Re-record the sidebar regions that the redesign intentionally changed:
group session counts are gone, search is a collapsed header action, and
grouping lives in the View options menu. Session rows also follow the new
recency ordering, so their tree order updates with the counts.
The sidebar redesign removed group session counts, collapsed search into a
header action, and moved grouping into the View options menu. Update the
browser scenarios that waited on the old surfaces:
- Wait on the Ungrouped bucket row instead of the removed session-count text.
- Expand the collapsed search control before filling the renamed input.
- Open the View options menu instead of the removed Group by button.
- Assert the persisted grouping under the new dsh.workspace.view.v4 key.
- built-boot: assert the fixture workspace group row instead of its count.
Resolve the note-erasure race the review found: a control that rendered
before the first list read held no item and passed note=undefined, so
switching a rating silently dropped the stored note. The controller now
owns note resolution and toggle-vs-retract, deciding from the committed
item inside the serialized mutation, and clearNote expresses deletion.
Also from review:
- serialize the reconnect re-read behind queued mutations (resync), so a
list reply cannot resurrect a version a newer mutation replaced
- re-check disposal after the seeding read, so an unloaded fiber never
reaches the wire
- drop Object.freeze on Maps, which does not prevent set/delete
- declare the @deepseek-ai/dsh-client-connection dependency it imports
- surface a failed list load in the controls
- drop the /client value exports that had no consumer
- state the per-turn render scope in the README and subsystem pages
- align the package version with the root
Local run of check:ci:windows-complete (the windows-native gate) on
latest master surfaced five Windows-only failures, all unreachable by
current CI because the native windows job is disabled and the wine gate
only covers build+site.
- install-lefthook/translation-pairing-merge specs junctioned the real
scripts/ and tsx package into fixtures; Windows recursive deletion
(Node rmSync and git worktree remove) follows MOUNT_POINT junctions and
deleted the repository's own directories mid-run. Fixtures now unlink
their reparse points before any recursive removal (shared helper in
scripts/test-fixture-cleanup.ts).
- workflow-workerthread spawned its worker with an empty env; on Windows
os.tmpdir() then degrades to the literal relative path undefined\temp,
so tsx wrote its transform cache into a cwd-relative undefined/
directory inside the repo. The worker env now injects the host temp
path on win32 (workerSpawnEnv, platform-parameterized and unit-tested
on both arms).
- workspace-context spec did not stub USERPROFILE (win32 homedir) or a
set DSH_HOME, leaking the developer machine's real ~/.dsh/AGENTS.md
into discovery.
- ui-trajectory client-bundle spec mounted the built artifact without the
remote/settingsScope provides the locale plugin needs, so the plugin
never activated and no view registered.
- subagent temp-fixture cleanup lacked the maxRetries Windows handle
release needs under load (EPERM); added retries to the three affected
specs and the fixture-cleanup helper.
The preset-roster loop added by this PR names the \cordis\ preset id in
apps/cli/tests/windows-shell.spec.ts; the bare token is product data like
the existing agent-preset allowlist entries, not a package reference, so
the rescope-vendor hygiene check must not rewrite it.
Routes koffi allocations through a branded NativePtr helper (koffi's TS
types are any), binds the creationTime callback instead of passing the
unbound method, and braces the no-op signal assertions.
Adds the tool-pwsh-persistent README trio, documents the pty-local
shellDialect and the subprocess-local Windows inspector (console-wide
signalling, pseudo foreground groups, taskkill teardown) in both
languages, updates the tool-pwsh and persistent-pty notes in place, and
moves the pwsh-persistent-pty design note to implemented with the
shipped Decision and Consequences.
Adds @deepseek-ai/dsh-tool-pwsh-persistent, the mirror of
tool-bash-persistent for PowerShell: one owner-scoped persistent pwsh
per agent, an Invoke-Expression wrapper with backtick-escaped bodies and
exact native exit codes ( reset, \True fallback, catch to 1),
PSReadLine-echo tolerance (the echoed wrapper is stripped from captured
output and can never fabricate completion), and the same
timeout/cancel/exit reset semantics with pwsh-flavored diagnostics.
The minimal preset now gates its persistent shell stack by platform with
the #2234 disabled interpolation: the bash rows mount on POSIX and the
pwsh rows (pty-local shellDialect pwsh + the new tool) on win32, keeping
exactly one persistent shell per host. windows-shell.spec pins the
per-platform roster; the real Loader composition proves cwd/env
persistence, multiline and here-string commands, large-output clipping,
and exit/reset over a real ConPTY pwsh.
Adds shellDialect ('bash' | 'pwsh') to the local PTY backend. The
effective shellPath/shellArgs resolve per dialect (pwsh through the
shared dsh-pwsh-local resolver, bash defaults unchanged), the child
environment drops bash-only PS1/PROMPT_COMMAND markers and adds
NO_COLOR for pwsh, and pwsh startup bootstraps the prompt function that
emits the shared OSC 133;D + BEL marker, waiting (across follow-up
sends) until the controlled prompt is actually visible so the
banner-to-prompt gap cannot settle startup early. Bash behavior is
byte-identical; the real-pwsh suite exercises persistent state and
secret scrubbing on Windows.
createProcessInspector now returns a WindowsProcessInspector on win32
instead of throwing: Toolhelp32 tree enumeration with GetProcessTimes
start identities, the shell pid as a pseudo foreground group, taskkill
tree signalling, and inspector-verified Windows teardown (node-pty
signal kills throw on Windows, and externally taskkilled shells may
never fire its exit notification, so the handle settles \done\ from the
verified absence). subprocess-local and pty-local suites now run on
Windows with platform gates; the koffi-backed inspector joins the
windows-only coverage exclusions on Linux and is fully covered by the
windows-native lane.
Also flips vitest.config so subprocess-local and pty-local sources are
coverage-required on win32, and adapts the spawn/terminal suites to run
natively there (node-translated shell commands, injected POSIX group
paths, taskkill signal semantics).
Every generated method resolves to RemoteResult, so the plain-Node script
must read the business value through `.value`: the CAS ref it passed on to
goals/edit was undefined, which the client codec rejected before the request
left. The invalid-payload case keeps its try/catch — a codec-rejected
argument still throws at the Client Remote face rather than folding into the
error branch.
Review follow-ups that are logic rather than documentation:
- rpc.schema.ts had lost the credential-rejected branch while api-proxy.ts
still returns that code, so a legitimate business error failed the
client's response parse. Restore the branch and assert it.
- rpc-schemas.spec.ts had lost the workspace list, archiveSession and
insertSessionBefore cases along with the command schemas; those routes
still ship, so restore their coverage.
- An omitted SRC field is now recognized by an absent key instead of an
undefined value, which makes the allowance assertExactArguments already
granted reachable; an explicitly undefined field stays invalid input. A
weak descriptor's undefined result rides the wire as an absent value,
matching the envelope removal.
- The chooser unmounts an already-created backend when the surface entry
fails to load, and no longer reverses the captured id array in place.
`command.execute` no longer exists on the API Proxy, and the fake's own
handler went with it, so the case only reached a 404 body. The same carrier
behaviour is asserted on live routes by its `session.search`,
`subagent.prompt` and `host.pickDirectory` siblings.
Matching the full `RemoteFailure` keeps the assertion inside the typed result
and drops the `expect.stringContaining` placeholders, whose `any` return the
lint rule rejects on assignment.
`@deepseek-ai/cordis` returns to the peer and dev dependencies of
`dsh-client-ui-model` and `dsh-client-ui-skill`; every harness package declares
it, and the client type-assembly rename dropped it from both. The commands
manifest ships `src` alongside its generated typert faces, matching the
`./src/*` export it already declares.
knip gains the two directory-picker surface workspaces, whose specs are `.tsx`
and matched no default pattern, and ignores `zod` in the commands workspace:
that dependency belongs to the generated Remote and Host faces in `lib/`, which
knip never scans. The unused `dsh-client-test-runtime` and
`dsh-client-connection` dev dependencies are gone; the picker surface's own spec
never imported the former, and ui-settings reads the carrier's types through the
Remote assembly now.
Exporting `./typert` and `./remote` ships two generated modules that
`import { z } from 'zod'`, and the package declared no runtime dependency at
all. Under pnpm's isolated layout nothing resolves zod for it — there is no
root `node_modules/zod` to walk up to — so loading the plugin tree failed with
ERR_MODULE_NOT_FOUND the moment a composition mounted the commands typert
face. The two other packages exporting `./typert` both declare it; this
matches them.
Every generated Remote method resolves to `RemoteResult<T>`, so the Gateway
client spec asserts the ok and error branches instead of the unwrapped value
and a throw, and the generator fixtures declare the wrapper in the consumer
face they typecheck. The RPC-failure test splits into the Host error carried
verbatim in the error branch plus a transport throw folded into it.
The runtime client, ui-command and ui-plan benches answer the generated
commands Remote through its result branches and provide the `remote.commands`
namespace their plugins now inject; the ui-command bench also serves the `$on`
the service subscribes on construction.
The directory-picker chooser mounts a backend and its surface as a pair, so the
real-Loader composition serves both surface packages and asserts each entry
arrives and leaves with its backend.
The Gateway client spec's synthetic Remote namespace now resolves under both
analyzers, so its typescript/no-unsafe-call suppressions report as unused.
A business package imported the Remote assembly for `ctx.remote` and the
Connection plugin for the wire types it passes around. The assembly now
re-exports the carrier's Client-facing types, so a business package names one
package. The re-export is type-only: the carrier's runtime values keep their
own module edge, since inlining them here would duplicate the carrier inside
the assembly bundle.
Four surfaces that had no Remote assembly dependency declare one now.
The Gateway and the carrier each compiled both halves under one tsconfig, so
the Host aggregate built their browser faces — including the face that owns
`ctx.remote`, the most likely future consumer of a generated `/remote`
contribution. Both packages now expose a host and a client face, and each
aggregate references only its own; three modules the halves share appear in
both file lists, as api/remotes already does.
The two apps/web specs in the Host aggregate restate the conversation engine's
Context key format instead of importing the Client runtime for it. A drift
makes the key miss its rendered node, so the assertion fails loudly.
The Host aggregate now reaches one Client project, the carrier's host face,
which the Gateway's own dispatch face needs; no generated contribution is
reachable from it.
The browse and native backends were dual-face packages: a Node backend plus a
browser surface under one tsconfig that referenced Client packages. That put
Client projects — and through them the Client runtime — inside the Host
compiler aggregate, which builds before the generated Remote contributions
exist. Each browser half moves to its own Client package, and both backends
become Node-only.
The interaction is still one choice: the adaptive chooser mounts the backend
and its surface as a pair of Loader entries and tears both down in reverse, so
a resolved kind still swaps both faces. Compositions that pin an interaction
directly now pin the pair, and the chooser's runtime-string package list keeps
naming everything a composing app must resolve.
`CommandService.list` and `execute` carry the wire contract directly through
`@Remote`, and the Client assembly mounts the generated commands
contribution. The legacy API Proxy route, its schemas, the map rows, the
generated client methods and the fixture's command domain are removed, so the
catalog and the admission call have one owner again.
`Session.command()` keeps a result-shaped public face for parity with the
prompt, cancel and attachment neighbours it sits beside, and reads the
generated namespace through one `SessionRemotes` parameter. The Session
cluster declares that face against the owning business package rather than the
generated contribution: the Host compiler aggregate builds this package, and
it runs before any contribution is emitted.
Migrated calls lose the `title-invalid` class of protocol-only error codes and
report `internal`; no production caller branched on them.
Every generated Remote method now resolves to `RemoteResult<T>`: the Client
face folds a carrier failure, a transport throw and a rejected result payload
into one error branch, so no consumer wraps a call to recover them. Only
assembly faults still reject — a wrong argument count, an unmounted method, a
missing Context binder, an absent Connection.
`RemoteFailure.code` stays an open string because the closed RPC code union
lives in the carrier package, which already depends on type-meta; naming it
here would invert that edge.
The goal surface drops its own try/catch plus the structural probe that
guessed whether a thrown cause was an RPC failure, and reads the result
instead.
Absence crosses the wire as a missing field: an omitted argument and a void
or undefined result both arrive as an absent JSON member, and the wide RPC
result slot accepts a success response without a value. Parameters declared
optional stay optional in the generated consumer declaration, so a business
signature is never widened to `T | undefined` to suit the wire. The weak SRC
descriptor reads parameter names from a JavaScript signature and cannot see
optionality, so a source-launched Host accepts an absent field and the strict
LIB pass owns rejecting a genuinely missing required parameter.
Adding COLLAPSE_SECTION_ORDER and CODE_ONLY_INSTRUCTION shifted every
later line in packages/core/tools/src/index.ts by 14, and three generated
artifacts cite those lines: the subsystems cordis-surface region, the
event producer/consumer matrix, and the Agent Note pair record left
inconsistent by the cherry-pick resolution.
_Kerman