Replace the single DSH_CI_FAILOVER variable with two independent
switches so an outage on one platform no longer retargets the other:
- DSH_CI_FAILOVER_LINUX: the three required Linux workers (node-24,
node-24-coverage, node-24-consumers) and the all-checks-passed verdict,
which resolves its pool to vm-backup and keeps its concurrency and
cache-restore branches.
- DSH_CI_FAILOVER_WINDOWS: the non-blocking windows-native job, which
resolves to the dsh-win-ci pool.
all-checks-passed rides the Linux switch because it aggregates the
required Linux workers and runs on the vm-backup pool. The Dependabot
exclusion is preserved on both switches. The failover runbook (EN/ZH)
and its translation pairing, plus the docs that referenced the old
variable, are updated in the same change.
The failover Windows pool releases child-process and antivirus file
handles slower than the hosted pool; a 1-second window (10 x 100 ms)
still exhausts before release under load, so install-lefthook fixture
cleanup threw EPERM in rmSync. A 10-second window (50 x 200 ms) covers
the slower release without pinning afterEach cleanup, since a
terminated child's handles drain once rather than reacquire.
cancel-in-progress is evaluated against the newly triggered run, so
exempting push means one master merge does not cancel the drill still
running from the previous one — not that a drill always finishes. A
benchmark dispatched on master shares the group and does cancel a
mid-flight drill. Record that bound in the runbook and drop the
overstated wording from the workflow comment and the spec name.
Also repair two gates that fail on master and block every pull request:
the telemetry note referenced an SDK proposal deleted in 408721954a,
and the ui-settings-general README pair carried stale recorded hashes
after both sides were updated together in aa1ec02bc6.
The two self-hosted standby drills each run their complete unsharded
aggregate with one gate worker, which takes longer than the interval
between master merges, so unconditional cancel-in-progress supersedes a
drill before it reaches a verdict and the lane yields no readiness
evidence for the failover runbook to point a responder at.
Exempt push and nothing else. This has to be decided at workflow level:
cancellation applies to the whole superseded run, so a job-level
concurrency group cannot exempt its job. The negated form is
load-bearing — naming pull_request alone would also stop cancelling
workflow_dispatch, and each runner benchmark fans out to twelve larger
runners for up to fifteen minutes in this same group on master, so a
re-dispatch would queue ahead of a drill instead of replacing a stale
measurement. It does not promise every push run finishes: a newer
pending run still displaces an older one, only that the lanes
periodically reach a verdict.
A master push carries only wine-apt-cache and the two drills; every other
job is pull-request-gated, workflow_dispatch-gated, or if: false. The
spec pins that set and classifies by exact condition, since a negated
event test mentions the event it excludes.
The merge conflict resolution kept the master-side snapshot which had
the old DSH_TELEMETRY_DISABLED=1 text. Regenerated to match the current
README.md which uses DSH_TELEMETRY_MODE=FEEDBACK_ONLY/FULL.
Keep both Remote contributions master and this branch add: the mount loop
now carries commandsRemote, goalsRemote, pluginInventoryRemote, and
messageFeedbackRemote, with both new tsconfig references retained.
Adapt to two contract changes master introduced:
- The generated Remote face now wraps every business result in
RemoteResult, folding carrier failures into an ok:false branch instead
of rejecting. The controller reads that envelope at its three call
sites and maps a carrier failure onto the same settled shape the
controls already render; three specs cover the new branch.
- Client packages split their tsconfig into host and client halves, and
the host aggregate now compiles any test not named *.client.spec.*.
Rename this package's specs to the client convention and drop the
../connection project reference, which pointed at a solution file that
no longer carries the client sources.
Keep master's mount loop with its rollback-on-failure in api-remotes and
add messageFeedbackRemote to it.
The source-through-tsx fallback in windowsAclRunnerInvocation was only
reachable while sandbox-windows-acl/lib/runner.js was absent, so the
per-file 100% gate failed wherever a gate had already built it. In
ci-primary and ci-windows-complete the typert-contracts gate runs
build:lib:host ahead of test:coverage in one workspace, leaving both
fallback statements uncovered; the sharded coverage job never builds
first and stayed green.
Cover the fallback through an injected entry path that is guaranteed not
to exist, and keep the uninjected case asserting only the verdict that
holds under either arm. Verified at 100% statements/branches/functions/
lines with lib/runner.js both present and absent.
Resolve the note-erasure race the review found: a control that rendered
before the first list read held no item and passed note=undefined, so
switching a rating silently dropped the stored note. The controller now
owns note resolution and toggle-vs-retract, deciding from the committed
item inside the serialized mutation, and clearNote expresses deletion.
Also from review:
- serialize the reconnect re-read behind queued mutations (resync), so a
list reply cannot resurrect a version a newer mutation replaced
- re-check disposal after the seeding read, so an unloaded fiber never
reaches the wire
- drop Object.freeze on Maps, which does not prevent set/delete
- declare the @deepseek-ai/dsh-client-connection dependency it imports
- surface a failed list load in the controls
- drop the /client value exports that had no consumer
- state the per-turn render scope in the README and subsystem pages
- align the package version with the root
wireSchemas() already advertised only run_code under mode: 'code', but the
executor resolved every call through get(), which returns the full visible
map plus the reserved transport. A model could name a native tool directly
and bypass run_code entirely. Route the execution-path lookups through a
new private resolveExecution() that applies the mode collapse at the
operation boundary: model-direct calls under 'code' may only name run_code
(UNKNOWN_TOOL otherwise), while SDK sub-dispatches (parent token set) keep
every visible tool. get()/schemas() public semantics are unchanged.
The denial happens at createExecution, before the extensible policy
pipeline — pre-execute listeners, approval ask, and guards never observe
a call that is deterministically denied. A collapsed call honors the
pre-dispatch cancellation contract, routes aborted results through the
visible tool's finalizeContent, and captures the finalizer before
argument materialization.
Regenerated docs, catalogs, graphs, scoped events, re-recorded
translation pairs, and updated test assertions.
Fixes#1815
LegGasai noted that filtering prompt sections by tool:* prefix is a poor
heuristic: it conflates section naming convention with presentation
semantics and would incorrectly drop tool:structured_output. The executor
collapse already enforces the boundary — a model-direct native call is
rejected as UNKNOWN_TOOL regardless of what the prompt says, so filtering
the prompt adds no security and only risks losing useful guidance.
The tool:read/tool:bash/etc sections describe capability usage patterns
that apply to both native and code presentations, and keeping them does
not reopen the native direct-call path because the executor blocks it.
wireSchemas() already advertised only run_code under mode: 'code', but the
executor resolved every call through get(), which returns the full visible
map plus the reserved transport. A model could name a native tool directly
and bypass run_code entirely. Route the execution-path lookups through a
new private resolveExecution() that applies the mode collapse at the
operation boundary: model-direct calls under 'code' may only name run_code
(UNKNOWN_TOOL otherwise), while SDK sub-dispatches (parent token set) keep
every visible tool. get()/schemas() public semantics are unchanged.
The denial happens at createExecution, before the extensible policy
pipeline — pre-execute listeners, approval ask, and guards never observe
a call that is deterministically denied. A collapsed call honors the
pre-dispatch cancellation contract, routes aborted results through the
visible tool's finalizeContent, and captures the finalizer before
argument materialization.
Under code mode, a system-prompt/assemble listener filters out tool:*
guidance sections that told the model to call native tools directly.
The tools:sdk section and SDK types remain so programs can still use
all tools through run_code.
Regenerated docs, catalogs, graphs, scoped events, and re-recorded
translation pairs.
Fixes#1815
wireSchemas() already advertised only run_code under mode: 'code', but the
executor resolved every call through get(), which returns the full visible
map plus the reserved transport. A model could name a native tool directly
and bypass run_code entirely. Route the execution-path lookups through a
new private resolveExecution() that applies the mode collapse at the
operation boundary: model-direct calls under 'code' may only name run_code
(UNKNOWN_TOOL otherwise), while SDK sub-dispatches (parent token set) keep
every visible tool. get()/schemas() public semantics are unchanged.
The denial happens at createExecution, before the extensible policy
pipeline — pre-execute listeners, approval ask, and guards never observe
a call that is deterministically denied. A collapsed call honors the
pre-dispatch cancellation contract, routes aborted results through the
visible tool's finalizeContent, and captures the finalizer before
argument materialization.
Under code mode, a system-prompt/assemble listener filters out tool:*
guidance sections that told the model to call native tools directly.
The tools:sdk section and SDK types remain so programs can still use
all tools through run_code.
Fixes#1815
Resolve additive conflicts in the api-remotes client assembly by keeping
both the message-feedback remote mount and master's forwarded-event
allowlist, and regenerate the module graph.
Cover the reachable controller and control branches: each failure code's
copy, dispose-during-flight, non-Error rejections, and non-conflict
mutation failures.
Two paths were unreachable rather than untested, so remove them instead:
commit() cannot run after disposal because mutate() refuses admission
first, and the mutation tail cannot reject because every queued operation
settles as a result. Pass the recorded rating into the note save so the
editor's render site proves it exists.
Record the measured numbers (23 snapshot files, 26 assistant messages)
instead of the estimate, and document why the E2E hovers the unrated
control before asserting the restored state.
Consume the durable message-feedback sidecar from #2217 in the browser:
per-message Like/Dislike with an optional note, contributed through a
declared assistant-actions slot.
- carry MessageId on finalized AssistantMessageNode so a target is nameable
- declare conversation.chat.assistant-actions and render it in the
IconActions row between copy and branch
- hold one FeedbackController per Session with per-item ifVersion CAS,
reconciling a version-conflict from the reply's authoritative item
- mount messageFeedbackRemote alongside goalsRemote
Resolve three conflicts:
- packages/bundle/base/tests/base.spec.ts: keep both assertion sets — this
branch's telemetry-otel mode expression and master's subagent rows plus
manifest dependencies.
- packages/session/session-telemetry-otel/tests/otel.spec.ts: keep master's
per-mode sharing disclosure test, but select FULL explicitly instead of
relying on an omitted mode, because the default is now DISABLED; the
default-construction test keeps asserting disabled delivery and gains a
case pinning that an omitted mode reports 'disabled' sharing.
- scripts/snapshots/translation-prompt-v4/request-response.expected.json:
re-recorded from the merged READMEs rather than hand-merging the embedded
document text.
Split the deferred resolver into its own function so the v8 ignore covers
only the production resolver arm, leaving the security-relevant
deps.consent precedence branch enforced at 100% branch coverage. Assert
the frozen-allow path so both sides of that branch are exercised, and
document the caller obligation on reportCommandTelemetry and
resolveTelemetryConsent.
dsh-sdk resolved launcher telemetry consent in the finally block, after
startSDK had already loaded the project .env into process.env, so a
project file or project code could grant reporting of its own cordis.yml
and package.json. Freeze the decision from the launching environment
before dispatch and pass it to the reporter; an unsupported mode denies
instead of throwing because telemetry may never change a command result.
Configuration source ownership denies the whole DSH_* namespace to
discovered files, so the launcher must not read a mutated environment.
Switch the afterEach cleanup from rmSync to the async rm with 10
retries, matching subagent-claude-code. On native Windows the
synchronous rmSync retry window (5 x 100ms) is too short for the
real Codex subprocess to release its directory handles after exit,
so cleanup repeatedly fails with EPERM; the async variant with a
wider retry window drains the handles before removing the tree.
Replace the non-standard '无条件下报' with '无条件外发' in the default-off
note, and complete the welcome-notice descriptions in the note and the
ui-settings-general READMEs to mention the FULL launcher telemetry
disclosure. Re-record bilingual pairing hashes.
Cover the hosted Windows-pool outage in scope, add the dsh-win-ci pool description (32 scheduled-task runner instances, 96-core machine, Git Bash on PATH prerequisite), and update the switch to retarget all five jobs (three Linux workers, native Windows, all-checks-passed).
The FULL opt-in also enables dsh-sdk command telemetry (anonymous ID,
command result, redacted project configuration), which the welcome
notice and root README did not disclose. Update onboarding copy, bump
WELCOME_NOTICE_VERSION, sync the welcome and translation-prompt
snapshots, and re-record bilingual pairing hashes. Also de-duplicate
'reported by default' in the default-off Agent Note.
The repo's user-visible copy (root README, welcome notice) still
describes internal testing, so 'entering public beta' was an unrecorded
fact and contradicted this PR's own copy. Problem now states the recorded
facts: internal testing mounted telemetry with a baked-in production
endpoint and both feeds reported by default to help diagnose problems,
so a fresh installation exported without a positive deployment choice.
Consequences returns to the phase-independent statement.
Problem now explains that DSH is entering public beta and default-off is
the appropriate stance for that phase — consistent with internal testing
having default-on for diagnostics. Update Consequences to match.
The /feedback acknowledgement now appends a sharing-policy sentence after the
anonymous user id. The seeded-history e2e regex anchored on the end of the
User line, and the golden snapshot did not include the disclosure. Update both
to match the new format, and re-record the module-graph translation-pairing
hash after rebasing onto master (which picked up the windows-native ACL
coverage fix in #2182).
Regenerates the ack golden for the merged acknowledgement format, records
the zh counterparts and pairing hashes for the telemetry and catalog
pages, and restores the command-feedback to session-telemetry edge and
dependency in the module graph.
The post-rebase cleanup removes leftover conflict-marker lines and the
superseded acknowledgement text from the command source, re-adds the
session-telemetry project reference, and restores the lockfile importer
link for the sharing dependency.
The feedback-command e2e now drives the recorded prompt through a separate
all-modes test that arms whenTurnSettled before sending and writes the
fixture back via recordFixture in record mode; the acknowledgement golden
test runs only in replay/refresh. The scaffold restores the pinned DSH_HOME
on the persistence-root setup failure path, and the telemetry subsystems
page links the README's sharing-disclosure anchor.
The /feedback acknowledgement now echoes the receiving session id and
reports the mounted telemetry backend's sharing policy: the telemetry seam
exposes a backend-independent TelemetrySharingStatus through a required
abstract sharing member on the Telemetry service, the OTel backend maps its
mode onto it, and the command appends one policy-only sharing sentence
(full / feedback-only / disabled / not configured) to the acknowledgement.
The web client renders the text through the existing command row without a
client change; a new assembled-browser e2e mounts the shipped telemetry row
in FULL mode against a local dead endpoint and pins the shipped default
sentence as a keyless golden.
Restore the Wine-emulated windows job as the required pull-request
Windows signal. Add DSH_CI_FAILOVER switch to windows-native so it
retargets onto the self-hosted [self-hosted, dsh-win-ci, windows]
pool under failover. Enable serial-windows as a master-only
self-hosted standby mirroring serial-linux-selfhosted.
The windows-native job remains absent from all-checks-passed.needs —
Wine owns the required verdict, native Windows reports independently.
Restore wine-apt-cache, wine-windows-gates.sh, check:windows-wine
script, and the original Agent Note topology.
- Fix relative links to archived native-windows-pull-request-ci note
(../../archived/ not ../archived/ from implemented/process/)
- Replace dangling reference to nonexistent
2026-08-10-unified-windows-selfhosted-ci.md with the archived note
- Seal archived note triplet in manifest.json
- Update i18n consistency sidecars
Resolve modify/delete conflict on
.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.i18n.yaml:
accept deletion — the note triplet was archived to archived/process/.
- Rewrite ci-workflow.spec.ts to assert new single-job native Windows topology
- Remove check:windows-wine from root AGENTS.md command list
- Archive 2026-08-08-native-windows-pull-request-ci (dual-lane topology
superseded) with Archived: metadata and inbound-link updates
- Update cross-references in serial-cross-platform-ci-reference,
portable-required-pull-request-ci, and pnpm-action-setup notes
- Add Windows pool coverage to the failover runbook (EN + zh)
- Remove dead wine-windows-gates.sh
- Remove unnecessary Playwright Chromium install from serial-windows
- Fix .github/AGENTS.md windows-* label wording
- Fix PR description before-state accuracy
Replace the Wine-emulated windows job and the independent windows-native
job with a single required native Windows job that runs
check:ci:windows-complete on the hosted larger runner, falling back to
the self-hosted [self-hosted, dsh-win-ci, windows] pool under failover
(DSH_CI_FAILOVER=selfhosted). The serial-windows standby mirrors
serial-linux-selfhosted: master-only, unsharded, self-hosted, absent
from all-checks-passed.
Remove wine-apt-cache, the check:windows-wine script reference, and the
dual-lane topology the two Windows notes described.
Enable serial-windows to execute the complete check:ci on the in-house
self-hosted Windows pool instead of the disabled hosted windows-2025
lane. Point the job at [self-hosted, dsh-win-ci, windows] and wire it
into all-checks-passed so it gates pull requests.
The Wine-emulated windows job remains the required win32 signal for
PRs that cannot reach the self-hosted pool; this lane adds a real
native-Windows run where one is available.
The inline comment called every dunder entry "the Python backend's" slot,
but `__debug__` is a CPython compile-time constant, not a seeded slot;
align the comment with the seam declaration, which is the single home for
why each entry is reserved.
- index.ts: RESERVED_ERROR_MEMBERS JSDoc now says `__x__` (non-empty
middle), matching DUNDER_MEMBER and the derivative docs; and
PORTABLE_RESERVED_WORDS is described as covering portable *target*
languages (Python is a later-PR backend, not yet shipped).
- types.ts + type-equiv docs: CodeBindingNamespace.global points to
RESERVED_BINDING_GLOBALS by name with an `e.g.` sample rather than
enumerating the set (single home), no longer implying `__debug__` is a
seeded slot.
- Agent Note: separate `__debug__` (CPython compile-time constant) from
the seeded bootstrap globals.
- README (en/zh): document the four exported exclusion sets and the
portable identifier/naming contract — no cross-package link needed.
- Regenerate cordis services catalog for the shifted source line.
- Agent Note: correct the stale worker-adoption paragraph — the worker
consumes the seam constants directly by name (no RESERVED_WORDS /
RESERVED_ERROR_PROPERTIES re-alias) — and describe DUNDER_MEMBER as
`__x__` (non-empty middle).
- types.ts: document RESERVED_BINDING_GLOBALS on CodeBindingNamespace.global
(names like `__dsh_main__` pass the identifier rule but are still refused)
and the non-empty-middle dunder rule on memberNameProperty; propagate to
the type-equiv derivative docs (both languages, re-recorded).
`____` has an empty middle between the two `__` pairs and does not match
`/^__.+__$/`; assert that (not a match) and add `__x__` as the shortest
real dunder form that does.
- Worker consumes PORTABLE_RESERVED_WORDS / RESERVED_ERROR_MEMBERS by
their seam names directly, dropping the local re-alias (symmetry with
the other two imported constants).
- Split the reserved-vs-duplicate diagnostics: a backend-owned global now
reports "reserved binding global", not the misleading "duplicate".
- DUNDER_MEMBER uses `__.+__` so a bare `__` (empty middle, not a real
CPython dunder) is not matched; add coverage.
- Worker misuse tests add `a$b` (second-char `$`) and `lambda` (Python
keyword) so the identifier narrowing and reserved-word adoption are
each pinned directly, not only transitively.
- Clarify the seam JSDoc (dunder-vs-explicit-set wording, Python backend
is a later stack PR) and record in the Agent Note the obligation to
widen RESERVED_BINDING_GLOBALS when the bootstrap seeds more globals.
Update the type-equiv blocks in docs/core-data-structures/code-runtime
(both languages, re-recorded) to mirror the new CodeBindingNamespace /
CodeBindingErrorClass JSDoc, and regenerate the cordis services catalog
for the shifted source line. Keeps the worker-only intro until the
Python backend package exists.
Move the reserved-word, reserved-global, reserved-error-member, and
dunder exclusion sets from the worker backend up to the code-runtime
seam package, and narrow the portable identifier subset to drop the
JS-only `$`. Every backend now imports one contract so a binding
namespace list valid on one backend is valid on all.
Delivers only the seam extension and the worker's adoption; the Python
backend, py-types renderer, and Code Mode language dispatch are later
PRs in the stack that depend on these exports.
ed30088adb deleted packages/ui/tui, so the two present-tense clauses naming
it in notes this branch already rewrites no longer describe HEAD. The
operative claim — the surfaces beyond the web row needed no change — stands
without naming the package. Pair hashes re-recorded.
Also anchor tool-row-styles.spec.ts's rule lookup at a rule boundary, so a
compound selector landing above a base rule fails loud instead of reading
the wrong declaration block.
`flex: none` stops the `+n` box shrinking but not its text wrapping, so a
row too narrow for title + separator + suffix broke the one-line summary in
the exact case the slot exists for. Add `white-space: nowrap` and pin the
declaration as CSS text, since jsdom has no layout.
Also align the README's row illustration with the English rendering (the
same sentence's plan-strip clause already used it), and record the two
deferred review findings in the Agent Note so they survive merge.
planSummary treated whitespace-only content as nameable, so a rejected call
whose args survive verbatim rendered a blank active clause beside a live +N.
The tool's own rule is trimmed non-empty; the row now uses it.
Also hoists the duplicated DSH_SNAPSHOT refresh flag out of the two assembled
snapshot files into their shared assembled-boot scaffolding.
ea2fc29530 gave the assistant footer separators flanking spaces, so the
accessible text reads `{{clock}} Ran for {{duration}}`. The CJK-strong and
inline-code-link goldens were recorded on a base that predates it and merged
without a re-record; master's push runs skip the snapshot lane, so nothing
caught the drift until a branch merged both. Every other golden already
carries the space.
Chinesezjc