From 39f55a049f1d9ca92226e1f631cc07332b5746f2 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 13 Aug 2026 01:59:32 +0800
Subject: [PATCH] fix: rebase
---
docs/subsystems/README.md | 2 +-
docs/subsystems/README.zh.md | 2 +-
...ication.i18n.yaml => extensions.i18n.yaml} | 6 +-
...{self-modification.zh.md => extensions.md} | 22 +-
...{self-modification.md => extensions.zh.md} | 22 +-
packages/api/remotes/tests/built-lib.e2e.ts | 4 +-
packages/api/remotes/tsconfig.client.json | 2 +-
packages/api/remotes/tsconfig.host.json | 2 +-
.../cordis-client-runner/src/client/guard.ts | 14 +-
.../cordis-client-runner/src/client/index.ts | 4 +-
.../src/client/providers.ts | 4 +-
.../src/client/runtime.ts | 4 +-
.../tests/guard.client.spec.ts | 6 +-
.../tests/plugin.client.spec.ts | 4 +-
.../tests/runner.client.spec.ts | 8 +-
.../cordis-client-runner/tsconfig.json | 2 +-
.../cordis-host-runner/package.json | 4 +-
.../cordis-host-runner/src/index.ts | 4 +-
.../cordis-host-runner/tsconfig.json | 4 +-
.../extensions/tool-cordis/src/api-catalog.ts | 1892 +++++++++---
packages/extensions/tool-cordis/tsconfig.json | 2 +-
packages/extensions/ui-cordis/package.json | 6 +-
.../extensions/ui-cordis/src/client/index.ts | 6 +-
packages/extensions/ui-cordis/tsconfig.json | 4 +-
pnpm-lock.yaml | 2715 +++++++++--------
scripts/gen-cordis-catalog.ts | 9 +-
26 files changed, 3031 insertions(+), 1723 deletions(-)
rename docs/subsystems/{self-modification.i18n.yaml => extensions.i18n.yaml} (67%)
rename docs/subsystems/{self-modification.zh.md => extensions.md} (90%)
rename docs/subsystems/{self-modification.md => extensions.zh.md} (90%)
diff --git a/docs/subsystems/README.md b/docs/subsystems/README.md
index 74111204c7..a1c2262f40 100644
--- a/docs/subsystems/README.md
+++ b/docs/subsystems/README.md
@@ -32,7 +32,7 @@ One page per subsystem of the DeepSeek Harness: what it is, the data structures
| [terminal.md](terminal.md) | persistent terminal ids, backend/session contracts, send readiness, bounded reads, and owner-visible snapshots |
| [sandbox.md](sandbox.md) | per-session policy resolution and the process-confinement seam: file-effect modes, execution/provider policies, `ConfinedArgv`, enforcement and fail-closed errors |
| [code-runtime.md](code-runtime.md) | the code-execution seam: `CodeRunRequest`/`Result`, binding namespaces, captured logs, the `CodeRunFailure` taxonomy |
-| [self-modification.md](self-modification.md) | versioned dynamic Cordis Plugins and Packages, Host/Client activation, approval, runtime inspection, and lifecycle teardown |
+| [extensions.md](extensions.md) | versioned dynamic Cordis Plugins and Packages, Host/Client activation, approval, runtime inspection, and lifecycle teardown |
| [filesystem.md](filesystem.md) | the filesystem seam: `FsTarget`, read/write/edit outcomes, observed-file state, `FsErrorCode` |
| [lsp.md](lsp.md) | the LSP navigation seam: `LspQueryRequest`/`Result`, `LspProvider`/`Service`, four operations, `LspError` |
| [skills.md](skills.md) | the skill service: discovery priority, `SkillSummary`/`SkillDefinition`, session-prefix catalog, model-facing `skill` loading |
diff --git a/docs/subsystems/README.zh.md b/docs/subsystems/README.zh.md
index 7cd9bbf2f9..0b5c00e632 100644
--- a/docs/subsystems/README.zh.md
+++ b/docs/subsystems/README.zh.md
@@ -32,7 +32,7 @@
| [terminal.md](terminal.md) | 持久化终端 ID、后端/会话约定、发送就绪状态、有界读取与 owner 可见快照 |
| [sandbox.md](sandbox.md) | 每会话策略解析与进程约束 seam：文件效果模式、执行/提供方策略、`ConfinedArgv`、强制执行与故障关闭错误 |
| [code-runtime.md](code-runtime.md) | 代码执行 seam：`CodeRunRequest`/`Result`、绑定命名空间、捕获日志、`CodeRunFailure` 分类体系 |
-| [self-modification.md](self-modification.md) | 带版本的动态 Cordis Plugin 与 Package、Host/Client 激活、审批、运行时检查和生命周期撤销 |
+| [extensions.md](extensions.md) | 带版本的动态 Cordis Plugin 与 Package、Host/Client 激活、审批、运行时检查和生命周期撤销 |
| [filesystem.md](filesystem.md) | 文件系统 seam：`FsTarget`、读/写/编辑结果、观测到的文件状态、`FsErrorCode` |
| [lsp.md](lsp.md) | LSP 导航 seam：`LspQueryRequest`/`Result`、`LspProvider`/`Service`、四种操作、`LspError` |
| [skills.md](skills.md) | skill（技能）服务：发现优先级、`SkillSummary`/`SkillDefinition`、会话前缀目录、面向模型的 `skill` 加载 |
diff --git a/docs/subsystems/self-modification.i18n.yaml b/docs/subsystems/extensions.i18n.yaml
similarity index 67%
rename from docs/subsystems/self-modification.i18n.yaml
rename to docs/subsystems/extensions.i18n.yaml
index 6da3bee9f6..bd02afe3f3 100644
--- a/docs/subsystems/self-modification.i18n.yaml
+++ b/docs/subsystems/extensions.i18n.yaml
@@ -1,6 +1,6 @@
# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
-# pnpm run verify-translation-pairing --write docs/subsystems/self-modification.md
-self-modification.md: 90ee02eb69149c6729635f9916fbd3946d4ae477
-self-modification.zh.md: a22bb38b1fe398da19b11384e6e38b9dde6d0c3e
+# pnpm run verify-translation-pairing --write docs/subsystems/extensions.md
+extensions.md: 90ee02eb69149c6729635f9916fbd3946d4ae477
+extensions.zh.md: a22bb38b1fe398da19b11384e6e38b9dde6d0c3e
diff --git a/docs/subsystems/self-modification.zh.md b/docs/subsystems/extensions.md
similarity index 90%
rename from docs/subsystems/self-modification.zh.md
rename to docs/subsystems/extensions.md
index a22bb38b1f..f212f99704 100644
--- a/docs/subsystems/self-modification.zh.md
+++ b/docs/subsystems/extensions.md
@@ -1,8 +1,8 @@
-# 运行时自修改
+# Extensions
-[English](self-modification.md) | 中文
+English | [中文](extensions.zh.md)
-self-modification 子系统允许 agent（智能体）定义带版本的 Cordis 包、运行其 host 与浏览器两半，并在编写代码前查询获准公开的运行时元数据。包生命周期与沙箱行为由 [`packages/self-modification`](../../packages/self-modification/README.md) 包组说明。
+The extensions subsystem lets an agent define versioned Cordis packages, run their host and browser halves, and query approved runtime metadata before writing code. Package lifecycle and sandbox behavior belong to the [`packages/extensions`](../../packages/extensions/README.md) package group.
@@ -62,7 +62,7 @@ resolveClientQuery( agent: Agent, requestId: CordisInspectRequestId, resolution:
Types: [Agent](core.md)
-Source: [`packages/self-modification/cordis-host-runner/src/inspect-registry.ts:46`](../../packages/self-modification/cordis-host-runner/src/inspect-registry.ts)
+Source: [`packages/extensions/cordis-host-runner/src/inspect-registry.ts:46`](../../packages/extensions/cordis-host-runner/src/inspect-registry.ts)
@@ -254,7 +254,7 @@ inspectPackage( agent: Agent, pluginId: CordisDynamicPluginId, packageId: Cordis
Types: [Agent](core.md)
-Source: [`packages/self-modification/cordis-host-runner/src/index.ts:124`](../../packages/self-modification/cordis-host-runner/src/index.ts)
+Source: [`packages/extensions/cordis-host-runner/src/index.ts:124`](../../packages/extensions/cordis-host-runner/src/index.ts)
@@ -275,7 +275,7 @@ One exact Plugin/Package activation is now live in the Host.
'cordis/dynamic-package'(pkg: DynamicCordisPackage): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:379`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:379`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -292,7 +292,7 @@ One exact activation was withdrawn.
'cordis/dynamic-retract'(retracted: DynamicCordisRetracted): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:385`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:385`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -309,7 +309,7 @@ Request a live read-only query from the Client inspect registry.
'cordis/inspect-query'(request: CordisInspectQueryRequest): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:391`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:391`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -326,7 +326,7 @@ Notify every Client that an inspect query has settled or been cancelled.
'cordis/inspect-query-resolved'(resolved: CordisInspectQueryResolved): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:397`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:397`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -343,7 +343,7 @@ A Client-bearing activation needs a browser page, and may require a user decisio
'cordis/request-run'(request: DynamicCordisRunRequest): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:367`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:367`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -360,5 +360,5 @@ A pending Client activation request left the answerable state.
'cordis/request-run-resolved'(resolved: DynamicCordisRequestResolved): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:373`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:373`](../../packages/extensions/cordis-host-runner/src/types.ts)
diff --git a/docs/subsystems/self-modification.md b/docs/subsystems/extensions.zh.md
similarity index 90%
rename from docs/subsystems/self-modification.md
rename to docs/subsystems/extensions.zh.md
index 90ee02eb69..717b14951d 100644
--- a/docs/subsystems/self-modification.md
+++ b/docs/subsystems/extensions.zh.md
@@ -1,8 +1,8 @@
-# Runtime self-modification
+# 扩展
-English | [中文](self-modification.zh.md)
+[English](extensions.md) | 中文
-The self-modification subsystem lets an agent define versioned Cordis packages, run their host and browser halves, and query approved runtime metadata before writing code. Package lifecycle and sandbox behavior belong to the [`packages/self-modification`](../../packages/self-modification/README.md) package group.
+extensions 子系统允许 agent（智能体）定义带版本的 Cordis 包、运行其 host 与浏览器两半，并在编写代码前查询获准公开的运行时元数据。包生命周期与沙箱行为由 [`packages/extensions`](../../packages/extensions/README.md) 包组说明。
@@ -62,7 +62,7 @@ resolveClientQuery( agent: Agent, requestId: CordisInspectRequestId, resolution:
Types: [Agent](core.md)
-Source: [`packages/self-modification/cordis-host-runner/src/inspect-registry.ts:46`](../../packages/self-modification/cordis-host-runner/src/inspect-registry.ts)
+Source: [`packages/extensions/cordis-host-runner/src/inspect-registry.ts:46`](../../packages/extensions/cordis-host-runner/src/inspect-registry.ts)
@@ -254,7 +254,7 @@ inspectPackage( agent: Agent, pluginId: CordisDynamicPluginId, packageId: Cordis
Types: [Agent](core.md)
-Source: [`packages/self-modification/cordis-host-runner/src/index.ts:124`](../../packages/self-modification/cordis-host-runner/src/index.ts)
+Source: [`packages/extensions/cordis-host-runner/src/index.ts:124`](../../packages/extensions/cordis-host-runner/src/index.ts)
@@ -275,7 +275,7 @@ One exact Plugin/Package activation is now live in the Host.
'cordis/dynamic-package'(pkg: DynamicCordisPackage): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:379`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:379`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -292,7 +292,7 @@ One exact activation was withdrawn.
'cordis/dynamic-retract'(retracted: DynamicCordisRetracted): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:385`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:385`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -309,7 +309,7 @@ Request a live read-only query from the Client inspect registry.
'cordis/inspect-query'(request: CordisInspectQueryRequest): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:391`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:391`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -326,7 +326,7 @@ Notify every Client that an inspect query has settled or been cancelled.
'cordis/inspect-query-resolved'(resolved: CordisInspectQueryResolved): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:397`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:397`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -343,7 +343,7 @@ A Client-bearing activation needs a browser page, and may require a user decisio
'cordis/request-run'(request: DynamicCordisRunRequest): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:367`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:367`](../../packages/extensions/cordis-host-runner/src/types.ts)
@@ -360,5 +360,5 @@ A pending Client activation request left the answerable state.
'cordis/request-run-resolved'(resolved: DynamicCordisRequestResolved): void
```
-Source: [`packages/self-modification/cordis-host-runner/src/types.ts:373`](../../packages/self-modification/cordis-host-runner/src/types.ts)
+Source: [`packages/extensions/cordis-host-runner/src/types.ts:373`](../../packages/extensions/cordis-host-runner/src/types.ts)
diff --git a/packages/api/remotes/tests/built-lib.e2e.ts b/packages/api/remotes/tests/built-lib.e2e.ts
index f3ea7b1cde..232cf9b2f6 100644
--- a/packages/api/remotes/tests/built-lib.e2e.ts
+++ b/packages/api/remotes/tests/built-lib.e2e.ts
@@ -51,7 +51,7 @@ describe.skipIf(!requiredArtifacts)('Goal Remote built LIB chain', () => {
const { Context } = cordis
const { default: AgentRegistry } = await import(urls.agent)
const connectionHost = await import(urls.connectionHost)
- const { default: TypertGatewayService } = await import(urls.apiGatewayHost)
+ const { default: TypertRemoteService } = await import(urls.apiGatewayHost)
const { default: GoalService } = await import(urls.goal)
const { TYPERT } = await import(urls.goalTypert)
const { default: TypertRegistry } = await import(urls.registryHost)
@@ -70,7 +70,7 @@ describe.skipIf(!requiredArtifacts)('Goal Remote built LIB chain', () => {
await host.plugin({ inject: connectionHost.inject, apply: connectionHost.apply })
await host.plugin(TypertRegistry)
await host.plugin(AgentRegistry)
- await host.plugin(TypertGatewayService)
+ await host.plugin(TypertRemoteService)
await host.plugin(GoalService)
host.typert.register(TYPERT)
diff --git a/packages/api/remotes/tsconfig.client.json b/packages/api/remotes/tsconfig.client.json
index 0f5fc31211..a0161dd047 100644
--- a/packages/api/remotes/tsconfig.client.json
+++ b/packages/api/remotes/tsconfig.client.json
@@ -25,7 +25,7 @@
},
{
- "path": "../../self-modification/cordis-host-runner"
+ "path": "../../extensions/cordis-host-runner"
},
{
"path": "../../goal/goal"
diff --git a/packages/api/remotes/tsconfig.host.json b/packages/api/remotes/tsconfig.host.json
index 6c3131944f..61eae810f4 100644
--- a/packages/api/remotes/tsconfig.host.json
+++ b/packages/api/remotes/tsconfig.host.json
@@ -38,7 +38,7 @@
"path": "../../session/session-persistence"
},
{
- "path": "../../self-modification/cordis-host-runner"
+ "path": "../../extensions/cordis-host-runner"
},
{
"path": "../../settings/settings"
diff --git a/packages/extensions/cordis-client-runner/src/client/guard.ts b/packages/extensions/cordis-client-runner/src/client/guard.ts
index 8f71f9ced1..831209f7a4 100644
--- a/packages/extensions/cordis-client-runner/src/client/guard.ts
+++ b/packages/extensions/cordis-client-runner/src/client/guard.ts
@@ -6,7 +6,7 @@
* carry extra machinery: `slots`, where the register proxy assigns the
* shadowing priority and ledgers the registration — invoking the service with
* the traced receiver so the effect lands on the CALLING plugin's fiber
- * (SlotsService.register must stay a prototype method for exactly that
+ * (SlotRegistry.register must stay a prototype method for exactly that
* reason) — and `theme`, whose override source is pinned to the package id.
*
* This is API discipline, not a security boundary: a dynamic package's code is
@@ -15,8 +15,8 @@
import { Context } from '@deepseek-ai/cordis'
import type { DynamicCordisPackage } from '@deepseek-ai/dsh-api-remotes/client'
-import type { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ThemeService } from '@deepseek-ai/dsh-client-ui-theme/client'
+import type { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
+import type { ThemeRuntime } from '@deepseek-ai/dsh-client-ui-theme/client'
/** Facade verbs beyond declared services (host CTX_VERBS twin). */
const CTX_VERBS = new Set([
@@ -93,7 +93,7 @@ interface ErasedSlotOptions {
* The slots seat: automatic shadowing priority and ledger recording around the
* traced service's own register.
*/
-function guardedSlots(slots: SlotsService, env: DynamicCordisGuardEnv): unknown {
+function guardedSlots(slots: SlotRegistry, env: DynamicCordisGuardEnv): unknown {
return new Proxy(slots, {
get(target, prop) {
const value = Reflect.get(target, prop, target) as unknown
@@ -145,7 +145,7 @@ function guardedSlots(slots: SlotsService, env: DynamicCordisGuardEnv): unknown
* keep the returned handle (slots parity — register hangs its own cleanup).
* Everything else forwards through the generic guard.
*/
-function guardedTheme(theme: ThemeService, env: DynamicCordisGuardEnv, ctx: Context): unknown {
+function guardedTheme(theme: ThemeRuntime, env: DynamicCordisGuardEnv, ctx: Context): unknown {
return new Proxy(theme, {
get(target, prop) {
if (prop !== 'overrideTokens') {
@@ -205,8 +205,8 @@ export function dynamicCordisContext(ctx: Context, env: DynamicCordisGuardEnv):
if (requireDeclaration && !declared.has(name)) return denyRead(name)
const service = denyContext(ctx.get(name), name, env)
if (service === null || (typeof service !== 'object' && typeof service !== 'function')) return service
- if (name === 'slots') return guardedSlots(service as SlotsService, env)
- if (name === 'theme') return guardedTheme(service as ThemeService, env, ctx)
+ if (name === 'slots') return guardedSlots(service as SlotRegistry, env)
+ if (name === 'theme') return guardedTheme(service as ThemeRuntime, env, ctx)
return guardedService(service, name, env)
}
return new Proxy({}, {
diff --git a/packages/extensions/cordis-client-runner/src/client/index.ts b/packages/extensions/cordis-client-runner/src/client/index.ts
index b0c52d4fb0..f54bfc2318 100644
--- a/packages/extensions/cordis-client-runner/src/client/index.ts
+++ b/packages/extensions/cordis-client-runner/src/client/index.ts
@@ -16,7 +16,7 @@ import type {
DynamicCordisInventoryRow,
} from '@deepseek-ai/dsh-api-remotes/client'
import type { ClientModuleSystem } from '@deepseek-ai/dsh-client-modules/client'
-import type { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import type { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
// The Client Remote assembly is the one place the two planes meet: it mounts the
// `dynamicCordisRunner` namespace and re-exports its payload vocabulary, so this
// package names what it sends without importing a Host package.
@@ -206,7 +206,7 @@ export function apply(ctx: Context): void {
ctx,
loader: ctx.loader,
modules: ctx.get('modules') as ClientModuleSystem,
- slots: ctx.get('slots') as SlotsService,
+ slots: ctx.get('slots') as SlotRegistry,
invoke: async (pluginId, pluginRunId, method, args) => {
// Model-authored arguments reach this boundary untyped; the namespace's
// generated codec is what validates them as JSON, and its rejection is a
diff --git a/packages/extensions/cordis-client-runner/src/client/providers.ts b/packages/extensions/cordis-client-runner/src/client/providers.ts
index 1099cc5409..3d06f41402 100644
--- a/packages/extensions/cordis-client-runner/src/client/providers.ts
+++ b/packages/extensions/cordis-client-runner/src/client/providers.ts
@@ -2,7 +2,7 @@
import type { Context } from '@deepseek-ai/cordis'
import type { JsonValue } from '@deepseek-ai/dsh-api-remotes/client'
-import type { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import type { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
import type {} from '@deepseek-ai/dsh-client-ui-theme/client'
import { queryEventApi, queryServiceApi } from './api-catalog.ts'
import type { ClientCordisInspectProviderRegistration } from './inspect-registry.ts'
@@ -169,7 +169,7 @@ function readExact(input: JsonValue | undefined, field: string): string | undefi
}
/* jscpd:ignore-end */
-type LiveSlotNode = ReturnType[number]
+type LiveSlotNode = ReturnType[number]
const SLOT_CATALOG = new Map(CLIENT_SLOT_API.map(entry => [entry.key, entry]))
diff --git a/packages/extensions/cordis-client-runner/src/client/runtime.ts b/packages/extensions/cordis-client-runner/src/client/runtime.ts
index 114031fc93..8f5b356de7 100644
--- a/packages/extensions/cordis-client-runner/src/client/runtime.ts
+++ b/packages/extensions/cordis-client-runner/src/client/runtime.ts
@@ -21,7 +21,7 @@ import type {
} from '@deepseek-ai/dsh-api-remotes/client'
import type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
import type { ClientModuleSystem } from '@deepseek-ai/dsh-client-modules/client'
-import type { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import type { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
import { DynamicCordisStyles, evaluateClientHalf, DYNAMIC_CLIENT_REDIRECTS } from './evaluator.ts'
import type { DynamicCordisEvaluatedPlugin } from './evaluator.ts'
import { dynamicCordisContext } from './guard.ts'
@@ -121,7 +121,7 @@ export interface DynamicCordisRunnerEnv {
/** Module table, for factory invalidation before every (re-)registration. */
modules: ClientModuleSystem
/** Slot registry, for the entry-crash supervision seam. */
- slots: SlotsService
+ slots: SlotRegistry
/** Route one `host.call` to the package's host half through the Remote namespace. */
invoke(
pluginId: CordisDynamicPluginId,
diff --git a/packages/extensions/cordis-client-runner/tests/guard.client.spec.ts b/packages/extensions/cordis-client-runner/tests/guard.client.spec.ts
index cd492fa6ac..5d81d8798b 100644
--- a/packages/extensions/cordis-client-runner/tests/guard.client.spec.ts
+++ b/packages/extensions/cordis-client-runner/tests/guard.client.spec.ts
@@ -16,7 +16,7 @@ import type {
CordisDynamicPluginRunId,
DynamicCordisPackage,
} from '@deepseek-ai/dsh-api-remotes/client'
-import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
import { dynamicCordisContext } from '../src/client/guard.ts'
import type { DynamicCordisSlotLedgerRow } from '../src/client/guard.ts'
@@ -37,7 +37,7 @@ type Facade = Record & { get(name: string): unknown }
interface Bench {
ctx: Context
- slots: SlotsService
+ slots: SlotRegistry
facade: Facade
ledger: DynamicCordisSlotLedgerRow[]
/** Components the facade claimed for the package, in registration order. */
@@ -53,7 +53,7 @@ interface Bench {
*/
async function boot(inject: string[], extras: Record = {}): Promise {
const ctx = new Context()
- await ctx.plugin(SlotsService)
+ await ctx.plugin(SlotRegistry)
const themeLayerDispose = vi.fn()
const overrideTokens = vi.fn(() => themeLayerDispose)
ctx.reflect.provide('theme', {
diff --git a/packages/extensions/cordis-client-runner/tests/plugin.client.spec.ts b/packages/extensions/cordis-client-runner/tests/plugin.client.spec.ts
index ba1d0125b7..a97a15e8b3 100644
--- a/packages/extensions/cordis-client-runner/tests/plugin.client.spec.ts
+++ b/packages/extensions/cordis-client-runner/tests/plugin.client.spec.ts
@@ -18,7 +18,7 @@ import type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
import type { DynamicCordisInvokeResult } from '@deepseek-ai/dsh-api-remotes/client'
// Type-only: resolves `ctx.remote` and with it the `$on`/`$dispatch` surface.
import type {} from '@deepseek-ai/dsh-api-gateway/client'
-import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
import * as NodeHalf from '../src/index.ts'
import * as Invariant from '../src/invariant.ts'
import * as ClientHalf from '../src/client/index.ts'
@@ -80,7 +80,7 @@ interface Bench {
/** Mount the browser half over a module table and a loader standing on real fibers. */
async function boot(): Promise {
const ctx = new Context()
- await ctx.plugin(SlotsService)
+ await ctx.plugin(SlotRegistry)
const factories = new Map unknown>()
const fibers = new Map()
let next = 0
diff --git a/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts b/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts
index cdb453edd2..5505620245 100644
--- a/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts
+++ b/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts
@@ -19,7 +19,7 @@ import type {
} from '@deepseek-ai/dsh-api-remotes/client'
import type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
import type { ClientModuleSystem } from '@deepseek-ai/dsh-client-modules/client'
-import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import { SlotRegistry } from '@deepseek-ai/dsh-client-runtime/client'
import { DYNAMIC_CLIENT_REDIRECTS } from '../src/client/evaluator.ts'
import { DynamicCordisPackageRunner } from '../src/client/runtime.ts'
import type { DynamicCordisClientHalf, DynamicCordisRenderFailure } from '../src/client/runtime.ts'
@@ -48,7 +48,7 @@ function half(overrides: Partial = {}): DynamicCordisCl
interface Bench {
ctx: Context
- slots: SlotsService
+ slots: SlotRegistry
runner: DynamicCordisPackageRunner
invalidated: string[]
removed: string[]
@@ -83,7 +83,7 @@ function seated(fiber: T): T {
async function boot(): Promise {
const ctx = new Context()
- await ctx.plugin(SlotsService)
+ await ctx.plugin(SlotRegistry)
const invalidated: string[] = []
const removed: string[] = []
const created: string[] = []
@@ -128,7 +128,7 @@ async function boot(): Promise {
listener = fn
return () => { listener = undefined }
},
- } as unknown as SlotsService,
+ } as unknown as SlotRegistry,
invoke,
reportGuardFailure: () => {},
reportRenderFailure: (agentId, pluginId, pluginRunId, failure) => {
diff --git a/packages/extensions/cordis-client-runner/tsconfig.json b/packages/extensions/cordis-client-runner/tsconfig.json
index 7dbd8762ec..a93e5c0fb0 100644
--- a/packages/extensions/cordis-client-runner/tsconfig.json
+++ b/packages/extensions/cordis-client-runner/tsconfig.json
@@ -33,7 +33,7 @@
"path": "../../client/ui-theme"
},
{
- "path": "../../support/invariants"
+ "path": "../../runtime-diagnostics/invariants"
}
]
}
diff --git a/packages/extensions/cordis-host-runner/package.json b/packages/extensions/cordis-host-runner/package.json
index 7d19b058a5..13e97cbcc5 100644
--- a/packages/extensions/cordis-host-runner/package.json
+++ b/packages/extensions/cordis-host-runner/package.json
@@ -61,7 +61,7 @@
"@deepseek-ai/dsh-scope": "workspace:^",
"@deepseek-ai/dsh-session": "workspace:^",
"@deepseek-ai/dsh-tools": "workspace:^",
- "@deepseek-ai/dsh-type-meta": "workspace:^"
+ "@deepseek-ai/dsh-typert-protocol": "workspace:^"
},
"devDependencies": {
"@deepseek-ai/cordis": "workspace:^",
@@ -73,6 +73,6 @@
"@deepseek-ai/dsh-scope": "workspace:^",
"@deepseek-ai/dsh-session": "workspace:^",
"@deepseek-ai/dsh-tools": "workspace:^",
- "@deepseek-ai/dsh-type-meta": "workspace:^"
+ "@deepseek-ai/dsh-typert-protocol": "workspace:^"
}
}
diff --git a/packages/extensions/cordis-host-runner/src/index.ts b/packages/extensions/cordis-host-runner/src/index.ts
index f1b92322c4..b032248009 100644
--- a/packages/extensions/cordis-host-runner/src/index.ts
+++ b/packages/extensions/cordis-host-runner/src/index.ts
@@ -10,7 +10,7 @@ import z from '@deepseek-ai/schemastery'
import type { Agent } from '@deepseek-ai/dsh-agent'
import { createUserMessage } from '@deepseek-ai/dsh-llm'
import type { JsonValue } from '@deepseek-ai/dsh-session/types'
-import { GatewayService, Remote } from '@deepseek-ai/dsh-type-meta'
+import { TypertRemoteService, Remote } from '@deepseek-ai/dsh-typert-protocol'
import { isPlugin, normalizeHandler } from './guard.ts'
import { CordisInspectRegistryService } from './inspect-registry.ts'
import { missingServices, startHostHalf } from './lifecycle.ts'
@@ -121,7 +121,7 @@ interface ActivationPlan {
}
/** Dynamic Plugin registry and Host-half lifecycle. */
-export class DynamicCordisRunnerService extends GatewayService {
+export class DynamicCordisRunnerService extends TypertRemoteService {
static inject = ['tools']
static Config: z = z.object({
diff --git a/packages/extensions/cordis-host-runner/tsconfig.json b/packages/extensions/cordis-host-runner/tsconfig.json
index 640a2f675e..b14e68a5ec 100644
--- a/packages/extensions/cordis-host-runner/tsconfig.json
+++ b/packages/extensions/cordis-host-runner/tsconfig.json
@@ -39,10 +39,10 @@
"path": "../../llm/llm"
},
{
- "path": "../../support/invariants"
+ "path": "../../runtime-diagnostics/invariants"
},
{
- "path": "../../typert/type-meta"
+ "path": "../../typert/protocol"
}
]
}
diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts
index fca96a1923..989b926264 100644
--- a/packages/extensions/tool-cordis/src/api-catalog.ts
+++ b/packages/extensions/tool-cordis/src/api-catalog.ts
@@ -4,33 +4,50 @@
* `pnpm run verify-cordis-api` in doc-sync).
*
* The machine-readable cordis API catalog `cordis_inspect` serves to the
- * model: harness services (summary + public method signatures/JSDoc),
- * harness events (mode + signature/JSDoc), and the inherited `ctx` API. Produced by
+ * model: harness services (summary + structured public method contracts),
+ * harness events (mode + structured listener contracts), and the inherited `ctx` API. Produced by
* the same AST walk as docs/cordis-catalog, so this data and the rendered
* docs cannot diverge.
*
* @module @deepseek-ai/dsh-tool-cordis/api-catalog
*/
-/** One public service method and its source-owned contract. */
+/* jscpd:ignore-start */
+/** One named parameter in a Service method or Event listener. */
+export interface ApiParameter {
+ /** Parameter name from the exact signature. */
+ name: string
+ /** Source-owned parameter contract. */
+ description: string
+}
+
+/** One public service member and its source-owned contract. */
export interface ServiceApiMethod {
/** Public method signature with its body stripped. */
signature: string
- /** Original method JSDoc, with only container indentation removed. */
- jsDoc: string
+ /** Method purpose and behavior. */
+ description: string
+ /** Named parameters in signature order. */
+ parameters: readonly ApiParameter[]
+ /** Non-void result contract when documented. */
+ returns?: string
+ /** Documented failure conditions. */
+ throws?: readonly string[]
}
-/** One harness `ctx.` service: its one-line summary and public methods. */
+/** One harness `ctx.` service and its public methods. */
export interface ServiceApiEntry {
/** The `ctx.` name, e.g. `tools`. */
key: string
/** First sentence of the service class JSDoc. */
summary: string
+ /** Complete service description. */
+ description: string
/** Public methods, bodies stripped, in source order. */
methods: readonly ServiceApiMethod[]
}
-/** One harness event: its dispatch mode, exact signature, and one-line summary. */
+/** One harness event: its dispatch mode, exact signature, and listener contract. */
export interface EventApiEntry {
/** The scoped event name, e.g. `agent/status`. */
name: string
@@ -38,10 +55,12 @@ export interface EventApiEntry {
mode: string
/** The exact listener signature, whitespace-normalized. */
signature: string
- /** Original event JSDoc, with only container indentation removed. */
- jsDoc: string
/** First sentence of the event JSDoc. */
summary: string
+ /** Complete event description. */
+ description: string
+ /** Named listener parameters in signature order. */
+ parameters: readonly ApiParameter[]
}
/** One inherited (cordis core + loader/hmr/timer) `ctx` member group with its summary. */
@@ -52,7 +71,7 @@ export interface InheritedApiEntry {
summary: string
}
-/** One named type shape the service signatures reference. */
+/** One named type declaration referenced by a Service or Event signature. */
export interface TypeApiEntry {
/** The exported type/interface name, e.g. `ShellRunResult`. */
name: string
@@ -65,1336 +84,2066 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
{
key: 'agentDefaultModel',
summary: 'Owns the default model selection independently of any Host or transport.',
+ description: 'Owns the default model selection independently of any Host or transport. The composition entry remains usable without a settings provider; when one is mounted, its user layer is read live.',
methods: [
{
signature: 'currentSelection(): ModelSelection',
- jsDoc: '/**\n * Read the current default model selection.\n * @returns a detached provider, model, and optional reasoning selection.\n */',
+ description: 'Read the current default model selection.',
+ parameters: [],
+ returns: 'a detached provider, model, and optional reasoning selection.',
},
{
signature: 'async saveSelection(next: ModelSelection): Promise',
- jsDoc: '/**\n * Save the complete default model selection. A deployment without a settings\n * provider keeps its composition entry.\n * @param next - resolved selection accepted by an entry point.\n * @returns fulfillment after the optional settings write settles.\n */',
+ description: 'Save the complete default model selection. A deployment without a settings provider keeps its composition entry.',
+ parameters: [{ name: 'next', description: 'resolved selection accepted by an entry point.' }],
+ returns: 'fulfillment after the optional settings write settles.',
},
],
},
{
key: 'agentLoop',
summary: 'Concrete agent factory and driver service.',
+ description: 'Concrete agent factory and driver service.',
methods: [
+ {
+ signature: 'readonly config: ResolvedConfig',
+ description: 'Validated configuration owned by the agent-loop service.',
+ parameters: [],
+ },
{
signature: 'create(id: SessionId, options: AgentOptions = {}, meta: Pick = {}): Agent',
- jsDoc: '/**\n * Create an agent and session under one caller-supplied identity, owned by\n * the accessing fiber. Constructor-driven config calls mint a fresh combined\n * id before entering this boundary.\n * @param id - shared agent/session identity.\n * @param options - concrete loop options.\n * @param meta - optional fresh-session workspace metadata.\n * @returns the published running agent.\n */',
+ description: 'Create an agent and session under one caller-supplied identity, owned by the accessing fiber. Constructor-driven config calls mint a fresh combined id before entering this boundary.',
+ parameters: [{ name: 'id', description: 'shared agent/session identity.' }, { name: 'options', description: 'concrete loop options.' }, { name: 'meta', description: 'optional fresh-session workspace metadata.' }],
+ returns: 'the published running agent.',
},
{
signature: 'async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise',
- jsDoc: '/**\n * Create an owned agent on a caller-supplied session id.\n * @param ownerCtx - caller context that structurally owns the lifecycle.\n * @param options - identities, session seed/metadata, loop options, setup, and cancellation.\n * @returns the published handle.\n */',
+ description: 'Create an owned agent on a caller-supplied session id.',
+ parameters: [{ name: 'ownerCtx', description: 'caller context that structurally owns the lifecycle.' }, { name: 'options', description: 'identities, session seed/metadata, loop options, setup, and cancellation.' }],
+ returns: 'the published handle.',
},
{
signature: 'async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise',
- jsDoc: '/**\n * Resume an owned agent from the configured persistence service.\n * @param ownerCtx - caller context that owns load, setup, and the live lifecycle.\n * @param options - persisted identity, loop options, setup, and cancellation.\n * @returns the published handle.\n */',
+ description: 'Resume an owned agent from the configured persistence service.',
+ parameters: [{ name: 'ownerCtx', description: 'caller context that owns load, setup, and the live lifecycle.' }, { name: 'options', description: 'persisted identity, loop options, setup, and cancellation.' }],
+ returns: 'the published handle.',
},
],
},
{
key: 'agentPresets',
summary: 'Registry over the deployment\'s agent presets.',
+ description: 'Registry over the deployment\'s agent presets.\n\nDiscovery is unmemoized: `list()` and `resolve()` re-read the roots on every call so a preset authored while the process runs is visible immediately, and a preset deleted underneath a picker disappears from the next read.',
methods: [
{
signature: 'async list(): Promise',
- jsDoc: '/**\n * Every preset the configured roots currently supply.\n * @returns the presets, first-root-wins per id.\n */',
+ description: 'Every preset the configured roots currently supply.',
+ parameters: [],
+ returns: 'the presets, first-root-wins per id.',
},
{
signature: 'async resolve(id?: string): Promise',
- jsDoc: '/**\n * Resolve one preset by id.\n *\n * A broken preset resolves — deleting one, reading one, and reporting one\n * all need the row — and the mounting paths refuse it AFTER resolution\n * through {@link resolveMountable}.\n * @param id - the preset id, or `undefined` for {@link defaultId}.\n * @returns the resolved preset.\n * @throws when no configured root supplies that id.\n */',
+ description: 'Resolve one preset by id.\n\nA broken preset resolves — deleting one, reading one, and reporting one all need the row — and the mounting paths refuse it AFTER resolution through resolveMountable.',
+ parameters: [{ name: 'id', description: 'the preset id, or `undefined` for {@link defaultId}.' }],
+ returns: 'the resolved preset.',
+ throws: ['when no configured root supplies that id.'],
},
{
signature: 'async mount(agentCtx: Context, id?: string): Promise',
- jsDoc: '/**\n * Compose one agent from a preset: ensure the preset\'s standing mount, then\n * parent the agent\'s scope key to it so the mount\'s registrations and\n * listeners cover this agent.\n *\n * Call from the agent factory\'s `setup(agentCtx)`; a rejection there rolls\n * the agent creation back, so a broken preset never yields a half-composed\n * session.\n * @param agentCtx - the agent\'s scope context.\n * @param id - the preset id, or `undefined` for {@link defaultId}.\n * @returns the preset that was composed, for the caller to record.\n * @throws when the preset is unknown or its composition is unusable.\n */',
+ description: 'Compose one agent from a preset: ensure the preset\'s standing mount, then parent the agent\'s scope key to it so the mount\'s registrations and listeners cover this agent.\n\nCall from the agent factory\'s `setup(agentCtx)`; a rejection there rolls the agent creation back, so a broken preset never yields a half-composed session.',
+ parameters: [{ name: 'agentCtx', description: 'the agent\'s scope context.' }, { name: 'id', description: 'the preset id, or `undefined` for {@link defaultId}.' }],
+ returns: 'the preset that was composed, for the caller to record.',
+ throws: ['when the preset is unknown or its composition is unusable.'],
},
{
signature: 'composeFrom(agentCtx: Context, parentCtx: Context): string | undefined',
- jsDoc: '/**\n * Join one agent to the SAME standing composition another already runs on.\n *\n * This is how a child agent inherits its parent\'s capabilities. It is a bind,\n * not a mount: the parent\'s generation is already composed, so the child gets\n * that exact instance — the same plugin objects, the same tool registrations,\n * the same prompt sections. Re-resolving the parent\'s preset by id instead\n * would re-read the roster, and a composition file edited since the parent\n * started would hand the child a DIFFERENT generation than the one its\n * parent\'s history was produced under (and a preset deleted since would fail\n * the child outright while its parent keeps running).\n *\n * Synchronous, and with no composition failure mode of its own — it reads no\n * roster, mounts nothing, and touches no file — which is what lets a child\n * creation window use it: the two in-process subagent drivers compose their\n * children inside a synchronous `setup`. It still rejects a caller error, as\n * the `@throws` below record.\n *\n * A parent that joined no preset — a rosterless deployment — yields no join\n * and no error: there, the model-facing rows sit in the host composition and\n * the child already sees them through the global layer.\n * @param agentCtx - the joining agent\'s scope context.\n * @param parentCtx - the scope context of the agent whose composition to join.\n * @returns the preset id joined, or undefined when the parent joined none.\n * @throws when `agentCtx` carries no scope, or has already joined a preset.\n */',
+ description: 'Join one agent to the SAME standing composition another already runs on.\n\nThis is how a child agent inherits its parent\'s capabilities. It is a bind, not a mount: the parent\'s generation is already composed, so the child gets that exact instance — the same plugin objects, the same tool registrations, the same prompt sections. Re-resolving the parent\'s preset by id instead would re-read the roster, and a composition file edited since the parent started would hand the child a DIFFERENT generation than the one its parent\'s history was produced under (and a preset deleted since would fail the child outright while its parent keeps running).\n\nSynchronous, and with no composition failure mode of its own — it reads no roster, mounts nothing, and touches no file — which is what lets a child creation window use it: the two in-process subagent drivers compose their children inside a synchronous `setup`. It still rejects a caller error, as the `@throws` below record.\n\nA parent that joined no preset — a rosterless deployment — yields no join and no error: there, the model-facing rows sit in the host composition and the child already sees them through the global layer.',
+ parameters: [{ name: 'agentCtx', description: 'the joining agent\'s scope context.' }, { name: 'parentCtx', description: 'the scope context of the agent whose composition to join.' }],
+ returns: 'the preset id joined, or undefined when the parent joined none.',
+ throws: ['when `agentCtx` carries no scope, or has already joined a preset.'],
},
{
signature: 'composedPreset(agentCtx: Context): string | undefined',
- jsDoc: '/**\n * The preset one live agent runs on.\n *\n * Read from the live scope chain rather than from the session, so it answers\n * for an agent whose session has not recorded a preset yet — a child agent\n * whose durable header is being built from its parent\'s composition.\n * @param agentCtx - the agent\'s scope context.\n * @returns the preset id, or undefined when the agent joined none.\n */',
+ description: 'The preset one live agent runs on.\n\nRead from the live scope chain rather than from the session, so it answers for an agent whose session has not recorded a preset yet — a child agent whose durable header is being built from its parent\'s composition.',
+ parameters: [{ name: 'agentCtx', description: 'the agent\'s scope context.' }],
+ returns: 'the preset id, or undefined when the agent joined none.',
},
{
signature: 'async read(id: string): Promise',
- jsDoc: '/**\n * Read one preset\'s composition text.\n * @param id - the preset id.\n * @returns the composition exactly as stored.\n * @throws when no configured root supplies that id.\n */',
+ description: 'Read one preset\'s composition text.',
+ parameters: [{ name: 'id', description: 'the preset id.' }],
+ returns: 'the composition exactly as stored.',
+ throws: ['when no configured root supplies that id.'],
},
{
signature: 'async copy(from: string, id: string, name?: string): Promise',
- jsDoc: '/**\n * Create a locally authored preset by copying an existing one whole.\n *\n * Copy is the only authoring write. Composition text never crosses this\n * seam: the source is named by id and its directory is copied as it stands,\n * so the copy is exactly as loadable as its source and authoring grants no\n * capability the roster did not already carry. The copy is NOT mounted to\n * validate — a source that mounts today yields a copy that mounts today.\n * @param from - the preset the copy starts from; shipped presets are the\n * primary source, so any trust is accepted.\n * @param id - the new preset\'s id, which becomes its directory name.\n * @param name - display name for the copy; absent falls back to the id.\n * @throws when the source is unknown, the id is unusable or already taken,\n * or the deployment configures no writable root.\n */',
+ description: 'Create a locally authored preset by copying an existing one whole.\n\nCopy is the only authoring write. Composition text never crosses this seam: the source is named by id and its directory is copied as it stands, so the copy is exactly as loadable as its source and authoring grants no capability the roster did not already carry. The copy is NOT mounted to validate — a source that mounts today yields a copy that mounts today.',
+ parameters: [{ name: 'from', description: 'the preset the copy starts from; shipped presets are the primary source, so any trust is accepted.' }, { name: 'id', description: 'the new preset\'s id, which becomes its directory name.' }, { name: 'name', description: 'display name for the copy; absent falls back to the id.' }],
+ throws: ['when the source is unknown, the id is unusable or already taken, or the deployment configures no writable root.'],
},
{
signature: 'async remove(id: string): Promise',
- jsDoc: '/**\n * Delete a locally authored preset.\n * @param id - the preset id.\n * @throws when the preset is unknown or ships with the deployment.\n */',
+ description: 'Delete a locally authored preset.',
+ parameters: [{ name: 'id', description: 'the preset id.' }],
+ throws: ['when the preset is unknown or ships with the deployment.'],
},
{
signature: 'serviceFor(agent: { ctx: Context }, name: K): Context[K] | undefined',
- jsDoc: '/**\n * One agent\'s instance of a service its preset mounted.\n *\n * A preset publishes services behind `isolate` realms, which are invisible\n * outside the group that declares them — including to the host. This is how a\n * caller holding the agent reads one anyway: a request that is ABOUT a\n * session but arrives from outside it, which is every browser RPC.\n *\n * Read addressing only. A host row that `inject`s a service cannot use this,\n * because injection resolves before any session exists and has no agent to\n * key by; such a service belongs on the host plane instead.\n * @param agent - the agent whose composition to look inside.\n * @param name - the service name as the preset\'s rows resolve it.\n * @returns the agent\'s instance, or undefined when its preset mounts none.\n */',
+ description: 'One agent\'s instance of a service its preset mounted.\n\nA preset publishes services behind `isolate` realms, which are invisible outside the group that declares them — including to the host. This is how a caller holding the agent reads one anyway: a request that is ABOUT a session but arrives from outside it, which is every browser RPC.\n\nRead addressing only. A host row that `inject`s a service cannot use this, because injection resolves before any session exists and has no agent to key by; such a service belongs on the host plane instead.',
+ parameters: [{ name: 'agent', description: 'the agent whose composition to look inside.' }, { name: 'name', description: 'the service name as the preset\'s rows resolve it.' }],
+ returns: 'the agent\'s instance, or undefined when its preset mounts none.',
},
{
signature: 'async recompose(agentCtx: Context, id: string): Promise',
- jsDoc: '/**\n * Re-link one agent to a different preset\'s standing composition.\n *\n * Only valid while the agent has produced nothing: swapping tools mid\n * conversation would leave logged tool calls the new composition cannot\n * make. The CALLER owns that check — this method does not read session\n * history.\n *\n * The swap is a parent re-link, not an unmount: standing mounts are shared\n * and permanent, so the old composition stays for its other agents and the\n * new one is ensured BEFORE the link moves. An unknown or unusable preset\n * therefore throws with the agent exactly as it was — there is no torn-down\n * state to restore. The re-link runs through the binding this roster kept\n * from the agent\'s mount — dsh-scope\'s only re-link authority. An agent\n * that never composed one has nothing to re-link: the switch is then the\n * agent\'s first bind, exactly a mount.\n * @param agentCtx - the agent\'s scope context.\n * @param id - the preset to compose the agent from instead.\n * @returns the preset now installed.\n * @throws when the preset is unknown or its composition is unusable.\n */',
+ description: 'Re-link one agent to a different preset\'s standing composition.\n\nOnly valid while the agent has produced nothing: swapping tools mid conversation would leave logged tool calls the new composition cannot make. The CALLER owns that check — this method does not read session history.\n\nThe swap is a parent re-link, not an unmount: standing mounts are shared and permanent, so the old composition stays for its other agents and the new one is ensured BEFORE the link moves. An unknown or unusable preset therefore throws with the agent exactly as it was — there is no torn-down state to restore. The re-link runs through the binding this roster kept from the agent\'s mount — dsh-scope\'s only re-link authority. An agent that never composed one has nothing to re-link: the switch is then the agent\'s first bind, exactly a mount.',
+ parameters: [{ name: 'agentCtx', description: 'the agent\'s scope context.' }, { name: 'id', description: 'the preset to compose the agent from instead.' }],
+ returns: 'the preset now installed.',
+ throws: ['when the preset is unknown or its composition is unusable.'],
},
{
signature: 'async standingKeyFor(id?: string): Promise',
- jsDoc: '/**\n * The standing scope key of one preset, for a host reader with no agent.\n *\n * A cold transcript read resolves tool presenters against the composition\n * the session recorded, and the standing mount makes that possible without\n * resuming anything: ensuring the mount composes plugins but starts no\n * agent, no session, and no turn.\n * @param id - the preset id, or `undefined` for {@link defaultId}.\n * @returns the standing scope key readers pass as a registry view scope.\n * @throws when the preset is unknown or its composition is unusable.\n */',
+ description: 'The standing scope key of one preset, for a host reader with no agent.\n\nA cold transcript read resolves tool presenters against the composition the session recorded, and the standing mount makes that possible without resuming anything: ensuring the mount composes plugins but starts no agent, no session, and no turn.',
+ parameters: [{ name: 'id', description: 'the preset id, or `undefined` for {@link defaultId}.' }],
+ returns: 'the standing scope key readers pass as a registry view scope.',
+ throws: ['when the preset is unknown or its composition is unusable.'],
},
],
},
{
key: 'agents',
summary: 'Agent service (`ctx.agents`): tracks live agents and carries the initiating Agent through one process-local asynchronous driver chain.',
+ description: 'Agent service (`ctx.agents`): tracks live agents and carries the initiating Agent through one process-local asynchronous driver chain. Agent *creation* is provided by whichever plugin implements the AgentFactory (`@deepseek-ai/dsh-agent-loop`), registered via setFactory.\n\nInitiator methods provide same-process causal attribution only. Ambient presence is neither liveness proof nor authorization; subjects and owners remain explicit, as does identity at worker, process, persistence, and wire boundaries. Returned Promise boundaries drain during teardown, except a nested lineage that starts an owning-fiber unload is excluded from its own drain.',
methods: [
{
signature: 'currentInitiator(): Agent | undefined',
- jsDoc: '/**\n * Read the Agent that initiated the inherited asynchronous driver chain.\n * Use this optional form for logging, tracing, metrics, or host attribution\n * that also supports agentless calls. When a parent creates a child, setup\n * reports the causal parent while `agentCtx.agent` identifies the child.\n * @returns the inherited Agent, or `undefined` outside an initiator boundary\n * and inside an explicit clearing boundary.\n * @throws when this service instance has been disposed.\n */',
+ description: 'Read the Agent that initiated the inherited asynchronous driver chain. Use this optional form for logging, tracing, metrics, or host attribution that also supports agentless calls. When a parent creates a child, setup reports the causal parent while `agentCtx.agent` identifies the child.',
+ parameters: [],
+ returns: 'the inherited Agent, or `undefined` outside an initiator boundary and inside an explicit clearing boundary.',
+ throws: ['when this service instance has been disposed.'],
},
{
signature: 'requireInitiator(): Agent',
- jsDoc: '/**\n * Read the initiating Agent and fail when no initiator boundary is active.\n * Use this for private helpers contractually below a driver, or for a\n * deployment-owned outbound request whose contract forbids agentless calls.\n * Generic or direct-call paths use optional lookup or explicit request fields.\n * @returns the inherited Agent.\n * @throws when no initiator is active or this service instance has been disposed.\n */',
+ description: 'Read the initiating Agent and fail when no initiator boundary is active. Use this for private helpers contractually below a driver, or for a deployment-owned outbound request whose contract forbids agentless calls. Generic or direct-call paths use optional lookup or explicit request fields.',
+ parameters: [],
+ returns: 'the inherited Agent.',
+ throws: ['when no initiator is active or this service instance has been disposed.'],
},
{
signature: 'withInitiator(agent: Agent, operation: () => T): T',
- jsDoc: '/**\n * Run an operation with one exact Agent as its process-local initiator. The\n * exact synchronous value or Promise returned by the operation is preserved.\n * Custom drivers and test harnesses wrap their complete returned foreground\n * lifetime.\n * A queue or wire receiver may establish this boundary only after validating\n * explicit identity and resolving the exact live Agent; this method does neither.\n * Detached work remains owned by the subsystem that starts it.\n * @param agent - initiating Agent to inherit; presence is neither liveness proof nor authorization.\n * @param operation - synchronous or asynchronous operation to invoke.\n * @returns the exact value returned by `operation`.\n * @throws when the initiator scope is closing/disposed, or when `operation` throws.\n */',
+ description: 'Run an operation with one exact Agent as its process-local initiator. The exact synchronous value or Promise returned by the operation is preserved. Custom drivers and test harnesses wrap their complete returned foreground lifetime. A queue or wire receiver may establish this boundary only after validating explicit identity and resolving the exact live Agent; this method does neither. Detached work remains owned by the subsystem that starts it.',
+ parameters: [{ name: 'agent', description: 'initiating Agent to inherit; presence is neither liveness proof nor authorization.' }, { name: 'operation', description: 'synchronous or asynchronous operation to invoke.' }],
+ returns: 'the exact value returned by `operation`.',
+ throws: ['when the initiator scope is closing/disposed, or when `operation` throws.'],
},
{
signature: 'withoutInitiator(operation: () => T): T',
- jsDoc: '/**\n * Run an operation inside a boundary that hides any inherited initiating\n * Agent. The exact synchronous value or Promise is preserved.\n * Use this while creating lazy shared timers, queue pumps, pool maintenance,\n * watchers, or exporters so they do not inherit the first Agent that happens\n * to initialize them. It clears only initiator attribution, not explicit\n * fields, and does not own or drain detached resources.\n * @param operation - synchronous or asynchronous operation to invoke without an initiator.\n * @returns the exact value returned by `operation`.\n * @throws when the initiator scope is closing/disposed, or when `operation` throws.\n */',
+ description: 'Run an operation inside a boundary that hides any inherited initiating Agent. The exact synchronous value or Promise is preserved. Use this while creating lazy shared timers, queue pumps, pool maintenance, watchers, or exporters so they do not inherit the first Agent that happens to initialize them. It clears only initiator attribution, not explicit fields, and does not own or drain detached resources.',
+ parameters: [{ name: 'operation', description: 'synchronous or asynchronous operation to invoke without an initiator.' }],
+ returns: 'the exact value returned by `operation`.',
+ throws: ['when the initiator scope is closing/disposed, or when `operation` throws.'],
},
{
signature: 'setFactory(factory: AgentFactory): () => void',
- jsDoc: '/**\n * Register the agent-creation factory (the loop calls this on construction,\n * effect-scoped). A traced Cordis service is canonicalized to its concrete\n * target; each create/resume call is then traced through that caller\'s\n * context so ownership follows the caller without stacking proxy layers.\n * Throws if a factory is already registered. Returns the disposer; on\n * dispose the factory slot is cleared.\n * @param factory - the loop-owned factory {@link create}/{@link resume} delegate to.\n * @returns the disposer that clears the factory slot. The exact\n * Cordis effect disposer (single-shot): composite (generator) effects may\n * yield it directly — exact identity nests the teardown in order.\n */',
+ description: 'Register the agent-creation factory (the loop calls this on construction, effect-scoped). A traced Cordis service is canonicalized to its concrete target; each create/resume call is then traced through that caller\'s context so ownership follows the caller without stacking proxy layers. Throws if a factory is already registered. Returns the disposer; on dispose the factory slot is cleared.',
+ parameters: [{ name: 'factory', description: 'the loop-owned factory {@link create}/{@link resume} delegate to.' }],
+ returns: 'the disposer that clears the factory slot. The exact Cordis effect disposer (single-shot): composite (generator) effects may yield it directly — exact identity nests the teardown in order.',
},
{
signature: 'async create(options: CreateAgentOptions): Promise',
- jsDoc: '/**\n * Create and publish a new agent through the registered factory.\n * Distinct from {@link register} (which records an already-constructed\n * agent): this constructs the agent and its session. Rejects if no factory is\n * registered or creation/setup fails. The resolved {@link AgentHandle} lets\n * the owner tear down exactly this agent.\n * @param options - shared identity, session seed/metadata, and agent options.\n * @returns the handle after setup, rollback-covered publication, and loop start complete.\n */',
+ description: 'Create and publish a new agent through the registered factory. Distinct from register (which records an already-constructed agent): this constructs the agent and its session. Rejects if no factory is registered or creation/setup fails. The resolved AgentHandle lets the owner tear down exactly this agent.',
+ parameters: [{ name: 'options', description: 'shared identity, session seed/metadata, and agent options.' }],
+ returns: 'the handle after setup, rollback-covered publication, and loop start complete.',
},
{
signature: 'async resume(options: ResumeAgentOptions): Promise',
- jsDoc: '/**\n * Load a persisted session and resume an agent on it through the registered\n * factory. Rejects if no factory is registered; the factory rejects if\n * session persistence is not configured or persistence/setup fails.\n * @param options - persisted identity, configuration, and optional setup.\n * @returns the handle after setup, rollback-covered publication, and loop start complete.\n */',
+ description: 'Load a persisted session and resume an agent on it through the registered factory. Rejects if no factory is registered; the factory rejects if session persistence is not configured or persistence/setup fails.',
+ parameters: [{ name: 'options', description: 'persisted identity, configuration, and optional setup.' }],
+ returns: 'the handle after setup, rollback-covered publication, and loop start complete.',
},
{
signature: 'register(agent: Agent): () => void',
- jsDoc: '/**\n * Register a live agent. Throws if an agent with the same id is already\n * registered. Emits `agent/created` on registration and `agent/disposed`\n * when the calling fiber is disposed — both with the agent\'s scope carrier\n * (`scopeTarget(agent, agent)`): the subject is the agent in hand, so the\n * emits are scope-filtered regardless of which context invoked `register`\n * (calling through `agent.ctx` scopes EFFECTS; dispatch scoping always\n * requires passing the carrier). Returns the disposer.\n * @param agent - the already-constructed agent to record in the store.\n * @returns the EXACT Cordis effect disposer (single-shot; a repeat call\n * returns undefined without awaiting an in-flight teardown). Exact\n * identity is load-bearing: a composite (generator) effect that owns a\n * teardown ORDER — the agent factory\'s lifecycle chain — must yield THIS\n * function so Cordis nests the unregistration at that yield position;\n * yielding a wrapper would leave it disposing as a concurrent sibling on\n * owner unload, unregistering the agent (and emitting `agent/disposed`)\n * while its final turn is still draining.\n */',
+ description: 'Register a live agent. Throws if an agent with the same id is already registered. Emits `agent/created` on registration and `agent/disposed` when the calling fiber is disposed — both with the agent\'s scope carrier (`scopeTarget(agent, agent)`): the subject is the agent in hand, so the emits are scope-filtered regardless of which context invoked `register` (calling through `agent.ctx` scopes EFFECTS; dispatch scoping always requires passing the carrier). Returns the disposer.',
+ parameters: [{ name: 'agent', description: 'the already-constructed agent to record in the store.' }],
+ returns: 'the EXACT Cordis effect disposer (single-shot; a repeat call returns undefined without awaiting an in-flight teardown). Exact identity is load-bearing: a composite (generator) effect that owns a teardown ORDER — the agent factory\'s lifecycle chain — must yield THIS function so Cordis nests the unregistration at that yield position; yielding a wrapper would leave it disposing as a concurrent sibling on owner unload, unregistering the agent (and emitting `agent/disposed`) while its final turn is still draining.',
},
{
signature: 'enter(agent: Agent, owner: Agent | undefined): () => void',
- jsDoc: '/**\n * Insert an already-constructed agent without announcing it. This is the\n * advanced ordered-lifecycle primitive used by the async agent factory: it\n * first completes setup while the agent is unpublished, then assigns the\n * returned detach closure into its pre-installed composite teardown before\n * calling {@link announce}. Ordinary callers use {@link register}.\n * @param agent - the prepared, unpublished agent.\n * @param owner - live agent whose scoped context created this agent, or\n * undefined for a top-level runtime root. This is runtime ownership, not\n * the resumed session\'s durable parent lineage.\n * @returns an idempotent closure that removes this exact entry and emits\n * `agent/disposed` with listener failures contained. When called from a\n * synchronous `agent/created` listener, removal and disposal wait until\n * that creation dispatch unwinds.\n */',
+ description: 'Insert an already-constructed agent without announcing it. This is the advanced ordered-lifecycle primitive used by the async agent factory: it first completes setup while the agent is unpublished, then assigns the returned detach closure into its pre-installed composite teardown before calling announce. Ordinary callers use register.',
+ parameters: [{ name: 'agent', description: 'the prepared, unpublished agent.' }, { name: 'owner', description: 'live agent whose scoped context created this agent, or undefined for a top-level runtime root. This is runtime ownership, not the resumed session\'s durable parent lineage.' }],
+ returns: 'an idempotent closure that removes this exact entry and emits `agent/disposed` with listener failures contained. When called from a synchronous `agent/created` listener, removal and disposal wait until that creation dispatch unwinds.',
},
{
signature: 'announce(agent: Agent): void',
- jsDoc: '/**\n * Announce an agent previously inserted with {@link enter}.\n * @param agent - the live inserted agent to announce.\n * @throws if `agent` is not the exact live registry entry for its id, or its\n * creation announcement already began (including a reentrant call from a\n * creation listener).\n */',
+ description: 'Announce an agent previously inserted with enter.',
+ parameters: [{ name: 'agent', description: 'the live inserted agent to announce.' }],
+ throws: ['if `agent` is not the exact live registry entry for its id, or its creation announcement already began (including a reentrant call from a creation listener).'],
},
{
signature: 'get(id: SessionId): Agent | undefined',
- jsDoc: '/**\n * Look up a live agent.\n * @param id - the shared agent/session id to look up.\n * @returns the agent, or undefined when no live agent has that id.\n */',
+ description: 'Look up a live agent.',
+ parameters: [{ name: 'id', description: 'the shared agent/session id to look up.' }],
+ returns: 'the agent, or undefined when no live agent has that id.',
},
{
signature: 'isOwnedBy(id: SessionId, owner: Agent): boolean',
- jsDoc: '/**\n * Test whether a live agent was created through one exact parent agent\'s\n * scoped context. Runtime ownership is independent of durable session\n * lineage and remains unambiguous when unrelated providers reuse an id.\n * @param id - the candidate child agent\'s shared agent/session id.\n * @param owner - the expected runtime creator agent.\n * @returns true only while the exact child entry is live under that owner.\n */',
+ description: 'Test whether a live agent was created through one exact parent agent\'s scoped context. Runtime ownership is independent of durable session lineage and remains unambiguous when unrelated providers reuse an id.',
+ parameters: [{ name: 'id', description: 'the candidate child agent\'s shared agent/session id.' }, { name: 'owner', description: 'the expected runtime creator agent.' }],
+ returns: 'true only while the exact child entry is live under that owner.',
},
{
signature: 'list(): Agent[]',
- jsDoc: '/**\n * All live agents, in registration order.\n * @returns a fresh array; mutating it does not affect the registry.\n */',
+ description: 'All live agents, in registration order.',
+ parameters: [],
+ returns: 'a fresh array; mutating it does not affect the registry.',
},
{
signature: 'roots(): Agent[]',
- jsDoc: '/**\n * All live top-level agents in registration order. A top-level agent was\n * created without an owning agent context; durable session lineage does not\n * affect this runtime relation, so a resumed fork may still be a root.\n * @returns a fresh array; mutating it does not affect the registry.\n */',
+ description: 'All live top-level agents in registration order. A top-level agent was created without an owning agent context; durable session lineage does not affect this runtime relation, so a resumed fork may still be a root.',
+ parameters: [],
+ returns: 'a fresh array; mutating it does not affect the registry.',
+ },
+ ],
+ },
+ {
+ key: 'apiProxy',
+ summary: 'Root interface of the unified API.',
+ description: 'Root interface of the unified API. New client-request domain = one new file pair + one field here + one map row.',
+ methods: [
+ {
+ signature: 'downloads: DownloadsApi',
+ description: 'Host-only download surfaces (GET, no wire envelope); absent from IApiClient.',
+ parameters: [],
+ },
+ {
+ signature: 'respond(message: ClientResponse): Promise',
+ description: 'Response entry for server requests; not a domain method.',
+ parameters: [{ name: 'message', description: 'Client response carrying the server request\'s rpcId.' }],
+ returns: 'Transport receipt for the response delivery.',
},
],
},
{
key: 'approval',
summary: 'Approval service that applies session policy before answerers and logs every ask/outcome pair to the requesting session.',
+ description: 'Approval service that applies session policy before answerers and logs every ask/outcome pair to the requesting session. It exposes deterministic policy changes to the model through the runtime-context snapshot and switch notices.',
methods: [
{
signature: 'setPolicy(agent: Agent, policy: ApprovalPolicy): void',
- jsDoc: '/**\n * Switch one live agent\'s policy and queue the transition for its next model\n * step. Session initialization uses {@link setApprovalPolicy} directly\n * because there is no previously visible policy to change.\n * @param agent - the live agent whose policy is changing.\n * @param policy - the new effective policy.\n */',
+ description: 'Switch one live agent\'s policy and queue the transition for its next model step. Session initialization uses setApprovalPolicy directly because there is no previously visible policy to change.',
+ parameters: [{ name: 'agent', description: 'the live agent whose policy is changing.' }, { name: 'policy', description: 'the new effective policy.' }],
},
{
signature: 'async request(req: ApprovalRequest): Promise',
- jsDoc: '/**\n * Ask the composed answerers to decide one readonly same-process request.\n * The service borrows the request, agent, session, and live signal directly.\n * The request requires an open turn because the audit pair must be enclosed\n * by the durable log\'s commit/replay boundary; an idle ask rejects before\n * appending anything. The answerer phase always produces an outcome: an\n * aborted signal yields `\'cancelled\'`, a missing or throwing answerer yields\n * `\'unavailable\'` (fail closed), and a rogue non-vocabulary return value is\n * normalized to `\'unavailable\'`. A failure that prevents either audit append\n * from committing still rejects because returning an unlogged decision would\n * violate the pair. Session contains post-commit observer failures, so an\n * authoritative append cannot reject the request or suppress its matching\n * audit event.\n * @param req - the pending decision (agent, tool identity, reason, signal).\n * @returns the closed outcome; `\'allowed-once\'` is the only grant.\n * @throws when no turn is open or either audit event fails before the session\n * append commit point.\n */',
+ description: 'Ask the composed answerers to decide one readonly same-process request. The service borrows the request, agent, session, and live signal directly. The request requires an open turn because the audit pair must be enclosed by the durable log\'s commit/replay boundary; an idle ask rejects before appending anything. The answerer phase always produces an outcome: an aborted signal yields `\'cancelled\'`, a missing or throwing answerer yields `\'unavailable\'` (fail closed), and a rogue non-vocabulary return value is normalized to `\'unavailable\'`. A failure that prevents either audit append from committing still rejects because returning an unlogged decision would violate the pair. Session contains post-commit observer failures, so an authoritative append cannot reject the request or suppress its matching audit event.',
+ parameters: [{ name: 'req', description: 'the pending decision (agent, tool identity, reason, signal).' }],
+ returns: 'the closed outcome; `\'allowed-once\'` is the only grant.',
+ throws: ['when no turn is open or either audit event fails before the session append commit point.'],
},
{
signature: 'overrideOf(session: Session): ApprovalPolicy | undefined',
- jsDoc: '/**\n * Read the session override without applying the configured default.\n * @param session - session whose log supplies the override.\n * @returns the last logged policy, or `undefined` without one.\n */',
+ description: 'Read the session override without applying the configured default.',
+ parameters: [{ name: 'session', description: 'session whose log supplies the override.' }],
+ returns: 'the last logged policy, or `undefined` without one.',
},
],
},
{
key: 'attachments',
summary: 'Immutable binary attachment service.',
+ description: 'Immutable binary attachment service. Implementations validate bytes before publishing a reference.',
methods: [
+ {
+ signature: 'abstract readonly imageLimits: ImageAttachmentLimits',
+ description: 'Deployment-resolved image policy used by authoritative and fast-path validation.',
+ parameters: [],
+ },
{
signature: 'abstract validateImage(input: SaveImageAttachment): Promise',
- jsDoc: '/**\n * Validate one image without persisting it.\n * Batch callers validate every member before saving any member.\n * @param input - encoded bytes, declared media type, and optional display name.\n * @returns completion after the encoded raster has been fully decoded.\n */',
+ description: 'Validate one image without persisting it. Batch callers validate every member before saving any member.',
+ parameters: [{ name: 'input', description: 'encoded bytes, declared media type, and optional display name.' }],
+ returns: 'completion after the encoded raster has been fully decoded.',
},
{
signature: 'abstract saveImage(input: SaveImageAttachment): Promise',
- jsDoc: '/**\n * Validate and durably commit one image before its owning session event is appended.\n * @param input - encoded bytes, declared media type, and optional display name.\n * @returns a durable content-addressed reference.\n */',
+ description: 'Validate and durably commit one image before its owning session event is appended.',
+ parameters: [{ name: 'input', description: 'encoded bytes, declared media type, and optional display name.' }],
+ returns: 'a durable content-addressed reference.',
},
{
signature: 'abstract readImage(ref: ImageAttachmentRef, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Read one image and verify that bytes still match the recorded reference.\n * @param ref - durable reference from the session log.\n * @param signal - optional cancellation for backend read and verification work.\n * @returns the verified bytes and canonical reference.\n * @throws the signal reason when aborted, or a storage error when verification fails.\n */',
+ description: 'Read one image and verify that bytes still match the recorded reference.',
+ parameters: [{ name: 'ref', description: 'durable reference from the session log.' }, { name: 'signal', description: 'optional cancellation for backend read and verification work.' }],
+ returns: 'the verified bytes and canonical reference.',
+ throws: ['the signal reason when aborted, or a storage error when verification fails.'],
},
],
},
{
key: 'clientModules',
summary: 'The web plugin table service: incremental `dsh.client` scan + wire composition + bundle route + index tap.',
+ description: 'The web plugin table service: incremental `dsh.client` scan + wire composition + bundle route + index tap. Construction runs the activation scan synchronously — a malformed declaration or missing bundle among the already-loaded entries aggregates into one loud throw (FAILED fiber; the boot activation audit reports it).',
methods: [
{
signature: 'graph(): WebBootGraph',
- jsDoc: '/**\n * Current composed entry graph (stable object between changes).\n * @returns the graph served as `window.__DSH_BOOT__`.\n */',
+ description: 'Current composed entry graph (stable object between changes).',
+ parameters: [],
+ returns: 'the graph served as `window.__DSH_BOOT__`.',
},
{
signature: 'clientPath(id: string): string | undefined',
- jsDoc: '/**\n * Absolute path of an entry\'s client bundle.\n * @param id - entry id (package name).\n * @returns the path, or undefined for an unknown id.\n */',
+ description: 'Absolute path of an entry\'s client bundle.',
+ parameters: [{ name: 'id', description: 'entry id (package name).' }],
+ returns: 'the path, or undefined for an unknown id.',
},
{
signature: 'rebuilt(id: string): string | undefined',
- jsDoc: '/**\n * Re-hash one bundle (the HMR watch\'s registration hook — the only entry\n * point through which bundle content changes reach the graph).\n * @param id - entry id (package name).\n * @returns the new rev, or undefined for an unknown id.\n */',
+ description: 'Re-hash one bundle (the HMR watch\'s registration hook — the only entry point through which bundle content changes reach the graph).',
+ parameters: [{ name: 'id', description: 'entry id (package name).' }],
+ returns: 'the new rev, or undefined for an unknown id.',
},
{
signature: 'onRebuilt(listener: (id: string, rev: string) => void): () => void',
- jsDoc: '/**\n * Subscribe to bundle rebuilds; fires only when the re-hash changed the rev.\n * @param listener - receives the entry id and its new bundle rev.\n * @returns the unsubscriber.\n */',
+ description: 'Subscribe to bundle rebuilds; fires only when the re-hash changed the rev.',
+ parameters: [{ name: 'listener', description: 'receives the entry id and its new bundle rev.' }],
+ returns: 'the unsubscriber.',
},
{
signature: 'onGraphChanged(listener: () => void): () => void',
- jsDoc: '/**\n * Fires after any flush that recomposed the graph (row added/removed, or a\n * rebuilt rev change). Pull model: listeners re-read {@link graph}.\n * @param listener - notified with no payload.\n * @returns the unsubscriber.\n */',
+ description: 'Fires after any flush that recomposed the graph (row added/removed, or a rebuilt rev change). Pull model: listeners re-read graph.',
+ parameters: [{ name: 'listener', description: 'notified with no payload.' }],
+ returns: 'the unsubscriber.',
},
],
},
{
key: 'codeRuntime',
summary: 'Registers one `ctx.codeRuntime` implementation.',
+ description: 'Registers one `ctx.codeRuntime` implementation. Program, budget, abort, and substrate failures resolve in CodeRunResult; only Service Definition contract misuse rejects. Implementations bridge structured-cloneable bindings, materialize each declared namespace rejection class, treat programs as hostile peers, isolate runs from one another, and terminate and await in-flight runs during disposal.',
methods: [
+ {
+ signature: 'abstract readonly language: string',
+ description: 'The source language run expects `program` to be written in, as a lowercase identifier. Informational, not gating — a consumer that generates language-specific presentation (typed SDK stubs, usage instructions) switches on it and fails loud on a language it cannot present. Well-known values: `\'typescript\'` and `\'python\'`, those `dsh-tools` presents; only `\'typescript\'` has a published backend.',
+ parameters: [],
+ },
+ {
+ signature: 'abstract readonly isolation: string',
+ description: 'The execution substrate, as a lowercase identifier. Informational, not gating — a descriptor so deployments and diagnostics can tell backends apart, not a security claim. Well-known values: `\'worker-thread\'`, `\'process\'`, `\'container\'`.',
+ parameters: [],
+ },
{
signature: 'abstract run(request: CodeRunRequest): Promise',
- jsDoc: '/**\n * Execute one program against the request\'s bindings and capture what it\n * emitted. See the class doc for the resolution contract (error is a result\n * field; rejection means Service Definition contract misuse only).\n * @param request - the program, its bindings, and the abort signal; the\n * request carries everything the runtime acts on, with no hidden defaults.\n * @returns the run\'s outcome: completion value (when transferable), the\n * ordered log capture, and the failure (if any).\n */',
+ description: 'Execute one program against the request\'s bindings and capture what it emitted. See the class doc for the resolution contract (error is a result field; rejection means Service Definition contract misuse only).',
+ parameters: [{ name: 'request', description: 'the program, its bindings, and the abort signal; the request carries everything the runtime acts on, with no hidden defaults.' }],
+ returns: 'the run\'s outcome: completion value (when transferable), the ordered log capture, and the failure (if any).',
},
],
},
{
key: 'commands',
summary: 'Human-command registry.',
+ description: 'Human-command registry. Plain-context definitions are global; definitions registered through a command-injected child of an agent context shadow globals for that agent.',
methods: [
{
signature: 'register(definition: CommandDefinition): () => void',
- jsDoc: '/**\n * Register a global or calling-agent-scoped command.\n * @param definition - discovery metadata and direct UI handler.\n * @returns the exact effect disposer that unregisters this definition.\n */',
+ description: 'Register a global or calling-agent-scoped command.',
+ parameters: [{ name: 'definition', description: 'discovery metadata and direct UI handler.' }],
+ returns: 'the exact effect disposer that unregisters this definition.',
},
{
signature: '@Remote list(agent: Agent): readonly CommandDescriptor[]',
- jsDoc: '/**\n * List the effective immutable command descriptors for one agent.\n * @param agent - exact receiving agent and scoped-layer key.\n * @returns name-sorted descriptors after scoped shadowing.\n */',
+ description: 'List the effective immutable command descriptors for one agent.',
+ parameters: [{ name: 'agent', description: 'exact receiving agent and scoped-layer key.' }],
+ returns: 'name-sorted descriptors after scoped shadowing.',
},
{
signature: 'find(agent: Agent, name: string): CommandDefinition | undefined',
- jsDoc: '/**\n * Resolve one effective command definition.\n * @param agent - exact receiving agent and scoped-layer key.\n * @param name - command name without a slash.\n * @returns the scoped shadow or global definition.\n */',
+ description: 'Resolve one effective command definition.',
+ parameters: [{ name: 'agent', description: 'exact receiving agent and scoped-layer key.' }, { name: 'name', description: 'command name without a slash.' }],
+ returns: 'the scoped shadow or global definition.',
},
{
signature: '@Remote async execute( agent: Agent, line: string, signal: AbortSignal, ): Promise',
- jsDoc: '/**\n * Parse and execute a known command without sending it to the model.\n *\n * A resolved command\'s lifecycle is logged: `command/run` is appended\n * before the handler is invoked and `command/done` after settlement (a\n * thrown or aborted handler settles as `kind: \'error\'`). Both are direct\n * log-only appends — no turn wraps them, and persistence drains them at\n * ordinary checkpoints. Admission misses (syntax or unknown name) log\n * nothing — they never entered a handler. A `command/run` append failure\n * fails the execution loud; a `command/done` append failure on the\n * handler-failure path is contained so the handler\'s own error stays the\n * reported failure.\n *\n * @param agent - exact receiving agent.\n * @param line - complete slash-command line.\n * @param signal - cancellation signal owned by the UI request.\n * @returns the settled execution (result + lifecycle pairing id), or\n * `undefined` when syntax or name does not resolve.\n */',
+ description: 'Parse and execute a known command without sending it to the model.\n\nA resolved command\'s lifecycle is logged: `command/run` is appended before the handler is invoked and `command/done` after settlement (a thrown or aborted handler settles as `kind: \'error\'`). Both are direct log-only appends — no turn wraps them, and persistence drains them at ordinary checkpoints. Admission misses (syntax or unknown name) log nothing — they never entered a handler. A `command/run` append failure fails the execution loud; a `command/done` append failure on the handler-failure path is contained so the handler\'s own error stays the reported failure.',
+ parameters: [{ name: 'agent', description: 'exact receiving agent.' }, { name: 'line', description: 'complete slash-command line.' }, { name: 'signal', description: 'cancellation signal owned by the UI request.' }],
+ returns: 'the settled execution (result + lifecycle pairing id), or `undefined` when syntax or name does not resolve.',
},
],
},
{
key: 'compaction',
summary: 'Abstract compaction service.',
+ description: 'Abstract compaction service. Implementations own trigger policy, retention, and summarization, and may consume a separate measurement service. A successful run replaces the selected surface span with one summary node and prevents concurrent compaction of the same session. The replacement user message uses compactCheckpointSource with the transaction identity so consumers recognize and correlate it independently of the backend. Load one implementation per context as `ctx.compaction`.',
methods: [
{
signature: 'abstract compactIfNeeded( agent: CompactionAgentContext, trigger: CompactionTrigger, signal: AbortSignal, ): Promise',
- jsDoc: '/**\n * Consider automatic compaction for one explicit trigger. Pressure policy\n * uses the latest durable routed request, while context-overflow policy may\n * force a useful balanced reduction even below the normal threshold. Return\n * `null` when no safe range can be compacted. A single oversized retained\n * unit or request envelope cannot be repaired through surface compaction.\n *\n * @param agent - agent context owning the session surface and routing options.\n * @param trigger - normal pressure or provider-confirmed context overflow.\n * @param signal - cancellation signal; model-backed implementations must forward it.\n * @returns the compaction result, or `null` if no compaction was needed.\n */',
+ description: 'Consider automatic compaction for one explicit trigger. Pressure policy uses the latest durable routed request, while context-overflow policy may force a useful balanced reduction even below the normal threshold. Return `null` when no safe range can be compacted. A single oversized retained unit or request envelope cannot be repaired through surface compaction.',
+ parameters: [{ name: 'agent', description: 'agent context owning the session surface and routing options.' }, { name: 'trigger', description: 'normal pressure or provider-confirmed context overflow.' }, { name: 'signal', description: 'cancellation signal; model-backed implementations must forward it.' }],
+ returns: 'the compaction result, or `null` if no compaction was needed.',
},
{
signature: 'abstract compactNow( agent: ManualCompactAgentContext, signal: AbortSignal, sourceCommandId?: CommandId, ): Promise',
- jsDoc: '/**\n * Explicitly compact useful history even below automatic pressure thresholds.\n * Implementations synchronously start an idle task before any asynchronous\n * work, select a useful range without writing on a no-op, then\n * append a standalone `compaction/start` before summarization. That durable\n * marker is the compaction lock until one `compaction/end` attempt. Later waking\n * prompts remain accepted in FIFO order and start only after the optional\n * durability checkpoint and idle-task settlement. Context injected while the\n * summary runs may sit between the marker pair; only the selected span must\n * remain stable.\n *\n * @param agent - idle agent whose durable history should be compacted.\n * @param signal - cancellation scoped to this compaction request.\n * @param sourceCommandId - initiating command identity for a manual compaction.\n * @returns the compaction result, or `null` when no safe useful range exists.\n * @throws {@link ManualCompactionError} for expected busy, agent-cancellation,\n * changed-span, summarization/shrink, commit-stage, or persistence failures;\n * an aborted request preserves its exact abort reason. Failed attempts remain\n * visible in the log.\n */',
+ description: 'Explicitly compact useful history even below automatic pressure thresholds. Implementations synchronously start an idle task before any asynchronous work, select a useful range without writing on a no-op, then append a standalone `compaction/start` before summarization. That durable marker is the compaction lock until one `compaction/end` attempt. Later waking prompts remain accepted in FIFO order and start only after the optional durability checkpoint and idle-task settlement. Context injected while the summary runs may sit between the marker pair; only the selected span must remain stable.',
+ parameters: [{ name: 'agent', description: 'idle agent whose durable history should be compacted.' }, { name: 'signal', description: 'cancellation scoped to this compaction request.' }, { name: 'sourceCommandId', description: 'initiating command identity for a manual compaction.' }],
+ returns: 'the compaction result, or `null` when no safe useful range exists.',
+ throws: ['{@link ManualCompactionError} for expected busy, agent-cancellation, changed-span, summarization/shrink, commit-stage, or persistence failures; an aborted request preserves its exact abort reason. Failed attempts remain visible in the log.'],
},
{
signature: 'abstract compactRegion( start: number, end: number, agent: CompactionAgentContext, signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Forcibly compact a range of surface nodes into a single summary node.\n * `start` and `end` name an inclusive span by surface position, not numeric seq\n * order; replacements can make visible seqs non-monotonic. Both edges must be\n * balanced so assistant tool calls remain paired with their results. A model-\n * backed implementation forwards cancellation and rejects active, missing,\n * reversed, or unbalanced ranges. The target session is `agent.session`.\n * Its replacement user message must use {@link compactCheckpointSource} with\n * the transaction\'s `CompactionId`.\n * Use {@link toolPairingBalancedBefore} and {@link toolPairingBalancedAfter}\n * for the edge checks.\n *\n * @param start - first surface seq, inclusive.\n * @param end - last surface seq, inclusive.\n * @param agent - context whose session is mutated and whose routing options guide summarization.\n * @param signal - optional cancellation; model-backed implementations must forward it.\n * @throws when compaction is active or the range is missing, reversed, or unbalanced.\n * @returns the appended event seqs, summary, replaced range, and token accounting.\n */',
+ description: 'Forcibly compact a range of surface nodes into a single summary node. `start` and `end` name an inclusive span by surface position, not numeric seq order; replacements can make visible seqs non-monotonic. Both edges must be balanced so assistant tool calls remain paired with their results. A model- backed implementation forwards cancellation and rejects active, missing, reversed, or unbalanced ranges. The target session is `agent.session`. Its replacement user message must use compactCheckpointSource with the transaction\'s `CompactionId`. Use toolPairingBalancedBefore and toolPairingBalancedAfter for the edge checks.',
+ parameters: [{ name: 'start', description: 'first surface seq, inclusive.' }, { name: 'end', description: 'last surface seq, inclusive.' }, { name: 'agent', description: 'context whose session is mutated and whose routing options guide summarization.' }, { name: 'signal', description: 'optional cancellation; model-backed implementations must forward it.' }],
+ returns: 'the appended event seqs, summary, replaced range, and token accounting.',
+ throws: ['when compaction is active or the range is missing, reversed, or unbalanced.'],
},
],
},
{
key: 'credentials',
summary: 'Abstract credential service.',
+ description: 'Abstract credential service. Providers implement the four operations over their source layers; one seam-wide rule binds them all: an empty stored value is absent everywhere — `resolve` skips it, `describe` reports it unconfigured — so a blank never masquerades as a configured secret.',
methods: [
{
signature: 'abstract resolve(ref: CredentialRef): Promise',
- jsDoc: '/**\n * Resolve one reference to its current value. Resolution is per call:\n * consumers re-resolve at each operation and must not cache across\n * operations — that per-operation read is what makes a changed credential\n * reach the next operation without a restart.\n * @param ref - the reference to resolve.\n * @returns the value and its source, or `undefined` while unconfigured.\n */',
+ description: 'Resolve one reference to its current value. Resolution is per call: consumers re-resolve at each operation and must not cache across operations — that per-operation read is what makes a changed credential reach the next operation without a restart.',
+ parameters: [{ name: 'ref', description: 'the reference to resolve.' }],
+ returns: 'the value and its source, or `undefined` while unconfigured.',
},
{
signature: 'abstract describe(ref: CredentialRef): Promise',
- jsDoc: '/**\n * Describe one reference for configuration surfaces without exposing the\n * value.\n * @param ref - the reference to describe.\n * @returns configured state, supplying source, and writability.\n */',
+ description: 'Describe one reference for configuration surfaces without exposing the value.',
+ parameters: [{ name: 'ref', description: 'the reference to describe.' }],
+ returns: 'configured state, supplying source, and writability.',
},
{
signature: 'abstract set(ref: CredentialRef, value: string): Promise',
- jsDoc: '/**\n * Durably store one value in the provider-managed writable source. Rejects\n * while a read-only source shadows the reference — the write would appear\n * to succeed while resolution keeps returning the shadowing value — and\n * rejects an empty value (use {@link unset}).\n * @param ref - the reference to store.\n * @param value - the non-empty secret value.\n */',
+ description: 'Durably store one value in the provider-managed writable source. Rejects while a read-only source shadows the reference — the write would appear to succeed while resolution keeps returning the shadowing value — and rejects an empty value (use unset).',
+ parameters: [{ name: 'ref', description: 'the reference to store.' }, { name: 'value', description: 'the non-empty secret value.' }],
},
{
signature: 'abstract unset(ref: CredentialRef): Promise',
- jsDoc: '/**\n * Remove one reference from the provider-managed writable source; removing\n * an absent reference is a no-op. Rejects while a read-only source shadows\n * the reference, like {@link set}.\n * @param ref - the reference to remove.\n */',
+ description: 'Remove one reference from the provider-managed writable source; removing an absent reference is a no-op. Rejects while a read-only source shadows the reference, like set.',
+ parameters: [{ name: 'ref', description: 'the reference to remove.' }],
},
],
},
{
key: 'directoryPicker',
summary: 'Abstract directory-picking service.',
+ description: 'Abstract directory-picking service. Subclass, implement `capability()`, and load the subclass as a plugin — it registers as `ctx.directoryPicker` (one implementation per context; loading a second throws, cordis\' standard duplicate-service behavior). The capability object must be stable for the service lifetime: consumers may capture it across calls.',
methods: [
{
signature: 'abstract capability(): DirectoryPickerCapability',
- jsDoc: '/**\n * The backend\'s interaction capability.\n * @returns the discriminated capability consumers switch on.\n */',
+ description: 'The backend\'s interaction capability.',
+ parameters: [],
+ returns: 'the discriminated capability consumers switch on.',
},
],
},
{
key: 'e2b',
summary: 'Creates one lazily consumable E2B SDK handle and deletes the sandbox at timeout or disposal.',
+ description: 'Creates one lazily consumable E2B SDK handle and deletes the sandbox at timeout or disposal. Creation begins at plugin construction; adapters await getSandbox before their first operation.',
methods: [
+ {
+ signature: 'readonly cwd: string',
+ description: 'Validated remote working directory shared by provider adapters.',
+ parameters: [],
+ },
+ {
+ signature: 'readonly runtimeRoot: string',
+ description: 'Remote directory reserved for adapter-owned process and terminal state.',
+ parameters: [],
+ },
{
signature: 'async getSandbox(): Promise',
- jsDoc: '/**\n * Return the shared live SDK handle.\n * @returns the created sandbox after the configured cwd exists.\n * @throws when E2B rejects creation or the service is disposing.\n */',
+ description: 'Return the shared live SDK handle.',
+ parameters: [],
+ returns: 'the created sandbox after the configured cwd exists.',
+ throws: ['when E2B rejects creation or the service is disposing.'],
},
],
},
{
key: 'fs',
summary: 'Abstract filesystem provider.',
+ description: 'Abstract filesystem provider. Targets must preserve identity across aliases; reads expose regular UTF-8 text or typed errors, listings are stable and content-free, and mutations are atomic. Optional guards add stale protection without changing the unguarded provider contract.',
methods: [
{
signature: 'abstract resolve(path: string, opts?: { cwd?: string; signal?: AbortSignal }): Promise',
- jsDoc: '/**\n * Resolve a model/plugin-supplied path into a stable {@link FsTarget}. May perform I/O (a\n * remote/sandboxed backend may need a round-trip to map a path to a stable identity), hence\n * async even though the local backend only normalizes + realpaths.\n *\n * @param path - the path to resolve; relative paths resolve against `opts.cwd`.\n * @param opts - optional cwd override and cancellation signal.\n * @returns the stable target; the same file yields the same `targetKey`.\n */',
+ description: 'Resolve a model/plugin-supplied path into a stable FsTarget. May perform I/O (a remote/sandboxed backend may need a round-trip to map a path to a stable identity), hence async even though the local backend only normalizes + realpaths.',
+ parameters: [{ name: 'path', description: 'the path to resolve; relative paths resolve against `opts.cwd`.' }, { name: 'opts', description: 'optional cwd override and cancellation signal.' }],
+ returns: 'the stable target; the same file yields the same `targetKey`.',
},
{
signature: 'abstract processPath(target: FsTarget): string',
- jsDoc: '/**\n * Return the canonical absolute path a subprocess in this filesystem\'s\n * execution world can open. The path is deliberately separate from\n * {@link FsTarget.targetKey}: consumers may pass this value to another OS\n * capability, but must continue treating the target key as opaque.\n * @param target - the resolved target whose process path is required.\n * @returns an absolute path in the backend\'s execution world.\n */',
+ description: 'Return the canonical absolute path a subprocess in this filesystem\'s execution world can open. The path is deliberately separate from FsTarget.targetKey: consumers may pass this value to another OS capability, but must continue treating the target key as opaque.',
+ parameters: [{ name: 'target', description: 'the resolved target whose process path is required.' }],
+ returns: 'an absolute path in the backend\'s execution world.',
},
{
signature: 'abstract fileUrl(target: FsTarget): string',
- jsDoc: '/**\n * Return the canonical `file:` URI for a target in this filesystem\'s\n * execution world. Backends own URI encoding because the host platform may\n * differ from the execution platform.\n * @param target - the resolved target to encode.\n * @returns the target\'s canonical file URI.\n */',
+ description: 'Return the canonical `file:` URI for a target in this filesystem\'s execution world. Backends own URI encoding because the host platform may differ from the execution platform.',
+ parameters: [{ name: 'target', description: 'the resolved target to encode.' }],
+ returns: 'the target\'s canonical file URI.',
},
{
signature: 'abstract contains(parent: FsTarget, child: FsTarget): boolean',
- jsDoc: '/**\n * Test canonical containment without exposing or parsing backend target\n * keys. Both targets must come from this provider.\n * @param parent - canonical directory target.\n * @param child - canonical candidate target.\n * @returns true when `child` is `parent` or a descendant of it.\n */',
+ description: 'Test canonical containment without exposing or parsing backend target keys. Both targets must come from this provider.',
+ parameters: [{ name: 'parent', description: 'canonical directory target.' }, { name: 'child', description: 'canonical candidate target.' }],
+ returns: 'true when `child` is `parent` or a descendant of it.',
},
{
signature: 'abstract stat(target: FsTarget, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Return target metadata, or `undefined` when the target does not exist.\n * @param target - the resolved target to stat.\n * @param signal - aborts the metadata round-trip.\n * @returns metadata only, never content; undefined for an absent target.\n */',
+ description: 'Return target metadata, or `undefined` when the target does not exist.',
+ parameters: [{ name: 'target', description: 'the resolved target to stat.' }, { name: 'signal', description: 'aborts the metadata round-trip.' }],
+ returns: 'metadata only, never content; undefined for an absent target.',
},
{
signature: 'abstract lstat(path: string, opts?: { cwd?: string }, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Return path metadata without following the final path component when it is a\n * symbolic link. This is intentionally path-shaped, not target-shaped:\n * {@link resolve} follows symlinks to produce the stable identity used by\n * normal reads/writes, while `lstat` lets a consumer reject the path itself\n * before that follow happens.\n *\n * `opts.cwd` follows {@link resolve}\'s cwd rules. `undefined` means the path is\n * absent.\n * @param path - the path to inspect; relative paths resolve against `opts.cwd`.\n * @param opts - `cwd` overrides the backend\'s default base for relative paths.\n * @param signal - aborts the metadata round-trip.\n * @returns metadata only, never content; undefined for an absent path.\n */',
+ description: 'Return path metadata without following the final path component when it is a symbolic link. This is intentionally path-shaped, not target-shaped: resolve follows symlinks to produce the stable identity used by normal reads/writes, while `lstat` lets a consumer reject the path itself before that follow happens.\n\n`opts.cwd` follows resolve\'s cwd rules. `undefined` means the path is absent.',
+ parameters: [{ name: 'path', description: 'the path to inspect; relative paths resolve against `opts.cwd`.' }, { name: 'opts', description: '`cwd` overrides the backend\'s default base for relative paths.' }, { name: 'signal', description: 'aborts the metadata round-trip.' }],
+ returns: 'metadata only, never content; undefined for an absent path.',
},
{
signature: 'abstract readText(target: FsTarget, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Read the whole regular text file as a single decoded string.\n * @param target - the resolved target to read.\n * @param signal - aborts the read.\n * @returns the full decoded UTF-8 content.\n */',
+ description: 'Read the whole regular text file as a single decoded string.',
+ parameters: [{ name: 'target', description: 'the resolved target to read.' }, { name: 'signal', description: 'aborts the read.' }],
+ returns: 'the full decoded UTF-8 content.',
},
{
signature: 'abstract streamText(target: FsTarget, signal?: AbortSignal): Promise>',
- jsDoc: '/**\n * Stream the whole regular text file as decoded text chunks (same text\n * semantics as {@link readText}, for large files). The backend owns\n * cross-chunk UTF-8 decoding and binary rejection so the policy layer never\n * touches raw bytes.\n * @param target - the resolved target to read.\n * @param signal - aborts the stream, including between chunks.\n * @returns the chunk iterable, decoded and validated like {@link readText}.\n */',
+ description: 'Stream the whole regular text file as decoded text chunks (same text semantics as readText, for large files). The backend owns cross-chunk UTF-8 decoding and binary rejection so the policy layer never touches raw bytes.',
+ parameters: [{ name: 'target', description: 'the resolved target to read.' }, { name: 'signal', description: 'aborts the stream, including between chunks.' }],
+ returns: 'the chunk iterable, decoded and validated like {@link readText}.',
},
{
signature: 'abstract readBytes(target: FsTarget, signal: AbortSignal | undefined, maxBytes: number): Promise',
- jsDoc: '/**\n * Read the whole regular file as raw bytes with no decoding or binary\n * rejection. The bound lives at this seam so a backend can never buffer an\n * unbounded file: a target known or discovered to exceed `maxBytes` fails\n * with `FS_TOO_LARGE` instead of returning a truncated result.\n * @param target - the resolved target to read.\n * @param signal - aborts the read.\n * @param maxBytes - inclusive byte cap on the complete content.\n * @returns the full raw content, at most `maxBytes` long.\n */',
+ description: 'Read the whole regular file as raw bytes with no decoding or binary rejection. The bound lives at this seam so a backend can never buffer an unbounded file: a target known or discovered to exceed `maxBytes` fails with `FS_TOO_LARGE` instead of returning a truncated result.',
+ parameters: [{ name: 'target', description: 'the resolved target to read.' }, { name: 'signal', description: 'aborts the read.' }, { name: 'maxBytes', description: 'inclusive byte cap on the complete content.' }],
+ returns: 'the full raw content, at most `maxBytes` long.',
},
{
signature: 'abstract listDir(target: FsTarget, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * List direct children of a directory in stable name order. Returns resolved\n * child targets plus cheap metadata only; never reads file contents.\n * @param target - the resolved directory target.\n * @param signal - aborts the listing.\n * @returns one entry per direct child, in stable name order.\n */',
+ description: 'List direct children of a directory in stable name order. Returns resolved child targets plus cheap metadata only; never reads file contents.',
+ parameters: [{ name: 'target', description: 'the resolved directory target.' }, { name: 'signal', description: 'aborts the listing.' }],
+ returns: 'one entry per direct child, in stable name order.',
},
{
signature: 'abstract writeText( target: FsTarget, content: string, expected?: FsWriteIntent, signal?: AbortSignal, sandboxPolicy?: SandboxExecutionPolicy, ): Promise',
- jsDoc: '/**\n * Atomically create or replace UTF-8 text. `expected` guards intent and\n * staleness; omission allows unconditional overwrite.\n * @param target - the resolved target to write.\n * @param content - the full new file content.\n * @param expected - the write intent guarding the write; omit for unconditional.\n * @param signal - aborts before atomic publication takes effect.\n * @param sandboxPolicy - the per-call mode and workspace root this write\n * runs under; a sandboxing backend fences the write by it, the bare backend\n * ignores it. Omit to leave the backend its own default.\n * @returns the outcome, including the version the write produced.\n */',
+ description: 'Atomically create or replace UTF-8 text. `expected` guards intent and staleness; omission allows unconditional overwrite.',
+ parameters: [{ name: 'target', description: 'the resolved target to write.' }, { name: 'content', description: 'the full new file content.' }, { name: 'expected', description: 'the write intent guarding the write; omit for unconditional.' }, { name: 'signal', description: 'aborts before atomic publication takes effect.' }, { name: 'sandboxPolicy', description: 'the per-call mode and workspace root this write runs under; a sandboxing backend fences the write by it, the bare backend ignores it. Omit to leave the backend its own default.' }],
+ returns: 'the outcome, including the version the write produced.',
},
{
signature: 'abstract editText( target: FsTarget, edit: FsEditRequest, expected?: { version: FsVersion }, signal?: AbortSignal, sandboxPolicy?: SandboxExecutionPolicy, ): Promise',
- jsDoc: '/**\n * Atomically edit literal text. When supplied, the version guard is checked\n * before matching so stale content reports `FS_STALE_VERSION`; omission edits\n * the current content without a freshness precondition.\n * @param target - the resolved target to edit.\n * @param edit - the literal search/replace request.\n * @param expected - the version guard; omit for an unconditional edit.\n * @param signal - aborts before atomic publication takes effect.\n * @param sandboxPolicy - the per-call mode and workspace root this edit runs\n * under; a sandboxing backend fences the edit by it, the bare backend\n * ignores it. Omit to leave the backend its own default.\n * @returns the outcome, including the version the edit produced.\n */',
+ description: 'Atomically edit literal text. When supplied, the version guard is checked before matching so stale content reports `FS_STALE_VERSION`; omission edits the current content without a freshness precondition.',
+ parameters: [{ name: 'target', description: 'the resolved target to edit.' }, { name: 'edit', description: 'the literal search/replace request.' }, { name: 'expected', description: 'the version guard; omit for an unconditional edit.' }, { name: 'signal', description: 'aborts before atomic publication takes effect.' }, { name: 'sandboxPolicy', description: 'the per-call mode and workspace root this edit runs under; a sandboxing backend fences the edit by it, the bare backend ignores it. Omit to leave the backend its own default.' }],
+ returns: 'the outcome, including the version the edit produced.',
},
],
},
{
key: 'goals',
summary: 'Goal service (`ctx.goals`) backed exclusively by the owning session log.',
+ description: 'Goal service (`ctx.goals`) backed exclusively by the owning session log.',
methods: [
{
signature: 'get(agent: Agent): GoalView | undefined',
- jsDoc: '/**\n * Read the current goal for one exact live agent.\n * @param agent - owning live agent.\n * @returns a fresh view or `undefined` when no goal is current.\n * @throws {@link GoalError} when the agent is not the registry\'s live instance.\n */',
+ description: 'Read the current goal for one exact live agent.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }],
+ returns: 'a fresh view or `undefined` when no goal is current.',
+ throws: ['{@link GoalError} when the agent is not the registry\'s live instance.'],
},
{
signature: 'disarm(agent: Agent): GoalView | undefined',
- jsDoc: '/**\n * Remove process-local continuation authority without changing durable goal\n * phase or revision. Lifecycle owners use this before unloading a driver;\n * a later human-authorized {@link resume} records the new activation edge.\n * @param agent - owning live agent.\n * @returns a fresh disarmed view, or `undefined` when no goal is current.\n */',
+ description: 'Remove process-local continuation authority without changing durable goal phase or revision. Lifecycle owners use this before unloading a driver; a later human-authorized resume records the new activation edge.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }],
+ returns: 'a fresh disarmed view, or `undefined` when no goal is current.',
},
{
signature: 'create(agent: Agent, request: CreateGoalRequest): GoalView',
- jsDoc: '/**\n * Create and arm a goal. A completed goal may be replaced; every other\n * current phase must be cleared or resumed instead.\n * @param agent - owning live agent.\n * @param request - objective and optional round cap.\n * @returns the created live view.\n */',
+ description: 'Create and arm a goal. A completed goal may be replaced; every other current phase must be cleared or resumed instead.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'request', description: 'objective and optional round cap.' }],
+ returns: 'the created live view.',
},
{
signature: '@Remote(\'edit\') edit(agent: Agent, ref: GoalRef, request: EditGoalRequest): GoalView',
- jsDoc: '/**\n * Edit objective and/or round cap without changing phase.\n * @param agent - owning live agent.\n * @param ref - expected current revision.\n * @param request - at least one replacement field.\n * @returns the edited view.\n */',
+ description: 'Edit objective and/or round cap without changing phase.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'ref', description: 'expected current revision.' }, { name: 'request', description: 'at least one replacement field.' }],
+ returns: 'the edited view.',
},
{
signature: '@Remote(\'pause\') pause(agent: Agent, ref: GoalRef): GoalView',
- jsDoc: '/**\n * Pause an active goal and disarm automatic continuation.\n * @param agent - owning live agent.\n * @param ref - expected current revision.\n * @returns the paused view.\n */',
+ description: 'Pause an active goal and disarm automatic continuation.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'ref', description: 'expected current revision.' }],
+ returns: 'the paused view.',
},
{
signature: '@Remote(\'resume\') resume(agent: Agent, ref: GoalRef): GoalView',
- jsDoc: '/**\n * Resume and arm a stopped goal, or rearm an active goal after a\n * session-start edge, while its round budget still has capacity.\n * @param agent - owning live agent.\n * @param ref - expected current revision.\n * @returns the active view.\n */',
+ description: 'Resume and arm a stopped goal, or rearm an active goal after a session-start edge, while its round budget still has capacity.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'ref', description: 'expected current revision.' }],
+ returns: 'the active view.',
},
{
signature: '@Remote(\'complete\') complete(agent: Agent, ref: GoalRef): GoalView',
- jsDoc: '/**\n * Mark a current non-complete goal complete and disarm it.\n * @param agent - owning live agent.\n * @param ref - expected current revision.\n * @returns the completed view.\n */',
+ description: 'Mark a current non-complete goal complete and disarm it.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'ref', description: 'expected current revision.' }],
+ returns: 'the completed view.',
},
{
signature: 'block(agent: Agent, ref: GoalRef, reason: GoalBlockReason): GoalView',
- jsDoc: '/**\n * Mark an active goal blocked and disarm it.\n * @param agent - owning live agent.\n * @param ref - expected current revision.\n * @param reason - policy-owned stable code and human-readable explanation.\n * @returns the blocked view with its durable reason.\n */',
+ description: 'Mark an active goal blocked and disarm it.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'ref', description: 'expected current revision.' }, { name: 'reason', description: 'policy-owned stable code and human-readable explanation.' }],
+ returns: 'the blocked view with its durable reason.',
},
{
signature: '@Remote(\'clear\') clear(agent: Agent, ref: GoalRef): GoalRef',
- jsDoc: '/**\n * Clear the current goal while retaining a durable tombstone and history.\n * @param agent - owning live agent.\n * @param ref - expected current revision.\n * @returns the tombstone ref whose revision is one past the cleared snapshot.\n */',
+ description: 'Clear the current goal while retaining a durable tombstone and history.',
+ parameters: [{ name: 'agent', description: 'owning live agent.' }, { name: 'ref', description: 'expected current revision.' }],
+ returns: 'the tombstone ref whose revision is one past the cleared snapshot.',
},
{
signature: '@Remote(\'create\') remoteExportCreate(agent: Agent, request: CreateGoalRequest): CreateGoalResult',
- jsDoc: '/**\n * Create one Goal through the remote boundary.\n * @param agent - exact live Agent resolved from the wire identity.\n * @param request - objective and optional round cap.\n * @returns the created Goal identity.\n */',
+ description: 'Create one Goal through the remote boundary.',
+ parameters: [{ name: 'agent', description: 'exact live Agent resolved from the wire identity.' }, { name: 'request', description: 'objective and optional round cap.' }],
+ returns: 'the created Goal identity.',
},
],
},
{
key: 'invariants',
summary: 'Package-owned invariant registry with global and regex-based selection.',
+ description: 'Package-owned invariant registry with global and regex-based selection.',
methods: [
{
signature: 'register(packageName: string, installer: InvariantInstaller): () => void',
- jsDoc: '/**\n * Register one package\'s invariant installer. The package name is reserved\n * even when filtering disables its checks. Enabled installers run in a child\n * fiber; failure disposes that fiber and releases the reservation.\n * @param packageName - full npm package name that owns the contribution.\n * @param installer - listener or startup-check installer for the child context.\n * @returns an effect-scoped disposer for the registration.\n */',
+ description: 'Register one package\'s invariant installer. The package name is reserved even when filtering disables its checks. Enabled installers run in a child fiber; failure disposes that fiber and releases the reservation.',
+ parameters: [{ name: 'packageName', description: 'full npm package name that owns the contribution.' }, { name: 'installer', description: 'listener or startup-check installer for the child context.' }],
+ returns: 'an effect-scoped disposer for the registration.',
},
],
},
{
key: 'jobs',
summary: 'Abstract background job registry.',
+ description: 'Abstract background job registry. Subclass, implement the abstract methods, and load the subclass as a plugin — it registers as `ctx.jobs` (one implementation per context; loading a second throws, which is cordis\' standard duplicate-service behavior).\n\nImplementations must honor these semantics:\n\n- Registrations outlive producer and controller fibers. Owner and service disposal cancel live work and await compliant producers; a throwing teardown cancel force-fails only the record. Teardown cancellation also marks the record reported, because a record its owner is being destroyed for has no reader left.\n- Owned-job access is fenced by the owner\'s session id. Ids are predictable, so authorization — not secrecy — is the boundary.\n- Settlement is first-wins: one terminal record, released waiters, and one round of contained listener notification, even against a late producer outcome. Completion is announced last, after the record is committed and every other observer of the settlement has seen it, because a reporter may open a model turn synchronously.\n- start refuses work while no attached job controller serves the spec\'s owner, so a producer cannot start work that owner cannot collect or stop. One registry serves every composition in the process, so this question — and completion-listener delivery — is owner-relative rather than process-wide: registrations made from an unscoped context serve every owner, and registrations made under an agent composition\'s scope serve exactly the agents composed under it.',
methods: [
{
signature: 'abstract start(spec: JobStart): JobId',
- jsDoc: '/**\n * Preflight access, validation, owner cleanup, and implementation-owned\n * admission before starting and atomically registering work. Any preflight\n * rejection leaves no job id or execution resource. A throwing starter\n * leaves nothing registered; after it returns, registration cannot fail.\n * Settlement records the outcome, notifies listeners, and releases waiters.\n * @param spec - job identity, owner, and synchronous starter.\n * @returns the registry-issued `-N` id.\n */',
+ description: 'Preflight access, validation, owner cleanup, and implementation-owned admission before starting and atomically registering work. Any preflight rejection leaves no job id or execution resource. A throwing starter leaves nothing registered; after it returns, registration cannot fail. Settlement records the outcome, notifies listeners, and releases waiters.',
+ parameters: [{ name: 'spec', description: 'job identity, owner, and synchronous starter.' }],
+ returns: 'the registry-issued `-N` id.',
},
{
signature: 'abstract list(caller?: Agent): JobSnapshot[]',
- jsDoc: '/**\n * List caller-owned and unowned jobs in registration order without exposing\n * another session\'s labels.\n * @param caller - reading agent; a non-agent caller sees only unowned jobs.\n * @returns fresh snapshots.\n */',
+ description: 'List caller-owned and unowned jobs in registration order without exposing another session\'s labels.',
+ parameters: [{ name: 'caller', description: 'reading agent; a non-agent caller sees only unowned jobs.' }],
+ returns: 'fresh snapshots.',
},
{
signature: 'abstract get(id: JobId, caller?: Agent): JobSnapshot',
- jsDoc: '/**\n * Return a non-consuming snapshot without changing its read cursor or notice\n * state. Throws for an unknown or foreign job.\n * @param id - job to look up.\n * @param caller - reading agent checked against the owner.\n * @returns a fresh snapshot.\n */',
+ description: 'Return a non-consuming snapshot without changing its read cursor or notice state. Throws for an unknown or foreign job.',
+ parameters: [{ name: 'id', description: 'job to look up.' }, { name: 'caller', description: 'reading agent checked against the owner.' }],
+ returns: 'a fresh snapshot.',
},
{
signature: 'abstract read(id: JobId, caller?: Agent): JobRead',
- jsDoc: '/**\n * Read the next stream delta, or the idempotent final output after settlement.\n * A terminal read marks the job reported. Throws for an unknown or foreign\n * job.\n * @param id - job to read.\n * @param caller - reading agent checked against the owner.\n * @returns output text and the post-read snapshot.\n */',
+ description: 'Read the next stream delta, or the idempotent final output after settlement. A terminal read marks the job reported. Throws for an unknown or foreign job.',
+ parameters: [{ name: 'id', description: 'job to read.' }, { name: 'caller', description: 'reading agent checked against the owner.' }],
+ returns: 'output text and the post-read snapshot.',
},
{
signature: 'abstract kill(id: JobId, caller?: Agent, reason?: string): \'requested\' | \'already-finished\'',
- jsDoc: '/**\n * Request cancellation, then mark the job stopping and reported. A producer\n * throw propagates without changing job state. Throws for an unknown or\n * foreign job.\n * @param id - job to cancel.\n * @param caller - killing agent checked against the owner.\n * @param reason - logged reason forwarded to the producer.\n * @returns `requested` for live work, otherwise `already-finished`.\n */',
+ description: 'Request cancellation, then mark the job stopping and reported. A producer throw propagates without changing job state. Throws for an unknown or foreign job.',
+ parameters: [{ name: 'id', description: 'job to cancel.' }, { name: 'caller', description: 'killing agent checked against the owner.' }, { name: 'reason', description: 'logged reason forwarded to the producer.' }],
+ returns: '`requested` for live work, otherwise `already-finished`.',
},
{
signature: 'abstract wait(id: JobId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Wait for settlement or timeout without cancelling the job. Caller abort\n * rejects only while the job is live; after settlement the terminal\n * snapshot wins so a notice suppressed for this waiter is still delivered.\n * Throws for invalid, unknown, or foreign input.\n * @param id - job to wait for.\n * @param timeoutMs - positive finite wait bound in milliseconds.\n * @param caller - waiting agent checked against the owner.\n * @param signal - optional cancellation of the wait itself.\n * @returns snapshot at settlement or timeout.\n */',
+ description: 'Wait for settlement or timeout without cancelling the job. Caller abort rejects only while the job is live; after settlement the terminal snapshot wins so a notice suppressed for this waiter is still delivered. Throws for invalid, unknown, or foreign input.',
+ parameters: [{ name: 'id', description: 'job to wait for.' }, { name: 'timeoutMs', description: 'positive finite wait bound in milliseconds.' }, { name: 'caller', description: 'waiting agent checked against the owner.' }, { name: 'signal', description: 'optional cancellation of the wait itself.' }],
+ returns: 'snapshot at settlement or timeout.',
},
{
signature: 'abstract onJobDone(listener: JobDoneListener): () => void',
- jsDoc: '/**\n * Register an effect-scoped completion listener. It receives the settlements\n * of the owners its registering context\'s scope covers; each listener is\n * contained; returned promises are observed but not awaited. No listener runs\n * after service disposal.\n * @param listener - receives each terminal snapshot and its exact owner.\n * @returns disposer that unregisters the listener.\n */',
+ description: 'Register an effect-scoped completion listener. It receives the settlements of the owners its registering context\'s scope covers; each listener is contained; returned promises are observed but not awaited. No listener runs after service disposal.',
+ parameters: [{ name: 'listener', description: 'receives each terminal snapshot and its exact owner.' }],
+ returns: 'disposer that unregisters the listener.',
},
{
signature: 'abstract onJobsChanged(listener: JobsChangedListener): () => void',
- jsDoc: '/**\n/**\n * Register an effect-scoped observer of visible-set changes. It fires after\n * every commit that changes what {@link list} returns for that owner —\n * registration, every stopping transition (including the one teardown\n * performs before it awaits a slow producer), settlement, owner-disposal\n * removal, and the emptying that service disposal commits — so an observer\n * re-reads rather than accumulating deltas.\n *\n * Delivery is owner-relative on the same terms as {@link onJobDone}: an\n * observer registered from an unscoped context — a host composition\'s own\n * carrier — sees every owner, while one registered under an agent\n * composition\'s scope sees exactly the agents composed under it.\n *\n * This is not a superset of {@link onJobDone}: that one delivers the terminal\n * record under first-wins semantics a job controller couples to notice\n * delivery, while this one carries no delivery meaning and marks nothing\n * reported. Listeners are contained and never awaited.\n * @param listener - receives the owner whose visible set changed, or\n * `undefined` when an unowned job changed and every caller\'s set did.\n * @returns disposer that unregisters the listener.\n */',
+ description: '/** Register an effect-scoped observer of visible-set changes. It fires after every commit that changes what list returns for that owner — registration, every stopping transition (including the one teardown performs before it awaits a slow producer), settlement, owner-disposal removal, and the emptying that service disposal commits — so an observer re-reads rather than accumulating deltas.\n\nDelivery is owner-relative on the same terms as onJobDone: an observer registered from an unscoped context — a host composition\'s own carrier — sees every owner, while one registered under an agent composition\'s scope sees exactly the agents composed under it.\n\nThis is not a superset of onJobDone: that one delivers the terminal record under first-wins semantics a job controller couples to notice delivery, while this one carries no delivery meaning and marks nothing reported. Listeners are contained and never awaited.',
+ parameters: [{ name: 'listener', description: 'receives the owner whose visible set changed, or `undefined` when an unowned job changed and every caller\'s set did.' }],
+ returns: 'disposer that unregisters the listener.',
},
{
signature: 'abstract attachController(name: string): () => void',
- jsDoc: '/**\n * Attach an effect-scoped controller that can read and stop jobs. It serves the\n * owners its registering context\'s scope covers, and {@link start} refuses an\n * owner no attached controller serves.\n * @param name - diagnostic label; duplicate names remain independent.\n * @returns disposer that detaches this controller.\n */',
+ description: 'Attach an effect-scoped controller that can read and stop jobs. It serves the owners its registering context\'s scope covers, and start refuses an owner no attached controller serves.',
+ parameters: [{ name: 'name', description: 'diagnostic label; duplicate names remain independent.' }],
+ returns: 'disposer that detaches this controller.',
},
],
},
{
key: 'llm',
summary: 'The abstract `llm` service: an adapter registry plus a streaming model-call API, interceptable via the `llm/stream` waterfall.',
+ description: 'The abstract `llm` service: an adapter registry plus a streaming model-call API, interceptable via the `llm/stream` waterfall.',
methods: [
{
signature: 'registerAdapter(providers: string[], adapter: LlmAdapter): AdapterRegistrationHandle',
- jsDoc: '/**\n * Register an adapter for the given provider routes. Throws `LlmError` with code\n * `DUPLICATE_ADAPTER` if any provider already has an adapter (all-or-nothing).\n * Disposed with the fiber.\n * @param providers - every provider route this adapter should serve.\n * @param adapter - the adapter that streams calls for those providers.\n * @returns the disposer, carrying {@link AdapterRegistrationHandle.replace}.\n */',
+ description: 'Register an adapter for the given provider routes. Throws `LlmError` with code `DUPLICATE_ADAPTER` if any provider already has an adapter (all-or-nothing). Disposed with the fiber.',
+ parameters: [{ name: 'providers', description: 'every provider route this adapter should serve.' }, { name: 'adapter', description: 'the adapter that streams calls for those providers.' }],
+ returns: 'the disposer, carrying {@link AdapterRegistrationHandle.replace}.',
},
{
signature: 'listProviders(): LlmProviderInfo[]',
- jsDoc: '/**\n * Describe provider routes with a registered adapter.\n * @returns detached provider metadata in registration order.\n */',
+ description: 'Describe provider routes with a registered adapter.',
+ parameters: [],
+ returns: 'detached provider metadata in registration order.',
},
{
signature: 'registerConfigurableProviders(entries: readonly LlmConfigurableProvider[]): DirectoryRegistrationHandle',
- jsDoc: '/**\n * Declare provider routes an adapter plugin can activate through\n * configuration. Registration is all-or-nothing: an empty list, invalid\n * entry, or a provider already declared by any registration throws\n * `LlmError` without registering the rest. Disposed with the fiber.\n * @param entries - every configurable provider this plugin owns.\n * @returns a handle that withdraws all of them, and can atomically replace them.\n */',
+ description: 'Declare provider routes an adapter plugin can activate through configuration. Registration is all-or-nothing: an empty list, invalid entry, or a provider already declared by any registration throws `LlmError` without registering the rest. Disposed with the fiber.',
+ parameters: [{ name: 'entries', description: 'every configurable provider this plugin owns.' }],
+ returns: 'a handle that withdraws all of them, and can atomically replace them.',
},
{
signature: 'listConfigurableProviders(): LlmConfigurableProvider[]',
- jsDoc: '/**\n * List every declared configurable provider, registered or dormant.\n * @returns detached directory entries in declaration order.\n */',
+ description: 'List every declared configurable provider, registered or dormant.',
+ parameters: [],
+ returns: 'detached directory entries in declaration order.',
},
{
signature: 'registerModelDiscovery( settingsNs: string, discover: (request: LlmModelDiscoveryRequest) => Promise, ): () => void',
- jsDoc: '/**\n * Offer to interrogate provider endpoints on behalf of the settings\n * namespace this plugin owns. The namespace is the key because that is what\n * a configuration surface already holds from the configurable-provider\n * directory, and because a provider being *added* has no route to name yet.\n * Disposed with the fiber.\n * @param settingsNs - the namespace whose profiles this discovery serves.\n * @param discover - interrogates one endpoint; must honor `request.signal`.\n * @returns the disposer that withdraws the offer.\n */',
+ description: 'Offer to interrogate provider endpoints on behalf of the settings namespace this plugin owns. The namespace is the key because that is what a configuration surface already holds from the configurable-provider directory, and because a provider being *added* has no route to name yet. Disposed with the fiber.',
+ parameters: [{ name: 'settingsNs', description: 'the namespace whose profiles this discovery serves.' }, { name: 'discover', description: 'interrogates one endpoint; must honor `request.signal`.' }],
+ returns: 'the disposer that withdraws the offer.',
},
{
signature: 'async discoverModels( settingsNs: string, request: LlmModelDiscoveryRequest, ): Promise',
- jsDoc: '/**\n * Interrogate one provider endpoint for the models it advertises. The\n * request describes a draft, not a stored route, so nothing here reads or\n * writes settings or credentials — the caller owns both, and the reply is\n * candidate metadata a surface may offer for adoption.\n * @param settingsNs - namespace whose registered discovery serves this draft.\n * @param request - the endpoint, protocol, and one-shot credential to use.\n * @returns the advertised models, deduplicated in endpoint order.\n */',
+ description: 'Interrogate one provider endpoint for the models it advertises. The request describes a draft, not a stored route, so nothing here reads or writes settings or credentials — the caller owns both, and the reply is candidate metadata a surface may offer for adoption.',
+ parameters: [{ name: 'settingsNs', description: 'namespace whose registered discovery serves this draft.' }, { name: 'request', description: 'the endpoint, protocol, and one-shot credential to use.' }],
+ returns: 'the advertised models, deduplicated in endpoint order.',
},
{
signature: 'providerRetryPolicy(provider: string): ResolvedRetryPolicy',
- jsDoc: '/**\n * Resolve the retry policy captured when one provider route was registered.\n * @param provider - registered provider route to inspect.\n * @returns the provider-owned policy, with normal defaults already resolved.\n */',
+ description: 'Resolve the retry policy captured when one provider route was registered.',
+ parameters: [{ name: 'provider', description: 'registered provider route to inspect.' }],
+ returns: 'the provider-owned policy, with normal defaults already resolved.',
},
{
signature: 'async listModels(provider: string): Promise',
- jsDoc: '/**\n * Discover models advertised by one registered provider. Catalog membership\n * is advisory and never changes routing or request validation.\n * @param provider - registered provider route to inspect.\n * @returns detached model metadata in adapter-preferred order.\n */',
+ description: 'Discover models advertised by one registered provider. Catalog membership is advisory and never changes routing or request validation.',
+ parameters: [{ name: 'provider', description: 'registered provider route to inspect.' }],
+ returns: 'detached model metadata in adapter-preferred order.',
},
{
signature: 'async resolveModelInfo( provider: string, model: string, signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Resolve and validate all metadata from the adapter that owns one exact\n * route. The result is detached from adapter-owned objects; catalog\n * membership remains advisory and does not control request routing.\n * @param provider - registered provider route to inspect.\n * @param model - exact model id passed to the adapter.\n * @param signal - optional cancellation for adapter-owned asynchronous lookup.\n * @returns exact model identity plus available context and reasoning metadata.\n */',
+ description: 'Resolve and validate all metadata from the adapter that owns one exact route. The result is detached from adapter-owned objects; catalog membership remains advisory and does not control request routing.',
+ parameters: [{ name: 'provider', description: 'registered provider route to inspect.' }, { name: 'model', description: 'exact model id passed to the adapter.' }, { name: 'signal', description: 'optional cancellation for adapter-owned asynchronous lookup.' }],
+ returns: 'exact model identity plus available context and reasoning metadata.',
},
{
signature: 'async resolveCallConfig(config: LlmCallConfig, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Validate a conversation call config against its exact model capability and\n * materialize adapter-configured defaults. Unsupported explicit efforts\n * reject before provider I/O; no clamping or aliasing is performed. This\n * standalone query does not bind a later dispatch; use {@link prepareCall}\n * when logging and streaming must share one adapter registration.\n * @param config - provider/model route and optional request controls.\n * @param signal - optional cancellation for adapter-owned capability lookup.\n * @returns a detached config only when a default must be materialized.\n */',
+ description: 'Validate a conversation call config against its exact model capability and materialize adapter-configured defaults. Unsupported explicit efforts reject before provider I/O; no clamping or aliasing is performed. This standalone query does not bind a later dispatch; use prepareCall when logging and streaming must share one adapter registration.',
+ parameters: [{ name: 'config', description: 'provider/model route and optional request controls.' }, { name: 'signal', description: 'optional cancellation for adapter-owned capability lookup.' }],
+ returns: 'a detached config only when a default must be materialized.',
},
{
signature: 'async prepareCall(config: LlmCallConfig, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Resolve one call under its current adapter registration. The returned\n * one-shot handle keeps that registration across header logging and dispatch,\n * so HMR cannot combine one adapter\'s capability result with another adapter.\n * @param config - provider/model route and optional request controls.\n * @param signal - optional cancellation for adapter-owned capability lookup.\n * @returns a prepared config and its registration-bound stream entry point.\n */',
+ description: 'Resolve one call under its current adapter registration. The returned one-shot handle keeps that registration across header logging and dispatch, so HMR cannot combine one adapter\'s capability result with another adapter.',
+ parameters: [{ name: 'config', description: 'provider/model route and optional request controls.' }, { name: 'signal', description: 'optional cancellation for adapter-owned capability lookup.' }],
+ returns: 'a prepared config and its registration-bound stream entry point.',
},
{
signature: 'stream(options: GenerateOptions): AsyncIterable',
- jsDoc: '/**\n * Stream one model call as raw chunks (token-level deltas). Replay state is\n * retained only when the same adapter instance owns its historical provider\n * and the target provider. Final adapter selection remains fixed through\n * asynchronous exact-model resolution and dispatch. Adapter selection,\n * dispatch, and iteration failures become terminal `error` or `aborted`\n * finish chunks; middleware, nested-call, cleanup, and consumer failures\n * remain thrown.\n * @param options - the full request; `options.provider` selects the adapter.\n * @returns the chunk stream, possibly wrapped by `llm/stream` listeners.\n */',
+ description: 'Stream one model call as raw chunks (token-level deltas). Replay state is retained only when the same adapter instance owns its historical provider and the target provider. Final adapter selection remains fixed through asynchronous exact-model resolution and dispatch. Adapter selection, dispatch, and iteration failures become terminal `error` or `aborted` finish chunks; middleware, nested-call, cleanup, and consumer failures remain thrown.',
+ parameters: [{ name: 'options', description: 'the full request; `options.provider` selects the adapter.' }],
+ returns: 'the chunk stream, possibly wrapped by `llm/stream` listeners.',
+ },
+ ],
+ },
+ {
+ key: 'lsp',
+ summary: 'The LSP capability seam (`ctx.lsp`).',
+ description: 'The LSP capability seam (`ctx.lsp`). Owns provider registration/selection and normalized query execution; exposes exactly the four operations and no protocol escape hatch.',
+ methods: [
+ {
+ signature: 'registerProvider(provider: LspProvider): () => void',
+ description: 'Register a provider, atomically reserving its id and every normalized extension. Any conflict or invalid input publishes nothing and throws `LspError`; the returned disposer releases all reservations. Disposed with the calling fiber.',
+ parameters: [{ name: 'provider', description: 'the backend to register.' }],
+ returns: 'a synchronous disposer releasing the id and all extension reservations.',
+ },
+ {
+ signature: 'query(request: LspQueryRequest, signal?: AbortSignal): Promise',
+ description: 'Select a provider by the file\'s extension and run one query. Selection is per-query and order-independent; no match throws `LspError` `LSP_UNAVAILABLE`.',
+ parameters: [{ name: 'request', description: 'the normalized query.' }, { name: 'signal', description: 'optional cancellation forwarded to the selected provider.' }],
+ returns: 'the normalized, closed-union result.',
},
],
},
{
key: 'messageFeedback',
summary: 'Storage-domain sidecar service.',
+ description: 'Storage-domain sidecar service. It inspects persisted Session history and never creates or resumes an Agent or Session.',
methods: [
{
signature: '@Remote(\'list\') async list(request: MessageFeedbackListRequest): Promise',
- jsDoc: '/**\n * Read feedback belonging to the current persisted Session lifecycle.\n * A stale row from a reused Session id is invisible.\n * @param request - Session identity to inspect and list.\n * @returns current immutable items or `session-not-found`.\n */',
+ description: 'Read feedback belonging to the current persisted Session lifecycle. A stale row from a reused Session id is invisible.',
+ parameters: [{ name: 'request', description: 'Session identity to inspect and list.' }],
+ returns: 'current immutable items or `session-not-found`.',
},
{
signature: '@Remote(\'put\') put(request: MessageFeedbackPutRequest): Promise',
- jsDoc: '/**\n * Create or replace feedback for one derived append-origin assistant\n * message. Every request must match the addressed item\'s current version;\n * a matching no-op returns the stored item without changing its revision.\n * @param request - target, desired value, and observed item version.\n * @returns the committed item or an explicit business failure.\n */',
+ description: 'Create or replace feedback for one derived append-origin assistant message. Every request must match the addressed item\'s current version; a matching no-op returns the stored item without changing its revision.',
+ parameters: [{ name: 'request', description: 'target, desired value, and observed item version.' }],
+ returns: 'the committed item or an explicit business failure.',
},
{
signature: '@Remote(\'delete\') delete(request: MessageFeedbackDeleteRequest): Promise',
- jsDoc: '/**\n * Delete one feedback item. Absence is successful regardless of the\n * supplied version; an existing item requires an exact version match.\n * @param request - Session, message, and observed item version.\n * @returns the stable absent postcondition, or an explicit failure.\n */',
+ description: 'Delete one feedback item. Absence is successful regardless of the supplied version; an existing item requires an exact version match.',
+ parameters: [{ name: 'request', description: 'Session, message, and observed item version.' }],
+ returns: 'the stable absent postcondition, or an explicit failure.',
},
],
},
{
key: 'permissionPresets',
summary: 'Owns the deployment\'s permission presets and their write path.',
+ description: 'Owns the deployment\'s permission presets and their write path. Requires a confining `ctx.shell` executor and `ctx.approval`; unmatched knob values are reported as CUSTOM_PRESET, not an error.',
methods: [
{
signature: 'current(events: readonly SessionEvent[]): string',
- jsDoc: '/**\n * Resolve the preset matching the effective knob values. A still-matching\n * last selection wins shared-bundle ties; otherwise the first table match\n * wins, or {@link CUSTOM_PRESET} when no entry matches.\n * @param events - the session\'s events in log order.\n * @returns the effective preset name, or `custom` when nothing matches.\n */',
+ description: 'Resolve the preset matching the effective knob values. A still-matching last selection wins shared-bundle ties; otherwise the first table match wins, or CUSTOM_PRESET when no entry matches.',
+ parameters: [{ name: 'events', description: 'the session\'s events in log order.' }],
+ returns: 'the effective preset name, or `custom` when nothing matches.',
},
{
signature: 'selectFor(state: KnobState): PermissionSelect',
- jsDoc: '/**\n * Build the whole select value for one folded knob state: every table\n * option in declaration order, `custom` appended exactly while derived.\n * @param state - the folded knob overrides.\n * @returns the `permissions` projection payload.\n */',
+ description: 'Build the whole select value for one folded knob state: every table option in declaration order, `custom` appended exactly while derived.',
+ parameters: [{ name: 'state', description: 'the folded knob overrides.' }],
+ returns: 'the `permissions` projection payload.',
},
{
signature: 'resolve(name: string): PresetSpec',
- jsDoc: '/**\n * Resolve a preset\'s knob bundle.\n * @param name - the preset name to resolve.\n * @returns the configured bundle.\n * @throws when `name` is not in the table.\n */',
+ description: 'Resolve a preset\'s knob bundle.',
+ parameters: [{ name: 'name', description: 'the preset name to resolve.' }],
+ returns: 'the configured bundle.',
+ throws: ['when `name` is not in the table.'],
},
{
signature: 'optionOf(name: string): PresetOption',
- jsDoc: '/**\n * Build the client option for a table entry or {@link CUSTOM_PRESET}. A\n * missing label falls back to the table key.\n * @param name - a table key, or `custom`.\n * @returns the option a client renders.\n * @throws when `name` is neither a table key nor `custom`.\n */',
+ description: 'Build the client option for a table entry or CUSTOM_PRESET. A missing label falls back to the table key.',
+ parameters: [{ name: 'name', description: 'a table key, or `custom`.' }],
+ returns: 'the option a client renders.',
+ throws: ['when `name` is neither a table key nor `custom`.'],
},
{
signature: 'set(session: Session, name: string): void',
- jsDoc: '/**\n * Record a changed preset, then update each changed knob through its own\n * setter. Selecting the effective preset again appends nothing.\n * @param session - the session the switch belongs to.\n * @param name - the preset to switch to; unknown names throw.\n */',
+ description: 'Record a changed preset, then update each changed knob through its own setter. Selecting the effective preset again appends nothing.',
+ parameters: [{ name: 'session', description: 'the session the switch belongs to.' }, { name: 'name', description: 'the preset to switch to; unknown names throw.' }],
},
],
},
{
key: 'planMode',
summary: '`ctx.planMode`: owns logged plan state, applies and narrates selected state at step start, the `plan:policy` section, the `/plan` command, and the stable exit tool.',
+ description: '`ctx.planMode`: owns logged plan state, applies and narrates selected state at step start, the `plan:policy` section, the `/plan` command, and the stable exit tool. UIs observe committed flips through `session/event`; there is no live mirror.',
methods: [
{
signature: 'get(agent: Agent): { active: boolean; pending?: boolean }',
- jsDoc: '/**\n * Read the logged plan state and any selected state awaiting the next\n * accepted in-turn pre-step.\n *\n * @param agent The agent to read.\n * @returns Current logged state plus a pending selection, when present.\n */',
+ description: 'Read the logged plan state and any selected state awaiting the next accepted in-turn pre-step.',
+ parameters: [{ name: 'agent', description: 'The agent to read.' }],
+ returns: 'Current logged state plus a pending selection, when present.',
},
{
signature: 'set(agent: Agent, active: boolean): \'committed\' | \'queued\' | \'cancelled\' | \'noop\'',
- jsDoc: '/**\n * Select whether plan mode should be active. Between turns the method\n * appends the change immediately because no in-turn pre-step will run until\n * another prompt starts a turn. The open-turn fold is the idle signal:\n * agent status stays `running` through post-turn checkpointing, when no\n * further in-turn pre-step runs. During an open turn the selection remains\n * pending until the next accepted in-turn pre-step. Repeated selection of\n * the current or already-pending state is a no-op.\n *\n * @param agent The agent to switch.\n * @param active Whether plan mode should be active.\n * @returns what happened: `committed` (logged now), `queued` (awaiting the\n * next accepted in-turn pre-step), `cancelled` (an opposite pending selection\n * was cleared; the logged state already matches), or `noop` (already in that\n * state).\n */',
+ description: 'Select whether plan mode should be active. Between turns the method appends the change immediately because no in-turn pre-step will run until another prompt starts a turn. The open-turn fold is the idle signal: agent status stays `running` through post-turn checkpointing, when no further in-turn pre-step runs. During an open turn the selection remains pending until the next accepted in-turn pre-step. Repeated selection of the current or already-pending state is a no-op.',
+ parameters: [{ name: 'agent', description: 'The agent to switch.' }, { name: 'active', description: 'Whether plan mode should be active.' }],
+ returns: 'what happened: `committed` (logged now), `queued` (awaiting the next accepted in-turn pre-step), `cancelled` (an opposite pending selection was cleared; the logged state already matches), or `noop` (already in that state).',
},
],
},
{
key: 'sandbox',
summary: 'Abstract process-sandbox service.',
+ description: 'Abstract process-sandbox service. confine must return enforcing argv or fail closed at wrap or runner-execution time; silent unconfined passthrough is forbidden. Functional probes arbitrate multi-runner chains and may be skipped for a sole candidate, whose own refusal remains the fail-closed end.',
methods: [
{
signature: 'abstract confine(argv: readonly string[], policy: SandboxPolicy): ConfinedArgv',
- jsDoc: '/**\n * Wrap `argv` so it executes confined under `policy` on this host; the\n * caller spawns the returned argv in place of its own.\n * @param argv - the exact argv the caller is about to spawn (program plus\n * arguments), NOT a shell string — a shell-shaped consumer passes\n * `[\'bash\', \'-c\', command]`.\n * @param policy - the file-effect policy this execution runs under,\n * carried per call (see {@link SandboxPolicy}).\n * @returns the argv to spawn instead, plus the enforcement completeness\n * the selected backend achieves for it.\n */',
+ description: 'Wrap `argv` so it executes confined under `policy` on this host; the caller spawns the returned argv in place of its own.',
+ parameters: [{ name: 'argv', description: 'the exact argv the caller is about to spawn (program plus arguments), NOT a shell string — a shell-shaped consumer passes `[\'bash\', \'-c\', command]`.' }, { name: 'policy', description: 'the file-effect policy this execution runs under, carried per call (see {@link SandboxPolicy}).' }],
+ returns: 'the argv to spawn instead, plus the enforcement completeness the selected backend achieves for it.',
},
],
},
{
key: 'sandboxPolicy',
summary: 'The sandbox-policy service (`ctx.sandboxPolicy`).',
+ description: 'The sandbox-policy service (`ctx.sandboxPolicy`). Owns the deployment default mode, fallback workspace root, and current request-time policy section. Tool layers call resolve for each execution so a session\'s mode log and immutable cwd travel together to every enforcing capability.',
methods: [
+ {
+ signature: 'readonly defaultMode: SandboxMode',
+ description: 'The deployment default mode — the fallback beneath a session override.',
+ parameters: [],
+ },
+ {
+ signature: 'readonly workspaceRoot: string',
+ description: 'The absolute `workspace-write` fallback root for calls without a session cwd.',
+ parameters: [],
+ },
{
signature: 'resolve(request: SandboxPolicyRequest = {}): SandboxExecutionPolicy',
- jsDoc: '/**\n * Resolve the complete policy for one capability call. An approved explicit\n * mode outranks the session\'s last `sandbox/mode` event, which outranks the\n * deployment default. A session cwd is its workspace-write boundary; the\n * configured root is the fallback for agentless calls and sessions without a\n * cwd.\n * @param request - optional session and approved mode override.\n * @returns the fully resolved per-call mode and absolute workspace root.\n */',
+ description: 'Resolve the complete policy for one capability call. An approved explicit mode outranks the session\'s last `sandbox/mode` event, which outranks the deployment default. A session cwd is its workspace-write boundary; the configured root is the fallback for agentless calls and sessions without a cwd.',
+ parameters: [{ name: 'request', description: 'optional session and approved mode override.' }],
+ returns: 'the fully resolved per-call mode and absolute workspace root.',
},
{
signature: 'overrideOf(session: Session): SandboxMode | undefined',
- jsDoc: '/**\n * Read the session override without applying the deployment default.\n * @param session - session whose log supplies the override.\n * @returns the last logged mode, or `undefined` without one.\n */',
+ description: 'Read the session override without applying the deployment default.',
+ parameters: [{ name: 'session', description: 'session whose log supplies the override.' }],
+ returns: 'the last logged mode, or `undefined` without one.',
},
],
},
{
key: 'sessionPersistence',
summary: 'Durable append-only session storage.',
+ description: 'Durable append-only session storage. Implementations preserve contiguous, losslessly JSON-serializable events; append resolves only after durability, and load balances a complete interrupted tail without rewriting committed events.',
methods: [
{
signature: 'abstract locate(meta: SessionHeader): SessionLocation | undefined',
- jsDoc: '/**\n * Resolve this backend\'s independent local artifact for a session without\n * reading, creating, flushing, or otherwise materializing it. Backends such\n * as SQLite that do not own one artifact per session return `undefined`.\n * @param meta - the immutable session header whose artifact is requested.\n * @returns the backend-specific absolute location, when one exists.\n */',
+ description: 'Resolve this backend\'s independent local artifact for a session without reading, creating, flushing, or otherwise materializing it. Backends such as SQLite that do not own one artifact per session return `undefined`.',
+ parameters: [{ name: 'meta', description: 'the immutable session header whose artifact is requested.' }],
+ returns: 'the backend-specific absolute location, when one exists.',
+ },
+ {
+ signature: 'abstract readonly supportsRawArtifacts: boolean',
+ description: 'Whether this backend exposes one verbatim raw artifact per session. A backend that declares `true` must override readRaw.',
+ parameters: [],
},
{
signature: 'readRaw(_id: SessionId, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Read a session\'s backend-owned artifact text verbatim — the exact durable\n * bytes the backend wrote (decoded from its physical encoding, e.g. a\n * decompressed JSONL). The returned `content` is the raw text, not a\n * reconstruction from parsed events, so it preserves backend-specific\n * serialization (chunk packing, key order, line breaks). Callers first test\n * {@link supportsRawArtifacts}; `undefined` then means only that the requested\n * session has no materialized artifact.\n * @param _id - the persisted session to read (unused by the default: no\n * per-session artifact).\n * @param signal - optional cancellation for backend read work.\n * @returns the raw artifact plus its parsed header, or `undefined` when the\n * session is absent.\n * @throws when this backend does not expose per-session raw artifacts.\n */',
+ description: 'Read a session\'s backend-owned artifact text verbatim — the exact durable bytes the backend wrote (decoded from its physical encoding, e.g. a decompressed JSONL). The returned `content` is the raw text, not a reconstruction from parsed events, so it preserves backend-specific serialization (chunk packing, key order, line breaks). Callers first test supportsRawArtifacts; `undefined` then means only that the requested session has no materialized artifact.',
+ parameters: [{ name: '_id', description: 'the persisted session to read (unused by the default: no per-session artifact).' }, { name: 'signal', description: 'optional cancellation for backend read work.' }],
+ returns: 'the raw artifact plus its parsed header, or `undefined` when the session is absent.',
+ throws: ['when this backend does not expose per-session raw artifacts.'],
},
{
signature: 'abstract create(meta: SessionHeader): Promise',
- jsDoc: '/**\n * Register a new session\'s metadata. A backend MAY defer the physical write\n * until the first {@link append} (lazy materialization), in which case a\n * created-but-never-appended session is absent from {@link list}\n * — abandoned sessions leave nothing behind.\n * @param meta - the immutable header (id, version, cwd, lineage) to record.\n */',
+ description: 'Register a new session\'s metadata. A backend MAY defer the physical write until the first append (lazy materialization), in which case a created-but-never-appended session is absent from list — abandoned sessions leave nothing behind.',
+ parameters: [{ name: 'meta', description: 'the immutable header (id, version, cwd, lineage) to record.' }],
},
{
signature: 'abstract append(id: SessionId, events: readonly SessionEvent[]): Promise',
- jsDoc: '/**\n * Durably persist a batch of events. Honors the append-only and contiguous-\n * seq contracts: the first event\'s `seq` MUST equal the stored next-seq\n * (after `load` has durably closed any interrupted turn). Rejects non-JSON-\n * serializable `event.data` with an error naming the offending event type.\n * @param id - the session the batch belongs to.\n * @param events - the contiguous batch to persist, in seq order.\n */',
+ description: 'Durably persist a batch of events. Honors the append-only and contiguous- seq contracts: the first event\'s `seq` MUST equal the stored next-seq (after `load` has durably closed any interrupted turn). Rejects non-JSON- serializable `event.data` with an error naming the offending event type.',
+ parameters: [{ name: 'id', description: 'the session the batch belongs to.' }, { name: 'events', description: 'the contiguous batch to persist, in seq order.' }],
},
{
signature: 'async prepare(id: SessionId, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Prepare the exact unpublished Session used by resume. Implementations may\n * reuse object graphs retained by an earlier {@link inspect} after confirming\n * their durable revision is still current; disposal releases an unpublished\n * reservation. Revision retries require the durable log to remain unchanged\n * for one read/check round trip; continuous external writers may delay completion.\n * @param id - persisted session to prepare.\n * @param signal - optional cancellation for preparation work.\n * @returns one owned unpublished Session preparation.\n */',
+ description: 'Prepare the exact unpublished Session used by resume. Implementations may reuse object graphs retained by an earlier inspect after confirming their durable revision is still current; disposal releases an unpublished reservation. Revision retries require the durable log to remain unchanged for one read/check round trip; continuous external writers may delay completion.',
+ parameters: [{ name: 'id', description: 'persisted session to prepare.' }, { name: 'signal', description: 'optional cancellation for preparation work.' }],
+ returns: 'one owned unpublished Session preparation.',
},
{
signature: 'abstract load(id: SessionId): Promise',
- jsDoc: '/**\n * Load an immutable balanced logical view and commit any required cold\n * recovery. A complete interrupted final turn is preserved and durably\n * closed with missing tool errors plus any open step and turn boundaries;\n * only a torn final record is discarded. Unknown versions and corruption in\n * the committed prefix reject. Implementations MUST NOT crash-repair an\n * identity still bound to a live Session: a balanced live log may return as a\n * durable snapshot, while an open live turn rejects. Returned values may be\n * shared with immutable live or prepared state and must not be mutated.\n * Revision-based implementations may wait for one stable read/check round trip.\n * @param id - the persisted session to reload.\n * @returns the header and a log ending on a balanced `turn/end`.\n */',
+ description: 'Load an immutable balanced logical view and commit any required cold recovery. A complete interrupted final turn is preserved and durably closed with missing tool errors plus any open step and turn boundaries; only a torn final record is discarded. Unknown versions and corruption in the committed prefix reject. Implementations MUST NOT crash-repair an identity still bound to a live Session: a balanced live log may return as a durable snapshot, while an open live turn rejects. Returned values may be shared with immutable live or prepared state and must not be mutated. Revision-based implementations may wait for one stable read/check round trip.',
+ parameters: [{ name: 'id', description: 'the persisted session to reload.' }],
+ returns: 'the header and a log ending on a balanced `turn/end`.',
},
{
signature: 'abstract inspect(id: SessionId, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Inspect an immutable logical session without committing recovery or\n * publishing it. A cold complete interrupted turn receives synthetic closers\n * in memory and a torn physical tail remains untouched. An already-live\n * Session instead yields its current immutable snapshot, which may contain an\n * open turn and its `session/end-seed` boundary. Coordinator-backed\n * implementations retain the exact cold unpublished Session for bounded\n * reuse by a later {@link prepare}. A stale ready source is reloaded; a source\n * already committing or reserved for resume remains exclusive, and inspection\n * may borrow its immutable view. Callers borrow only the immutable header and\n * log. Continuous external writers may delay revision convergence.\n * @param id - the persisted session to inspect.\n * @param signal - optional cancellation for queued and backend read work.\n * @returns the validated header and current logical event log.\n */',
+ description: 'Inspect an immutable logical session without committing recovery or publishing it. A cold complete interrupted turn receives synthetic closers in memory and a torn physical tail remains untouched. An already-live Session instead yields its current immutable snapshot, which may contain an open turn and its `session/end-seed` boundary. Coordinator-backed implementations retain the exact cold unpublished Session for bounded reuse by a later prepare. A stale ready source is reloaded; a source already committing or reserved for resume remains exclusive, and inspection may borrow its immutable view. Callers borrow only the immutable header and log. Continuous external writers may delay revision convergence.',
+ parameters: [{ name: 'id', description: 'the persisted session to inspect.' }, { name: 'signal', description: 'optional cancellation for queued and backend read work.' }],
+ returns: 'the validated header and current logical event log.',
},
{
signature: 'abstract readFrom(id: SessionId, fromSeq: number, signal?: AbortSignal): Promise<{ meta: SessionHeader; events: SessionEvent[] }>',
- jsDoc: '/**\n * Read the stored events from `fromSeq` onward — the read-from-seq\n * primitive for read models that resume from a watermark (e.g. a persisted\n * projection cache folding only the tail past its checkpoint). Unlike\n * {@link inspect}, it is a detached physical suffix read: no preparation\n * cache, torn-tail truncation, synthetic closers, or coordinator-state\n * publication. Only events from the valid contiguous stored prefix are\n * returned, so a torn fragment never reaches the caller. `fromSeq` at or\n * beyond the stored prefix returns an empty event list (never an error).\n * Backends whose medium can seek by seq\n * (SQLite) read only the suffix; sequential media (JSONL, both encodings)\n * still parse the whole artifact and skip forward — the primitive bounds\n * what is RETURNED and refolded, not every backend\'s physical read.\n * @param id - the persisted session to read.\n * @param fromSeq - first event seq to include; a non-negative safe integer.\n * @param signal - optional cancellation for queued and backend read work.\n * @returns the header and the stored events with `seq >= fromSeq`.\n */',
+ description: 'Read the stored events from `fromSeq` onward — the read-from-seq primitive for read models that resume from a watermark (e.g. a persisted projection cache folding only the tail past its checkpoint). Unlike inspect, it is a detached physical suffix read: no preparation cache, torn-tail truncation, synthetic closers, or coordinator-state publication. Only events from the valid contiguous stored prefix are returned, so a torn fragment never reaches the caller. `fromSeq` at or beyond the stored prefix returns an empty event list (never an error). Backends whose medium can seek by seq (SQLite) read only the suffix; sequential media (JSONL, both encodings) still parse the whole artifact and skip forward — the primitive bounds what is RETURNED and refolded, not every backend\'s physical read.',
+ parameters: [{ name: 'id', description: 'the persisted session to read.' }, { name: 'fromSeq', description: 'first event seq to include; a non-negative safe integer.' }, { name: 'signal', description: 'optional cancellation for queued and backend read work.' }],
+ returns: 'the header and the stored events with `seq >= fromSeq`.',
},
{
signature: 'abstract list(signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Lightweight listing from metadata, without a full-log parse.\n * @param signal - optional cancellation for backend listing work.\n * @returns one header per materialized session.\n */',
+ description: 'Lightweight listing from metadata, without a full-log parse.',
+ parameters: [{ name: 'signal', description: 'optional cancellation for backend listing work.' }],
+ returns: 'one header per materialized session.',
},
{
signature: 'abstract listSnapshots(signal?: AbortSignal): Promise',
- jsDoc: '/**\n * List materialized sessions with cheap per-log change tokens.\n *\n * Repeated observations of an unchanged log return the same revision. A\n * successful mutating {@link load} repair changes the next listed revision.\n * Revisions also distinguish independently backed stores so backend-local\n * counters cannot compare equal across different persistence sources.\n * @param signal - optional cancellation for backend snapshot-listing work.\n * @returns one header and opaque revision per materialized session without loading full logs.\n */',
+ description: 'List materialized sessions with cheap per-log change tokens.\n\nRepeated observations of an unchanged log return the same revision. A successful mutating load repair changes the next listed revision. Revisions also distinguish independently backed stores so backend-local counters cannot compare equal across different persistence sources.',
+ parameters: [{ name: 'signal', description: 'optional cancellation for backend snapshot-listing work.' }],
+ returns: 'one header and opaque revision per materialized session without loading full logs.',
},
],
},
{
key: 'sessionProjectionCache',
summary: 'The persisted projection cache service.',
+ description: 'The persisted projection cache service. Opens the `session_projcache` domain at init, checkpoints live sessions on a throttled write-behind (count/interval triggers from Config) plus two mandatory points — `turn/end` and session disposal (the live-to-cold moment) — and serves the cold-read ladder: cached row, persistence `readFrom` tail, registry `restore`, durable write-back. Every durable write is fail-soft: failures log a warning and the cache self-heals on the next write or cold read.',
methods: [
{
signature: 'cachedSnapshot(meta: SessionHeader): ProjectionSnapshot | undefined',
- jsDoc: '/**\n * The zero-I/O listing read: whole values viewed straight from the stored\n * rows (version-matching keys only), each cut carried with its watermark\n * so a client value store can seed under its higher-seq-wins rule — as\n * stale as the last durable checkpoint but never wrong, and never from an\n * unrelated log (the caller\'s header is the identity witness). Fresher\n * paths (the history tail baseline, {@link coldSnapshot}) supersede these\n * values whenever a session is actually opened.\n * @param meta - the listed session\'s header (identity witness; no log read).\n * @returns the cut (`asOfSeq` = lowest served-row watermark), or\n * `undefined` when no usable row exists for this lifecycle.\n */',
+ description: 'The zero-I/O listing read: whole values viewed straight from the stored rows (version-matching keys only), each cut carried with its watermark so a client value store can seed under its higher-seq-wins rule — as stale as the last durable checkpoint but never wrong, and never from an unrelated log (the caller\'s header is the identity witness). Fresher paths (the history tail baseline, coldSnapshot) supersede these values whenever a session is actually opened.',
+ parameters: [{ name: 'meta', description: 'the listed session\'s header (identity witness; no log read).' }],
+ returns: 'the cut (`asOfSeq` = lowest served-row watermark), or `undefined` when no usable row exists for this lifecycle.',
},
{
signature: 'async write(session: Session): Promise',
- jsDoc: '/**\n * Durably checkpoint one live session NOW (both mandatory points call\n * this; tests and carriers may too). The registry cut is snapshotted at\n * this boundary (states are live references), then the whole record is\n * replaced. NOT fail-soft — callers on the fail-soft paths contain it.\n * @param session - the live session to checkpoint.\n * @returns resolution after durability and event emission.\n */',
+ description: 'Durably checkpoint one live session NOW (both mandatory points call this; tests and carriers may too). The registry cut is snapshotted at this boundary (states are live references), then the whole record is replaced. NOT fail-soft — callers on the fail-soft paths contain it.',
+ parameters: [{ name: 'session', description: 'the live session to checkpoint.' }],
+ returns: 'resolution after durability and event emission.',
},
{
signature: 'async coldSnapshot(id: SessionId, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Cold-read one persisted session\'s projections with zero full-log load:\n * cached rows + a persistence `readFrom` tail from the registry\'s restore\n * floor, refolded by the registry and written back (fail-soft) so the next\n * cold read starts closer. A cache row invalidated by a shrunk log\n * (crash-repair truncation) triggers one full re-read from seq 0 — the\n * ladder\'s slow rung, still no crash. Rejects when the session has no\n * persisted log (`not found` from the persistence seam).\n * @param id - the persisted session to read.\n * @param signal - optional cancellation for the persistence reads.\n * @returns the snapshot cut at the stored log end.\n */',
+ description: 'Cold-read one persisted session\'s projections with zero full-log load: cached rows + a persistence `readFrom` tail from the registry\'s restore floor, refolded by the registry and written back (fail-soft) so the next cold read starts closer. A cache row invalidated by a shrunk log (crash-repair truncation) triggers one full re-read from seq 0 — the ladder\'s slow rung, still no crash. Rejects when the session has no persisted log (`not found` from the persistence seam).',
+ parameters: [{ name: 'id', description: 'the persisted session to read.' }, { name: 'signal', description: 'optional cancellation for the persistence reads.' }],
+ returns: 'the snapshot cut at the stored log end.',
},
],
},
{
key: 'sessionProjections',
summary: '`ctx.sessionProjections`: the projection unit table and its drive.',
+ description: '`ctx.sessionProjections`: the projection unit table and its drive. The service subscribes to `session/event` once; every committed event passes every registered unit\'s `apply` (eager drive), and a changed state reference notifies the change feed with the schema-validated view. Cells build lazily — a unit registered after events flowed, or a session older than the registry, folds `init` over the in-memory log on first touch (event or read). Registration is an effect (disposer rides the calling fiber): an unloaded domain plugin\'s key disappears from snapshots and clients read it as capability absence. Domain plugins register under `ctx.inject([\'sessionProjections\'], …)` so headless assemblies without the registry stay unaffected. Registrants sharing a key share one unit and are counted: the same tool package mounted in N agent presets registers N times, and the key survives until the last one unloads.',
methods: [
{
signature: 'register(definition: ProjectionDefinition): () => void',
- jsDoc: '/**\n * Register one domain\'s unit. The registration is an effect on the calling\n * context\'s fiber: disposing the fiber (or calling the returned disposer)\n * removes the key — and the unit\'s cached cells — from subsequent drives\n * and snapshots.\n * @param definition - key, state schema, pure unit functions, and stateVersion.\n * @returns the exact disposer that unregisters this unit.\n */',
+ description: 'Register one domain\'s unit. The registration is an effect on the calling context\'s fiber: disposing the fiber (or calling the returned disposer) removes the key — and the unit\'s cached cells — from subsequent drives and snapshots.',
+ parameters: [{ name: 'definition', description: 'key, state schema, pure unit functions, and stateVersion.' }],
+ returns: 'the exact disposer that unregisters this unit.',
},
{
signature: 'onChanged(listener: ProjectionChangeListener): () => void',
- jsDoc: '/**\n * Subscribe to the change feed. The registration is an effect on the\n * calling context\'s fiber.\n * @param listener - called once per unit whose state reference changed, per committed event.\n * @returns the exact disposer that unsubscribes.\n */',
+ description: 'Subscribe to the change feed. The registration is an effect on the calling context\'s fiber.',
+ parameters: [{ name: 'listener', description: 'called once per unit whose state reference changed, per committed event.' }],
+ returns: 'the exact disposer that unsubscribes.',
},
{
signature: 'snapshot(session: Session): ProjectionSnapshot',
- jsDoc: '/**\n * One consistent cut over every registered unit for one session, read from\n * the watermark cache (missing cells fold lazily over the in-memory log).\n * Fully synchronous — every value and `asOfSeq` reflect the same log\n * position. Each value passes its unit\'s schema before leaving.\n * @param session - the session whose projection values are read.\n * @returns the snapshot; `values` is empty when no unit is registered.\n */',
+ description: 'One consistent cut over every registered unit for one session, read from the watermark cache (missing cells fold lazily over the in-memory log). Fully synchronous — every value and `asOfSeq` reflect the same log position. Each value passes its unit\'s schema before leaving.',
+ parameters: [{ name: 'session', description: 'the session whose projection values are read.' }],
+ returns: 'the snapshot; `values` is empty when no unit is registered.',
},
{
signature: 'checkpoint(session: Session): ProjectionCheckpoint',
- jsDoc: '/**\n * State-level checkpoint of every registered unit for one session, read\n * from the watermark cache (missing cells fold lazily over the in-memory\n * log). This is the write side of the persisted projection cache: the\n * returned rows are the `(key → {ver, seq, val})` part of the durable\n * `(sessionId, key, ver, seq, val)`\n * rows. Every `val` is a DETACHED structured clone — never the live\n * cell reference: the watermark cache is this registry\'s authoritative\n * mutable state, and a caller reaching the live reference could corrupt\n * every subsequent snapshot and frame through it (plain JSON by the unit\n * contract, so the clone is total).\n * @param session - the session whose unit states are checkpointed.\n * @returns one row per registered key; empty when no unit is registered.\n */',
+ description: 'State-level checkpoint of every registered unit for one session, read from the watermark cache (missing cells fold lazily over the in-memory log). This is the write side of the persisted projection cache: the returned rows are the `(key → {ver, seq, val})` part of the durable `(sessionId, key, ver, seq, val)` rows. Every `val` is a DETACHED structured clone — never the live cell reference: the watermark cache is this registry\'s authoritative mutable state, and a caller reaching the live reference could corrupt every subsequent snapshot and frame through it (plain JSON by the unit contract, so the clone is total).',
+ parameters: [{ name: 'session', description: 'the session whose unit states are checkpointed.' }],
+ returns: 'one row per registered key; empty when no unit is registered.',
},
{
signature: 'restoreFloor(checkpoint: ProjectionCheckpoint): number | undefined',
- jsDoc: '/**\n * The stored seq a {@link restore} tail read over `checkpoint` must start\n * at: one event BELOW the lowest usable watermark (a row is usable when\n * its `ver` matches the live unit\'s `stateVersion`; an absent or mismatched row\n * pulls the floor to `0` — that key must refold the full log). The\n * one-below anchor is load-bearing: the tail then proves how far the\n * stored log still extends, so {@link restore} can detect a log that\n * shrank below a row\'s watermark (crash-repair truncation) instead of\n * serving the stale row as current — an empty tail read from the anchor\n * yields an end below every watermark and the restore rejects for a full\n * re-read.\n * @param checkpoint - persisted rows for one session (possibly stale or empty).\n * @returns the seq to hand the persistence `readFrom`, or `undefined`\n * when no unit is registered (no read needed — {@link restore} would\n * serve empty values regardless).\n */',
+ description: 'The stored seq a restore tail read over `checkpoint` must start at: one event BELOW the lowest usable watermark (a row is usable when its `ver` matches the live unit\'s `stateVersion`; an absent or mismatched row pulls the floor to `0` — that key must refold the full log). The one-below anchor is load-bearing: the tail then proves how far the stored log still extends, so restore can detect a log that shrank below a row\'s watermark (crash-repair truncation) instead of serving the stale row as current — an empty tail read from the anchor yields an end below every watermark and the restore rejects for a full re-read.',
+ parameters: [{ name: 'checkpoint', description: 'persisted rows for one session (possibly stale or empty).' }],
+ returns: 'the seq to hand the persistence `readFrom`, or `undefined` when no unit is registered (no read needed — {@link restore} would serve empty values regardless).',
},
{
signature: 'viewCheckpoint(checkpoint: ProjectionCheckpoint): Partial',
- jsDoc: '/**\n * View a checkpoint\'s rows without any log read: for every registered\n * unit whose row\'s `ver` matches, serve the schema-validated\n * `view` of the stored state; mismatched or absent rows leave their key\n * absent (a cold or listing consumer treats it as not-yet-available and a\n * fuller read path refolds it). The zero-I/O rung of the read ladder —\n * values are as stale as their rows, never wrong.\n * @param checkpoint - persisted rows for one session (possibly stale or empty).\n * @returns whole values per key with a usable row; empty when none.\n */',
+ description: 'View a checkpoint\'s rows without any log read: for every registered unit whose row\'s `ver` matches, serve the schema-validated `view` of the stored state; mismatched or absent rows leave their key absent (a cold or listing consumer treats it as not-yet-available and a fuller read path refolds it). The zero-I/O rung of the read ladder — values are as stale as their rows, never wrong.',
+ parameters: [{ name: 'checkpoint', description: 'persisted rows for one session (possibly stale or empty).' }],
+ returns: 'whole values per key with a usable row; empty when none.',
},
{
signature: 'restore(checkpoint: ProjectionCheckpoint, events: readonly SessionEvent[], baseSeq: number): { snapshot: ProjectionSnapshot; checkpoint: ProjectionCheckpoint }',
- jsDoc: '/**\n * Cold read: fold every registered unit over a stored log suffix, seeding\n * each from its checkpoint row when usable — the one read recipe (cached\n * state + forward tail replay + `view`) applied without a live `Session`.\n * Call with the events returned by a persistence\n * `readFrom(id, restoreFloor(checkpoint))` and that same floor as\n * `baseSeq`; the floor\'s one-below anchor makes the supplied end honest,\n * so a shrunk log is detected here. A row is usable iff its\n * `ver` matches the live unit\'s `stateVersion`, it does not predate `baseSeq`\n * (`seq >= baseSeq - 1`), and it does not claim events past the\n * supplied end (`seq <= endSeq`); an unusable row is discarded\n * and its key refolds from `init` — which is only sound over the full\n * log, so a discarded row with `baseSeq > 0` throws (the caller re-reads\n * from seq 0, e.g. after a crash-repair truncation shrank the log below\n * a row\'s watermark).\n * @param checkpoint - persisted rows for one session (possibly stale or empty).\n * @param events - the stored events with `seq >= baseSeq`, in seq order.\n * @param baseSeq - the seq `events` starts at (its first event\'s seq when non-empty).\n * @returns the snapshot cut at the supplied log end (`asOfSeq` is the last\n * supplied event\'s seq, `baseSeq - 1` for an empty tail) plus the\n * refreshed checkpoint rows at that cut, ready for a durable write-back.\n */',
+ description: 'Cold read: fold every registered unit over a stored log suffix, seeding each from its checkpoint row when usable — the one read recipe (cached state + forward tail replay + `view`) applied without a live `Session`. Call with the events returned by a persistence `readFrom(id, restoreFloor(checkpoint))` and that same floor as `baseSeq`; the floor\'s one-below anchor makes the supplied end honest, so a shrunk log is detected here. A row is usable iff its `ver` matches the live unit\'s `stateVersion`, it does not predate `baseSeq` (`seq >= baseSeq - 1`), and it does not claim events past the supplied end (`seq <= endSeq`); an unusable row is discarded and its key refolds from `init` — which is only sound over the full log, so a discarded row with `baseSeq > 0` throws (the caller re-reads from seq 0, e.g. after a crash-repair truncation shrank the log below a row\'s watermark).',
+ parameters: [{ name: 'checkpoint', description: 'persisted rows for one session (possibly stale or empty).' }, { name: 'events', description: 'the stored events with `seq >= baseSeq`, in seq order.' }, { name: 'baseSeq', description: 'the seq `events` starts at (its first event\'s seq when non-empty).' }],
+ returns: 'the snapshot cut at the supplied log end (`asOfSeq` is the last supplied event\'s seq, `baseSeq - 1` for an empty tail) plus the refreshed checkpoint rows at that cut, ready for a durable write-back.',
},
],
},
{
key: 'sessionQuery',
summary: 'Unified live-preferred session query service.',
+ description: 'Unified live-preferred session query service.\n\nExact reads, filters, and traces are backend-independent concrete behavior. A backend implements full-text observation, reconciliation, ranking, cursor generations, and query execution on the same `ctx.sessionQuery` service.',
methods: [
{
signature: 'abstract searchSessions( request: SessionSearchRequest, exec?: SessionSearchExecContext, ): Promise>',
- jsDoc: '/**\n * Search the live-preferred logical corpus and group by session.\n * @param request - query text, metadata filters, page size, and cursor.\n * @param exec - optional cancellation control.\n * @returns session hits ranked by their strongest matching event.\n */',
+ description: 'Search the live-preferred logical corpus and group by session.',
+ parameters: [{ name: 'request', description: 'query text, metadata filters, page size, and cursor.' }, { name: 'exec', description: 'optional cancellation control.' }],
+ returns: 'session hits ranked by their strongest matching event.',
},
{
signature: 'abstract searchEvents( request: SessionEventSearchRequest, exec?: SessionSearchExecContext, ): Promise',
- jsDoc: '/**\n * Search events within one live-preferred logical session.\n * @param request - target session, query text, filters, page size, and cursor.\n * @param exec - optional cancellation control.\n * @returns matching event hits and their target header from one indexed generation.\n */',
+ description: 'Search events within one live-preferred logical session.',
+ parameters: [{ name: 'request', description: 'target session, query text, filters, page size, and cursor.' }, { name: 'exec', description: 'optional cancellation control.' }],
+ returns: 'matching event hits and their target header from one indexed generation.',
},
{
signature: 'listSessions(signal?: AbortSignal): Promise',
- jsDoc: '/**\n * List the complete logical corpus using live-preferred records.\n * @param signal - optional cancellation for persistence listing.\n * @returns deterministic newest-first cloned session records.\n */',
+ description: 'List the complete logical corpus using live-preferred records.',
+ parameters: [{ name: 'signal', description: 'optional cancellation for persistence listing.' }],
+ returns: 'deterministic newest-first cloned session records.',
},
{
signature: 'async readSession(sessionId: SessionId): Promise',
- jsDoc: '/**\n * Read and replay-validate one complete logical session log without making it live.\n * @param sessionId - live or persisted session id to read.\n * @returns cloned header and complete raw event log from one observation.\n * @throws when persistence, header compatibility, or replay validation fails.\n */',
+ description: 'Read and replay-validate one complete logical session log without making it live.',
+ parameters: [{ name: 'sessionId', description: 'live or persisted session id to read.' }],
+ returns: 'cloned header and complete raw event log from one observation.',
+ throws: ['when persistence, header compatibility, or replay validation fails.'],
},
{
signature: 'async filterSessions( filters: readonly SessionResultFilter[], signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Filter the complete logical corpus with provider-independent predicates.\n * @param filters - ANDed session metadata and availability clauses.\n * @param signal - optional cancellation for persistence listing.\n * @returns matching cloned records in deterministic newest-first order.\n */',
+ description: 'Filter the complete logical corpus with provider-independent predicates.',
+ parameters: [{ name: 'filters', description: 'ANDed session metadata and availability clauses.' }, { name: 'signal', description: 'optional cancellation for persistence listing.' }],
+ returns: 'matching cloned records in deterministic newest-first order.',
},
{
signature: 'async readTitle( sessionId: SessionId, signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Fold the latest log-backed title from one live-preferred logical session.\n * @param sessionId - live or persisted session id to read.\n * @param signal - optional cancellation for source resolution and title folding.\n * @returns latest title snapshot, or `undefined` when the log has no title event.\n */',
+ description: 'Fold the latest log-backed title from one live-preferred logical session.',
+ parameters: [{ name: 'sessionId', description: 'live or persisted session id to read.' }, { name: 'signal', description: 'optional cancellation for source resolution and title folding.' }],
+ returns: 'latest title snapshot, or `undefined` when the log has no title event.',
},
{
signature: 'async readTitleSnapshot( sessionId: SessionId, signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Fold the latest title and return its source header from one corpus observation.\n * @param sessionId - live or persisted session id to read.\n * @param signal - optional cancellation for source resolution and title folding.\n * @returns cloned source header and optional latest title snapshot.\n */',
+ description: 'Fold the latest title and return its source header from one corpus observation.',
+ parameters: [{ name: 'sessionId', description: 'live or persisted session id to read.' }, { name: 'signal', description: 'optional cancellation for source resolution and title folding.' }],
+ returns: 'cloned source header and optional latest title snapshot.',
},
{
signature: 'async readTitleSnapshots( sessionIds: readonly SessionId[], signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Fold titles for unique sessions from one cancellable corpus observation.\n *\n * Results preserve first-occurrence input order. Operational failures stay\n * isolated per session, while cancellation rejects the complete operation.\n * @param sessionIds - live or persisted session ids to observe.\n * @param signal - optional cancellation shared by all source reads.\n * @returns one fulfilled or rejected result per unique requested id.\n */',
+ description: 'Fold titles for unique sessions from one cancellable corpus observation.\n\nResults preserve first-occurrence input order. Operational failures stay isolated per session, while cancellation rejects the complete operation.',
+ parameters: [{ name: 'sessionIds', description: 'live or persisted session ids to observe.' }, { name: 'signal', description: 'optional cancellation shared by all source reads.' }],
+ returns: 'one fulfilled or rejected result per unique requested id.',
},
{
signature: 'async listEvents(sessionId: SessionId): Promise',
- jsDoc: '/**\n * List lightweight raw-log event records for one logical session.\n * @param sessionId - live-preferred session id to read.\n * @returns event records in ascending seq order.\n */',
+ description: 'List lightweight raw-log event records for one logical session.',
+ parameters: [{ name: 'sessionId', description: 'live-preferred session id to read.' }],
+ returns: 'event records in ascending seq order.',
},
{
signature: 'async filterEvents( sessionId: SessionId, filters: readonly SessionEventResultFilter[], ): Promise',
- jsDoc: '/**\n * Scan first-party semantic event documents with provider-independent filters.\n * @param sessionId - live-preferred session id to scan.\n * @param filters - ANDed metadata and literal-text predicates.\n * @returns matching semantic documents in ascending seq order.\n */',
+ description: 'Scan first-party semantic event documents with provider-independent filters.',
+ parameters: [{ name: 'sessionId', description: 'live-preferred session id to scan.' }, { name: 'filters', description: 'ANDed metadata and literal-text predicates.' }],
+ returns: 'matching semantic documents in ascending seq order.',
},
{
signature: 'async readSurface(sessionId: SessionId): Promise',
- jsDoc: '/**\n * Read one session\'s complete current model surface from one corpus observation.\n * @param sessionId - live-preferred session id to read.\n * @returns cloned header, current surface, and the last sequence number included in the raw-log capture.\n * @throws when source resolution fails or the session surface is invalid.\n */',
+ description: 'Read one session\'s complete current model surface from one corpus observation.',
+ parameters: [{ name: 'sessionId', description: 'live-preferred session id to read.' }],
+ returns: 'cloned header, current surface, and the last sequence number included in the raw-log capture.',
+ throws: ['when source resolution fails or the session surface is invalid.'],
},
{
signature: 'async traceSession(sessionId: SessionId, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Trace known ancestry and descendants from one corpus observation.\n * @param sessionId - logical session id to trace.\n * @param signal - optional cancellation for persistence listing.\n * @returns a complete lineage or the first parent that could not be resolved.\n * @throws when corpus resolution fails, the target is absent, or its known ancestry cycles.\n */',
+ description: 'Trace known ancestry and descendants from one corpus observation.',
+ parameters: [{ name: 'sessionId', description: 'logical session id to trace.' }, { name: 'signal', description: 'optional cancellation for persistence listing.' }],
+ returns: 'a complete lineage or the first parent that could not be resolved.',
+ throws: ['when corpus resolution fails, the target is absent, or its known ancestry cycles.'],
},
{
signature: 'async traceEvent(request: SessionEventTraceRequest, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Trace one event\'s direct positional replacements and cited source events.\n * @param request - target session id and event seq.\n * @param signal - optional cancellation for persisted source resolution.\n * @returns source header, direct links, and the target\'s positional replacement chain.\n * @throws when source resolution fails, the target is absent, or surface/source-event validation fails.\n */',
+ description: 'Trace one event\'s direct positional replacements and cited source events.',
+ parameters: [{ name: 'request', description: 'target session id and event seq.' }, { name: 'signal', description: 'optional cancellation for persisted source resolution.' }],
+ returns: 'source header, direct links, and the target\'s positional replacement chain.',
+ throws: ['when source resolution fails, the target is absent, or surface/source-event validation fails.'],
},
{
signature: 'async readEvent(request: SessionEventReadRequest, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Read one full event plus a bounded raw-log context window.\n * @param request - target session/seq and context sizes.\n * @param signal - optional cancellation for persisted source resolution.\n * @returns cloned target and neighboring events.\n */',
+ description: 'Read one full event plus a bounded raw-log context window.',
+ parameters: [{ name: 'request', description: 'target session/seq and context sizes.' }, { name: 'signal', description: 'optional cancellation for persisted source resolution.' }],
+ returns: 'cloned target and neighboring events.',
},
],
},
{
key: 'sessionReferenceResolver',
summary: 'Exact-read consumer that prepares immutable cross-session message context.',
+ description: 'Exact-read consumer that prepares immutable cross-session message context.',
methods: [
{
signature: 'async listCandidates( agent: Agent, query: string = \'\', limit: number = this.config.candidateLimit, signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * List reference candidates, ranked by working-directory affinity.\n * @param agent - target agent; self is excluded and its cwd drives ranking.\n * @param query - optional case-insensitive session-id/cwd/title substring.\n * @param limit - optional positive result cap.\n * @param signal - optional cancellation boundary for host autocomplete teardown.\n * @returns candidates labeled by latest title or, when absent, session id.\n */',
+ description: 'List reference candidates, ranked by working-directory affinity.',
+ parameters: [{ name: 'agent', description: 'target agent; self is excluded and its cwd drives ranking.' }, { name: 'query', description: 'optional case-insensitive session-id/cwd/title substring.' }, { name: 'limit', description: 'optional positive result cap.' }, { name: 'signal', description: 'optional cancellation boundary for host autocomplete teardown.' }],
+ returns: 'candidates labeled by latest title or, when absent, session id.',
},
{
signature: 'async prepare( agent: Agent, content: ContentBlock[], references: SessionReferenceInput[], signal?: AbortSignal, ): Promise',
- jsDoc: '/**\n * Snapshot all references before enqueue and return one aggregated durable context.\n * @param agent - target agent; references to it are rejected.\n * @param content - already host-normalized readable message content.\n * @param references - structured source sessions in mention order.\n * @param signal - optional cancellation boundary for host request teardown.\n * @returns detached content and optional referenced-session context.\n */',
+ description: 'Snapshot all references before enqueue and return one aggregated durable context.',
+ parameters: [{ name: 'agent', description: 'target agent; references to it are rejected.' }, { name: 'content', description: 'already host-normalized readable message content.' }, { name: 'references', description: 'structured source sessions in mention order.' }, { name: 'signal', description: 'optional cancellation boundary for host request teardown.' }],
+ returns: 'detached content and optional referenced-session context.',
},
],
},
{
key: 'sessions',
summary: 'In-memory session store (`ctx.sessions`).',
+ description: 'In-memory session store (`ctx.sessions`).\n\nPersistence is intentionally not implemented here — persistence plugins subscribe to `session/event` and flush on `session/flush` / dispose.',
methods: [
{
signature: 'create(id?: SessionId, options?: CreateSessionOptions): Session',
- jsDoc: '/**\n * Create a session owned by the calling fiber: disposing that fiber stops\n * event notification and removes the session from the store. `options.seed`\n * populates the session with a copy of those events (replay/fork);\n * `options.meta` attaches creation metadata (validated absolute `cwd`, seed\n * and parent lineage, and delegation depth) as the immutable\n * {@link SessionHeader} (the store fills `version`/`id`/`createdAt`).\n *\n * For an agent whose session must be torn down IN ORDER with its loop (so the\n * loop\'s final events are published before the store attachment ends), do NOT use this\n * — fold the session lifecycle into the agent\'s own effect via\n * {@link prepare} + {@link enter} + {@link announce} (see\n * `dsh-agent-loop`\'s creation transaction).\n *\n * @param id - the session id; omitted, the store mints `session-`.\n * @param options - seed events and/or creation metadata for the header.\n * @returns the live session, already entered and announced.\n * @throws if a session with `id` already exists, metadata is not a plain\n * lossless-JSON record with valid scalar fields, or `meta.cwd` is a\n * non-absolute path (storage backends key directories off it).\n */',
+ description: 'Create a session owned by the calling fiber: disposing that fiber stops event notification and removes the session from the store. `options.seed` populates the session with a copy of those events (replay/fork); `options.meta` attaches creation metadata (validated absolute `cwd`, seed and parent lineage, and delegation depth) as the immutable SessionHeader (the store fills `version`/`id`/`createdAt`).\n\nFor an agent whose session must be torn down IN ORDER with its loop (so the loop\'s final events are published before the store attachment ends), do NOT use this — fold the session lifecycle into the agent\'s own effect via prepare + enter + announce (see `dsh-agent-loop`\'s creation transaction).',
+ parameters: [{ name: 'id', description: 'the session id; omitted, the store mints `session-`.' }, { name: 'options', description: 'seed events and/or creation metadata for the header.' }],
+ returns: 'the live session, already entered and announced.',
+ throws: ['if a session with `id` already exists, metadata is not a plain lossless-JSON record with valid scalar fields, or `meta.cwd` is a non-absolute path (storage backends key directories off it).'],
},
{
signature: 'prepare(id?: SessionId, options?: PrepareSessionOptions): Session',
- jsDoc: '/**\n * Build a session WITHOUT entering it into the store — validate the id/cwd and\n * construct the {@link Session} (with its immutable {@link SessionHeader}).\n * Pairs with {@link enter} + {@link announce}: a caller that owns a composite\n * `ctx.effect` (the agent factory) folds the session lifecycle into that ONE\n * effect so a fiber unload tears the session + agent down as a single ORDERED\n * chain rather than as racing sibling effects — which would remove the publication hooks\n * before the driver\'s closing events commit, dropping them.\n *\n * @param id - the session id; omitted, the store mints `session-`.\n * @param options - seed events and/or creation metadata for the header. With\n * `seedSource: \'persistence\'`, metadata and events must be fresh detached\n * graphs whose ownership transfers to this call: they are validated and\n * frozen in place through {@link Session.fromRestore}, so the caller must\n * retain no mutable aliases.\n * @returns the constructed session, NOT yet in the store.\n * @throws if a session with `id` already exists, metadata is not a plain\n * lossless-JSON record with valid scalar fields, or `meta.cwd` is a\n * non-absolute path.\n */',
+ description: 'Build a session WITHOUT entering it into the store — validate the id/cwd and construct the Session (with its immutable SessionHeader). Pairs with enter + announce: a caller that owns a composite `ctx.effect` (the agent factory) folds the session lifecycle into that ONE effect so a fiber unload tears the session + agent down as a single ORDERED chain rather than as racing sibling effects — which would remove the publication hooks before the driver\'s closing events commit, dropping them.',
+ parameters: [{ name: 'id', description: 'the session id; omitted, the store mints `session-`.' }, { name: 'options', description: 'seed events and/or creation metadata for the header. With `seedSource: \'persistence\'`, metadata and events must be fresh detached graphs whose ownership transfers to this call: they are validated and frozen in place through {@link Session.fromRestore}, so the caller must retain no mutable aliases.' }],
+ returns: 'the constructed session, NOT yet in the store.',
+ throws: ['if a session with `id` already exists, metadata is not a plain lossless-JSON record with valid scalar fields, or `meta.cwd` is a non-absolute path.'],
},
{
signature: 'enter(session: Session): () => void',
- jsDoc: '/**\n * Enter a {@link prepare}d session into the store: install the module-private\n * append publication hooks and add it to the store. Returns the DETACH\n * disposer (hooks + store removal). Does NOT emit `session/created` —\n * the caller yields this disposer inside its effect and THEN calls\n * {@link announce}, so a throwing `session/created` listener rolls the attach\n * back instead of leaking it.\n *\n * Re-checks the id for a duplicate: `prepare` and `enter` are public\n * cross-package primitives and a caller may interleave arbitrary work (or\n * another create) between them, so a stale prepared session must NOT overwrite\n * a live store entry of the same id — its detach disposer would later delete\n * the REAL session. The {@link create} convenience and the agent factory call\n * the two back-to-back so they never trip this, but the public API cannot\n * assume that.\n *\n * @param session - a {@link prepare}d session not yet in the store.\n * @returns the detach disposer (publication hooks + store removal). When called from\n * a synchronous `session/created` listener, removal and disposal wait until\n * that creation dispatch unwinds.\n * @throws if a session with this id is already in the store.\n */',
+ description: 'Enter a prepared session into the store: install the module-private append publication hooks and add it to the store. Returns the DETACH disposer (hooks + store removal). Does NOT emit `session/created` — the caller yields this disposer inside its effect and THEN calls announce, so a throwing `session/created` listener rolls the attach back instead of leaking it.\n\nRe-checks the id for a duplicate: `prepare` and `enter` are public cross-package primitives and a caller may interleave arbitrary work (or another create) between them, so a stale prepared session must NOT overwrite a live store entry of the same id — its detach disposer would later delete the REAL session. The create convenience and the agent factory call the two back-to-back so they never trip this, but the public API cannot assume that.',
+ parameters: [{ name: 'session', description: 'a {@link prepare}d session not yet in the store.' }],
+ returns: 'the detach disposer (publication hooks + store removal). When called from a synchronous `session/created` listener, removal and disposal wait until that creation dispatch unwinds.',
+ throws: ['if a session with this id is already in the store.'],
},
{
signature: 'announce(session: Session): void',
- jsDoc: '/** Emit `session/created` exactly once for an {@link enter}ed session (with\n * the carrier {@link enter} captured). Separate from {@link enter} so the\n * caller can yield the detach disposer first (rollback safety — see\n * {@link enter}).\n * @param session - the entered session to announce to listeners.\n * @throws if the session is not live or its announcement already began,\n * including a reentrant call from a creation listener. */',
+ description: 'Emit `session/created` exactly once for an entered session (with the carrier enter captured). Separate from enter so the caller can yield the detach disposer first (rollback safety — see enter).',
+ parameters: [{ name: 'session', description: 'the entered session to announce to listeners.' }],
+ throws: ['if the session is not live or its announcement already began, including a reentrant call from a creation listener.'],
},
{
signature: 'async flush(session: Session): Promise',
- jsDoc: '/**\n * Dispatch the awaited `session/flush` durability checkpoint for `session`,\n * with the carrier captured at {@link enter}. THE flush entry point: the\n * store owns the carrier, so callers (the checkpoint policy\'s per-request\n * barrier, goal-round-driver\'s idle checkpoint, teardown drains, and consumers\n * that flush themselves before reading storage) must come through here\n * rather than dispatch a raw `ctx.parallel(\'session/flush\', …)` — one owner,\n * one spelling, and the scoped-dispatch invariant can pin it.\n * @param session - the session whose buffered events must reach durable storage.\n * @returns whether at least one durability listener participated, after every\n * listener has settled successfully.\n * @throws the first registered listener failure after every listener settles.\n */',
+ description: 'Dispatch the awaited `session/flush` durability checkpoint for `session`, with the carrier captured at enter. THE flush entry point: the store owns the carrier, so callers (the checkpoint policy\'s per-request barrier, goal-round-driver\'s idle checkpoint, teardown drains, and consumers that flush themselves before reading storage) must come through here rather than dispatch a raw `ctx.parallel(\'session/flush\', …)` — one owner, one spelling, and the scoped-dispatch invariant can pin it.',
+ parameters: [{ name: 'session', description: 'the session whose buffered events must reach durable storage.' }],
+ returns: 'whether at least one durability listener participated, after every listener has settled successfully.',
+ throws: ['the first registered listener failure after every listener settles.'],
},
{
signature: 'get(id: SessionId): Session | undefined',
- jsDoc: '/**\n * Look up a live session.\n * @param id - the session id to look up.\n * @returns the session, or undefined when no live session has that id.\n */',
+ description: 'Look up a live session.',
+ parameters: [{ name: 'id', description: 'the session id to look up.' }],
+ returns: 'the session, or undefined when no live session has that id.',
},
{
signature: 'list(): Session[]',
- jsDoc: '/**\n * All live sessions, in creation order.\n * @returns a fresh array; mutating it does not affect the store.\n */',
+ description: 'All live sessions, in creation order.',
+ parameters: [],
+ returns: 'a fresh array; mutating it does not affect the store.',
},
{
signature: 'fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId): Session',
- jsDoc: '/**\n * Create a live child session from a stable prefix of a live source.\n * `boundary` is an inclusive source event seq; omitted means the source\'s\n * current last event. The selected slice may end with a between-turn event\n * but must not end inside an open turn.\n *\n * @param source - Live source session object or id.\n * @param boundary - Inclusive source event seq to fork through; omitted means\n * the source\'s current last event, and omitted on an empty source forks an\n * empty child.\n * @param childSessionId - Optional child session id; omitted delegates to\n * `SessionStore`\'s id policy.\n * @returns The created live child session.\n */',
+ description: 'Create a live child session from a stable prefix of a live source. `boundary` is an inclusive source event seq; omitted means the source\'s current last event. The selected slice may end with a between-turn event but must not end inside an open turn.',
+ parameters: [{ name: 'source', description: 'Live source session object or id.' }, { name: 'boundary', description: 'Inclusive source event seq to fork through; omitted means the source\'s current last event, and omitted on an empty source forks an empty child.' }, { name: 'childSessionId', description: 'Optional child session id; omitted delegates to `SessionStore`\'s id policy.' }],
+ returns: 'The created live child session.',
},
],
},
{
key: 'sessionTelemetry',
summary: 'Loadable form of the backend contract: one implementation per context — the cordis `Service` registration under the `telemetry` key throws on a duplicate, cordis\' standard behavior.',
+ description: 'Loadable form of the backend contract: one implementation per context — the cordis `Service` registration under the `telemetry` key throws on a duplicate, cordis\' standard behavior. A backend composes a SessionTelemetryCoordinator in its constructor to install the capture side.',
methods: [
+ {
+ signature: 'abstract readonly sharing: SessionTelemetrySharingStatus',
+ description: 'Deployment-selected session-sharing policy, disclosed for acknowledgement surfaces that report whether recorded feedback leaves the process. Every backend must disclose its policy; a consumer renders "not configured" only when no telemetry service is mounted. The seam owns this vocabulary so the disclosure is backend-independent.',
+ parameters: [],
+ },
{
signature: 'abstract emit(record: SessionTelemetryRecord): void',
- jsDoc: '/**\n * See {@link SessionTelemetrySink.emit} — that declaration is the contract\'s one home.\n * @param record - the logical record to report; owned by the backend after the call.\n */',
+ description: 'See SessionTelemetrySink.emit — that declaration is the contract\'s one home.',
+ parameters: [{ name: 'record', description: 'the logical record to report; owned by the backend after the call.' }],
},
{
signature: 'flush?(): void',
- jsDoc: '/** See {@link SessionTelemetrySink.flush}. */',
+ description: 'See SessionTelemetrySink.flush.',
+ parameters: [],
},
{
signature: 'abstract shutdown(): Promise',
- jsDoc: '/**\n * See {@link SessionTelemetrySink.shutdown}.\n * @returns resolves when the backend\'s pipeline has quiesced.\n */',
+ description: 'See SessionTelemetrySink.shutdown.',
+ parameters: [],
+ returns: 'resolves when the backend\'s pipeline has quiesced.',
},
],
},
{
key: 'sessionTitle',
summary: 'Log-backed title fold plus asynchronous fallback generation.',
+ description: 'Log-backed title fold plus asynchronous fallback generation.',
methods: [
{
signature: 'get(session: Session): SessionTitleSnapshot | undefined',
- jsDoc: '/**\n * Read the latest folded title from one live or replayed session.\n * @param session - session whose log is the title source of truth.\n * @returns latest title snapshot, or `undefined` before eligible input.\n */',
+ description: 'Read the latest folded title from one live or replayed session.',
+ parameters: [{ name: 'session', description: 'session whose log is the title source of truth.' }],
+ returns: 'latest title snapshot, or `undefined` before eligible input.',
},
{
signature: 'rename(session: Session, title: string): SessionTitleSnapshot',
- jsDoc: '/**\n * Accept an explicit user title. Appends a `session/title` event with the\n * `user` source, which pins the title: in-flight automatic generation is\n * superseded and later user messages schedule none (an explicit\n * {@link SessionTitleService.refresh} remains the deliberate unpin).\n * @param session - exact live session to rename.\n * @param title - raw user input; normalized before acceptance.\n * @returns the accepted title snapshot.\n * @throws {SessionTitleInvalidError} when the title normalizes to empty.\n * @throws {Error} when the session is not live or the service is disposed.\n */',
+ description: 'Accept an explicit user title. Appends a `session/title` event with the `user` source, which pins the title: in-flight automatic generation is superseded and later user messages schedule none (an explicit SessionTitleService.refresh remains the deliberate unpin).',
+ parameters: [{ name: 'session', description: 'exact live session to rename.' }, { name: 'title', description: 'raw user input; normalized before acceptance.' }],
+ returns: 'the accepted title snapshot.',
+ throws: ['{SessionTitleInvalidError} when the title normalizes to empty.', '{Error} when the session is not live or the service is disposed.'],
},
{
signature: 'async refresh(session: Session, signal?: AbortSignal): Promise',
- jsDoc: '/**\n * Explicitly retry the registered provider, or materialize the built-in\n * fallback when no provider is registered.\n * @param session - exact live session to refresh.\n * @param signal - optional caller cancellation.\n * @returns latest accepted title, or `undefined` when no eligible text exists.\n */',
+ description: 'Explicitly retry the registered provider, or materialize the built-in fallback when no provider is registered.',
+ parameters: [{ name: 'session', description: 'exact live session to refresh.' }, { name: 'signal', description: 'optional caller cancellation.' }],
+ returns: 'latest accepted title, or `undefined` when no eligible text exists.',
},
{
signature: 'register(provider: SessionTitleProvider): () => Promise',
- jsDoc: '/**\n * Register the sole optional title provider. Disposal aborts its pending and\n * active work before another provider may register.\n * @param provider - provider identity, cadence, and generation function.\n * @returns exact Cordis effect disposer, which settles after active calls quiesce.\n */',
+ description: 'Register the sole optional title provider. Disposal aborts its pending and active work before another provider may register.',
+ parameters: [{ name: 'provider', description: 'provider identity, cadence, and generation function.' }],
+ returns: 'exact Cordis effect disposer, which settles after active calls quiesce.',
},
],
},
{
key: 'settings',
summary: 'Abstract settings service.',
+ description: 'Abstract settings service. Providers implement raw-document storage (`load`/`persist`) and push external changes through Settings.publish; the base class owns namespace registration, resolution, validation, change detection, and the `settings/updated` commit event.',
methods: [
+ {
+ signature: 'abstract readonly writable: boolean',
+ description: 'Whether update may persist through this provider.',
+ parameters: [],
+ },
{
signature: 'prepareDocument(): Promise',
- jsDoc: '/**\n * Prepare the provider\'s user-editable document for a native editor. File\n * providers may materialize an absent document before returning its path;\n * non-file providers return undefined.\n * @returns the absolute local document path, or undefined for non-file storage.\n */',
+ description: 'Prepare the provider\'s user-editable document for a native editor. File providers may materialize an absent document before returning its path; non-file providers return undefined.',
+ parameters: [],
+ returns: 'the absolute local document path, or undefined for non-file storage.',
},
{
signature: 'register(ns: SettingsNamespace, schema: z, options?: SettingsRegisterOptions): SettingsScope',
- jsDoc: '/**\n * Register a namespace schema and receive its owner scope. The registration\n * is an effect on the calling plugin\'s fiber: disposing that fiber removes\n * the namespace and its observers. An invalid stored section fails the\n * registration itself — the earliest point where the schema can judge it.\n * @param ns - unique namespace; duplicate registration fails loud.\n * @param schema - schemastery schema resolving this namespace\'s value.\n * @param options - composition `base` layer and effect timing.\n * @returns the owner scope for reads, observation, and updates.\n */',
+ description: 'Register a namespace schema and receive its owner scope. The registration is an effect on the calling plugin\'s fiber: disposing that fiber removes the namespace and its observers. An invalid stored section fails the registration itself — the earliest point where the schema can judge it.',
+ parameters: [{ name: 'ns', description: 'unique namespace; duplicate registration fails loud.' }, { name: 'schema', description: 'schemastery schema resolving this namespace\'s value.' }, { name: 'options', description: 'composition `base` layer and effect timing.' }],
+ returns: 'the owner scope for reads, observation, and updates.',
},
{
signature: 'describe(options?: SettingsDescribeOptions): SettingsDescriptor[]',
- jsDoc: '/**\n * Describe every registered namespace for configuration surfaces, including\n * the composition `base` and raw user layers so a form can mark which fields\n * the user overrode (presence in `user`) and what a reset returns to.\n * @param options - redaction switch; wire surfaces must redact.\n * @returns one descriptor per registered namespace, in registration order.\n */',
+ description: 'Describe every registered namespace for configuration surfaces, including the composition `base` and raw user layers so a form can mark which fields the user overrode (presence in `user`) and what a reset returns to.',
+ parameters: [{ name: 'options', description: 'redaction switch; wire surfaces must redact.' }],
+ returns: 'one descriptor per registered namespace, in registration order.',
},
{
signature: 'get(ns: SettingsNamespace): unknown',
- jsDoc: '/**\n * Read one registered namespace\'s resolved value.\n * @param ns - the namespace to read.\n * @returns the resolved value, or `undefined` while unregistered.\n */',
+ description: 'Read one registered namespace\'s resolved value.',
+ parameters: [{ name: 'ns', description: 'the namespace to read.' }],
+ returns: 'the resolved value, or `undefined` while unregistered.',
},
{
signature: 'async update(ns: SettingsNamespace, patch: object, expectedRevision?: number): Promise',
- jsDoc: '/**\n * Merge a patch into one registered namespace\'s user layer, validate the\n * resolved candidate, persist through the provider, then commit and emit.\n * A validation failure rejects before anything is persisted. Writes to one\n * namespace are serialized: concurrent updates apply in call order, each\n * merging over the previous write\'s committed section.\n * @param ns - the registered namespace to update.\n * @param patch - plain-object patch over the user section.\n * @param expectedRevision - the descriptor `revision` the caller read; a\n * namespace that moved past it rejects with {@link SettingsConflictError}.\n */',
+ description: 'Merge a patch into one registered namespace\'s user layer, validate the resolved candidate, persist through the provider, then commit and emit. A validation failure rejects before anything is persisted. Writes to one namespace are serialized: concurrent updates apply in call order, each merging over the previous write\'s committed section.',
+ parameters: [{ name: 'ns', description: 'the registered namespace to update.' }, { name: 'patch', description: 'plain-object patch over the user section.' }, { name: 'expectedRevision', description: 'the descriptor `revision` the caller read; a namespace that moved past it rejects with {@link SettingsConflictError}.' }],
},
{
signature: 'async replace(ns: SettingsNamespace, section: object, expectedRevision?: number): Promise',
- jsDoc: '/**\n * Replace one registered namespace\'s user section wholesale, validate,\n * persist, then commit and emit. Keys absent from `section` fall back to the\n * composition `base` and schema defaults — this is the removal/reset path a\n * merge-only patch cannot express (`replace({})` re-inherits everything).\n * @param ns - the registered namespace to replace.\n * @param section - the complete next user section.\n * @param expectedRevision - the descriptor `revision` the caller read; a\n * namespace that moved past it rejects with {@link SettingsConflictError}.\n */',
+ description: 'Replace one registered namespace\'s user section wholesale, validate, persist, then commit and emit. Keys absent from `section` fall back to the composition `base` and schema defaults — this is the removal/reset path a merge-only patch cannot express (`replace({})` re-inherits everything).',
+ parameters: [{ name: 'ns', description: 'the registered namespace to replace.' }, { name: 'section', description: 'the complete next user section.' }, { name: 'expectedRevision', description: 'the descriptor `revision` the caller read; a namespace that moved past it rejects with {@link SettingsConflictError}.' }],
},
{
signature: 'async mutate(ns: SettingsNamespace, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise',
- jsDoc: '/**\n * Apply path-addressed edits to one registered namespace\'s user section,\n * validate, persist, then commit and emit. The ops are applied to the\n * section as it stands when the write reaches the front of the queue, so a\n * caller never has to restate fields it did not touch — and, crucially,\n * cannot delete fields it never saw. This is the write path for any caller\n * holding a redacted view; `replace` remains the wholesale reset.\n * @param ns - the registered namespace to edit.\n * @param ops - ordered path edits; later ops observe earlier ones.\n * @param expectedRevision - the descriptor `revision` the caller read; a\n * namespace that moved past it rejects with {@link SettingsConflictError}.\n */',
+ description: 'Apply path-addressed edits to one registered namespace\'s user section, validate, persist, then commit and emit. The ops are applied to the section as it stands when the write reaches the front of the queue, so a caller never has to restate fields it did not touch — and, crucially, cannot delete fields it never saw. This is the write path for any caller holding a redacted view; `replace` remains the wholesale reset.',
+ parameters: [{ name: 'ns', description: 'the registered namespace to edit.' }, { name: 'ops', description: 'ordered path edits; later ops observe earlier ones.' }, { name: 'expectedRevision', description: 'the descriptor `revision` the caller read; a namespace that moved past it rejects with {@link SettingsConflictError}.' }],
},
],
},
{
key: 'shell',
summary: 'Abstract bash execution service.',
+ description: 'Abstract bash execution service. Subclass, implement the abstract methods, and load the subclass as a plugin — it registers as `ctx.shell` (one implementation per context; loading a second throws, which is cordis\' standard duplicate-service behavior).\n\nImplementations must honor these semantics:\n\n- run rejects only for infrastructure failures. Nonzero exits, timeout kills, and abort kills resolve with a ShellRunResult.\n- start returns immediately; no timeout applies to background processes. `done` settles at process close and never rejects; spawn failures settle as `killed` with the error on stderr.\n- ShellProcess.readOutput is incremental: consecutive reads never repeat output. Lossy reads report truncation and available spill files.\n- A still-running background process is stopped and awaited when its owning composition tears down. With the subprocess seam that boundary is `ctx.subprocess` disposal, so a background process survives an executor-only reload.',
methods: [
{
signature: 'abstract resolve(request: ShellExecRequest): ShellExecSpec',
- jsDoc: '/**\n * Apply implementation-owned defaults and caps to a request before execution.\n * @param request - the caller\'s request; omitted fields get this\n * implementation\'s defaults, capped fields are clamped.\n * @returns the fully-specified spec to hand to {@link run}/{@link start}.\n */',
+ description: 'Apply implementation-owned defaults and caps to a request before execution.',
+ parameters: [{ name: 'request', description: 'the caller\'s request; omitted fields get this implementation\'s defaults, capped fields are clamped.' }],
+ returns: 'the fully-specified spec to hand to {@link run}/{@link start}.',
},
{
signature: 'abstract run(spec: ShellExecSpec): Promise',
- jsDoc: '/**\n * Run a command in the foreground; resolves when it finishes.\n * @param spec - a resolved spec from {@link resolve}, never a raw request.\n * @returns the outcome; nonzero exits, timeout kills, and abort kills\n * resolve with a descriptive result rather than reject.\n */',
+ description: 'Run a command in the foreground; resolves when it finishes.',
+ parameters: [{ name: 'spec', description: 'a resolved spec from {@link resolve}, never a raw request.' }],
+ returns: 'the outcome; nonzero exits, timeout kills, and abort kills resolve with a descriptive result rather than reject.',
},
{
signature: 'abstract start(spec: ShellExecSpec): ShellProcess',
- jsDoc: '/**\n * Start a background process and return its handle immediately.\n * @param spec - a resolved spec from {@link resolve}, never a raw request.\n * @returns the live process handle (reads, kill, quiescence promise).\n */',
+ description: 'Start a background process and return its handle immediately.',
+ parameters: [{ name: 'spec', description: 'a resolved spec from {@link resolve}, never a raw request.' }],
+ returns: 'the live process handle (reads, kill, quiescence promise).',
},
],
},
{
key: 'shellEnv',
summary: 'Registry (`ctx.shellEnv`) for trusted, per-execution `DSH_*` variables.',
+ description: 'Registry (`ctx.shellEnv`) for trusted, per-execution `DSH_*` variables. The namespace is rebuilt for every model shell call: ambient `DSH_*` values are discarded by the executor, then the registry\'s current snapshot is injected. Built-in shell facts remain owned by the registry itself while plugins can register additional, enumerable facts with effect-scoped disposal.',
methods: [
{
signature: 'register(contributor: BashEnvContributor): () => void',
- jsDoc: '/**\n * Register one environment contributor. Names and keys are unique; built-in\n * keys are reserved. Registration is disposed with the calling plugin fiber.\n * @param contributor - declared key ownership and per-execution resolver.\n * @returns the disposer that unregisters the contribution.\n */',
+ description: 'Register one environment contributor. Names and keys are unique; built-in keys are reserved. Registration is disposed with the calling plugin fiber.',
+ parameters: [{ name: 'contributor', description: 'declared key ownership and per-execution resolver.' }],
+ returns: 'the disposer that unregisters the contribution.',
},
{
signature: 'collect(execution: ToolExecution): DshEnvironment',
- jsDoc: '/**\n * Build the trusted `DSH_*` snapshot for one shell tool execution.\n * @param execution - the current tool execution.\n * @returns an immutable environment overlay containing built-ins and current contributions.\n */',
+ description: 'Build the trusted `DSH_*` snapshot for one shell tool execution.',
+ parameters: [{ name: 'execution', description: 'the current tool execution.' }],
+ returns: 'an immutable environment overlay containing built-ins and current contributions.',
},
{
signature: 'list(): BashEnvVariableInfo[]',
- jsDoc: '/**\n * Enumerate plugin-contributed variables without executing their resolvers.\n * @returns declarations sorted by environment variable name.\n */',
+ description: 'Enumerate plugin-contributed variables without executing their resolvers.',
+ parameters: [],
+ returns: 'declarations sorted by environment variable name.',
},
],
},
{
key: 'skills',
summary: 'Layered registry of skill providers, the host+per-scope shape the tools registry established.',
+ description: 'Layered registry of skill providers, the host+per-scope shape the tools registry established. A registration files into the layer of its calling context\'s scope (scopeOf): host rows and repository plugins land in the global layer, while a plugin mounted by an agent preset\'s standing composition lands in that preset\'s layer. A read merges the global layer with the viewing scope\'s chain — the nearest layer\'s entry wins a duplicate name outright, and the rank order decides duplicates only within one layer. It exposes sorted invocation-neutral summaries and loads full skill bodies on demand.',
methods: [
{
signature: 'registerProvider(create: (control: SkillProviderControl) => SkillProvider): () => void',
- jsDoc: '/**\n * Register a borrowed same-process provider synchronously during plugin\n * apply, into the calling context\'s layer: a scoped context (an agent\n * preset\'s standing mount) registers for that scope alone, an unscoped\n * context registers globally. Duplicate names within one layer and reserved\n * names throw; remote initialization belongs in `list()`. Fiber disposal\n * unregisters the provider and invalidates catalog caches.\n * @param create - synchronous factory receiving this registration\'s lifecycle and invalidation control.\n * @returns the exact Cordis effect disposer that unregisters this provider;\n * composite effects may yield it directly to preserve teardown ordering.\n */',
+ description: 'Register a borrowed same-process provider synchronously during plugin apply, into the calling context\'s layer: a scoped context (an agent preset\'s standing mount) registers for that scope alone, an unscoped context registers globally. Duplicate names within one layer and reserved names throw; remote initialization belongs in `list()`. Fiber disposal unregisters the provider and invalidates catalog caches.',
+ parameters: [{ name: 'create', description: 'synchronous factory receiving this registration\'s lifecycle and invalidation control.' }],
+ returns: 'the exact Cordis effect disposer that unregisters this provider; composite effects may yield it directly to preserve teardown ordering.',
},
{
signature: 'register(skill: SkillRegistration): () => void',
- jsDoc: '/**\n * Register a borrowed readonly runtime skill into the calling context\'s\n * layer. Project entries outrank runtime entries, which outrank user\n * entries, within one layer. Same-name runtime entries in one layer are\n * first-wins; a duplicate logs a warning and receives a no-op disposer so\n * it cannot remove the winner.\n * @param skill - the skill definition input; omitted invocation and provider fields receive defaults.\n * @returns the exact Cordis effect disposer, preserving composite teardown order and invalidating caches.\n */',
+ description: 'Register a borrowed readonly runtime skill into the calling context\'s layer. Project entries outrank runtime entries, which outrank user entries, within one layer. Same-name runtime entries in one layer are first-wins; a duplicate logs a warning and receives a no-op disposer so it cannot remove the winner.',
+ parameters: [{ name: 'skill', description: 'the skill definition input; omitted invocation and provider fields receive defaults.' }],
+ returns: 'the exact Cordis effect disposer, preserving composite teardown order and invalidating caches.',
},
{
signature: 'async list(options: SkillViewOptions = {}): Promise',
- jsDoc: '/**\n * List invocation-neutral skill summaries for a workspace. Consumers apply\n * model or user invocation policy at their operational boundary. Lookup\n * options and provider candidates are readonly same-process values borrowed\n * throughout discovery.\n * @param options - view options; `scope` selects the viewing agent\'s layers, `cwd` selects project roots, and `signal` cancels discovery.\n * @returns all sorted winning summaries.\n */',
+ description: 'List invocation-neutral skill summaries for a workspace. Consumers apply model or user invocation policy at their operational boundary. Lookup options and provider candidates are readonly same-process values borrowed throughout discovery.',
+ parameters: [{ name: 'options', description: 'view options; `scope` selects the viewing agent\'s layers, `cwd` selects project roots, and `signal` cancels discovery.' }],
+ returns: 'all sorted winning summaries.',
},
{
signature: 'async snapshot(options: SkillViewOptions = {}): Promise',
- jsDoc: '/**\n * Observe the current invocation-neutral catalog and whether discovery completed within a stable revision.\n * Incomplete observations are never cached, allowing consumers to retain last-good state and\n * retry on their next request boundary.\n * @param options - view options; `scope` selects the viewing agent\'s layers, `cwd` selects project roots, and `signal` cancels discovery.\n * @returns sorted summaries plus discovery-completeness state.\n */',
+ description: 'Observe the current invocation-neutral catalog and whether discovery completed within a stable revision. Incomplete observations are never cached, allowing consumers to retain last-good state and retry on their next request boundary.',
+ parameters: [{ name: 'options', description: 'view options; `scope` selects the viewing agent\'s layers, `cwd` selects project roots, and `signal` cancels discovery.' }],
+ returns: 'sorted summaries plus discovery-completeness state.',
},
{
signature: 'async get(name: string, options: SkillViewOptions = {}): Promise',
- jsDoc: '/**\n * Load and validate the winning candidate, passing its opaque discovery locator back to the\n * provider. Cancellation is rechecked after selection, including cache hits, and raced against\n * loading so an uncooperative provider cannot hang the caller.\n * @param name - kebab-case skill name.\n * @param options - view options; `scope` selects the viewing agent\'s layers,\n * `cwd` selects workspace-sensitive skills, and `signal` cancels work.\n * @returns the full skill, including body content, or `undefined`.\n */',
+ description: 'Load and validate the winning candidate, passing its opaque discovery locator back to the provider. Cancellation is rechecked after selection, including cache hits, and raced against loading so an uncooperative provider cannot hang the caller.',
+ parameters: [{ name: 'name', description: 'kebab-case skill name.' }, { name: 'options', description: 'view options; `scope` selects the viewing agent\'s layers, `cwd` selects workspace-sensitive skills, and `signal` cancels work.' }],
+ returns: 'the full skill, including body content, or `undefined`.',
},
],
},
{
key: 'spillStore',
summary: 'Abstract spill storage service.',
+ description: 'Abstract spill storage service. Subclass, implement saveText, and load the subclass as a plugin — it registers as `ctx.spillStore` (one implementation per context; loading a second throws, cordis\' standard duplicate-service behavior).\n\nSemantics every implementation must honor:\n\n- saveText persists the FULL `content` verbatim and returns an opaque locator, exact byte length, and model-facing retrieval guidance.\n- Storage is scoped by the request\'s SaveTextSpill.owner session; the backend chooses a private (not world-readable) location and a collision-free name derived from — never equal to — the caller\'s `suggestedName`.\n- `saveText` REJECTS on a real storage failure (permissions, ENOSPC, backend unavailable); the caller decides how to degrade (the spill policy treats a rejection as best-effort and keeps the inline result).',
methods: [
{
signature: 'abstract saveText(input: SaveTextSpill): Promise',
- jsDoc: '/**\n * Persist `input.content` to a session-scoped spill artifact.\n * @param input - the owner, caller-supplied source fields, suggested name, and full text to save.\n * @returns the saved artifact\'s {@link SpillRef}; rejects on a storage failure.\n */',
+ description: 'Persist `input.content` to a session-scoped spill artifact.',
+ parameters: [{ name: 'input', description: 'the owner, caller-supplied source fields, suggested name, and full text to save.' }],
+ returns: 'the saved artifact\'s {@link SpillRef}; rejects on a storage failure.',
},
],
},
{
key: 'storage',
summary: 'The storage hub service.',
+ description: 'The storage hub service. Backends register under `backend`; data forms mount under their `StorageForms` key and are reached as `ctx.storage.