Declare the tool-result pruning plugin in the examples workspace so the repl Cordis configuration resolves through plain Node and the Loader metadata gate.
Express the validated single-node surface rewrite without a non-null assertion or an unreachable defensive branch, preserving both the runtime contract and per-file 100% coverage.
Retarget the pruning feature onto the merged compaction foundation.
Adapt content-only tool-result rewrite validation to the session-owned surface manager, migrate the demo wiring to repl-agent, and refresh generated type, catalog, and website contracts while preserving pressure and overflow pruning behavior.
Copy an existing target's DACL onto the empty staging file before any content is written, then publish with ReplaceFileW so Windows replacement keeps the target security descriptor instead of inheriting the broader parent policy.
Keep new-file inheritance and POSIX mode behavior unchanged, retain the already-protected temp when a concurrently removed target requires rename fallback, and translate native errors into Node-style codes for the filesystem error boundary.
Add host-independent Win32 binding coverage, native Windows descriptor assertions, package documentation, and a bilingual implemented RFC that supersedes the earlier inheritance-only replacement claim.
Master unifies every live agent with its exact SessionId and moves declarative startup failures to agent-loop/config-start-failed. Keeping the branch’s AgentId label binding would let the TUI target the wrong lifecycle after reload and would miss asynchronous resume failures.
Resolve that contract migration by giving the selected terminal front door the same generated or resumed SessionId as agent-core, mounting the front door first, and entering fullscreen only after the matching root appears. Refresh the source-derived catalogs and keyless terminal goldens so Code Mode, workflow, Cordis-tool, and transient UI scenarios all exercise the merged identity model.
Wrap runDshSdkCommand so each command times itself and, in a finally block,
resolves consent (option A) and sends one best-effort, fire-and-forget telemetry
event (redacted cordis.yml + package.json content; never reads .env). Never
affects the command's exit code. Adds dsh-scripts -> dsh-telemetry dependency.
Default-on via absent consent entry; opt-out by a disabled telemetry entry.
The config/create wizard opt-out toggle is deferred (see design doc).
External-plugin creation will add a package-manager-native dependency
(github:owner/repo#ref or pkg@version) plus a cordis mount instead of fetching
tarballs into a temp dir, so the giget/pacote fetch package is no longer needed.
Add @deepseek-ai/dsh-telemetry, a launcher-side (non-plugin) library for the
ConsentResolver (parses cordis.yml consent + DO_NOT_TRACK/CI), buildTelemetryPayload
(redacted cordis.yml + package.json full content, never .env), getOrCreateAnonymousId
(random UUID in a per-machine global config file), and TelemetryReporter
(fire-and-forget, never blocks or crashes the command).
Endpoint is a fixed .invalid placeholder pending the real endpoint. Launcher
dispatch wiring and the helper feature-catalog entry are intentionally out of
scope. Registers the package in tsconfig references, the module graph, and the
README model-experience audit map. Per-file 100% coverage.
Greenfield #2 "建插件" modules for the forthcoming `dsh-sdk create <source>`
command, in a new foundation-independent package so it touches none of the
dsh-scripts / dsh-helper / create-sdk hotspots the foundation refactor edits.
- `resolvePluginSource(spec)` parses `owner/repo[/subdir]#ref` (github) or
`pkg@version` (npm) into a `PluginSource` discriminated union, failing loud on
an ambiguous or malformed spec.
- `PluginFetcher<S>` seam + `fetchPlugin` tag dispatch returning a common
`FetchedPlugin` (temp dir + immutable provenance).
- `GigetFetcher` (github) over @bluwy/giget-core: resolve `#ref` to a commit SHA
first, download that SHA; provenance pins the SHA. Chosen over unjs/giget for
its single runtime dep and absent install/action surface.
- `PacoteFetcher` (npm) over pacote: resolve the manifest, then extract the
tarball verified against its registry integrity. Registry-only is enforced by
the source resolver; extract runs no lifecycle scripts.
- Branded `CommitSha`/`Integrity`; network + temp-dir boundaries are injected so
the logic is unit-tested at 100% per-file coverage without network.
Wiring (package.json pin, cordis.yml via ProjectEditSession with a confirmed
diff, install --ignore-scripts) and the launcher command registration land
later with the foundation.
Move the interactive pi-tui front door into @deepseek-ai/dsh-tui while keeping @deepseek-ai/dsh-stdio line-oriented for pipes. Select the terminal package in the demo app, preserve logger ownership, and cover the production Loader composition with a PTY smoke test.
Clean merge; post-merge fixes only: packages/mode/README.md repoints its
stdio link at the renamed dsh-stdio home, and the lockfile re-resolves
this branch's dsh-mode peer edges against master's new sdk packages.
Conflict resolution notes:
- package.json/run-gates: both sides' new doc-sync gates kept (master's
scoped-events/readme gates + this branch's website-api/website-yaml);
js-yaml devDeps deduped (master added them independently).
- pnpm-workspace/knip: website AND python/sdk-runtime entries kept.
- doc-typecheck/verify-type-equiv: master's condensed headers kept, website
glob retained in both scan scopes.
- vendor/cordis/src/fiber.ts: master's lifecycle-hardening code taken; this
branch's richer FiberState JSDoc reapplied on top. vendor/README.md logs
both local modifications (hardening = 6, JSDoc enrichment = 7).
- pnpm-lock: regenerated from master's side (pnpm install).
Post-merge sync the gates forced (the system working as designed):
- verify-website-yaml caught 4 stale plugin names from master's package
reorg (dsh-stdio-agent -> dsh-stdio-demo, dsh-acp-agent -> dsh-acp-demo);
8 references fixed across guide/ and develop/.
- gen-website-api picked up master's 6 new services automatically
(ctx.approval/permission/sandbox/sessionQuery/skills/tasks -> 6 new pages
+ sidebar); api/index.md hub updated to list them.
- AGENTS.md budget ceiling 1370 -> 1400: the website rows (layout line + two
command lines) and master's own growth collided with the old ceiling; all
three website rows are load-bearing (new top-level dir, new CI command).
design/revertible-effects and design/context-model carry real TeX that was
showing as literal $$ source. markdown: { math: true } enables
markdown-it-mathjax3; pinned ^4.3.2 deliberately — v5 injects a <style> tag
per formula (31 on one page), which Vue's template compiler rejects, so v5
cannot work under VitePress; v4 emits pure SVG (probed: 0 style tags).
- website joins the pnpm workspace; root scripts website:dev/website:build;
run-gates gains a website-build gate (ci-primary + ci-static) — the
VitePress build doubles as the site's dead-link check; AGENTS.md documents
the commands.
- doc-typecheck + verify-type-equiv now scan website/zh-CN/**/*.md; every
```typescript fence converted to ```ts and made standalone-compilable
(55 compiled, 1 ignore-check). Phantom APIs the compiler caught are fixed:
invented event names (agent/turn-end, tool/call, llm/pre-request, ready,
dispose) replaced with real catalog events or per-plugin declare-module
merges; presentCall/inject/Config claims corrected to the real shapes.
- guide/config.md entry-fields table completed against loader EntryOptions;
its coding-agent example brought in line with examples/coding-agent.
