fix(invariants): assert runtime relationships, not API shapes

packages/ui/permission/src/invariant.ts

@@ -1,34 +1,29 @@
-/** Package-owned runtime contract checks for `@deepseek-ai/dsh-permission`. @module @deepseek-ai/dsh-permission/invariant */
+/** Package-owned permission-preset event invariants. @module @deepseek-ai/dsh-permission/invariant */
 
 import type { Context } from 'cordis'
-import { observePluginInvariant, type InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
+import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 
 const PACKAGE_NAME = '@deepseek-ai/dsh-permission'
 
 /** Cordis companion plugin name. */
 export const name = 'permission-invariant'
-/** Services required before the companion can register. */
+/** Service required before the companion can reserve package ownership. */
 export const inject = ['invariants']
 
-/** Install checks for this package's active plugin fibers. */
-const install: InvariantInstaller = (ctx, fail) => {
-  observePluginInvariant(ctx, fail, {
-    name: 'PermissionService',
-    inject: [
-      'bash',
-      'approval',
-    ],
-    effects: [
-      'ctx.provide("permission")',
-    ],
-    services: [
-      'permission',
-    ],
-  })
-}
+/** Install validation that durable preset events remain resolvable. */
+const install: InvariantInstaller = Object.assign((ctx: Context, fail: (message: string) => never) => {
+  ctx.on('internal/dispatch', (_mode, eventName, args) => {
+    if (eventName !== 'session/event') return
+    const event = (args as [Session, SessionEvent])[1]
+    if (event.type === 'permission/preset' && !ctx.permission.names.includes(event.data.preset)) {
+      fail(`permission/preset names unknown preset ${JSON.stringify(event.data.preset)}`)
+    }
+  }, { global: true })
+}, { inject: ['permission'] })
 
 /**
- * Register this package's invariant companion.
+ * Register the permission invariant companion.
  * @param ctx - Cordis context carrying the invariant service.
  * @returns the installed registration's disposer after setup succeeds.
  */

packages/ui/permission/tests/invariant.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import { Context, Service } from 'cordis'
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
+import * as PermissionInvariant from '@deepseek-ai/dsh-permission/invariant'
+import InvariantService from '@deepseek-ai/dsh-invariants'
+
+class PermissionProbe extends Service {
+  readonly names = ['safe', 'trusted']
+
+  constructor(ctx: Context) {
+    super(ctx, 'permission')
+  }
+}
+
+async function setup(): Promise<Context> {
+  const ctx = new Context()
+  await ctx.plugin(PermissionProbe)
+  await ctx.plugin(InvariantService)
+  await ctx.plugin(PermissionInvariant)
+  return ctx
+}
+
+function presetEvent(preset: string): SessionEvent {
+  return { type: 'permission/preset', seq: 0, time: 0, data: { preset } }
+}
+
+describe('permission invariants', () => {
+  it('accepts configured preset events and ignores other session data', async () => {
+    const ctx = await setup()
+    expect(() => { ctx.emit('session/event', {} as Session, presetEvent('safe')) }).not.toThrow()
+    expect(() => { ctx.emit('session/event', {} as Session, {
+      type: 'turn/end', seq: 0, time: 0, data: {},
+    } as SessionEvent) }).not.toThrow()
+    expect(() => { ctx.emit('tools/change') }).not.toThrow()
+  })
+
+  it('rejects a durable preset that the active table cannot resolve', async () => {
+    const ctx = await setup()
+    expect(() => { ctx.emit('session/event', {} as Session, presetEvent('missing')) })
+      .toThrow(/unknown preset "missing"/)
+  })
+})