enabling a shipped plugin that a
bundle leaves disabled, add the workspace-bundle recipe for it, forbid
hand-editing profile files that install_bundle owns, and verify installs
through the install result and cordis_inspect_query instead of logs,
process lists, or paged list_plugins calls.
* feat(approval): localize prompts and allow consent for one turn
* test(approval): update cast baseline and Web PTC prompt pin
* fix(approval): cover PTC language and clarify turn consent
* fix(approval): group turn consent under allow menu
* fix(approval): keep turn consent in memory only
* test(snapshot): refresh owners for merged justification guidance
* fix(approval): drop duplicate allow-once from the allow menu
* refactor(approval): derive turn consent expiry from one check
Replace the turn approval bookkeeping (revocation state, incremental log
cursor, and turn-signal listeners) with one side-effect-free expiry check
over the log and lifetime flags. Events now only withdraw open
presentations early; the expiry check decides whether an answer or turn
consent still applies, including for Sessions without event publication.
* refactor(approval): drop one-turn consent and keep localization only
Remove the allowed-turn answer, the live turn-consent state, the allow
menu, and their tests, notes, and recorded Web scenario. The approval
service returns to the master request path; the request keeps the
localized displayReason for presentation, and the card resolves it in
the active UI language.
* test(snapshots): record the localized justification schema text in new scenarios
---------
Co-authored-by: Turtle <[email protected]>
Co-authored-by: Kaige-Gao <[email protected]>
#5108 added this case against a master where the shipped Web bundle had no
Schedule rows; #5123 then made Schedule part of the default Web composition.
Every other minimal-preset session in this file already expects bash plus
the four Schedule tools, so this one does too.
The shipped Web composition gained the four Host Schedule tools, and the
other four minimal-agent assertions in this file already expect them. The
legacy profile-patch scenario still expected bash alone, so master's E2E
lane failed on it. Align it with its siblings.
Session format v4 refuses the retired `{ kind: 'plugin', plugin: '<name>' }`
wrapper at message admission, and the v3-to-v4 migration maps released plugin
names to producer-owned kinds. Five paired documents still show the wrapper as
the current shape, so a plugin author copying them writes a source the session
refuses.
The examples now name the kind the producer declares through
`MessageSourceMap`, and the tool cookbook states that declaration requirement;
the wrapper appears only as the form the admission check rejects. The two
package READMEs also disagreed with their own sources: time-context writes
`{ kind: 'time-context', form: 'snapshot', sections }`, and
repeat-tool-reminder writes `{ kind: 'repeat-tool-reminder' }` with no `form`
or `summary`.
Conflict resolution:
- docs/config-catalog and docs/module-graph: regenerate with the current
generators, which write the bilingual pages together.
- The conflict came from master's new short-fingerprint pairing records: our
branch still carried the previous full-hash records. Take master's record
format, then re-record the output-retention README pair after regenerating
its two sides.
Broaden the skill description to cover enabling a shipped plugin that a
bundle leaves disabled, add the workspace-bundle recipe for it, forbid
hand-editing profile files that install_bundle owns, and verify installs
through the install result and cordis_inspect_query instead of logs,
process lists, or paged list_plugins calls.
The Consequences and the alternative treated the task's Session binding as the
constraint on who writes the prompt. The package README records that the same
binding is not caller authorization, and the Web task detail writes the prompt
through the same service, so both sentences now name the prompt's writing paths
and the binding's actual scope instead.
The note said the Session "owns" the schedule; the storage binds a task to a
sessionId and the owning note keeps "Host-owned" for the Host storage domain, so
the Decision and the alternative now use that binding. The Decision also stops
calling every dynamic field JSON-encoded, since only the id and the prompt are,
and the alternative states plainly that the prompt was called untrusted input.
When the loaded catalog offers no model and no provider failed to load,
the composer trigger shows a warning dot and "No model configured"
instead of the saved route id, and its menu opens on guidance to sign in
to a DeepSeek account or add an API key. A saved selection that becomes
unavailable while other models remain keeps its route id. The README no
longer claims an unavailable model disables the composer.
The Consequences now state that the prompt text carries no authorship guarantee:
a model-written reminder can quote text read from the web, files, or command
output and deliver it under the user-origin line, while the Session binding only
limits which Session's model writes the task. They also name the Web notice that
renders the delivered message, and the Problem and Decision drop the repeated
"standing" wording and the change narration.
The Decision now separates the message's origin (a schedule owned by that
Session) from the authorship of the prompt text, which the schedule tools let the
model write on the user's behalf. It also replaces the claim that every dynamic
field is JSON-encoded: the occurrence instant is a validated canonical RFC 3339
value, and the id and prompt are JSON strings.
Each record rendered its whole saved prompt, so a long instruction on a
recurring task filled the records tab with the same text once per run.
A prompt longer than two lines now shows two lines and an Expand toggle;
the toggle appears only while the clamp hides text, and a collapsed prompt
re-measures when the panel width changes.
Also drop the stale comment about the removed message-id anchor.
Due reminders entered their Session as user-role messages whose fixed text told
the model to treat the reminder prompt as untrusted content rather than new user
instructions. Both delivery paths now open with one shared origin line,
"This is a scheduled message from the user", so the message states where it came
from instead of what standing to give its own payload.
One-shot and recurring batch framing share SCHEDULED_MESSAGE_FRAMING, so the two
paths cannot drift. The bracketed markers and the JSON-encoded dynamic fields are
unchanged, so a prompt still cannot forge framing lines.
The rationale and alternatives are recorded in the Agent Note
.agents/notes/implemented/architecture/2026-09-24-scheduled-message-framing.md.
The official DeepSeek route and pi-ai routes that name an API-key
reference again return an empty catalog while that reference resolves
to nothing, so model pickers stop offering models that can only fail
with MISSING_CREDENTIAL. A malformed key still reports
INVALID_CREDENTIAL, and routes with provider-native authentication keep
their catalogs. This restores the discovery rule that 6db08fd80f
replaced with credential-independent catalogs.
lint:contracts-ready rejected the override filter's undefined check
against its declared type and four asymmetric matchers typed any. The
override filter now takes the parsed configuration as it arrives, and
the tests narrow their matchers the way other packages do.
The shipped Web composition now puts four Schedule tools on every live root
Agent, which pushes a full-preset `cordis_inspect_query` answer past the
12,500-token inline budget, so the spill policy retains its head and tail with
a spill path instead of the complete JSON.
Refreshed owners publish a v4 generation, so every scenario that names
another owner's Session fixture must name that owner's highest generation.
The shipped Web composition also puts the Host Schedule tools on every live
root Agent, so the minimal-preset tool-table assertions include them.
* feat(experimental): ship every experimental capability as an optional bundle
dsh-base mounts the registration-only browser-use and computer-use
services; the Playwright MCP, Chrome DevTools MCP, native and MCP Cua
Driver providers, Auto review, and the Inspector become one-row bundles
listed in OPTIONAL_BUNDLES with an icon and locale display metadata.
verify-default-product-isolation requires both for every optional
bundle. Python PTC and Stagehand stay explicit compositions.
* feat(experimental): keep optional bundles inside the install closure
Drop the Playwright MCP, Chrome DevTools MCP, and native Cua Driver
bundles: each is a runtime dependency of every install and would add
about 85 MB of provider runtimes whether or not enabled. dsh-browser-use
leaves dsh-base with them. The three packages keep their locale display
metadata for component rows.
* feat(experimental): drop the Cua Driver MCP bundle and leave dsh-base untouched
* test(web): refresh Official-group goldens for the four optional bundles
* fix(plugins): use an uninstalled bundle as the install example and pin optional-bundle metadata
The install guide's example is now @deepseek-ai/dsh-subagent-codex,
a published bundle no shipped profile carries, since Auto review is an
installed optional bundle. The optional-bundle spec guards its corpus and
pins each bundle's title, description, and icon in both languages; the
Inspector's Loader test mounts its real bundle patch, its Client names
the reload a hot-enabled page needs, and its description states the
loopback DevTools endpoint's reach.
* test(web): refresh GitHub install recovery placeholder snapshot
The account row lost its only action when the catalog editor was removed
and rendered as a bare name. It now carries a green "Signed in" status;
the store keeps the row only while the account lists models, so the
status holds whenever the row renders. The package README no longer
describes the removed editor.
The Web bundle now mounts `time-context` and `schedule` and leaves the
`ui-schedule` client row enabled, so the Automation tasks page, the Session
reminder catalog, and the `schedule_*` tools work without an overlay. Both
packages join the bundle's declared dependencies, and the example overlay is
deleted: re-inserting its rows would mount both Host plugins twice.
The fixed-rate floor drops from 300 to 60 seconds across the Host decoder,
the create and update validation, the model-visible tool schema, and the
client's per-unit floors.
Web recorded sessions and header sidecars are refreshed for the readings
`time-context` now appends; `normalizeWebSessionVolatiles` tokenizes their
sampled instant, browser zone, and elapsed duration so replay stays stable.
The sidebar toggle is flush with `.logoRow`, which clips its own overflow, so
the standard outward ring lost every pixel that left the row: the reviewer saw
the ring cut on the toggle in both the expanded header and the settled rail.
The 36px rail toggle is also 1px wider than its 35px row, so the control's own
right edge was clipped there. Draw this control's ring inside its own box and
stop clipping the row once the rail has settled; the ring keeps the standard
`--dsw-focus-ring-width` colour and width, and pointer modality still resolves
`--dsw-focus-ring-color` to transparent.
`focus-rings.e2e.ts` asserts the whole ring against every clipping ancestor in
both layouts, in both themes.
Only the ui-theme README pairing record conflicted; re-recorded. The stylesheet
corpus spec passes over master's new client sheets, so no ring needed realigning.
`.selected` still named `--dsw-alias-brand-primary-new-colorprimary-new-color`, the
corrupted token left by a botched rename; its dark value is `deepseek-450` while
every focus ring now uses `deepseek-400`. The selection ring reads the clean
brand-blue alias instead, so one blue covers selection and focus.
- Only the definitive Windows session-end message bypasses the quit
confirmation; the macOS power-off flag clears on the next focus or show
because another application can cancel that shutdown.
- A bypassing quit disposes the pending confirmation so a late inspection
result opens no box and an answered box cannot approve.
- Cancelling a quit that closing the welcome window started shows the
welcome window again.
- The first-hide notice records its marker only after delivery and
withdraws it on failure; the Windows quit dialog uses the multi-size ICO.
- windowShown settles when the awaited window is destroyed.
- Cross-link the partially superseded window-menus note; tidy docs.
Closing the main window hides it on macOS and Windows; the page and the
Host keep running and the next show resumes the same document. Windows
gets a permanent tray icon (open / quit) and a one-time notification the
first time the window is hidden after installation.
Every ordinary quit entry asks the Host over a new quit-inspection IPC
request for active tasks (same rule as the update restart check) and
armed scheduled reminders (schedule family of workspace/session-activity
for loaded sessions). Nothing to interrupt quits silently; otherwise a
native message box explains what stops, with Quit as the default and
Cancel on Esc. Inspection failure or a missed two-second deadline counts
as running tasks. The installer restart, fatal recovery, the development
restart command, and OS session end skip the confirmation.
Also: defer the downloaded-update confirmation while the window is hidden,
render the tray ICO from the vector icon, and point the installer's
running-application message at the tray.
Closes#4013
Resolve local image paths through the authenticated dsh-app file route and allow that route in rewritten Markdown images. Cover desktop rendering, previews, encoded filenames, and unsupported origins.
Fixes#5105.
Resolve the account provider import to carry both the account quota
codes from #4858 and APP_IDENTITY for the model gate. The upstream
account-quota spec now answers the account listing request with 404,
because the account route requests /models before its first Messages
call and a shared mocked Response body can only be read once.
- Instant entries that take already-validated values throw on violated
preconditions; the module header said every entry answers a result.
- formatFourDigitYearInstant also refuses a non-integral epoch.
- Schedule's reason mappers switch over the closed unions with a never
default, so a new library reason fails the build instead of falling
through to a catch-all.
- The Agent Note claimed the schedule suites pin these diagnostics; they
assert codes only, and the note now records the added message assertion.
A calendar date the month does not have keeps the at diagnostic; only an
out-of-range clock field keeps the local at one. The extraction had
collapsed both onto the local at wording.
Move Schedule's strict RFC 3339 instant, local-calendar, and IANA zone
parsing into @deepseek-ai/dsh-util-time, and have Schedule consume it.
The shared entries answer discriminated results and own no failure
vocabulary; Schedule keeps its error codes, diagnostics, durable record
shapes, and all recurrence arithmetic.
A plan review that mounted in the same commit as a Sidebar seat change
still crashed its opener, which retired the View full plan link and every
automatic open until the page reloaded. Two paths reached the crash:
- Returning from another Session: PlanReviewOpen read the departing seat
as mounted during render, and that seat released before the review's
effect ran while the arriving seat bound after it.
- A Session without a saved Sidebar layout: the seat released and rebound
around every store commit, and the commit that created the layout was
the one in which the review opened.
The seat now republishes its binding after each commit without releasing
it in between, and releases the latest binding only when it leaves the
screen. The review opener reads the mounted snapshot when it acts,
reports whether an open reached a seat, retries whenever the mounted
Session changes, and records the review as opened only after an open
does. Embedded subagent reviews still open in the visible parent Sidebar.
* feat(desktop): distinguish account quota alerts from API key notices
* docs: condense architecture introduction within existing budget
(cherry picked from commit 01aacaee4d48fd7f4d00acb5e23758084d3f224e)
* test(desktop): cover quota notice lifecycle and remove unknown casts
(cherry picked from commit 7fd09407c482d1f0e30f24ba0ebf23cd844ac9a1)
* chore(account-quota): align tests, catalogs, and bilingual pairs with the account plugin
* fix(ui-settings-account): pass the Platform retry label to the account top-up overlay
* fix(chat): preserve quota failures and global notices
* fix(account): keep active top-up pages across quota notices
* fix(account): share platform page ownership and release quota holds
* fix(account): defer notices behind the shared Platform page
The single native Platform view covers the document, so a quota failure that arrives while a Settings-opened page shows is deferred rather than retained: the newest failure still replaces an older notice and its Modal appears after the viewer returns if still current. Top up remains the retained case, releasing its hold and page request with the entry.
* test(account): align quota fixture with bonus actions
* fix(account): preserve quota notice and Platform return focus
* fix(account): preserve onboarding return reads and failed notices
* docs(account): clarify page opener return ownership
* test(account): drive bonus acknowledgement retry deterministically
---------
Co-authored-by: liyao <[email protected]>
Co-authored-by: lsdsjy <[email protected]>
* fix(plugins): name the default install source by the registry it names
The add-plugin dialog showed "默认安装源" for pnpm's own registry, which
told the reader nothing about where the install would download from. Name
npm's own registry as the official npm registry, and any other registry
pnpm's own configuration names by that registry's name or host, so the
folded control reads by the registry the install actually asks.
* test(plugins): cover comparing an unparseable registry address
---------
Co-authored-by: Turtle <[email protected]>
The archived filter reaches the row toast through the registration's declared
store instead of a registrant-owned view hook, per the cross-entry view-state
rule. The README names the toast action by its actual label, and the
unarchive e2e switches back to Hide archived so it again proves the restored
row is an ordinary row in the default view.
The view-options filter is now hide/all/only radio items, the
archived-only view drops Workspaces without an archived Session, and
tree children of a dropped Workspace nest under the nearest shown
ancestor (#4854).
The installed-wheel smoke checks real model tool use and externally verifies
the created file, a fresh host-only challenge, the copied receipt, and the
unchanged source. DeepSeek can return the requested acknowledgement before
a file-details paragraph; requiring it to be the last line makes correct
SDK execution fail according to the placement of explanatory prose.
Accept the exact acknowledgement on any standalone line, retaining completed
turns, model-requested tool calls, exact file bytes, and session-log checks.
Replay the observed response through both turns and keep negative coverage
for absent or embedded acknowledgements and incorrect files.
Only the bilingual pairing records conflicted. Master moved Agent Note records to
per-heading hashes, so this branch's note record was re-recorded in that format;
the ui-primitives and ui-theme README records were re-recorded unchanged. The
stylesheet corpus spec still passes over master's new client sheets, so no ring
needed realigning this time.
The probe needs a value that cannot be inferred from the prompt, not protected information. Describing that generated UUID as a private secret made the API test depend on an unrelated disclosure decision. Use an explicitly synthetic sample label and a benign formatting update while preserving execution audits, first-continuation cache assertions, and disabled retries.
Open the running Think disclosure explicitly when a process group also contains tool updates, and keep the fork process summary expandable in its ARIA expectation. Record the Goal request-series marker in a V4 fixture successor while preserving the historical V3 recording. Production behavior and the scroll assertions stay unchanged.
Record explicit request-series starts and the tool additions admitted when resuming a seeded parent with no tool declarations. Keep tool names and the shifted source-event reference alongside that activation history. Refresh only the affected owner-local outputs to the current writer format; retain historical replay fixtures and the unchanged child expectation.
Tool changes previously forced prompt consolidation even when the prepared
route could activate new tools through history. Rewriting the first system
message, or clearing an earlier appended prompt, reset the declaration
series and turned additions into immediate declarations.
Only routes without toolUpdate need that tool-triggered consolidation.
Capable routes append the full changed prompt and keep existing messages.
Explicit series starts, surface replacements, and unsupported prompt
routes still consolidate; retained-name definition changes still rebuild
tool declarations in Session.
Cover both update modes and reset paths, and pin the combined prompt/tool
transition through the shipped headless profile with shared schema goldens.
Run a real DeepSeek conversation through the built SDK profile and change the scoped tool registry through a model-invoked controller. Compare the first post-addition cache usage with the preceding request after unique user history has been cached; verify deferred declarations, chronological activation, and actual tool execution. Removal remains covered without requiring its cache prefix to survive. Disable test and provider retries so a warmed transition cannot hide a cache regression.
Log tool changes as developer messages independently of model capability,
fold committed headers and updates into Session.toolHistory(), and let the
LLM runtime construct deferred and retained declarations for routes that
declare a toolUpdate mode. DeepSeek serializes updates as system-role
tool_addition/tool_removal blocks with defer_loading and the tool-changes
beta header. An unchanged restored tool continues the series and is
re-offered through its recorded blocks instead of rewriting declarations.
Replace the obsolete rejection tests with wire assertions and add coverage
for the session fold, loop emission, route projection, config validation,
and the beta header. Chat and Trajectory changes land separately.
* feat(i18n): key translation pairing records by heading section
Replace the whole-file blob hashes in *.i18n.yaml with one entry per
heading section that still holds language-specific content, keyed by the
English heading-slug path. Blocks identical across the pair (generated
table rows, code blocks, shared regions) stay out of the hash, so edits to
different sections and identical regenerations merge with Git's default
text merge, including on GitHub.
Remove the dsh-translation-pairing merge driver, its resolver command and
installer wiring; gen-translation-brief recovers last-confirmed text from
commit history. Migrate all active records, archive the superseded Agent
Note, and record the replayed conflict reduction in the new one.
* test(i18n): refresh translation prompt snapshot for the terminology note
* feat(i18n): exclude only code blocks and generated regions from pairing records
Replace byte-equality masking with an explicit rule: a record hash skips
fenced code blocks and BEGIN/END GENERATED regions, the two kinds of
content the pairing gate already requires to be identical on both sides.
Move generated data into regions written into both pages:
gen-config-catalog renders both languages and the record with per-package
regions labelled by code identifiers; gen-module-graph keeps its table in a
region; gen-doc-graphs splices the event matrix regions into the Chinese
page. Add a generic region splice beside the region grammar.
master released 0.1.7-rc.1 while the package added by this branch still declared 0.1.7-alpha.2, which failed Dependency layout (verify-npm-install-layout), Pack npm tarballs (release members must share one version) and node 24 / static (constraints) from one cause. Merge origin/master and bump the new package to the root version.
The page carried a 28px top inset above its head row, so the window's topmost 28px on that page belonged to no drag region — the frame's former band covered it, and the per-row mark did not. The inset moves into the head rows themselves (.pageHead and .detailTop), which now start at the window's top edge while the content keeps its position. The browser lane pins each row's top edge at zero and the negative control confirms both assertions fail on the pre-fix sheet.
Review caught two real gaps in the previous commit.
The rename dialog's no-op check compared the localized display title, so
on an automatically titled Workspace the seeded prefill equalled it and
Rename stayed disabled — the user had no direct way to pin the visible
name. The dialog now seeds the draft with the label on screen while the
stored title decides whether confirming saves, and the duplicate check
excludes the target by Workspace identity instead of by title, since the
seeded label equals the row's own displayed title.
The registry took the automatic title from the canonical path, so a
symlink at the first-use path titled the Workspace after its target and
the default lost its localized label. The title now comes from the
requested directory's final segment; the path stays canonical.
Also: drop a rotting file count and the stale localized-path wording from
the Agent Notes, record the two cwd-derived Session label fallbacks as
known consequences, trim the WorkspaceBrowser memo comment to the
non-obvious part, and remove the deleted request type from the
hand-maintained catalog LINK_MAP.
Resolving packaged-app icons grew the embedded C# until the generated
-EncodedCommand line reached 32,883 characters for a 222-character path,
past the 32767-character CreateProcess limit, so association queries stopped
starting for long multibyte paths. Write the adapter to a private temporary
script and pass it with -File instead; the command line no longer grows with
the path. The temporary directory is removed once the call settles.
The icon fallback also reads the handler name the caller already fetched
instead of calling GetName again, and the README records that icon
visibility depends on resolving the Shell's indirect reference.
With no OS-marked default the split button labelled the first registered
application and marked it "(default)" in the menu, but the primary action
still asked the OS to resolve the association again; on Windows that can
prompt or open a different application than the button promises. Send that
application's id explicitly and keep the association path for the case the
Host actually marked a default.
The snapshot scenario now clears the platform's own default marker and
re-enters the file, so the association is read again instead of reusing the
answer already held, and it asserts the launched target rather than only the
labels.
Review threads: shrink READ_LANG_BY_EXTENSION to the suffixes whose own name is the better label (tsx/jsx/tf/tfvars/gradle) since the other 41 values already equal the language short name; label .hcl as hcl and .tfvars as tfvars instead of tf; accept .groovy alongside .gradle with its own short name; document that LANG_ALIASES also carries the persisted short ids; route the three inline alias lookups through grammarForHint; state that a short name may equal the grammar id; fix the util README wording.
Tests: cover .groovy, the four self-naming suffixes, and every id each suffix reaches through the shipped surfaces (the hand-synced LAZY_ALIASES list could not catch an alias whose target is neither boot nor lazy).
The retained-tab-layout note still stated that existing window-drag region pulses remain; this layer's pulse is gone and the shell watcher replaces it. Rewrite both sides and re-record the pair.
The recall watcher now tolerates a short quiet window so a report that arrives before a CSS transition moves anything cannot end the loop on its first unchanged sample, re-arms on a transition or animation that touches a marked row, and re-arms on a child list change in a container holding one. A dock picture withdraws its strip's drag claim while a pane floats, because a float sorted before that row would otherwise sit earlier in the document and lose its own subtraction. The settings panel closes when an onboarding step appears, since the step's overlay marks only #root inert. Prose and the two Agent Notes record the Windows narrowing of the Platform overlay return bar, the collection rule, and the rows' one home in the ui-theme manifest.
Node's module-hooks thread serializes resolver errors and returns the stack
accessor as a read-only configurable data property. Rewriting the routed
importer then assigned error.stack, threw a TypeError, and replaced the
original ERR_PACKAGE_PATH_NOT_EXPORTED or ERR_MODULE_NOT_FOUND error, so
plugin metadata reported a failure instead of falling back to package fields.
The importer rewrite now redefines a rejected stack value in place and
rethrows the original error with its code.
Master's newest commits add `.close` in ImageLightbox and `.imageButton` in
MarkdownText, each declaring the brand token directly. Both now read
`--dsw-focus-ring-color` through `--dsw-focus-ring-width`, as the stylesheet
corpus spec requires of every client focus rule.
The new no-default scenario cleared the macOS application catalog, which
does nothing on Linux: `gio mime` owns the OS default there, and the
Linux stub never wrote the launch log, so CI timed out waiting for the
application gesture. Clear the marker each platform actually reads, log
launches from both stubs, and compare the launched id against the
platform's own registration id.
Conflict resolution:
- docs/config-catalog: regenerate the English page; the Chinese page follows the
three shifted Config sources and the bilingual pair record is re-recorded.
- docs/module-graph: the generator rewrites all three artifacts together.
- packages/shell/tool-pwsh-persistent/src/index.ts: keep master's rewrite of the
prompt handling and re-apply the surrogate cap and its import.
- The three package.json dependency entries follow master's workspace:* range
convention, and the lockfile importer specifiers match them.
Master's newest agent-preset sheet carries both the new `.helpButton` and the
retained `.iconButton`, whose focus ring still declared the brand token
directly. The stylesheet corpus spec rejects that form, so it now reads
`--dsw-focus-ring-color` with the brand-token fallback.
ui-theme/README.md, README.zh.md and README.i18n.yaml conflicted again: master
extended the `design-platform.css` sentence with the `--dsw-alias-file-diff-*`
palette. Kept that sentence together with this branch's `focus.css` paragraphs
and the seven-sheet entry list, then re-recorded the pairing hashes.
The reported defect is the branch where the Shell lists associated
applications but marks none as the default: the split button promoted
"Show file location" to the primary action and hid the applications
behind the menu.
Record that state in the keyless document-preview scenario. The new
golden pins the primary action to the opening control, and the gesture
log asserts the main button opens the file while the menu's marked
default launches the first registered application.
Two focus treatments still named a colour of their own: the TurnNavigator
mark's tick filled with `state-business-primary` under a comment that already
claimed the brand colour, and the plugin inventory search input drew its focus
border in `state-business-primary` while the shadow beside it read
`--dsw-focus-ring-color`. Both now read the same ring colour as the rest.
`Tooltip` states why it takes `pointerModality()`'s wide answer while focus
rings read the narrower `data-input-modality` attribute the module publishes.
The ui-web source map gains the two window-drag modules and its boot row names the watcher install; ui-settings-general states that the settings panel portals beside #root. Both pairs are re-recorded. The ui-settings-general manifest keeps master's dependency order so only the two new dev entries appear in its diff.
The first-use directory name and its stored title came from the Client's
startup language, so one product decision carried two incompatible
requirements: a path addressed by shell commands, tool arguments, @path
references, and session logs, and a label a reader reads.
The controller now owns the fixed `default-workspace` directory name and
the registry titles the Workspace after that same segment, so
`workspace.initializeDefault` takes no request at all —
WorkspaceInitializeDefaultRequest and its name validation are gone, and
the registry resolver returns a path instead of a path and title. No
language reaches the Host.
Browser consumers label a Workspace through the new
`workspaceDisplayTitle`: a title still equal to the automatic one reads
as the localized default name from the `common` namespace, every other
title reads verbatim. The Workspace browser resolves it once at the store
read, so rows, hover card, search meta, and the rename and delete dialogs
inherit it; the hero picker and the Conversation chip resolve it too.
Confirming a rename stores the text on screen, which is what stops a row
following the language.
Explain configuration, window and input semantics, source ownership and current limitations. Record why persistence belongs to the execution host and refresh repository catalogs.
Exercise the real Loader, AgentLoop, helper transport and attachment pipeline with an explicit desktop protocol fixture. Add a headless V4 Session replay for observations and actions.
Use disposable applications and independent state records to verify clicks, Unicode input, modifiers, scrolling, dragging, capture and stale-target cleanup. Share the native test transport.
Declare package exports, workspace dependencies and build entries. Add an opt-in macOS source composition and enforce the experimental release payload.
Register native operations and model guidance, and bridge objects through the current authorized tool binding. Join Agent and provider cleanup without introducing a persistent evaluator.
Implement serial JSONL transport with request/response limits, deadlines, cancellation and process-range cleanup. Cover protocol and stream failures across host platforms.
Provide discovery, observations, screenshots and input through retained objects. Preserve per-window snapshot identity and prevent action options from replacing the selected target.
Define the evaluator-independent app/window API and validate method-specific requests and native responses. Test invalid targets and parameter admission.
Expose app and window handles, scoped AX snapshots, permissions, input and capture through a JSONL helper. Bind handles to process lifetimes and report stable native errors.
pnpm install --lockfile-only, run to align the new workspace edge's specifiers, also re-resolved unrelated entries: it pinned registry.npmjs.org tarball URLs on the two libreoffice-kit optional platform packages and downgraded glob 7.2.3 to 7.2.0. The tarball URLs fail verify-lockfile-policy against the mirror's published metadata.
Rebuild the file as the base lockfile plus only the three intended importer additions (the new package's block and its two consumers), so the resolution entries stay byte-identical to master.
The Summary narrated the change ("the suffixes the old read table recognized keep their historical value") rather than the contract, and at 109 words it exceeded the 100-word package Summary limit.
State the rule a reader at HEAD can act on: a suffix a recorded session already holds keeps its persisted value, every other suffix takes its language's short name. The dropped path-separator and leading-dot detail stays documented under Language selection. Both languages updated and the pairing record re-recorded.
The package joined the workspace as version 0.1.6-alpha.2 while the root release moved on, which failed three CI jobs from one cause: constraints (version must match root), Dependency layout (verify-npm-install-layout finds no workspace version), and Pack npm tarballs (dsh release members must share one version).
The new JSDoc and test prose narrated the change instead of the shipped
behavior: "pre-unification", "the old read table", "used to persist ... it
now persists". A reader at HEAD cannot resolve those stages, and the
persisted-value rule they describe is a durability contract that stands on
its own.
Restate each as the present contract: a suffix whose value a recorded
session already holds keeps it byte-identical; every other suffix takes its
language's short name. Rename the test's transcribed expectation away from
the branch vantage and re-wrap the module comment the earlier edit left
over-long.
`package-target.ts` imported `macos-notarization-proxy.ts`, whose top-level
import of `@deepseek-ai/node-addon-system/flock` resolves through the package
`exports` to the unbuilt `lib/flock.js` on a clean checkout. The step that
emits that file runs inside the same packaging script, so `check:package`,
`package:*`, and the `restore:mac-proxy` recovery command all failed with
`ERR_MODULE_NOT_FOUND` before reaching it; running `pnpm run typecheck` first
left the host addon binary missing instead, which failed at lock time.
The proxy lock now loads the entry at first use through `flock-entry.ts`. When
the import is unresolvable or the host platform package lacks a binary listed
in its `prebuilds.json`, the loader runs `pnpm run build:native-system` and
`pnpm --dir native/system run build:ts` before importing again; other errors
and build failures propagate, and a failed load is retried by the next call.
`check:package` no longer touches the entry at all.
Tests cover the loader steps and load the proxy module from a directory where
the addon package cannot be resolved. The Desktop README records the
behavior in both languages.
(cherry picked from commit 2d74cf50310d4efbbccbbe79a105fcc3a468b19d)
The packaged-imports plugin moves from generateBundle to moduleParsed so
external dynamic import() and require() targets, which chunk metadata
omits, fail the bundle too. Each bundle now carries an import policy:
the main process allows Node builtins, sandboxed preloads only the
modules Electron's require polyfill resolves, and the failure names the
importing module and the allowed set. The wine Windows gate bundles
apps/desktop after the Host tsdown pass like build:lib:host, the
ts-build-config note lists that step, and the tsdown docs name the
workspace match exactly.
Fixes#4993
Four focus rings added on master after this branch's base still declared their
own colour: PresetGuideDialog's panel, CodeCard's action (state-business-primary),
SegmentedControl's tab, and AccountSection's link button (button-primary-fill).
The stylesheet corpus spec now rejects each of them, so they read
`--dsw-focus-ring-color` with the brand-token fallback like every other ring.
CodeCard keeps its 1px dense width; the other three take
`--dsw-focus-ring-width`.
Conflicts and how they were resolved:
- ui-agent-preset/AgentPresetSection.module.css: master replaced the icon-only
tooltip actions (`.iconButton`, `.iconDanger`, `.revealedPath`) with
`.cardHelp` + `.helpButton`, which deleted the one declaration this branch
edited. Took master's structure and re-applied the branch's change to the two
`.cardMain:focus-visible` rings, which master kept unchanged.
- ui-theme/README.md and README.zh.md: master documented the separately exported
`brand-font.css`; this branch documented `focus.css`. Kept both, with the
dynamic entry's sheet list at seven sheets including `focus.css`.
`README.i18n.yaml` re-recorded with `verify-translation-pairing --write`.
Pointer suppression previously cleared `outline-color` on the focused element
alone, so a ring painted by a descendant, a pseudo-element, or a `box-shadow`
stayed visible, and editable text controls lost the focus feedback they need on
click.
Ring colour now flows through `--dsw-focus-ring-color`, which component outlines
and focus-ring shadows read alongside the brand token. Every ring that inherits
the variable is suppressed together, and `body :focus-visible:not(:read-write)`
limits the suppression to rings while editable controls keep their own feedback.
Keyboard modality returns on Tab, Home, End, PageUp, or PageDown, and on focus
reaching a different control after a non-composing key. IME composition keys,
refocusing the same control, and window blur leave rings silent. The desktop
preload menubar suppresses its own ring inside its shadow root, where the
document-level attribute does not reach.
The root tsdown workspace pass builds every member concurrently, so the
Desktop main bundle could resolve its inlined workspace devDependencies
(dsh-home-paths, dsh-app-boot, dsh-deepseek-account) before their lib/
output existed. rolldown then kept them as external imports, which the
asar does not ship, and the packaged application failed at launch with
ERR_MODULE_NOT_FOUND on a clean checkout; stale lib/ output on long-lived
checkouts hid the defect.
apps/desktop leaves the root workspace list and build:lib:host bundles it
after the Host pass. Every Desktop bundle now runs a rolldown plugin that
fails the build when a chunk imports a bare specifier the packaged
application cannot resolve: electron and the manifest dependencies for
the main bundle, electron alone for sandboxed preloads.
master grew a fourth drag owner after this branch: the Platform overlay's return
bar (ui-settings-account) declared `app-region: drag` on its own header. The
branch absorbs it into the contract — the header marks itself `data-window-drag`,
its own app-region drag/no-drag rules are deleted, the ui-theme manifest pins the
row and its 48px height, and the Agent Note's row list names it — so the tree
declares the drag surface in exactly two places again (the shell's mark rule and
the Windows caption row).
Earlier resolutions from the first merge stand: the dockkit strip keeps its mark,
the sidebar-right pulse stays deleted, ui-settings-general keeps upstream's
dsh-settings and this branch's react-dom, and tsconfig.host.json takes upstream's
`files: []`.
Checks: build, build:web, typecheck, test:gui, the ui-theme/base-styles gates, the
window-drag-coverage lane, doc-sync and translation pairing.
Conflict resolutions:
- ui-dockkit TabPanel: keep upstream's reworked tab strip and re-add the row's
`data-window-drag` mark on `css.tabStrip`.
- ui-sidebar-right SidebarRight.tsx/.module.css: keep upstream's retention
rewrite and re-delete its hand-written one-frame app-region pulse; the shell's
window-drag watcher owns recollection.
- ui-settings-general/package.json: keep upstream's `@deepseek-ai/dsh-settings`
dev dependency and this branch's `react-dom`.
- tsconfig.host.json: take upstream's `files: []`; client sources belong to the
client aggregate.
- pnpm-lock.yaml: master's lock plus only the react-dom importer entries.
The consolidated commit refreshed unrelated transitive resolutions while it
resolved the settings portal's new react-dom dependency. Restore those entries to
their previous versions and keep only the two importer entries the portal needs;
the lockfile already carries both snapshots.
The shared code-language table must not claim a suffix a dedicated viewer
declares, and the Host read card must keep the `lang` values it already
persisted.
- Drop `csv` from the shared table: Code registers before Spreadsheet, so
the earlier body would take `.csv` and the browser snapshot gate fails.
- Add `readLangHintForPath`, the read card's legacy projection over the
shared table: the 43 pre-unification suffixes keep their old short ids
byte for byte, new suffixes use the canonical id.
- Add an ownership regression test over the full preview registry that
turns red when `csv` returns, plus byte-level and alias-normalized tests
for the read projection.
Three tools capped the preview text they return with String.prototype.slice
at a UTF-16 code-unit budget. A cut that lands inside a surrogate pair
leaves a lone high surrogate, which is not well-formed text: a strict JSON
reader rejects the durable Session log carrying it, and the preview shows a
broken glyph. A lone surrogate retained in history has already blocked every
later Messages request for one session.
Centralize the cap in output-retention as
truncateWithoutSplittingSurrogatePair, and use it from the persistent bash
and pwsh shells and the string-replace editor. The cut drops the unpaired
half instead of keeping it, so the retained text stays a prefix and is at
most one code unit shorter than before.
The new dependency edges and the shifted Config sources regenerate
docs/module-graph and docs/config-catalog, including the committed
translation pair.
Refs #4817
The document Code preview and the Host read card each owned an
extension-to-language table that had drifted: the preview table had 13
extensions the read card lacked, and the two returned different language
ids for the same suffix. Both now resolve through the new zero-dependency
@deepseek-ai/dsh-util-code-language, which also adds common Windows,
config, markup, and language extensions. Every added grammar stays in the
lazy set; the boot grammars are unchanged.
Fixes#4822
The issue reported .ini files with no preview. On master the ini grammar is
already in CODE_HIGHLIGHT_EXTENSIONS, so the code renderer claims the
suffix and .ini previews. No production change is required; this test
records the admission behavior so a future allowlist change cannot silently
drop the reported suffix.
The Host's default marker is best effort: on Windows it comes from the
Shell's ASSOCSTR_EXECUTABLE/APPID answer, which does not always name an
enumerated handler. When no application carried that marker the split
button promoted 显示文件位置 to the primary action even though the menu
listed applications that can open the file.
Select the OS-marked default when present, otherwise the first registered
handler in Shell preference order, and mark it as the menu default.
Reveal is promoted only when no application is registered at all.
Windows 11 ships some applications (Notepad, other Store apps) as MSIX
packages whose Shell handler reports an indirect icon reference such as
@{Microsoft.WindowsNotepad_...?ms-resource://.../NotepadAppList.png}
instead of a file path. SHDefExtractIcon cannot read that reference, so
the menu showed the generic fallback glyph.
Resolve an indirect reference with SHLoadIndirectString before extracting,
and fall back to the handler's executable when the resolved source still
yields no image.
The macOS window's draggable area was a hand-written band: a 52px strip, deepened
to 76px by a marker the Conversation header had to keep in step with its own
height. It drifted from the layout — blank runs inside a chrome row did not drag,
and a control a few pixels away dragged the window instead.
Chrome rows now mark their own element (`data-window-drag`) and the shell declares
the surface once (`html[data-platform='darwin'] [data-window-drag]`), so a row's own
box is its draggable geometry and no fixed band has to match any row's height. The
frame band, its 52/76 figures, the marker, and the per-sheet drag rules are gone;
interactive controls and overlays portal beside `#root` where one rule subtracts
them.
Recollection becomes one shell watcher (`window-drag/recall.ts`): Electron rebuilds
the window's drag rects only when a computed app-region value changes
(electron#32341), so the watcher measures every marked row each frame while the
surface moves, sets `data-window-drag-recall` for the frames whose geometry changed,
and clears it on the frame that finds the geometry settled. The right panel's
hand-written pulse is deleted with it.
Coverage is a contract with executable parts. `window-drag/regions.ts` publishes the
composition rule and the interactive selector that both the sheet and its spec
compare against; the ui-theme gate asserts the package tree declares drag in exactly
two places and pairs every row's mark with its sheet, selector, and authored height;
and the browser lane boots the shipped composition in Chromium with the darwin
marker to assert per-row geometry, a content body under a marked head row, a
covering overlay, and the watcher's pulse. The plugin manager's detail views mark
the head row they share rather than the pane they render in, so their text and form
labels stay content.
Both real machines agree: the macOS matrix ran on a real `hiddenInset` window with
HID-level pointer input and window-frame readback, and the Windows matrix on a
Windows 11 ARM64 VM — chrome rows drag, content and the covering overlay do not,
and the controls keep their clicks.
Refs #4619
Every ring that used 2px now reads --dsw-focus-ring-width. The dense tables and
toolbars keep their 1px ring on purpose: at 2px they visibly outweigh the rows
they sit between, so the standard value and the dense exception stay distinct
rather than converging on a number nobody measured.
The action cluster animates its width with overflow hidden, and the search pill
clips to its rounded shape, so an outer ring on the add, search and clear
controls was cut to a sliver. This package declared no focus style at all — every
control fell back to the browser default inside those boxes.
Ring the three controls inside the element, the direction issue #4655 allows.
A tooltip asks what the last input was: after any key the user is working from
the keyboard, so a programmatic focus may raise a bubble. A focus ring asks
something narrower — Chromium reveals an already-focused control as soon as any
key arrives, including a modifier or Escape that never navigated anywhere, which
is the ring users report as unexplained.
Record both answers and publish the ring's narrower one, so tooltips keep their
existing behaviour and rings stay silent for a pointer's focus.
The breadcrumb trail and the Miller column scroll, and the column's left edge
carries no padding, so an outer ring on their buttons was clipped to a sliver.
The TurnNavigator marker sits at the scroller's right edge, which clipped three
of its four sides. Ring those inside the element instead — the direction issue
#4655 allows — and change no layout value.
Clicking a control leaves it focused with :focus-visible false, so nothing is
drawn. Chromium then reveals the ring the moment any key arrives — a modifier,
Escape, a typed character — which is the unexplained focus ring users report:
they never navigated there, yet a ring appears under the pointer's last target.
Record the input modality on the document element, publish the keyboard modality
only for focus navigation (Tab, arrow keys), and let the global focus sheet keep
a pointer's focus transparent. Tooltip's pointer modality moves into the same
module so tooltips and rings follow one rule.
Focus rings named eight different colours across 54 client stylesheets, and a
control that declared no ring fell back to the browser default, whose colour
follows the operating-system accent — so the same build showed orange on one
machine and blue on another.
Every keyboard focus ring now uses --dsw-alias-brand-primary. A global ui-theme
focus.css sheet reaches the controls that declare no ring of their own, and 49
declarations name the same token. Only the colour changed: each declaration
keeps its width, style and offset.
Windows directory junctions are reparse points that lstat reports as symlinks, so list refused My Music, My Pictures and My Videos with workspace-file/not-directory while its own listing reported them as directories. list now follows a final link, requires the resolved target to be a directory inside the workspace root, and keeps read's no-follow gate.
A `$$` right after `\verb` or `\verb*` is that command delimiter, so it no
longer closes the block: `$$\n\verb$$\nx\n$$` keeps the whole formula and the
paragraph after it, as the grammar this replaced did. The tokenizer also drops
a dead null guard and the blank line the earlier removal left behind.
Tests cover the two delimiter spellings, a failed fence inside a comment, and
a trailing lone dollar; coverage stays at 100% on both changed files.
The `\verb` state machine added for a `%` inside verbatim regions produced its
own defect class: its lookahead rescanned the line for every unterminated
candidate (58 KB of them took ~2 s), a `%` taken as a candidate delimiter lost
its comment state on the fallback, and control words, bare letters, and the
starred delimiter each needed a rule. It is gone; the comment gate alone keeps
`$$\verb|%|$$` and the rest of a 17-case parity set at base behavior.
What replaces it is the single-line rule the flow needs anyway: a `$$` that
failed to close continues scanning while it is still on the opening line, so a
later `$$` there still closes (`$$\verb*a$$a$$`), and it ends the candidate at
that line's ending (or immediately, on a later line), so `$$x$$ trailing` and
the repeated-candidate inputs keep the behavior earlier rounds pinned.
Net: 12 fewer branches in the tokenizer, linear parser work, and 132 tests with
100% statements, branches, functions, and lines.
A comment whose text before the closing fence is empty or whitespace
(`95%$$`, `95 %$$`) no longer suppresses it, so a multi-line block whose last
line ends that way keeps its whole formula instead of falling back to upstream
and dropping its first line. A comment holding a non-whitespace character still
suppresses the fence, which keeps `\frac{1}{ % keep $$` at base behavior.
The note records the whitespace rule and its one consequence: a fence behind a
whitespace-only comment closes there, leaving a following lone `$$` as its own
empty block.
A `%` inside an already open comment is comment text, so it no longer resets
the comment's content flag: `$$\n% 100%$$\n$$` and a formula whose comment
holds `95%` before the fence keep scanning instead of closing one line early,
which restores base behavior for both.
The starred `\verb*` form repeats any character, letters included, so only the
plain form continues to reject a letter delimiter (`\verbatim`); `$$\verb*a$$a$$`
renders as base does. The Agent Note records the comment gate as a sixth
residual shape and lists the conditions the new cases pin.
A `%` whose comment text is empty (`95%$$`, or a multiline block whose last
line ends that way) no longer suppresses the closing fence, so the whole
formula survives instead of falling back to upstream and dropping its first
line. A `%` with text before the fence still suppresses it, which keeps
`\frac{1}{ % keep $$` and the no-space spelling at base behavior.
The verbatim scan now follows LaTeX's own reader: a letter cannot be the
delimiter, one `*` marks the starred form, the region must close before the
line ending or its characters stay ordinary content, and a comment holds no
commands. The Agent Note states which state belongs to which construct.
A bare `%` before a same-line closing fence (`$$\text{acc} = 95%$$`) stopped the
block from closing, so a display formula degraded to inline math. The comment
exception now applies only to a closing fence on a later line of the block,
which is where a multi-line block can hide one; a block that opens and closes
on one line keeps closing where it did before this flow spanned lines.
`\verb|%|` keeps its content reading, and the two comment cases are one test
with the annotation assertion on the first source only.
`\verb|%|` inside a display formula made the comment tracking treat the `%` as
a TeX comment, so the block skipped its closing `$$`, swallowed the following
paragraph into a KaTeX error, and split the next formula. KaTeX renders
`\verb`, so this was a regression against base.
The value scanner now recognizes the `\verb` prefix and consumes its region
without touching the comment or escape state: `$$\verb|%|$$` closes where base
closes. The note records the verbatim rule and drops the numeric case counts
the earlier revision stated.
An unescaped `%` inside a multi-line formula starts a TeX comment that runs to
the line ending, but the closing-fence check read a `$$` at the end of one as a
fence: `$$\n\frac{1}{ % keep $$\n2}\n$$` closed after the comment, produced a
KaTeX error for the truncated formula, and swallowed the paragraph after it
into a second block. The block now tracks the comment and ignores a fence
inside it, so base and this branch render the same value and keep the
following paragraph.
The Agent Note records the comment rule, states that every multi-line block
this flow owns is new (not only the ones on their own paragraph), and lists
the comment guard with the other seven.
The Chinese Agent Note had lost the bounded-work paragraph that the English
one keeps, so both now state it in the same place and the pair is 62 lines
each. Consequences also records the fifth shape the review found: a multi-line
block inside a container whose continuation line is de-indented gives upstream
the fence meta and an empty value, so the opening line disappears behind an
empty display block; keeping the continuation's indentation or moving the
block out of the list renders it. The Testing section now separates the two
cases that pin new behavior from the seven that pin behavior this change must
not alter, one condition each.
A candidate line ending in an odd backslash kept the escape run alive across
the line ending and any blank lines after it, so the next line's leading `$$`
counted as escaped content and bypassed the closing-fence check. Base kept the
later block as its own display formula; this branch swallowed it into one
KaTeX error block, and repeating the pair made the parse quadratic (12.8 KB
took 1.4 s, 25.6 KB took 8.2 s).
The escape run now ends where the line ending is consumed, which is what a
trailing backslash escapes. The pair parses as base does and repeated
candidates stay linear (25.6 KB in ~76 ms).
A block whose opening line carries a solitary `$` and that must interrupt a
paragraph is unchanged from the grammar this replaces: both flows decline the
interruption, so the block stays in the paragraph. The Agent Note records that
fourth shape with its workaround, and its Testing section now states each
guard's condition instead of the revision that produced it.
Round two of review found the previous revision's decline rule too broad and
its interruption guard too eager:
- A solitary `$` inside a formula is content, not a failed closing fence, so
`$$P = \begin{cases} 1 & \text{if $x>0$} \end{cases}$$` and
`$$\text{a $x$ b}\tag{1}$$` stay display blocks. Only a full `$$` sequence
that the line does not end after makes the flow decline the candidate.
- The dollar flow's interruption check now declines instead of claiming the
interruption. Claiming it split `**before` / `$$a\$b` / `after**` into two
paragraphs and exposed its `**` markers, because the candidate it claimed
for then failed. Declining leaves the decision to upstream's own check,
which short-circuits without consuming and claims only accepted fences.
- The guard stays scoped to the dollar flow: an unconditional decline dropped
the multi-line `\[` blocks (`Prose line` followed by `\[`) that upstream has
no counterpart for.
Guards cover the solitary dollar, the tagged formula, the escaped-dollar
paragraph, and the multi-line backslash block; the first three fail against
the previous revision.
Review of the multi-line change found three behaviors it had altered:
- `$$x$$ trailing\n\n$$y$$` scanned on from the failed same-line close and
swallowed the second block's fence, rendering one broken math node where
inline math, the prose, and the display block belong. A `$$` the flow
cannot close now ends the attempt, as the single-line case already did.
- The paragraph-interruption guard sat in the shared tokenizer body, so an
unclosed `\[` candidate (`**before\n\[literal]\nafter**`) split its
paragraph and exposed the `**` markers. The guard applies to the dollar
flow only, which is the one with a competing upstream construct.
- Repeated unclosed candidates (`$$a$b` per line) scanned to EOF from every
line, making 9.6 KB of them take about four seconds in a synchronous
parse. Declining the candidate on its opening line restores linear work
(about 18 ms).
Each behavior gains a guard test that fails against the previous revision.
A `$$math` block whose opening line carries math and whose closing `$$` sits
at the end of the last math line parsed as an unclosed flow:
micromark-extension-math reads the opening line's text as fence meta and
accepts a closing fence only on a line whose content is exactly `$$`. The
flow then consumed the following document, and KaTeX rendered the block plus
that swallowed text as one error span. Fence meta was also silently dropped
because the renderer reads only the math node's value.
The compatibility layer's dollar flow now owns every `$$` fence, spans
multiple lines, and stops its paragraph-interruption check before the line
ending, as the upstream flow does; registering it after `math()` is what
gives it that precedence in micromark.
'contains steady-state registration failures' flaked on the CI coverage
lane (mock called 0 times): the spec slept a fixed 20ms and asserted an
async continuation had run, which contention can outlast. Convert the
three positive-assertion sleeps to the file's existing vi.waitFor
pattern; the absence-assertion sleeps stay, because polling cannot prove
nothing happened.
2026-08-28 16:15:51 +08:00
14154 changed files with 747298 additions and 810100 deletions
@@ -16,7 +16,7 @@ Every Agent Note has two axes, both encoded in its **path** — `{lifecycle}/{cl
The date in the filename is when the topic was **first proposed** (per git history). Cross-references between Agent Notes use relative markdown links (`[topic](../../implemented/architecture/2026-…-….md)`) — never bare prose or numbers — so they are mechanically checkable and survive moves between folders.
The active lifecycle tree is the working inventory: browse its lifecycle/class folders or search the repository. Do not add a centralized `INDEX.md`; the [no-index Agent Note](implemented/process/2026-07-19-remove-generated-agent-note-index.md) owns the rationale. Implemented records with historical decision value but little future guidance move to the separate frozen [`archived/`](archived/AGENTS.md) tree described below.
The active lifecycle tree is the working inventory: browse its lifecycle/class folders or search the repository. Do not add a centralized `INDEX.md`: it duplicates path metadata and makes unrelated note changes contend on one generated file. Implemented records with historical decision value but little future guidance move to the separate frozen [`archived/`](archived/AGENTS.md) tree described below.
## Classification
@@ -39,7 +39,7 @@ Delete an implemented Agent Note that only describes small UI adjustments or pur
The archive is path-encoded as `archived/{class}/yyyy-mm-dd-topic-title.md`; `implemented` is deliberately absent because only implemented notes can enter it. An archival change moves the complete English/Chinese/sidecar triplet, retains `Status: implemented`, inserts the same `Archived: YYYY-MM-DD` line immediately below that status in both language files, re-records the sidecar, and repairs or deletes inbound links. These are the only permitted content changes during archival. Existing title punctuation, blank-line layout, and language-switcher wording do not block archival; preserve them with the body.
Once sealed, every archived triplet is permanently frozen. Do not edit, translate, reformat, update, move, or delete it, and do not treat it as authority for current behavior. Documentation gates skip archived sources, including their outbound links; active prose may still link into an archived note when it intentionally cites history. [`verify-archived-agent-notes`](../../scripts/verify-archived-agent-notes.ts) enforces the closed class tree, complete triplets, archive metadata, sidecar hashes, and the append-only frozen-content manifest. The [archive-policy Agent Note](implemented/process/2026-07-26-frozen-agent-note-archive.md) owns the rationale.
Once sealed, every archived triplet is permanently frozen. Do not edit, translate, reformat, update, move, or delete it, and do not treat it as authority for current behavior. Documentation gates skip archived sources, including their outbound links; active prose may still link into an archived note when it intentionally cites history. [`verify-archived-agent-notes`](../../scripts/verify-archived-agent-notes.ts) enforces the closed class tree, complete triplets, archive metadata, sidecar hashes, and the append-only frozen-content manifest, except for the exact seal transitions documented in [archive instructions](archived/AGENTS.md). The [archive-policy Agent Note](implemented/process/2026-07-26-frozen-agent-note-archive.md) owns the rationale.
## When to write one
@@ -53,7 +53,7 @@ A feature-addition note may be consolidated into the later removal note only whe
## The file format
Every active Agent Note follows one in-file format, enforced by `pnpm run verify-agent-note-format` ([scripts/verify-agent-note-format.ts](../../scripts/verify-agent-note-format.ts), part of `doc-sync`); the rationale for the format — and the alternatives it rejected — is [the uniform-format Agent Note](implemented/process/2026-07-05-uniform-agent-note-format.md). Archived notes retain the format they had when sealed plus the archive-date line above.
Every active Agent Note follows one in-file format, enforced by `pnpm run verify-agent-note-format` ([scripts/verify-agent-note-format.ts](../../scripts/verify-agent-note-format.ts), part of `doc-sync`); the rationale for the format — and the alternatives it rejected — is [archived the uniform-format Agent Note](archived/process/2026-07-05-uniform-agent-note-format.md). Archived notes retain the format they had when sealed plus the archive-date line above.
@@ -5,3 +5,5 @@ Archived Agent Note triplets under the kind directories are frozen historical sn
The archival change may only relocate a complete English/Chinese/sidecar triplet, insert the identical `Archived: YYYY-MM-DD` line below both `Status: implemented` lines, re-record the sidecar, and repair or delete inbound links. Do not inspect, verify, or repair links out of archived notes.
Run the [`dsh-archive-agent-notes`](../../skills/dsh-archive-agent-notes/SKILL.md) workflow and append new artifact hashes with `pnpm run verify-archived-agent-notes --write`. The normal verifier rejects changed or missing sealed artifacts, incomplete triplets, unknown kind folders, and invalid archive metadata.
The authorized Figma-link removal from `feature/2026-08-10-durable-workflow-runs-in-chat` has three exact old-to-new seal exceptions in `scripts/archived-agent-notes.ts` for its English, Chinese, and pairing files. These exceptions permit no other content change, reversal, or deletion.
# Agent Note: The job registry absorbs the observation record; the standalone activity seam is removed
Status: implemented
Archived: 2026-09-30
Superseded: the record declaration (`JobStart.record`, `RecordingJob`, `readRecord`, `pumpJobOutput`) and the split wire (`SessionJob.record` on the session control stream, `ctx.jobOutput`) described below were consolidated into one output ring and direct operations on `ctx.jobs` — see [the jobs seam consolidation](2026-09-03-jobs-seam-consolidation.md). The argument for absorbing the standalone activity seam into `ctx.jobs` still holds.
# Agent Note: Right Sidebar tab types and navigation
Status: implemented
Archived: 2026-09-30
English | [中文](2026-09-05-sidebar-tab-types-and-navigation.zh.md)
@@ -72,7 +73,7 @@ interface SidebarRightTabParamsMap {} // key: kind — a page type declar
`openResource` accepts the union of every declared resource shape and `openTab<K>` the shape declared for `K`; a body narrows `navigation.params` by the protocol or kind it knows it serves. Parameters belong to the resource type rather than to the viewer because a line number is a fact about a file location, not about the text preview, and any type that claims `file` addresses receives the same shape. Values must be JSON-serializable, and a record must be rebuildable from address and parameters alone, because undo, redo, reload, and HMR rebuild tabs after the opener is gone.
Beside the two opens, the face carries `close(tabId)`, `active()`, `isExpanded()`, `toggleExpanded()`, and four operational methods — `focus(tabId)`, `split(paneId?)` (returning the new pane, or `undefined` when the pane budget or the width rule forbids the split, recording nothing), `float(tabId, rect?)`, and `dock(paneId)` — each recording one history entry and a no-op on a missing target or one already in the requested state. There is no layout snapshot, no subscription, and no lookup by address: the face grants control over the layout, not a view of it. The seat publishes its binding — its session, its store's actions, and its surface — while mounted; a command on the public face acts on the mounted session and throws with no mounted session surface. A tab's own actions reach their session's own store instead: the slot runtime mints one store per session, the plugin adopts each as it is minted, and the controller routes by session id, so an action fired after the user switched sessions still lands, and does nothing for a session whose store was never minted.
Beside the two opens, the face carries `close(tabId)`, `active()`, `isExpanded()`, `toggleExpanded()`, and four operational methods — `focus(tabId)`, `split(paneId?)` (returning the new pane, or `undefined` when the pane budget or the width rule forbids the split, recording nothing), `float(tabId, rect?)`, and `dock(paneId)` — each recording one history entry and a no-op on a missing target or one already in the requested state. There is no layout snapshot, no subscription, and no lookup by address: the face grants control over the layout, not a view of it. The plugin names the Session on screen — the selected Session while the Conversation fills the main column — from the Session selection and the main panel, before React renders either change, and publishes it as `mounted`; a command on the public face acts on that Session through its adopted store and throws when no Session is on screen or its store has not been minted. The seat reports only what it renders with: the room its docking kit measured and whether its frame width presents the panel fullscreen automatically. A tab's own actions reach their session's own store instead: the slot runtime mints one store per session, the plugin adopts each as it is minted, and the controller routes by session id, so an action fired after the user switched sessions still lands, and does nothing for a session whose store was never minted.
### Addresses
@@ -100,6 +101,8 @@ The conversation's `openFile(path, { line? })` — tool-row path links, produced
**Slot priorities to express an extension taking over a builtin, then registry-minted slot keys.** The first attempt had the overriding type register its body at a lower slot priority through an exported constant — a value import across dynamic plugins, and a second rule system (slot priority) standing in for the registry's. The second attempt had the registry mint a key per registration and return it from `register()`, which made registration a two-step dance whose ordering mattered. Letting the implementation declare its own `id` — required, unique, the same string it registers its seats under — needs no constant, no minting, and no ordering, and gives the registry the identity it needs to reject duplicates.
**A binding the seat publishes from its own effects.** The first form had the mounted seat publish its session, actions, and surface after each commit and release them when it left. React runs a commit's passive effects in tree order, and the frame renders the Conversation column before the right column, so in a commit that switched Sessions or returned from a global panel a Conversation component opening content from its effect ran while no seat was bound — after the departing seat's release and before the arriving seat's bind — and the open threw. The Session selection and the main panel change before React renders, so deriving the on-screen Session from them removes that ordering dependency. The seat still measures pane room, because only its rendered kit can.
## Consequences
- A type is one static object plus one or two keyed seat registrations; its occurrence information is read through injected `useTabInfo()`. The framework grows no per-type API surface, and a type shipped from outside this repository imports only types from the Sidebar package.
@@ -116,5 +119,5 @@ The conversation's `openFile(path, { line? })` — tool-row path links, produced
## Deferred
- A navigation protocol beyond `sidebar://<kind>`: sub-routes within a page, naming an implementation, and the ecosystem-facing rules for other navigation schemes.
- Opening into a session other than the one on screen from the public face, which acts on the mounted session only; a tab's own actions already act on their tab's session.
- Opening into a session other than the one on screen from the public face, which acts on the on-screen Session only; a tab's own actions already act on their tab's session.
- A localized message when an open fails from the conversation; the failure is currently the thrown error's text.
Loaded 100 of 14154 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
imccyu