`ScopedLayers.effect` already returns an exact `() => void`, so the inherited
`() => void dispose()` wrapper voided a void — two lint rules, four errors.
The scoped layer's own teardown had no test, which is the registry-contribution
disposal contract the testing policy requires and the only path that calls
`TaskLayer.isEmpty()`: `ScopedLayers` prunes a scope's layer when its last
contribution disposes. The new case mounts one plugin contributing both a
surface and a listener into one scope, then unloads it and observes that the
agents which joined that scope are refused again.
Refs #2141
One host registry serves every composition in the process, so its two
service-wide collections answered per-owner questions process-wide. `start()`
asked only whether SOME surface was attached, so an agent whose own composition
loads no `tool-tasks` could start work it has no tool to collect or stop as soon
as any other preset attached one — and the answer changed depending on which
sessions happened to be open. `settle()` walked every registered listener, so a
task settling without a waiter injected one completion notice per mounted
preset into the same owner.
Both collections now sit in `ScopedLayers`, the layered-registry primitive
`tools` and `skills` already use: a registration files into its registering
context's scope, and a read unions the global layer with the owner's scope
chain. A surface or listener registered from an unscoped context lands in the
global layer and serves every owner, which is exactly the host-plane
composition's own controls, so the TUI path is unchanged without a special
case.
This supersedes the consumer-side filter in the previous commit. That filter
produced the right notices but sat in the wrong layer: it left the `start()`
gate process-wide, it could not be enforced against a producer that resolves
the registry directly, and it made a Consumer carry scope knowledge that the
other layered registries keep in the registry. `tool-tasks` is scope-agnostic
again and the `dsh-scope` edge moves to `tasks-local`.
`start()`'s refusal is now owner-relative, so its model-visible text names the
agent rather than the process. The shipped `minimal` preset keeps
`enableRunInBackground: false`, no longer as the safety boundary — the registry
owns that now — but so an agent that could never collect a task is not offered
the parameter at all.
Refs #2141
Moving the task registry to the host plane put every preset's `tool-tasks`
listener on ONE `LocalTaskService`. `settle()` computes a single snapshot and
walks every registered listener with no scope filter, and it marks `reported`
only when a waiter is present — so a task settling without a waiter reached
each mount's listener with `reported` false and every one of them injected the
same completion into the same owner. Three shipped presets carry `tool-tasks`,
and a preset file edit adds a second generation of the same mount, so an agent
read N copies of one notice as model-visible durable context.
A mount now claims an owner only when the owner's scope chain reaches the
mount's own scope. An unscoped mount is the host-plane instance that serves
every agent, which keeps the TUI composition and every existing test intact.
Registry-side ownership was the alternative: mark `reported` once the first
listener claims it. It is wrong because `onTaskDone` is not a notice-only
seam — the `dsh-tasks` invariant companion registers a validating listener —
so first-claim-wins would silence observers that are not delivering anything.
The regression test mounts two scoped `tool-tasks` over one registry and
settles an unowned-wait task, which is the only path that reaches the notice
listeners at all: the shipped-composition e2e uses `wait: true`, and a waiter
marks `reported` before settlement, so that test structurally cannot cover it.
Also corrects the standing-mounts Agent Note, which still listed `tasks-local`
among the stateful PRESET plugins.
Refs #2141
The generated matrix under-reports client-face listeners because the program
is seeded from the host aggregate alone, so `session/preset-changed` lists
`ui-command` without `ui-skill` — the same shape as the existing
`connection/reset` and `models/changed` rows. Record it where the collector
lives, with what closing it actually takes.
The frame carried `agentPreset` for surfaces that label the session, but
nothing consumed it: `noteAgentPreset` ran only in the switching tab's RPC
callback, so a second connected client refetched its catalogs while its
session row — the header label's source, and the hero chip's no-op input —
kept the composition the session had replaced.
`SessionManager.handleHostEnvelope` now folds the frame like the other
session frames. Re-applying the switching tab's own frame is a no-op: the
merge lowers `blank` only and keeps the row's `updatedAt`.
Presets own the rows that decide what a session's `/` menu contains, but
both browser catalogs cache per session and had no invalidation edge for a
recompose: `commands/changed` is registry-wide and recomposing registers
nothing, so the menu kept serving the composition the session no longer ran.
The host stream now frames the logged `agent-preset/selected` commit as
`host/session-preset-changed`; the runtime bridges it to the typed
`session/preset-changed` event, `ui-command` soft-refreshes that session's
directory key and `ui-skill` invalidates its catalog entry.
Reaching the host on a second switch was a separate defect: the list-row
identity guard compared every summary field except `agentPreset`, and the
merge keeps the row's `updatedAt`, so a switched row looked unchanged and
served its cached instance forever. The hero chip compares the pick against
that row, so switching back to the creation-time preset sent no RPC at all.
`tool-bash` resolves the background-task registry with `ctx.get('tasks')`,
and it sits at the preset's top level. The registry sat inside an
entry-local `isolate: { tasks: true }` realm, which is invisible to every
sibling row outside it, while the Web surface disabled the host row — so
both lookups missed and every `run_in_background` call answered
"background tasks unavailable" with `task_output`, `task_list`, and
`task_kill` still listed in the catalog. `task_list` returning
"(no background tasks)" is what made the outage read as an empty queue
rather than a severed producer.
That is the `goals` criterion read from inside the preset: a Service a row
outside its realm READS belongs to the plane both can see. `tasks` already
keys access by owning agent (`assertAccess` compares `task.owner.id`) and
mints an independent token per `attachSurface` call, so one host instance
serves every session exactly as before presets — the per-preset-standing-mounts
note records that sharing `tasks-local` is a return to its design.
`minimal` mounts no `tool-tasks`, and the `start()` control-surface gate is
a service-wide set that another preset's controls would open for it, so its
`tool-bash` disables `run_in_background` and drops the parameter from the
schema.
Fixes#2141
The scaffold's ambient-root isolation proof still resolved a preset-realm
service; under the host registry it is a scope read on the composed
agent's view, and what it proves is unchanged.
The auto-merge kept recompose on the removed open re-link. It now moves
the binding this roster kept from the agent's mount; an agent that never
composed one has nothing to re-link, so the switch is its first bind —
exactly a mount — and once bound only the kept binding can move it.
setScopeParent could re-link any key from anywhere, leaving the
blank-session-only recompose rule entirely to caller discipline. The
relation now binds once — a second bind throws — and re-linking exists
only on the ScopeParentBinding returned to the original binder, the
private-capability shape the package conventions prescribe for a
single-caller operation. The preset roster keeps each composed agent's
binding in a WeakMap keyed by the agent, making it the sole authority
that can move an agent between standing compositions; the blank-session
contract itself stays with the gateway, which alone can see what a
session logged.
The persistence catalog recognizes SessionEventMap augmentations of
'@deepseek-ai/dsh-session/types' alone, so the selected event's old
root-specifier declaration compiled but silently vanished from the
generated catalog. The hermetic scaffold e2e still addressed the skill
registry as a preset-realm service; under the layered host registry the
composed agent's view is a scope read, and the ambient-root isolation it
proves is unchanged.
The persistence catalog recognizes augmentations of
'@deepseek-ai/dsh-session/types' alone, so the old root-specifier
declaration compiled but silently vanished from the generated catalog; the
Agent Note also drops its internal repository link for the public-links
gate, and the persistence catalog pair re-records with the restored
agent-preset section.
The shipped headless profile is base + headless (the direct-core front
door), and its installation-owned migration rewrites the old three-bundle
tuple down to that template, so a one-shot run composes no preset roster.
The runner's optional preset composition was compensating in the wrong
direction: it re-added roster reads the shipped profile never satisfies,
and its golden pinned a header field only a roster-bearing deployment
produces. The runner, the headless bundle manifest, and the dsh-run golden
return to the direct shape; skills in a direct run flow through the base
host rows' global layer, which is what the repository-plugin e2e proves.
The suite composes over the ambient DSH home, so a fixed session id
collides with the log a previous run persisted once the tool-execution
path checks persisted identity.
The skills subsystem page and dsh-skill README describe the host+per-scope
layers, SkillViewOptions joins the type-equiv corpus and the cordis-catalog
type pages, generated catalogs pick up the shifted source refs, and the
architecture Agent Note records the decision, the nearest-layer-wins
precedence choice, and the rejected alternatives.
The shipped-Web e2e enables the bundled badge skill as a stand-in for a
repository plugin's deployment-level provider and asserts the layering both
ways: a standard-preset agent's view merges the global layer with its
preset's local discovery and its loader tool resolves the global skill,
while the host view stays global-only and a core-web agent can read the
layer but composes no loader tool.
This reverts commit f12c131ee9fdbc01b9294c8dc2c73cd36ab717cf.
The layered host skill registry closes the gap the bypass recorded: a
repository plugin's skill root registers into the global layer and reaches
every preset-composed session's catalog, so the fixture declares its skill
root again and the e2e proves the full skill, MCP, and TypeScript
contribution set. The accidental .claude/launch.json from that commit goes
with it.
The skills capability moves back to the host plane as one singleton, layered
with the ScopedLayers infrastructure the tools registry established: a
registration files into its calling context's layer (repository plugins and
host rows land global, a preset's skill-local lands in that preset's layer),
and a read merges the global layer with the viewing scope's chain, the
nearest layer winning duplicate names outright while rank keeps deciding
duplicates within one layer.
The web-app bundle re-enables the base skill registry row (skill-local and
tool-skill stay preset-owned), the standard preset drops its isolate skills
realm for bare rows over the host registry, tool-skill passes the calling
agent as the view scope, and the gateway's skills domain reads the host
registry in the presenter scope — a cold session now resolves its recorded
preset's standing key instead of failing.
The agent-default-model refactor moved the headless runner off the
api-proxy create path onto a direct agents.create, which silently dropped
the preset composition the stack had put on every dsh run session: the
header lost its agentPreset and the agent ran on the host composition
alone. Resolve the default preset up front (optional service — a roster-
less composition keeps the pre-preset behavior), record it on the header,
and mount it in setup where a broken composition still fails the run.
The agent-default-model refactor renamed ApiProxyDefaults.defaultTarget to
defaultModelSelection; this stack-owned spec merged without textual
conflict and kept the old field, so its harness built a defaults object
whose selection thunk was undefined and every create answered internal.
The agent plane of this stack's compositions lives behind agent presets,
whose per-preset skills realm has no seam for a deployment-level provider
yet: the fixture's dsh.skills made the prepared wrapper wait forever on a
host skills registry the web/headless profiles no longer compose. Remove
the skill root and its assertions from the fixture and record the gap in
the package's Known Limitations; MCP and entry contributions stay covered
because the tools registry is host-plane and layered.
A hand-damaged preset was silent until the worst moment. An unparsable
composition listed as an ordinary selectable row and failed only at the
next session start — set as default, every new session failed. A
directory whose composition file was deleted vanished from the roster
while still occupying its id: copy answered "delete the existing preset
first" while remove answered "not found", a dead end.
Discovery now owns health: every id-shaped directory is a roster slot,
broken when its composition is missing or unloadable, checked with the
loader's own entryListSchema dialect (!!js included) so health never
rejects what the loader accepts. `broken` rides AgentPreset, the
agentPreset.list entry, and the UI row; mount/recompose/standingKeyFor
refuse broken up front with the discovery-reported reason, while
resolve/read/remove still answer. The section renders marked red cards —
unselectable, uncopyable, deletable, location kept on custom rows — and
both pickers drop broken rows entirely.
The cordis preset's persona now forbids editing the shipped install
(corrupting cordis would disable the mode itself) and points authoring
at $DSH_HOME/.agent-presets; its skill teaches preset.yml metadata, the
copy-first workflow, the one-escalation sandbox reality, and honest
verification. Exercised live: asked to edit the shipped composition the
composed agent refuses citing both rules; asked for real presets (simple
and complex) it lands them under the user root with one approved
escalation each and self-checks with the loader dialect.
Copying an existing preset — or drafting one in Creator mode — replaces
the copy-minimal skeleton hint: the creator entry exists now, so the intro
names the two real paths instead of steering everyone at one source.
The stub's confirmed-switch write-back landed with the header-label work
but nothing exercised it, and the module graph regen after the master
merge had been swallowed by a silenced generator run.
The exported mountPreset carries its own unscoped-context guard beside the
service's, and the per-file gate wants it exercised where it lives. The
module graph regen after the master merge had been swallowed by a silenced
generator run.
Yichen Jiang