Merge branch 'master' into code-mode-ui/dispatch-spill

scripts/clean.spec.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
@@ -59,4 +59,21 @@ describe('RepositoryCleaner', () => {
     await expect(new RepositoryCleaner(root).clean()).rejects.toThrow('packages/removed/ghost/notes.txt')
     expect(existsSync(join(root, 'products/shell/lib'))).toBe(true)
   })
+
+  it('refuses project outputs reached through a symlink outside the repository', async () => {
+    const root = fixture()
+    const externalProject = fixture()
+    write(join(root, 'tsconfig.json'), JSON.stringify({ files: [], references: [{ path: './linked' }] }))
+    write(join(externalProject, 'tsconfig.json'), JSON.stringify({
+      compilerOptions: { composite: true, outDir: 'lib/types' },
+      include: ['src'],
+    }))
+    write(join(externalProject, 'src/index.ts'), 'export {}\n')
+    write(join(externalProject, 'lib/types/index.js'))
+    symlinkSync(externalProject, join(root, 'linked'), process.platform === 'win32' ? 'junction' : 'dir')
+
+    await expect(new RepositoryCleaner(root).clean()).rejects.toThrow('outside repository')
+
+    expect(existsSync(join(externalProject, 'lib/types/index.js'))).toBe(true)
+  })
 })

scripts/clean.ts

@@ -1,4 +1,4 @@
-import { lstat, readdir, rm } from 'node:fs/promises'
+import { lstat, readdir, realpath, rm } from 'node:fs/promises'
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import ts from 'typescript'
@@ -45,7 +45,11 @@ function parseConfig(configPath: string): ts.ParsedCommandLine {
 
 /** Plans and removes repository-owned build output without crossing the repository boundary. */
 export class RepositoryCleaner {
-  constructor(private readonly root: string) {}
+  private readonly root: string
+
+  constructor(root: string) {
+    this.root = resolve(root)
+  }
 
   /**
    * Remove generated build state and package directories containing only known residue.
@@ -61,9 +65,10 @@ export class RepositoryCleaner {
   private async plan(): Promise<string[]> {
     const targets = new Set<string>()
     const unsafeOrphans: string[] = []
+    const canonicalRoot = await realpath(this.root)
 
     // These checks cover legacy root-level incremental state emitted by older configs.
-    await this.addIfPresent(targets, join(this.root, '.typecheck'))
+    await this.addIfPresent(targets, join(this.root, '.typecheck'), canonicalRoot)
     for (const entry of await readdir(this.root, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.endsWith('.tsbuildinfo')) targets.add(join(this.root, entry.name))
     }
@@ -72,7 +77,7 @@ export class RepositoryCleaner {
     // Each emitting project declares lib/types as outDir; its parent lib also owns
     // the sibling runtime bundles, so the complete build output root is removed.
     for (const outputDirectory of this.buildOutputDirectories()) {
-      await this.addIfPresent(targets, outputDirectory)
+      await this.addIfPresent(targets, outputDirectory, canonicalRoot)
     }
 
     for (const groupDirectory of await childDirectories(join(this.root, 'packages'))) {
@@ -90,7 +95,7 @@ export class RepositoryCleaner {
         if (unknown.length > 0) {
           unsafeOrphans.push(...unknown.map(entry => repositoryPath(this.root, join(packageDirectory, entry))))
         } else {
-          targets.add(packageDirectory)
+          await this.addIfPresent(targets, packageDirectory, canonicalRoot)
         }
       }
     }
@@ -137,15 +142,24 @@ export class RepositoryCleaner {
   }
 
   private assertRepositoryTarget(path: string): void {
-    const repositoryRelative = relative(this.root, path)
+    this.assertDescendant(this.root, path, path)
+  }
+
+  private assertDescendant(root: string, path: string, displayPath: string): void {
+    const repositoryRelative = relative(root, path)
     if (repositoryRelative === '' || repositoryRelative === '..' || repositoryRelative.startsWith(`..${sep}`) || isAbsolute(repositoryRelative)) {
-      throw new Error(`clean: refusing build output outside repository: ${path}`)
+      throw new Error(`clean: refusing deletion target outside repository: ${displayPath}`)
     }
   }
 
-  private async addIfPresent(targets: Set<string>, path: string): Promise<void> {
+  private async addIfPresent(targets: Set<string>, path: string, canonicalRoot: string): Promise<void> {
     // Missing outputs are normal on a clean checkout; only existing paths become deletion targets.
-    if (await exists(path)) targets.add(path)
+    if (!await exists(path)) return
+    // Resolve the parent rather than the final entry: rm unlinks a final symlink,
+    // but a symlink in an ancestor would make deletion cross the repository boundary.
+    const canonicalParent = await realpath(dirname(path))
+    this.assertDescendant(canonicalRoot, join(canonicalParent, basename(path)), path)
+    targets.add(path)
   }
 }
 

scripts/gen-doc-graphs.ts

@@ -365,9 +365,10 @@ const SERVICE_ROLES: ServiceRole[] = [
     key: 'tasks',
     pkg: 'tasks',
     title: 'Background task registry',
-    mode: 'core',
+    mode: 'seam',
+    implementations: ['tasks-local'],
     consumers: ['tool-bash', 'tool-pty', 'tool-subagent', 'tool-tasks'],
-    note: 'Producers (background bash, PTY sends, and subagent delegations) register running work; tool-tasks is the model-facing control surface that reads, lists, and kills it.',
+    note: 'Producers (background bash, PTY sends, and subagent delegations) register running work; tool-tasks is the model-facing control surface that reads, lists, and kills it; tasks-local is the process-local registry.',
   },
   {
     key: 'web',

scripts/gen-tool-catalog.ts

@@ -29,7 +29,7 @@ import SubagentService from '@deepseek-ai/dsh-subagent'
 import type { SubagentProvider } from '@deepseek-ai/dsh-subagent'
 import SkillService from '@deepseek-ai/dsh-skill'
 import * as SkillLocal from '@deepseek-ai/dsh-skill-local'
-import TaskService from '@deepseek-ai/dsh-tasks'
+import LocalTaskService from '@deepseek-ai/dsh-tasks-local'
 import * as ToolAskUser from '@deepseek-ai/dsh-tool-ask-user'
 import * as ToolBash from '@deepseek-ai/dsh-tool-bash'
 import * as ToolCordis from '@deepseek-ai/dsh-tool-cordis'
@@ -355,7 +355,7 @@ const TOOL_PACKAGES: ToolPackage[] = [
     requires: ['ctx.tools', 'ctx.tasks', 'ctx.systemPrompt'],
     writes: ['tool/call', 'tool/result', 'user/message via agent.inject() for background completion notices'],
     async mount(ctx) {
-      await ctx.plugin(TaskService)
+      await ctx.plugin(LocalTaskService)
       await ctx.plugin(ToolTasks)
     },
     note:

scripts/verify-package-readme-model-experience.ts

@@ -96,6 +96,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/support/llm-mock-server': { kind: 'none', reason: 'The test server substitutes provider wire behavior without invoking a real model.' },
   'packages/support/llm-replay': { kind: 'none', reason: 'The keyless adapter invokes no provider model.' },
   'packages/tasks/tasks': { kind: 'indirect', reason: 'Producer and control-surface plugins own all model rendering over the task registry.' },
+  'packages/tasks/tasks-local': { kind: 'indirect', reason: 'The registry backend delegates model rendering to producer plugins and dsh-tool-tasks.' },
   'packages/examples/acp-demo': { kind: 'indirect', reason: 'The app bundle delegates request composition to dsh-agent-spine-demo and dsh-acp.' },
   'packages/ui/app-boot': { kind: 'indirect', reason: 'Only the loaded plugin tree contributes model context.' },
   'packages/examples/jsonrpc-demo': { kind: 'indirect', reason: 'Only the externally configured plugin tree contributes model context.' },