Merge branch 'master' into fix/web-zstd-session-logs

packages/bash/tool-bash/README.md

@@ -49,6 +49,8 @@ The overlay is computed from the current `ToolExecution` and passed through the
 
 Result text contains stdout, an optional `[stderr]` section, then applicable sandbox-denial, timeout, signal, exit-code, and truncation markers. Timeout is reported independently of final exit status; nonzero exit remains a model-interpreted result rather than `isError`. Truncation links a safe complete spill file or reports it unavailable. Only infrastructure failures such as spawn errors and aborts produce `isError`.
 
+The canonical success is `{ kind: 'foreground', ...BashRunResult }` for a completed foreground process or `{ kind: 'background', taskId }` for a published task. The Native renderer preserves the text above, including exactly `started background task <id>`; programmatic consumers use the typed fields without parsing those strings. Executor stream caps remain acquisition limits on `BashRunResult` and carry their spill paths.
+
 When `run_in_background` is true, this plugin preflights `ctx.tasks.start()` before spawning, registers the calling agent as owner, and adapts the returned `BashProcess` handle into generic cancel/done/incremental-output hooks. The task runtime owns ids, cross-session isolation, completion notices, waiting, and disposal cleanup; this plugin only maps bash exit/sandbox facts into task output and outcome detail. `enableRunInBackground: false` removes the parameter and rejects a forced background call at execution time.
 
 ## UI presentation

packages/bash/tool-bash/src/index.ts

@@ -11,8 +11,9 @@
 import { Service, type Context } from 'cordis'
 import z from 'schemastery'
 import { isAbsolute, resolve as resolvePath } from 'node:path'
-import { defineTool } from '@deepseek-ai/dsh-tools'
+import { defineTool, TOOL_ABORTED } from '@deepseek-ai/dsh-tools'
 import type { GenericCallView, TerminalCallView, ToolExecution, ToolResult, ToolResultView } from '@deepseek-ai/dsh-tools'
+import { HarnessError } from '@deepseek-ai/dsh-llm'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-session-persistence'
 import type {} from '@deepseek-ai/dsh-system-prompt'
@@ -22,7 +23,7 @@ import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandb
 import { ESCALATION_TARGETS, approveEscalation, canonicalPath, validateEscalationArgs } from '@deepseek-ai/dsh-sandbox'
 import type { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
 import { DSH_ENV_PREFIX } from '@deepseek-ai/dsh-bash'
-import type { DshEnvironment, DshEnvironmentKey } from '@deepseek-ai/dsh-bash'
+import type { BashRunResult, DshEnvironment, DshEnvironmentKey } from '@deepseek-ai/dsh-bash'
 import { DSH_HOME_ENV, resolveDshHome } from '@deepseek-ai/dsh-paths'
 import { processOutcome } from './background.ts'
 import { parseExitStatus, renderProcessRead, renderResult } from './render.ts'
@@ -206,7 +207,7 @@ export class BashEnvRegistry extends Service {
   }
 }
 
-/** Parsed tool args; execute validates value constraints absent from SchemaSpec. */
+/** Parsed tool args; execute validates value constraints absent from ParameterSchemaSpec. */
 interface BashToolArgs {
   command: string
   description: string
@@ -318,6 +319,38 @@ function resolveWorkdir(
   return modelWorkdir
 }
 
+/** Detach the executor DTO from readonly seam interfaces into plain JSON data. */
+function canonicalBashResult(result: BashRunResult) {
+  const output = (stream: BashRunResult['stdout']) => ({
+    text: stream.text,
+    truncated: stream.truncated,
+    ...stream.spillPath !== undefined ? { spillPath: stream.spillPath } : {},
+  })
+  return {
+    exitCode: result.exitCode,
+    signal: result.signal,
+    timedOut: result.timedOut,
+    aborted: result.aborted,
+    timeoutMs: result.timeoutMs,
+    stdout: output(result.stdout),
+    stderr: output(result.stderr),
+    ...result.sandbox !== undefined ? {
+      sandbox: {
+        mode: result.sandbox.mode,
+        denied: result.sandbox.denied,
+        ...result.sandbox.enforcement !== undefined ? { enforcement: result.sandbox.enforcement } : {},
+        ...result.sandbox.runnerFailed !== undefined ? { runnerFailed: result.sandbox.runnerFailed } : {},
+      },
+    } : {},
+  }
+}
+
+/** Canonical background-handle properties shared by the bash output union. */
+const BACKGROUND_OUTPUT_PROPERTIES = {
+  kind: { type: 'string', required: true, const: 'background' },
+  taskId: { type: 'string', required: true },
+} as const
+
 export function apply(ctx: Context, config: Config = {}): void {
   const bashEnv = new BashEnvRegistry(ctx, config)
   bashEnv.register({
@@ -415,6 +448,65 @@ export function apply(ctx: Context, config: Config = {}): void {
         },
       } : {},
     },
+    output: {
+      schema: {
+        oneOf: [
+          {
+            type: 'object',
+            additionalProperties: false,
+            properties: BACKGROUND_OUTPUT_PROPERTIES,
+          },
+          {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              kind: { type: 'string', required: true, const: 'foreground' },
+              exitCode: { required: true, oneOf: [{ type: 'integer' }, { type: 'null' }] },
+              signal: { required: true, oneOf: [{ type: 'string' }, { type: 'null' }] },
+              timedOut: { type: 'boolean', required: true },
+              aborted: { type: 'boolean', required: true },
+              timeoutMs: { type: 'number', required: true },
+              stdout: {
+                type: 'object',
+                additionalProperties: false,
+                required: true,
+                properties: {
+                  text: { type: 'string', required: true },
+                  truncated: { type: 'boolean', required: true },
+                  spillPath: { type: 'string' },
+                },
+              },
+              stderr: {
+                type: 'object',
+                additionalProperties: false,
+                required: true,
+                properties: {
+                  text: { type: 'string', required: true },
+                  truncated: { type: 'boolean', required: true },
+                  spillPath: { type: 'string' },
+                },
+              },
+              sandbox: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                  mode: { type: 'string', required: true },
+                  denied: { type: 'boolean', required: true },
+                  enforcement: { type: 'string' },
+                  runnerFailed: { type: 'boolean' },
+                },
+              },
+            },
+          },
+        ],
+      },
+      render: (_args, value) => [{
+        type: 'text',
+        text: value.kind === 'background'
+          ? `started background task ${value.taskId}`
+          : renderResult(value as { kind: 'foreground' } & BashRunResult, escalationModes),
+      }],
+    },
     async execute(args: BashToolArgs, exec) {
       validateBashArgs(args)
       // Description is display metadata; workdir defaults to the caller's session.
@@ -444,7 +536,11 @@ export function apply(ctx: Context, config: Config = {}): void {
           throw new Error('background tasks unavailable: load @deepseek-ai/dsh-tasks and @deepseek-ai/dsh-tool-tasks')
         }
         // The caller owns cancellation until TaskService commits detached ownership.
-        if (exec.signal.aborted) return []
+        if (exec.signal.aborted) {
+          const error = new HarnessError('tool call aborted', TOOL_ABORTED)
+          error.name = 'AbortError'
+          throw error
+        }
         // Task preflight finishes before the starter can spawn a process.
         const id = tasks.start({
           kind: 'bash',
@@ -459,14 +555,14 @@ export function apply(ctx: Context, config: Config = {}): void {
             }
           },
         })
-        return [{ type: 'text', text: `started background task ${id}` }]
+        return { kind: 'background' as const, taskId: id }
       }
       const result = await ctx.bash.run(ctx.bash.resolve({
         ...request,
         signal: exec.signal,
       }))
       if (result.aborted) throw new Error('command aborted')
-      return [{ type: 'text', text: renderResult(result, escalationModes) }]
+      return { kind: 'foreground' as const, ...canonicalBashResult(result) }
     },
     presentCall: presentBashCall,
     presentResult: presentBashResult,

packages/bash/tool-bash/tests/tools.spec.ts

@@ -122,7 +122,13 @@ class RecordingSandboxExecutor extends BashExecutor {
       timeoutMs: spec.timeoutMs,
       stdout: { text: 'ok', truncated: false },
       stderr: { text: '', truncated: false },
-      sandbox: { mode: spec.sandboxPolicy?.mode ?? 'read-only', denied: false },
+      sandbox: {
+        mode: spec.sandboxPolicy?.mode ?? 'read-only',
+        denied: false,
+        ...spec.command === 'without optional sandbox facts'
+          ? {}
+          : { enforcement: 'full' as const, runnerFailed: false },
+      },
     })
   }
 
@@ -213,6 +219,16 @@ describe('bash tool', () => {
     const ctx = await setup()
     const result = await call(ctx, 'bash', { command: 'echo hello', description: 'test command' })
     expect(result.isError).toBe(false)
+    if (result.isError) throw new Error('expected bash success')
+    expect(result.value).toMatchObject({
+      kind: 'foreground',
+      exitCode: 0,
+      signal: null,
+      timedOut: false,
+      aborted: false,
+      stdout: { text: 'hello\n', truncated: false },
+      stderr: { text: '', truncated: false },
+    })
     expect(text(result)).toBe('hello\n')
   })
 
@@ -296,7 +312,7 @@ describe('bash tool', () => {
   })
 
   // Type and required-key violations are rejected by the harness
-  // (defineTool validates against the SchemaSpec — the arg-validation Agent Note) before execute.
+  // (defineTool validates against the ParameterSchemaSpec — the arg-validation Agent Note) before execute.
   it.each([
     [{}, /missing required property "command"/],
     [{ command: 42, description: 'd' }, /"command" must be a string/],
@@ -312,7 +328,7 @@ describe('bash tool', () => {
     expect(text(result)).toMatch(pattern)
   })
 
-  // Value constraints the SchemaSpec can't express stay in the tool body.
+  // Value constraints the ParameterSchemaSpec can't express stay in the tool body.
   it.each([
     [{ command: '  ', description: 'd' }, /invalid command/],
     [{ command: 'x', description: '   ' }, /invalid description/],
@@ -408,6 +424,8 @@ describe('background execution through the task runtime', () => {
     const ctx = await setupWithTasks()
     const started = await call(ctx, 'bash', { command: 'echo bg-ok', description: 'test command', run_in_background: true })
     expect(started.isError).toBe(false)
+    if (started.isError) throw new Error('expected background bash success')
+    expect(started.value).toEqual({ kind: 'background', taskId: 'bash-1' })
     expect(text(started)).toBe('started background task bash-1')
 
     const read = await callUntilText(ctx, 'task_output', { task_id: 'bash-1' }, 'bg-ok')
@@ -479,7 +497,10 @@ describe('background execution through the task runtime', () => {
       signal: controller.signal,
     })
     expect(result.isError).toBe(true)
-    expect(result.error).toEqual({ name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH })
+    expect(result.error).toEqual({
+      message: 'tool call aborted before dispatch',
+      info: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH },
+    })
     expect(text(result)).toBe('Error: tool call aborted before dispatch')
     expect((ctx.bash as CountingStartExecutor).starts).toBe(0)
   })
@@ -633,7 +654,10 @@ describe('sandbox escalation through the generic task producer', () => {
       signal: controller.signal,
     })
 
-    expect(result.error).toEqual({ name: 'AbortError', code: TOOL_ABORTED })
+    expect(result.error).toEqual({
+      message: 'tool call aborted',
+      info: { name: 'AbortError', code: TOOL_ABORTED },
+    })
     expect(text(result)).toBe('Error: tool call aborted')
     expect(start).not.toHaveBeenCalled()
   })
@@ -647,6 +671,22 @@ describe('sandbox escalation through the generic task producer', () => {
     expect(bash.modes).toEqual(['workspace-write', 'danger-full-access'])
   })
 
+  it('omits sandbox facts the executor did not acquire from the canonical result', async () => {
+    const { ctx } = await setupSandboxed()
+    const result = await call(ctx, 'bash', {
+      command: 'without optional sandbox facts',
+      description: 'exercise optional sandbox facts',
+    })
+
+    if (result.isError) throw new Error('expected foreground bash success')
+    expect(result.value).toMatchObject({
+      kind: 'foreground',
+      sandbox: { mode: 'read-only', denied: false },
+    })
+    expect((result.value as { sandbox: object }).sandbox).not.toHaveProperty('enforcement')
+    expect((result.value as { sandbox: object }).sandbox).not.toHaveProperty('runnerFailed')
+  })
+
   it('keeps the exhaustiveness backstop for a rogue approval implementation', async () => {
     const { ctx } = await setupSandboxed(true)
     ctx.approval.request = () => Promise.resolve('rogue' as ApprovalOutcome)

packages/client/AGENTS.md

@@ -9,7 +9,7 @@ Packages here are named with the directory prefix: `@deepseek-ai/dsh-client-<nam
 The [slot system standard](../../.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md) owns the full design; these are the rules you must not violate when writing or reviewing client code:
 
 1. **One API**: a plugin composes UI only through `ctx.slots.register({ name, children?, store?, inject? }, Component)`. There is no separate slot-definition call, no whitelist face object, no face-minting helper. The shell alone renders `'root'`.
-2. **children = declaration + authorization**: the slots your component renders are exactly the keys of your register call's `children` object (spec values: `kind`/`scope`). Rendering a slot you didn't declare, or declaring one someone else declared, fails at load — do not work around it; the conflict is the design speaking.
+2. **children = declaration + authorization**: the slots your component renders are exactly the keys of your register call's `children` object (spec values: `kind`/`scope`). Rendering a slot you didn't declare, or declaring one someone else declared, fails at load — do not work around it; the conflict is the design speaking. Slot names mirror the composition path: `<domain>.<entry>.<hole>` (e.g. `'conversation.chat.toolview'`).
 3. **Component props are the four shares, all derived**: `PropsRuntime<K>` (SlotMap: owner params + `useSession`/`sessionId` on session scope + `useSessions`) & `PropsRenderSlots<S>` (children keys) & `PropsStore<H>` (store factory) & the inject face. Never hand-write a member a share already derives; never re-type a share locally.
 4. **Hooks are framework-made only**: `useSession`, `useSessions`, `useStore`, `renderSlot` are the four seats. Business code never creates a hook or selector as a prop value — pass plain data and callbacks. (Component-internal behavioral hooks that subscribe to nothing external are fine.)
 5. **Live data has exactly three channels**: parent knows it → owner props at the renderSlot site; only the component knows it → local state; shared across entries or survives remounts → a store declared at register. Derived data is a pure function over framework-hook data (`useMemo`), never its own subscription.
@@ -20,9 +20,9 @@ The [slot system standard](../../.agents/notes/implemented/architecture/2026-07-
 
 The `/client` surface of a UI plugin package is a contract face, not a convenience barrel. Three rules, enforced package-wide (do not restate them as per-file comments):
 
-1. **A UI plugin exports no values beyond what cordis loading needs** — `apply` / `inject` (and `Config` where present), plus store factories consumed type-only by components (`ReturnType<typeof createXXXStore>`). Types are the extra allowance: contract types (owner shares, injected shapes, view/toolview entry types) export freely. Implementation components, pure helpers, constants, and store handles stay internal. Adding any new value export requires user sign-off, not a matching consumer.
+1. **A UI plugin exports no values beyond what cordis loading needs** — `apply` / `inject` (and `Config` where present), plus store factories consumed type-only by components (`ReturnType<typeof createXXXStore>`). Types are the extra allowance: contract types (owner shares, injected shapes, composed props aliases) export freely. Implementation components, pure helpers, constants, and store handles stay internal. Adding any new value export requires user sign-off, not a matching consumer.
 2. **Same-package tests import internals directly** — relative `../src/client/xxx.ts` from package tests, or the `./src/*` subpath where a spec lives outside the package. Never widen the public surface to make a test compile.
-3. **Cross-package imports of another plugin's symbols are in principle forbidden.** The sanctioned routes are the slot system (register/renderSlot, the view and toolview registries) and ctx services. If neither fits, stop and escalate — do not add an export to unblock yourself.
+3. **Cross-package imports of another plugin's symbols are in principle forbidden.** The sanctioned routes are the slot system (register/renderSlot) and ctx services. If neither fits, stop and escalate — do not add an export to unblock yourself.
 
 ## ctx discipline (components never see ctx)
 
@@ -45,7 +45,7 @@ Non-negotiables across the layers:
 
 ## Directory regime (plugin packages)
 
-One UI feature = one plugin package (`src/client/` browser half). A multi-domain package splits by future package boundaries — ui-conversation is the exemplar: `contract/` (the only shared face), domain directories that never import a sibling domain, and `apply.ts` as the single cross-domain assembly point; `scripts/verify-client-domain-graph.ts` enforces the levels. Registration goes through the slot/view/toolview registries in `apply` — never module-level side effects.
+One UI feature = one plugin package (`src/client/` browser half). A multi-domain package splits by future package boundaries — ui-conversation is the exemplar: `contract/` (the only shared face), domain directories that never import a sibling domain, and `apply.ts` as the single cross-domain assembly point; `scripts/verify-client-domain-graph.ts` enforces the levels. Registration goes through `slots.register` in `apply` — never module-level side effects.
 
 ## Styling
 

packages/client/runtime/README.md

@@ -13,6 +13,6 @@ None; this package neither assembles nor sends a provider request.
 ## Known Limitations and Deferred Work
 
 - **`loader.unload` is a stub (throws not-implemented)** — the full chain (fiber dispose → registration cascade → style removal) lands with the HMR project.
-- **Scope teardown is watch-approximated** — the most recently resolved binding stands in for "who is watching"; a removed-while-watched session's scope survives until the watch moves away, not until true observer count reaches zero.
+- **Scope teardown is stage-driven, single-occupant today** — the staged session follows `list.current` exactly (staging is the open signal: the event window opens ⟺ the session is on stage); a removed-while-staged session's scope survives frozen until the stage moves on, not until true observer count reaches zero. Resolution (`cell()`/`binding()`/`scope()`) is pure addressing, render-safe. The staged state can widen to a multi-pane list when concurrent panes land.
 - **Value imports of this package from plugin bundles must use the `/client` subpath** — the bare package name is not in the loader externals table and inlines a second module instance, whose private scope-tag Symbol never matches (the empty-state P0 postmortem).
 - **`SessionSummary.title` is a display projection** — the wire summary carries no title yet; the cwd basename stands in, then the raw id.

packages/client/runtime/src/client/index.ts

@@ -51,7 +51,7 @@ export type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
  */
 export type ClientContext = Context
 
-/** The conversation-snapshot selector hook (ConvViewProps/ToolViewProps take this). */
+/** The conversation-snapshot selector hook (ConvViewProps/ToolRowProps take this). */
 export type UseConversationSession = SnapshotSelectorHook<ConversationSnapshot>
 
 /**

packages/client/runtime/src/client/sessions/service.ts

@@ -5,13 +5,14 @@
  * slot-parity design), session scope tree (mintScope pattern: no-op plugin
  * Fiber + ctx.extend scope tag), stable SessionBinding cache, ancestry walk.
  *
- * Scope lifecycle is watch-driven: a scope is minted lazily on first
- * resolution; a session leaving the list tears its scope down only when
- * nobody is watching it. "Watched" is approximated as the most recently
- * resolved binding id — SessionProvider re-resolves on every selection
- * change (keyed remount), so a switch away always re-evaluates the deferred
- * teardown; a host-side death without list removal keeps the scope (frozen
- * read-only view).
+ * Scope lifecycle is stage-driven: a scope is minted lazily on first
+ * resolution (pure — resolution has no side effects and is render-safe);
+ * the event window and deferred teardown key off the STAGED session, which
+ * follows `list.current` exactly. Staging is the open signal: the window
+ * opens ⟺ the session is on stage (today the stage is `current`; the staged
+ * state can widen to a multi-pane list later). A session leaving the list
+ * tears its scope down immediately unless it is the staged one, whose scope
+ * survives frozen (read-only view) until the stage moves on.
  */
 import type { Context, Fiber } from 'cordis'
 import type { IApiClient, SessionId } from '@deepseek-ai/dsh-client-connection/client'
@@ -97,9 +98,14 @@ export class SessionsService {
   private readonly selection: SnapshotStore<{ sessionId?: SessionId }>
 
   private readonly scopes = new Map<SessionId, ScopeRecord>()
-  /** Most recently resolved binding id — the watch approximation for deferred teardown. */
+  /**
+   * The staged session id — follows `list.current` exactly, holding its last
+   * defined value across masked gaps (a transiently absent selection blanks
+   * `current` without moving the stage, so reconnect re-pulls and removals
+   * keep the staged scope's frozen view alive until the stage moves on).
+   */
   private watched: SessionId | undefined
-  /** Removed-while-watched sessions whose teardown waits for the watch to move away. */
+  /** Removed-while-staged sessions whose teardown waits for the stage to move away. */
   private readonly deferredRemovals = new Set<SessionId>()
 
   /**
@@ -115,6 +121,13 @@ export class SessionsService {
     // The manager owns wire truth; the store is its projection. Manager
     // notifications are already microtask-batched.
     this.manager.subscribe(() => { this.projectList() })
+    // Stage follower: every current write (open() and projection alike)
+    // re-evaluates staging, so startup restore (persisted selection validated
+    // by the projection) and reconnect resurfacing open their window with no
+    // dedicated code path. Safe to run synchronously inside the store notify:
+    // the follower writes no list state — session.open()'s synchronous prefix
+    // touches only session-side state and its own microtask-batched notifier.
+    this.list.subscribe(() => { this.followCurrent() })
     rootCtx.reflect.provide('sessions', this, undefined)
   }
 
@@ -152,35 +165,50 @@ export class SessionsService {
   }
 
   /**
-   * Resolve the stable session binding (SessionProvider's resolveBinding feed).
+   * Resolve the stable session binding (scope-addressed assembly feed). Pure
+   * resolution — no staging, no window side effects.
    * @param id - session id.
    * @returns binding, or undefined for a session neither listed nor already scoped.
    */
   binding(id: SessionId): SessionBinding | undefined {
-    const record = this.resolve(id)
-    if (record === undefined) return undefined
-    if (this.watched !== id) {
-      this.watched = id
-      this.sweepDeferred()
-    }
-    return record.binding
+    return this.resolve(id)?.binding
   }
 
   /**
    * Resolve the render-layer session cell (SessionProvider's feed through
-   * the renderer host; ctx never enters the render layer). Marks the session
-   * watched, same as {@link SessionsService.binding}.
+   * the renderer host; ctx never enters the render layer). Pure resolution —
+   * render-safe: SessionProvider calls this during render, so no staging, no
+   * window side effects (StrictMode double-invokes and concurrent discarded
+   * passes must stay free).
    * @param id - session id.
    * @returns cell, or undefined for a session neither listed nor already scoped.
    */
   cell(id: string): SessionCell | undefined {
-    const record = this.resolve(id as SessionId)
-    if (record === undefined) return undefined
-    if (this.watched !== id) {
-      this.watched = id as SessionId
-      this.sweepDeferred()
+    return this.resolve(id as SessionId)?.cell
+  }
+
+  /**
+   * Move the stage to the list's current session: sweep teardowns deferred
+   * behind the previous occupant and pull the new occupant's history window.
+   * Staging IS the open signal — the window opens ⟺ the session is on stage
+   * — and open() is idempotent (an in-flight or completed open no-ops; a
+   * failed one retries the next time current is touched).
+   */
+  private followCurrent(): void {
+    const current = this.list.getSnapshot().current
+    // A masked gap (current blanked while the selection's session is
+    // transiently absent) holds the stage: tearing down on the gap would
+    // destroy exactly the frozen scope the mask exists to preserve.
+    if (current === undefined || current === this.watched) return
+    this.watched = current
+    this.sweepDeferred()
+    const record = this.resolve(current)
+    /* v8 ignore next 3 -- defensive: current is always a listed id (open()
+     * validates and the projection masks absent selections), so resolve
+     * cannot miss; kept so a future current writer cannot crash the notify. */
+    if (record !== undefined) {
+      void record.binding.session.open()
     }
-    return record.cell
   }
 
   /**
@@ -246,7 +274,7 @@ export class SessionsService {
     this.pruneScopes(byId)
   }
 
-  /** Tear down scopes for removed sessions nobody watches; the watched one defers until the watch moves. */
+  /** Tear down scopes for removed sessions off stage; the staged one defers until the stage moves. */
   private pruneScopes(byId: Record<SessionId, SessionSummary>): void {
     for (const [id, record] of this.scopes) {
       if (byId[id] !== undefined) continue
@@ -268,11 +296,11 @@ export class SessionsService {
     this.rootCtx.get('slots')?.pruneStoreScope(id)
   }
 
-  /** Run deferred teardowns whose session is no longer watched (called when the watch moves). */
+  /** Run deferred teardowns whose session is no longer staged (called when the stage moves). */
   private sweepDeferred(): void {
     for (const id of [...this.deferredRemovals]) {
-      /* v8 ignore next -- defensive: only the watched id ever defers, and every
-       * watch move sweeps first, so the set cannot contain the id the watch just
+      /* v8 ignore next -- defensive: only the staged id ever defers, and every
+       * stage move sweeps first, so the set cannot contain the id the stage just
        * moved to; kept as a guard against future extra sweep call sites. */
       if (id === this.watched) continue
       // Still absent from the list? (A re-added id cancels the deferred teardown.)

packages/client/runtime/tests/sessions-service.spec.ts

@@ -2,8 +2,9 @@
  * SessionsService: list store projection (manager → {ids, byId, current}
  * with derived titles), the migrated current-selection account (open
  * validation, persisted mask semantics, cell resolution), scope-tree
- * lifecycle (lazy mint / frozen survival / removed teardown with watch
- * deferral), binding identity, ancestry walk, create.
+ * lifecycle (lazy mint / frozen survival / removed teardown with staged
+ * deferral — the stage follows list.current), binding identity, ancestry
+ * walk, create.
  */
 import { Context } from 'cordis'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -76,21 +77,21 @@ describe('scope tree', () => {
     expect(binding?.ctx).toBe(scoped)
   })
 
-  it('tears down an unwatched removed session but defers the watched one until the watch moves', async () => {
+  it('tears down an off-stage removed session but defers the staged one until the stage moves', async () => {
     const b = bench()
     await feedList(b, [{ id: 's1' }, { id: 's2' }])
     const ctx1 = b.svc.scope(sid('s1'))
-    b.svc.binding(sid('s1')) // s1 is watched
-    b.svc.scope(sid('s2')) // s2 scoped but not watched
+    b.svc.open(sid('s1')) // s1 staged (current)
+    b.svc.scope(sid('s2')) // s2 scoped but off stage
 
-    await feedList(b, [{ id: 's1' }]) // s2 removed, unwatched: torn down
+    await feedList(b, [{ id: 's1' }]) // s2 removed, off stage: torn down
     expect(b.svc.scope(sid('s2'))).toBeUndefined()
 
-    await feedList(b, []) // s1 removed while watched: deferred, scope survives
+    await feedList(b, []) // s1 removed while staged (current masks): deferred, scope survives
     expect(b.svc.scope(sid('s1'))).toBe(ctx1)
 
     await feedList(b, [{ id: 's3' }])
-    b.svc.binding(sid('s3')) // watch moves: deferred teardown sweeps s1
+    b.svc.open(sid('s3')) // stage moves: deferred teardown sweeps s1
     expect(b.svc.scope(sid('s1'))).toBeUndefined()
   })
 
@@ -106,10 +107,10 @@ describe('scope tree', () => {
     const b = bench()
     await feedList(b, [{ id: 's1' }])
     const scoped = b.svc.scope(sid('s1'))
-    b.svc.binding(sid('s1'))
-    await feedList(b, []) // removed while watched → deferred
-    await feedList(b, [{ id: 's1' }, { id: 's2' }]) // reappears
-    b.svc.binding(sid('s2')) // watch moves; sweep must NOT tear down the re-listed s1
+    b.svc.open(sid('s1'))
+    await feedList(b, []) // removed while staged → deferred
+    await feedList(b, [{ id: 's1' }, { id: 's2' }]) // reappears (current resurfaces, stage unchanged)
+    b.svc.open(sid('s2')) // stage moves; sweep must NOT tear down the re-listed s1
     expect(b.svc.scope(sid('s1'))).toBe(scoped)
   })
 })
@@ -168,15 +169,52 @@ describe('cell (render-layer session kit)', () => {
     expect(b.svc.cell('ghost')).toBeUndefined()
   })
 
-  it('moves the watch like binding(): switching cells sweeps a deferred removal', async () => {
+  it('cell()/binding() are pure resolution: no staging, no deferred sweep', async () => {
     const b = bench()
-    await feedList(b, [{ id: 's1' }])
-    b.svc.cell('s1') // watched
-    await feedList(b, []) // removed while watched → deferred, scope survives
+    await feedList(b, [{ id: 's1' }, { id: 's2' }])
+    b.svc.open(sid('s1')) // staged
+    b.svc.cell('s2') // resolution only — must NOT move the stage
+    b.svc.binding(sid('s2'))
+    await feedList(b, [{ id: 's2' }]) // s1 removed: still staged → deferred, scope survives
     expect(b.svc.scope(sid('s1'))).toBeDefined()
-    await feedList(b, [{ id: 's2' }])
-    b.svc.cell('s2') // watch moves → sweep tears s1 down
-    expect(b.svc.scope(sid('s1'))).toBeUndefined()
+  })
+
+  it('staging (current write) opens the session event window; resolution and re-staging do not re-pull', async () => {
+    const b = bench()
+    await feedList(b, [{ id: 's1' }, { id: 's2' }])
+    const historyCalls = () => b.api.calls.filter(c => c.method === 'session.history')
+    // Resolution is addressing, not staging: no window pull.
+    b.svc.scope(sid('s1'))
+    b.svc.cell('s1')
+    b.svc.binding(sid('s1'))
+    expect(historyCalls()).toHaveLength(0)
+    b.svc.open(sid('s1'))
+    expect(historyCalls().map(c => (c.payload as { sessionId: string }).sessionId)).toEqual(['s1'])
+    // Same current again: no second pull.
+    b.svc.open(sid('s1'))
+    expect(historyCalls()).toHaveLength(1)
+    // Stage moves: the new occupant opens.
+    b.svc.open(sid('s2'))
+    expect(historyCalls().map(c => (c.payload as { sessionId: string }).sessionId)).toEqual(['s1', 's2'])
+  })
+
+  it('startup restore: a persisted selection validated by the first projection opens its window unprompted', async () => {
+    const storage = new Map<string, string>([
+      ['dsh.sessions.current', JSON.stringify({ sessionId: 's1' })],
+    ])
+    vi.stubGlobal('localStorage', {
+      getItem: (k: string) => storage.get(k) ?? null,
+      setItem: (k: string, v: string) => { storage.set(k, v) },
+    })
+    try {
+      const b = bench()
+      expect(b.api.calls.filter(c => c.method === 'session.history')).toHaveLength(0)
+      await feedList(b, [{ id: 's1' }]) // projection validates the persisted id → current lands → stage follows
+      const historyCalls = b.api.calls.filter(c => c.method === 'session.history')
+      expect(historyCalls.map(c => (c.payload as { sessionId: string }).sessionId)).toEqual(['s1'])
+    } finally {
+      vi.unstubAllGlobals()
+    }
   })
 })
 
@@ -187,12 +225,13 @@ describe('slot-store scope prune hook', () => {
     b.ctx.reflect.provide('slots', { pruneStoreScope })
     await feedList(b, [{ id: 's1' }, { id: 's2' }])
     b.svc.scope(sid('s1'))
-    b.svc.binding(sid('s2')) // s2 watched
-    await feedList(b, []) // s1 unwatched → immediate drop; s2 watched → deferred
+    b.svc.scope(sid('s2'))
+    b.svc.open(sid('s2')) // s2 staged
+    await feedList(b, []) // s1 off stage → immediate drop; s2 staged → deferred
     expect(pruneStoreScope).toHaveBeenCalledWith('s1')
     expect(pruneStoreScope).not.toHaveBeenCalledWith('s2')
     await feedList(b, [{ id: 's3' }])
-    b.svc.binding(sid('s3')) // watch moves → deferred sweep drops s2
+    b.svc.open(sid('s3')) // stage moves → deferred sweep drops s2
     expect(pruneStoreScope).toHaveBeenCalledWith('s2')
   })
 
@@ -242,44 +281,46 @@ describe('coverage tails (branch duals)', () => {
     expect(byId[sid('empty-cwd')]?.title).toBe('empty-cwd')
   })
 
-  it('binding for an unknown session returns undefined without moving the watch', async () => {
+  it('binding for an unknown session returns undefined and leaves the staged scope intact', async () => {
     const b = bench()
     await feedList(b, [{ id: 's1' }])
-    b.svc.binding(sid('s1'))
+    b.svc.open(sid('s1'))
     expect(b.svc.binding(sid('ghost'))).toBeUndefined()
-    // Watch unchanged: removing s1 defers (still watched), proving the ghost lookup did not steal the watch.
+    // Stage unchanged: removing s1 defers (still staged), proving the ghost lookup touched nothing.
     await feedList(b, [])
     expect(b.svc.scope(sid('s1'))).toBeDefined()
   })
 
-  it('sweep skips the id that is itself still watched and tolerates a scope record already gone', async () => {
+  it('a masked current gap holds the stage (no teardown, no re-open) until the stage moves', async () => {
     const b = bench()
     await feedList(b, [{ id: 's1' }])
-    b.svc.binding(sid('s1'))
-    await feedList(b, []) // deferred removal of the watched id
-    // Re-resolving the SAME watched id: sweep runs but must skip it (watched-continue branch).
-    expect(b.svc.binding(sid('s1'))).toBeDefined()
+    b.svc.open(sid('s1'))
+    const historyCalls = () => b.api.calls.filter(c => c.method === 'session.history')
+    expect(historyCalls()).toHaveLength(1)
+    await feedList(b, []) // removed while staged: current masks to undefined, stage holds → deferred
     expect(b.svc.scope(sid('s1'))).toBeDefined()
+    // Resurfacing re-projects current = s1: same stage occupant, no second pull.
+    await feedList(b, [{ id: 's1' }])
+    expect(historyCalls()).toHaveLength(1)
+    expect(b.svc.list.getSnapshot().current).toBe('s1')
   })
 
-  it('sweep hits both deferral edges: watched-id skip and an already-vacated scope record', async () => {
+  it('sweep hits both deferral edges: staged-id skip and an already-vacated scope record', async () => {
     const b = bench()
     await feedList(b, [{ id: 'a' }, { id: 'b' }])
-    b.svc.binding(sid('a'))
-    b.svc.binding(sid('b')) // watch: b; both scoped
-    await feedList(b, []) // a removed unwatched → torn immediately; b removed watched → deferred
-    // Move the watch to a THIRD id while b stays deferred: sweep now walks a
-    // set containing b (torn) — and the watched-continue branch fires when the
-    // deferral set still holds the current watch target.
+    b.svc.scope(sid('a'))
+    b.svc.open(sid('b')) // stage: b; both scoped
+    await feedList(b, []) // a removed off stage → torn immediately; b removed staged → deferred
+    // Move the stage to a THIRD id while b stays deferred: sweep walks a set
+    // containing b (torn).
     await feedList(b, [{ id: 'c' }])
-    b.svc.binding(sid('c'))
+    b.svc.open(sid('c'))
     expect(b.svc.scope(sid('b'))).toBeUndefined()
-    // Deferral for an id whose record was never minted: force-add via removed
-    // list state (scope teardown raced) — sweep must tolerate the missing record.
-    await feedList(b, [])
-    b.svc.binding(sid('c')) // c now watched+removed → deferred
+    // Deferral for an id whose record was never minted: force the deferral
+    // via removed list state — sweep must tolerate the missing record.
+    await feedList(b, []) // c removed while staged → deferred (scope exists)
     await feedList(b, [{ id: 'd' }])
-    b.svc.binding(sid('d')) // sweep tears c
+    b.svc.open(sid('d')) // sweep tears c
     expect(b.svc.scope(sid('c'))).toBeUndefined()
   })
 

packages/client/ui-conversation/README.md

@@ -1,12 +1,16 @@
 # @deepseek-ai/dsh-client-ui-conversation
 
-Conversation domain: skeleton (header/tabs/composer/empty state), chat view (grouped step-summary flow, streaming tail isolation), ctx.toolviews named registry with bash samples, minimal details panel, scope-addressed ConversationService. Contract: api-contracts v3 §7 plus the slot terminal design (store seat / props shares).
+Conversation domain: skeleton (header/tabs/composer/empty state), chat view (grouped step-summary flow, streaming tail isolation, stats line, per-tool row slot with a bash sample registrant), minimal details panel, scope-addressed ConversationService. Contract: api-contracts v3 §7 plus the slot terminal design (store seat / props shares).
+
+The view ring IS a slot: the conversation registration declares the `'conversation.view'` list slot (session scope) in its `children` table, ConversationRoot renders the active entry through its renderSlot share (`only: <active id>`), and view tabs project from the ring ledger's registration options (`id`/`order`/`label`). The chat view is this package's own ring entry; other plugins (ui-trajectory) contribute tabs through plain `ctx.slots.register` — the former package-local view registry (`registerView`/`ViewEntry`/`ConversationViewMap` and the chrome attachment table) is retired, with per-view chrome dissolved into the view components themselves.
 
 Generic tool rows classify the built-in bash, read, search, write, and edit names into dedicated visual variants. The filesystem variants render the edit icon and `Write · <path>` or `Edit · <path>` summary while retaining the shared row-to-details interaction.
 
-Per-session UI state (selection, composer draft, active view) lives in the declared chat store (`stores.ts` `createChatStore`): apply constructs one handle and passes it to both the conversation and details registrations, so the two session slots share one instance per session (selection written by conversation, read by details) and the framework owns instance lifecycle and draft persistence. Components are pure — the framework standard kit (`useSession`/`sessionId`/`useSessions`) and the store faces (`useStore`/`actions`) arrive automatically from the registration declaration; the inject factories contribute plain data and callbacks only (send/stop choreography, view registry read face, startSession chain).
+Tool rows are slots too — the standalone tool ring (`ToolViewRegistry`/`ctx.toolviews`/outlet) is retired. The chat entry declares the keyed `'conversation.chat.toolview'` hole (session scope; the key space is runtime-open); its render site dispatches per row via `entryKey: toolName` with `GenericToolCard` as the call-site `fallback`. The owner payload is the uniform `ToolRowOwnerProps` (`callId`/`toolName`/`block`/`openDetails`) and `ToolRowProps` pre-composes it with the session standard kit. A registrant is a plain plugin: `ctx.slots.register({ name: 'conversation.chat.toolview', key: '<tool>', inject? }, Row)` with `inject: ['slots', 'conversation']` as the load-order seam (apply mounts ConversationService after the chat registration, so the service being present guarantees the slot is declared); session differentiation happens inside the component (`useSessions` reading `parentId` — the bash sample is the third-party-posture exemplar). Trajectory/waterfall toolview slots share this shape and land with their own render sites (RendersCheck rejects a declaration nobody renders).
 
-`src/client/` is organized for the future package split: `contract/` is the sole inter-domain shared face (`slots.ts` composed slot props, `views.ts` view ring, `toolview.ts` tool ring, `tool-call-model.ts`); the `skeleton/`, `chat/`, and `toolviews/` domain directories import contract files and never each other; `apply.ts` is the only assembly point allowed to import all three domains. The `/client` export surface is the contract only — `apply`/`inject`, the two service classes, and the `contract/` type families; implementation components (skeleton, chat rows) and the store factory stay internal and reach the page exclusively through apply's slot registrations (tests take them via the `./src/*` subpath).
+Per-session UI state (selection, composer draft, active view) lives in the declared chat store (`stores.ts` `createChatStore`): apply constructs one handle and passes it to the conversation, chat-view, and details registrations, so the session slots share one instance per session (selection written by the chat view, read by details) and the framework owns instance lifecycle and draft persistence. Components are pure — the framework standard kit (`useSession`/`sessionId`/`useSessions`) and the store faces (`useStore`/`actions`) arrive automatically from the registration declaration; the inject factories contribute plain data and callbacks only (send/stop choreography, tab read face, details/paging callbacks, startSession chain).
+
+`src/client/` is organized for the future package split: `contract/` is the sole inter-domain shared face (`slots.ts` slot declarations + composed slot props including the tool-row contract, `views.ts` shared primitives, `tool-call-model.ts`); the `skeleton/`, `chat/`, and `toolviews/` (sample registrants) domain directories import contract files and never each other; `apply.ts` is the only assembly point allowed to import all three domains. The `/client` export surface is the contract only — `apply`/`inject`, the two service classes, and the `contract/` type families; implementation components (skeleton, chat rows) and the store factory stay internal and reach the page exclusively through apply's slot registrations (tests take them via the `./src/*` subpath).
 
 ## Model Experience
 
@@ -23,4 +27,3 @@ None; this package neither assembles nor sends a provider request.
 - **Assistant footer extensions (IconActions row, per-message paging) are reserved slots** — drawn in the design, not implemented.
 - **The sparkle icon for the others tool row is a hand-drawn approximation** — the design glyph's vector geometry is not exportable locally; promotion into ui-primitives waits on an exact export.
 - **Approval/question cards are display-only placeholders** — web-side answering (composer takeover panel) is the P-II approvals project.
-- **Module-level toolview caches are single-bundle state** — the inject cache and registry maps must reach cross-bundle consumers through the package export surface and loader module table, never by a second bundle copy.

packages/client/ui-conversation/package.json

@@ -34,7 +34,6 @@
   },
   "license": "BSD-3-Clause",
   "dependencies": {
-    "@deepseek-ai/dsh-client-i18n": "workspace:^",
     "@deepseek-ai/dsh-client-runtime": "workspace:^",
     "@deepseek-ai/dsh-client-ui-layout": "workspace:^",
     "@deepseek-ai/dsh-client-ui-primitives": "workspace:^",

packages/client/ui-conversation/src/client/apply.ts

@@ -1,39 +1,32 @@
 /**
- * Client plugin body: provide the conversation service and toolview registry,
- * register the conversation/details slot occupants and the no-session empty
- * state, and mount the chat view with its samples. Assembly only — components
- * receive everything through props: the framework standard kit and store
- * faces arrive automatically from the declarations below; the inject
- * factories contribute the plain-data-and-callbacks business face (design §5).
+ * Client plugin body: register the conversation/details slot occupants and
+ * the no-session empty state, contribute the chat entry into the
+ * 'conversation.view' ring that the conversation registration declares, then
+ * mount the conversation service (class plugin) and the bash toolview sample.
+ * Assembly only — components receive everything through props: the framework
+ * standard kit and store faces arrive automatically from the declarations
+ * below; the inject factories contribute the plain-data-and-callbacks
+ * business face (design §5). Tool rows are ordinary keyed-slot registrations
+ * into 'conversation.chat.toolview' — no dedicated registry exists.
  */
 import type { Context } from 'cordis'
 import type { BoundActions } from '@deepseek-ai/dsh-client-ui-slots'
-import type { SessionId, SessionsService, SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
-import type { LayoutService } from '@deepseek-ai/dsh-client-ui-layout/client'
-import type { I18nService } from '@deepseek-ai/dsh-client-i18n/client'
-import type { SelectionTarget } from './contract/views.ts'
-import type { ConversationInjected, DetailsInjected, EmptyStateInjected } from './contract/slots.ts'
+import type { SessionId, SessionsService } from '@deepseek-ai/dsh-client-runtime/client'
+import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
+import type { ViewTab } from './contract/views.ts'
+import type {
+  ChatViewInjected, ConversationInjected, DetailsInjected, EmptyStateInjected,
+} from './contract/slots.ts'
 import { createChatStore } from './stores.ts'
 import { ConversationService } from './service.ts'
-import { ToolViewRegistry } from './toolviews/registry.ts'
-import { childSessionScope, registerChat } from './chat/register.ts'
-import { registerBashSamples } from './toolviews/bash-sample.tsx'
+import { ChatView } from './chat/ChatView.tsx'
+import { bashToolviewSample } from './toolviews/bash-sample.tsx'
 import { ConversationRoot } from './skeleton/ConversationRoot.tsx'
 import { DetailsPanel } from './skeleton/DetailsPanel.tsx'
 import { EmptyState } from './skeleton/EmptyState.tsx'
 
 /** Required services (cordis fiber inject — the loader passes the whole export surface as an object plugin). */
-export const inject = ['slots', 'layout', 'sessions', 'i18n']
-
-/** Resolve a service via ctx.get, failing loud. Property access is reserved
- *  for contexts whose fiber declares the inject (scope fibers do not). */
-// T is the caller-named cast target; inlining `as T` per call site would scatter the budgeted cast.
-// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters
-function need<T>(ctx: Context, name: string): T {
-  const value = ctx.get(name) as T | undefined
-  if (value === undefined) throw new Error(`ui-conversation: ${name} service unavailable`)
-  return value
-}
+export const inject = ['slots', 'layout', 'sessions']
 
 /** Resolve the session-scoped conversation service (scope-addressed send/cancel), failing loud. */
 function scopedConversation(sessions: SessionsService, id: SessionId): ConversationService {
@@ -49,48 +42,46 @@ function scopedConversation(sessions: SessionsService, id: SessionId): Conversat
  * @param ctx - client root context.
  */
 export function apply(ctx: Context): void {
-  const sessions = need<SessionsService>(ctx, 'sessions')
-  const layout = need<LayoutService>(ctx, 'layout')
-  const i18n = need<I18nService>(ctx, 'i18n')
-  const slots = need<SlotsService>(ctx, 'slots')
-
-  const conversation = new ConversationService(ctx)
-  const toolviews = new ToolViewRegistry()
-  ctx.provide('toolviews', toolviews)
-
-  const t = i18n.bind('conversation')
-  // Chat view + StatsLine footer; bash samples assembled here (apply is the
-  // only cross-domain point — chat consumes the resolver face, samples come
-  // from the toolviews domain). registerView inside registerChat is already
-  // effect-scoped; the raw sample registrations need the effect wrapper to
-  // ride the fiber cascade.
-  ctx.effect(
-    () => registerChat({ conversation, toolviews, t }),
-    'ui-conversation: chat view')
-  ctx.effect(
-    () => registerBashSamples(toolviews, childSessionScope(sessions.list)),
-    'ui-conversation: bash toolview samples')
+  const sessions = ctx.sessions
+  const layout = ctx.layout
+  const slots = ctx.slots
 
   // Shared store handle, constructed here so its identity lives and dies with
-  // this fiber (a module-level handle would be a de-facto singleton). Both
-  // session-slot registrations declare it; same scope key = same instance, so
-  // conversation writes and details reads meet in one store.
-  const chat = createChatStore()
+  // this fiber (a module-level handle would be a de-facto singleton). The
+  // conversation, chat-view, and details registrations all declare it; same
+  // scope key = same instance, so chat-view selection writes and details
+  // reads meet in one store.
+  const chatStore = createChatStore()
 
+  // Tab projection over the view ring's ledger (list entries carry id/order/
+  // label as registration options; the ledger keeps them order-sorted).
+  const viewTabs = (): ViewTab[] => {
+    const tabs: ViewTab[] = []
+    for (const entry of slots.entries('conversation.view')) {
+      /* v8 ignore next -- unreachable: list registration validates id at load. */
+      if (entry.options.id === undefined) continue
+      tabs.push({ id: entry.options.id, label: entry.options.label ?? entry.options.id })
+    }
+    return tabs
+  }
+
+  // Conversation occupant. Declaring the view ring here is claiming it:
+  // ConversationRoot is the only component authorized to render the ring.
   slots.register({
     name: 'conversation',
-    store: chat,
-    inject: (sessionId: SessionId, actions: BoundActions<typeof chat>): ConversationInjected => {
-      const session = sessions.manager.get(sessionId)
+    children: { 'conversation.view': { kind: 'list', scope: 'session' } },
+    store: chatStore,
+    inject: (sessionId: SessionId, actions: BoundActions<typeof chatStore>): ConversationInjected => {
+      // History pull is NOT triggered here: the runtime sessions service opens
+      // the event window when the watch lands on the session (cell/binding
+      // resolution) — an inject factory assembles callbacks, it has no side
+      // effect on session state.
       const scoped = scopedConversation(sessions, sessionId)
-      // Watch-driven history pull: assembling the surface IS the watch signal
-      // (once per entry x session; open() is idempotent and self-recovers).
-      void session.open()
       return {
         views: {
-          list: () => conversation.views(),
-          subscribe: fn => conversation.subscribeViews(fn),
-          version: () => conversation.viewsVersion(),
+          list: viewTabs,
+          subscribe: fn => slots.subscribe('conversation.view', fn),
+          version: () => slots.getVersion('conversation.view'),
         },
         send: (text, mode) => {
           const trimmed = text.trim()
@@ -107,19 +98,46 @@ export function apply(ctx: Context): void {
             // Stop failure surfaces via snapshot.promptError; nothing to restore.
           })
         },
-        openDetails: (target: SelectionTarget) => {
-          actions.select(target)
-          layout.openDetails()
-        },
-        loadOlder: () => { void session.loadOlder() },
         open: (target: SessionId) => { sessions.open(target) },
       }
     },
   }, ConversationRoot)
 
+  // The chat view: first entry of the ring this package just declared.
+  // Declaring the keyed toolview hole here is claiming it: ChatView is the
+  // only component authorized to render per-tool rows. Shares the chat
+  // store, so its selection writes land in the same per-session instance the
+  // details panel reads.
+  slots.register({
+    name: 'conversation.view',
+    id: 'chat',
+    order: 0,
+    label: 'Chat',
+    children: { 'conversation.chat.toolview': { kind: 'keyed', scope: 'session' } },
+    store: chatStore,
+    inject: (sessionId: SessionId, actions: BoundActions<typeof chatStore>): ChatViewInjected => ({
+      openDetails: (target) => {
+        actions.select(target)
+        layout.openDetails()
+      },
+      loadOlder: () => { void sessions.manager.get(sessionId).loadOlder() },
+    }),
+  }, ChatView)
+
+  // Class-plugin mount (packages/AGENTS.md service form): the service
+  // registers itself as `conversation` and lives on its own child fiber.
+  // Mounted AFTER the chat entry register above — construction guarantee for
+  // toolview registrants using `inject: ['conversation']` as their load-order
+  // seam: the service being present implies the chat entry (and with it the
+  // 'conversation.chat.toolview' declaration) is on the ledger.
+  ctx.plugin(ConversationService)
+
+  // The bash sample rides that exact seam, in third-party posture.
+  ctx.plugin(bashToolviewSample)
+
   slots.register({
     name: 'details',
-    store: chat,
+    store: chatStore,
     inject: (): DetailsInjected => ({
       closeDetails: () => { layout.closeDetails() },
     }),
@@ -128,7 +146,15 @@ export function apply(ctx: Context): void {
   slots.register({
     name: 'conversation.empty',
     inject: (): EmptyStateInjected => ({
-      startSession: opts => conversation.startSession(opts),
+      // ctx.get, not ctx.conversation: the service mounts on this plugin's
+      // own child fiber, so it is not in the inject topology the property
+      // proxy enforces; get reads the global store and stays loud on a torn
+      // boot through the optional-chain throw below.
+      startSession: (opts) => {
+        const conversation = ctx.get('conversation')
+        if (conversation === undefined) throw new Error('ui-conversation: conversation service unavailable')
+        return conversation.startSession(opts)
+      },
     }),
   }, EmptyState)
 }

packages/client/ui-conversation/src/client/chat/AssistantMarkdown.tsx

@@ -1,8 +1,9 @@
 // AssistantMarkdown: renders assistant blocks in order — markdown text body,
 // reasoning as the figma Think summary row (expand = indented gray text),
 // other-block JSON fallback. Tool-call heads are NOT rendered here: the chat
-// view groups them into tool rows via the toolview outlet (figma step-summary
-// flow). Shared by finalized nodes and the streaming partial (pulse marker).
+// view groups them into tool rows through its keyed toolview slot (figma
+// step-summary flow). Shared by finalized nodes and the streaming partial
+// (pulse marker).
 
 import { memo } from 'react'
 import type { AssistantBlock } from '@deepseek-ai/dsh-client-runtime/client'

packages/client/ui-conversation/src/client/chat/ChatView.tsx

@@ -1,53 +1,55 @@
 // ChatView: the default conversation view — message flow with user bubbles,
 // assistant narration, tool summary rows grouped into step runs, pending
-// cards, paging and bottom-follow. Created via factory so plugin deps
-// (toolviews registry, i18n) arrive by closure, never by import.
+// cards, paging, bottom-follow, and the session stats line under the flow
+// (chrome dissolved into the view: the footer is part of what a chat view
+// IS, not registration metadata). Pure component registered directly; its
+// registration declares the keyed 'conversation.chat.toolview' hole, so tool
+// rows render through the props renderSlot share (entryKey = tool name,
+// GenericToolCard as the render-site fallback).
 //
 // Render economics (architecture RFC performance model): the list parent
 // subscribes to snapshot segments that do NOT change per streaming chunk
 // (nodes/runningCalls/pending keep their references across chunk batches), so
 // during a token storm only StreamingTail re-renders; history rows hold via
 // memo on cache-stable node slices. Selection changes re-render the parent
-// map but only rows whose own selected bit flipped.
+// map but only rows whose own selected bit flipped. renderSlot is
+// entry-identity-stable (framework binding cache), so passing it through
+// memoized rows never churns them.
 
 import {
-  memo, useLayoutEffect, useMemo, useRef, useState, type FC, type ReactNode,
+  memo, useLayoutEffect, useMemo, useRef, useState, type ReactNode,
 } from 'react'
 import type {
-  ConversationNode, ConversationSnapshot, RunningToolCall, SessionId, ToolResultNode,
+  ConversationNode, ConversationSnapshot, RunningToolCall, ToolResultNode,
 } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
 import { IconChevronDownOutline14 } from '@deepseek-ai/dsh-client-ui-primitives'
-import type { ConvViewProps, SelectionTarget, Translate } from '../contract/views.ts'
-import type { ToolViewProps } from '../contract/toolview.ts'
-import type { ToolViewResolver } from '../contract/toolview.ts'
+import type { ChatViewSlotProps } from '../contract/slots.ts'
+import type { SelectionTarget } from '../contract/views.ts'
 import { deriveChatFlow, type ChatFlowItem } from './chat-flow.ts'
 import { AssistantMarkdown } from './AssistantMarkdown.tsx'
+import { GenericToolCard } from './GenericToolCard.tsx'
 import { MessageItem } from './MessageItem.tsx'
 import { PendingCard } from './PendingCard.tsx'
-import { ToolViewOutlet } from './ToolViewOutlet.tsx'
+import { StatsLine } from './StatsLine.tsx'
 import css from './ChatView.module.css'
 
-/** Plugin-supplied closure deps (assembled in registerChat, apply world). */
-export interface ChatViewDeps {
-  toolviews: ToolViewResolver
-  t: Translate
-}
-
 const FOLLOW_THRESHOLD = 24
 
 type OpenDetails = (target: SelectionTarget) => void
 
+/** The declared toolview hole's render share (stable framework binding, passed through memoized rows). */
+type RenderToolRow = ChatViewSlotProps['renderSlot']
+
 /** ui-slots' UseSession is deliberately wide (dependency direction); the
  *  chat view narrows once to the runtime snapshot the binding actually feeds. */
 type UseConversation = SnapshotSelectorHook<ConversationSnapshot>
 
-/** One tool call row (result or running): builds the bound ToolViewProps. */
-const CallRow = memo(function CallRow({ registry, sessionId, useSession, t, callId, toolName, block, seq, onOpenDetails, selected }: {
-  registry: ToolViewResolver
-  sessionId: SessionId
-  useSession: ConvViewProps['useSession']
-  t: Translate
+/** One tool call row (result or running): dispatches through the keyed
+ *  toolview slot with the owner payload; unregistered tools fall back to
+ *  GenericToolCard at this render site. */
+const CallRow = memo(function CallRow({ renderSlot, callId, toolName, block, seq, onOpenDetails, selected }: {
+  renderSlot: RenderToolRow
   callId: string
   toolName: string
   block: ToolResultNode | RunningToolCall
@@ -56,24 +58,23 @@ const CallRow = memo(function CallRow({ registry, sessionId, useSession, t, call
   onOpenDetails: OpenDetails
   selected: boolean
 }) {
-  const viewProps = useMemo<ToolViewProps>(() => ({
-    callId, toolName, block, useSession,
-    actions: { openDetails: () => onOpenDetails({ turnSeq: seq, callId, toolName }) },
-    t,
-  }), [callId, toolName, block, useSession, seq, onOpenDetails, t])
+  const owner = useMemo(() => ({
+    callId, toolName, block,
+    openDetails: () => { onOpenDetails({ turnSeq: seq, callId, toolName }) },
+  }), [callId, toolName, block, seq, onOpenDetails])
   return (
     <div className={css.callRow} data-selected={selected || undefined}>
-      <ToolViewOutlet registry={registry} sessionId={sessionId} toolName={toolName} viewProps={viewProps} />
+      {renderSlot('conversation.chat.toolview', owner, {
+        entryKey: toolName,
+        fallback: <GenericToolCard {...owner} />,
+      })}
     </div>
   )
 })
 
 /** Consecutive tool results as one step-run group (figma VERTICAL gap10). */
-const ToolGroup = memo(function ToolGroup({ registry, sessionId, useSession, t, results, onOpenDetails, selectedCallId }: {
-  registry: ToolViewResolver
-  sessionId: SessionId
-  useSession: ConvViewProps['useSession']
-  t: Translate
+const ToolGroup = memo(function ToolGroup({ renderSlot, results, onOpenDetails, selectedCallId }: {
+  renderSlot: RenderToolRow
   results: readonly ToolResultNode[]
   onOpenDetails: OpenDetails
   /** Only set when the selected call lives in THIS group (memo economy). */
@@ -84,10 +85,7 @@ const ToolGroup = memo(function ToolGroup({ registry, sessionId, useSession, t,
       {results.map((node) => (
         <CallRow
           key={node.callId}
-          registry={registry}
-          sessionId={sessionId}
-          useSession={useSession}
-          t={t}
+          renderSlot={renderSlot}
           callId={node.callId}
           toolName={node.call?.name ?? ''}
           block={node}
@@ -114,180 +112,166 @@ function StreamingTail({ useSession, onGrow }: {
   return <AssistantMarkdown blocks={partial.blocks} streaming />
 }
 
-/**
- * Build the chat view component over plugin deps.
- * @param deps - toolview registry and bound translator.
- * @returns the ConvViewProps component registered as the chat view.
- */
-export function createChatView(deps: ChatViewDeps): FC<ConvViewProps> {
-  const { toolviews, t } = deps
+/** The chat view slot entry: pure component over the composed props (tool rows render through the declared keyed hole's renderSlot share). */
+export function ChatView({ useSession, useStore, renderSlot, openDetails, loadOlder }: ChatViewSlotProps) {
+  const nodes = useSession((s) => s.nodes)
+  const runningCalls = useSession((s) => s.runningCalls)
+  const pending = useSession((s) => s.pending)
+  const openState = useSession((s) => s.openState)
+  const openErrorMessage = useSession((s) => s.openError === null ? null : `${s.openError.message}（${s.openError.code}）`)
+  const hasMore = useSession((s) => s.hasMore)
+  const loadingOlder = useSession((s) => s.loadingOlder)
+  const selectedCallId = useStore((s) => s.selection?.callId)
 
-  return function ChatView({ sessionId, useSession: useSessionWide, useStore, actions }: ConvViewProps) {
-    const useSession = useSessionWide as UseConversation
-    const nodes = useSession((s) => s.nodes)
-    const runningCalls = useSession((s) => s.runningCalls)
-    const pending = useSession((s) => s.pending)
-    const openState = useSession((s) => s.openState)
-    const openErrorMessage = useSession((s) => s.openError === null ? null : `${s.openError.message}（${s.openError.code}）`)
-    const hasMore = useSession((s) => s.hasMore)
-    const loadingOlder = useSession((s) => s.loadingOlder)
-    const selectedCallId = useStore((s) => s.selection?.callId)
+  const items = useMemo(() => deriveChatFlow(nodes), [nodes])
 
-    const items = useMemo(() => deriveChatFlow(nodes), [nodes])
+  const listRef = useRef<HTMLDivElement | null>(null)
+  const atBottomRef = useRef(true)
+  const [atBottom, setAtBottom] = useState(true)
+  /** Paging anchor: height/position at click, compensated after the prepend lands. */
+  const anchorRef = useRef<{ h: number; t: number } | null>(null)
+  const firstSeqRef = useRef<number | null>(null)
+  const openedRef = useRef(false)
+  const lastKeyRef = useRef<string | null>(null)
 
-    const listRef = useRef<HTMLDivElement | null>(null)
-    const atBottomRef = useRef(true)
-    const [atBottom, setAtBottom] = useState(true)
-    /** Paging anchor: height/position at click, compensated after the prepend lands. */
-    const anchorRef = useRef<{ h: number; t: number } | null>(null)
-    const firstSeqRef = useRef<number | null>(null)
-    const openedRef = useRef(false)
-    const lastKeyRef = useRef<string | null>(null)
+  const firstSeq = nodes[0]?.seq ?? null
+  const lastItem = items[items.length - 1]
 
-    const firstSeq = nodes[0]?.seq ?? null
-    const lastItem = items[items.length - 1]
-
-    const toBottom = (el: HTMLDivElement): void => {
-      el.scrollTop = el.scrollHeight
-      atBottomRef.current = true
-      setAtBottom(true)
-    }
-
-    useLayoutEffect(() => {
-      const el = listRef.current
-      /* v8 ignore next -- ref-null guard: React attaches the ref before layout effects run. */
-      if (el === null) return
-      // Open completed: jump to the bottom once.
-      if (openState === 'open' && !openedRef.current) {
-        openedRef.current = true
-        toBottom(el)
-        firstSeqRef.current = firstSeq
-        lastKeyRef.current = lastItem?.key ?? null
-        return
-      }
-      // Prepend (head seq decreased): compensate by the height delta.
-      if (anchorRef.current !== null && firstSeq !== null && firstSeqRef.current !== null && firstSeq < firstSeqRef.current) {
-        el.scrollTop = anchorRef.current.t + (el.scrollHeight - anchorRef.current.h)
-        anchorRef.current = null
-        firstSeqRef.current = firstSeq
-        /* v8 ignore next -- ?? arm: a prepend adds nodes, so the flow list here is never empty. */
-        lastKeyRef.current = lastItem?.key ?? null
-        return
-      }
-      firstSeqRef.current = firstSeq
-      // Own words must be visible: a new trailing user node force-scrolls
-      // (send lives in the composer, so arrival is detected here, not armed there).
-      const lastKey = lastItem?.key ?? null
-      const appendedUser = lastKey !== lastKeyRef.current
-        && lastItem !== undefined && lastItem.kind === 'node' && lastItem.node.kind === 'user'
-      lastKeyRef.current = lastKey
-      if (appendedUser || atBottomRef.current) toBottom(el)
-    })
-
-    const onScroll = (): void => {
-      const el = listRef.current
-      /* v8 ignore next -- ref-null guard: the handler only fires on the mounted element. */
-      if (el === null) return
-      const isAtBottom = el.scrollHeight - el.scrollTop - el.clientHeight <= FOLLOW_THRESHOLD + 1
-      atBottomRef.current = isAtBottom
-      setAtBottom(isAtBottom)
-    }
-
-    // Follow streaming growth the parent never re-renders for (stable ref).
-    // The ref starts null and is assigned every render, so the placeholder
-    // initializer a function initial value would need never exists.
-    const followRef = useRef<(() => void) | null>(null)
-    followRef.current = () => {
-      const el = listRef.current
-      if (el !== null && atBottomRef.current) el.scrollTop = el.scrollHeight
-    }
-    const onGrow = useRef(() => followRef.current?.()).current
-
-    const loadOlder = (): void => {
-      const el = listRef.current
-      /* v8 ignore next -- ref-null guard: the paging button renders inside the list tree. */
-      if (el !== null) anchorRef.current = { h: el.scrollHeight, t: el.scrollTop }
-      actions.loadOlder()
-    }
-
-    const renderItem = (item: ChatFlowItem): ReactNode => {
-      if (item.kind === 'tool-group') {
-        const inGroup = selectedCallId !== undefined
-          && item.results.some((r) => r.callId === selectedCallId)
-        return (
-          <ToolGroup
-            key={item.key}
-            registry={toolviews}
-            sessionId={sessionId}
-            useSession={useSession}
-            t={t}
-            results={item.results}
-            onOpenDetails={actions.openDetails}
-            selectedCallId={inGroup ? selectedCallId : undefined}
-          />
-        )
-      }
-      const node: ConversationNode = item.node
-      if (node.kind === 'assistant') {
-        return <AssistantMarkdown key={item.key} blocks={node.blocks} streaming={false} interrupted={node.interrupted} />
-      }
-      /* v8 ignore next -- tool-result never reaches here: deriveChatFlow folds them into groups. */
-      if (node.kind === 'tool-result') return null
-      return <MessageItem key={item.key} node={node} />
-    }
-
-    return (
-      <div className={css.root}>
-        <div ref={listRef} className={css.scroll} onScroll={onScroll}>
-          <div className={css.column}>
-          {openState === 'loading' && <div className={css.hint}>载入历史…</div>}
-          {openState === 'error' && <div className={css.openError}>历史加载失败：{openErrorMessage}</div>}
-          {hasMore && (
-            <div className={css.older}>
-              <button type="button" disabled={loadingOlder} onClick={loadOlder}>
-                {loadingOlder ? '加载中…' : '加载更早'}
-              </button>
-            </div>
-          )}
-          {items.map(renderItem)}
-          <StreamingTail useSession={useSession} onGrow={onGrow} />
-          {runningCalls.length > 0 && (
-            <div className={css.toolGroup}>
-              {runningCalls.map((call) => (
-                <CallRow
-                  key={call.callId}
-                  registry={toolviews}
-                  sessionId={sessionId}
-                  useSession={useSession}
-                  t={t}
-                  callId={call.callId}
-                  toolName={call.name}
-                  block={call}
-                  seq={call.turn}
-                  onOpenDetails={actions.openDetails}
-                  selected={call.callId === selectedCallId}
-                />
-              ))}
-            </div>
-          )}
-          {pending.map((item) => <PendingCard key={item.rpcId} item={item} />)}
-          </div>
-        </div>
-        {!atBottom && (
-          <button
-            type="button"
-            className={css.toBottom}
-            aria-label="回到底部"
-            onClick={() => {
-              const el = listRef.current
-              /* v8 ignore next -- ref-null guard: the button only renders alongside the mounted list. */
-              if (el !== null) toBottom(el)
-            }}
-          >
-            <IconChevronDownOutline14 />
-          </button>
-        )}
-      </div>
-    )
+  const toBottom = (el: HTMLDivElement): void => {
+    el.scrollTop = el.scrollHeight
+    atBottomRef.current = true
+    setAtBottom(true)
   }
+
+  useLayoutEffect(() => {
+    const el = listRef.current
+    /* v8 ignore next -- ref-null guard: React attaches the ref before layout effects run. */
+    if (el === null) return
+    // Open completed: jump to the bottom once.
+    if (openState === 'open' && !openedRef.current) {
+      openedRef.current = true
+      toBottom(el)
+      firstSeqRef.current = firstSeq
+      lastKeyRef.current = lastItem?.key ?? null
+      return
+    }
+    // Prepend (head seq decreased): compensate by the height delta.
+    if (anchorRef.current !== null && firstSeq !== null && firstSeqRef.current !== null && firstSeq < firstSeqRef.current) {
+      el.scrollTop = anchorRef.current.t + (el.scrollHeight - anchorRef.current.h)
+      anchorRef.current = null
+      firstSeqRef.current = firstSeq
+      /* v8 ignore next -- ?? arm: a prepend adds nodes, so the flow list here is never empty. */
+      lastKeyRef.current = lastItem?.key ?? null
+      return
+    }
+    firstSeqRef.current = firstSeq
+    // Own words must be visible: a new trailing user node force-scrolls
+    // (send lives in the composer, so arrival is detected here, not armed there).
+    const lastKey = lastItem?.key ?? null
+    const appendedUser = lastKey !== lastKeyRef.current
+      && lastItem !== undefined && lastItem.kind === 'node' && lastItem.node.kind === 'user'
+    lastKeyRef.current = lastKey
+    if (appendedUser || atBottomRef.current) toBottom(el)
+  })
+
+  const onScroll = (): void => {
+    const el = listRef.current
+    /* v8 ignore next -- ref-null guard: the handler only fires on the mounted element. */
+    if (el === null) return
+    const isAtBottom = el.scrollHeight - el.scrollTop - el.clientHeight <= FOLLOW_THRESHOLD + 1
+    atBottomRef.current = isAtBottom
+    setAtBottom(isAtBottom)
+  }
+
+  // Follow streaming growth the parent never re-renders for (stable ref).
+  // The ref starts null and is assigned every render, so the placeholder
+  // initializer a function initial value would need never exists.
+  const followRef = useRef<(() => void) | null>(null)
+  followRef.current = () => {
+    const el = listRef.current
+    if (el !== null && atBottomRef.current) el.scrollTop = el.scrollHeight
+  }
+  const onGrow = useRef(() => followRef.current?.()).current
+
+  const loadOlderAnchored = (): void => {
+    const el = listRef.current
+    /* v8 ignore next -- ref-null guard: the paging button renders inside the list tree. */
+    if (el !== null) anchorRef.current = { h: el.scrollHeight, t: el.scrollTop }
+    loadOlder()
+  }
+
+  const renderItem = (item: ChatFlowItem): ReactNode => {
+    if (item.kind === 'tool-group') {
+      const inGroup = selectedCallId !== undefined
+        && item.results.some((r) => r.callId === selectedCallId)
+      return (
+        <ToolGroup
+          key={item.key}
+          renderSlot={renderSlot}
+          results={item.results}
+          onOpenDetails={openDetails}
+          selectedCallId={inGroup ? selectedCallId : undefined}
+        />
+      )
+    }
+    const node: ConversationNode = item.node
+    if (node.kind === 'assistant') {
+      return <AssistantMarkdown key={item.key} blocks={node.blocks} streaming={false} interrupted={node.interrupted} />
+    }
+    /* v8 ignore next -- tool-result never reaches here: deriveChatFlow folds them into groups. */
+    if (node.kind === 'tool-result') return null
+    return <MessageItem key={item.key} node={node} />
+  }
+
+  return (
+    <div className={css.root}>
+      <div ref={listRef} className={css.scroll} onScroll={onScroll}>
+        <div className={css.column}>
+        {openState === 'loading' && <div className={css.hint}>载入历史…</div>}
+        {openState === 'error' && <div className={css.openError}>历史加载失败：{openErrorMessage}</div>}
+        {hasMore && (
+          <div className={css.older}>
+            <button type="button" disabled={loadingOlder} onClick={loadOlderAnchored}>
+              {loadingOlder ? '加载中…' : '加载更早'}
+            </button>
+          </div>
+        )}
+        {items.map(renderItem)}
+        <StreamingTail useSession={useSession} onGrow={onGrow} />
+        {runningCalls.length > 0 && (
+          <div className={css.toolGroup}>
+            {runningCalls.map((call) => (
+              <CallRow
+                key={call.callId}
+                renderSlot={renderSlot}
+                callId={call.callId}
+                toolName={call.name}
+                block={call}
+                seq={call.turn}
+                onOpenDetails={openDetails}
+                selected={call.callId === selectedCallId}
+              />
+            ))}
+          </div>
+        )}
+        {pending.map((item) => <PendingCard key={item.rpcId} item={item} />)}
+        </div>
+      </div>
+      <StatsLine useSession={useSession} />
+      {!atBottom && (
+        <button
+          type="button"
+          className={css.toBottom}
+          aria-label="回到底部"
+          onClick={() => {
+            const el = listRef.current
+            /* v8 ignore next -- ref-null guard: the button only renders alongside the mounted list. */
+            if (el !== null) toBottom(el)
+          }}
+        >
+          <IconChevronDownOutline14 />
+        </button>
+      )}
+    </div>
+  )
 }

packages/client/ui-conversation/src/client/chat/GenericToolCard.tsx

@@ -1,13 +1,15 @@
-// GenericToolCard: the registry-miss fallback toolview — classifies the tool
-// into one of the five figma row variants and renders the summary row. Also
-// the shared base the bash sample builds on: any ToolViewProps consumer.
+// GenericToolCard: the default tool row — classifies the tool into one of
+// the five figma row variants and renders the summary row. Supplied by the
+// chat view as the keyed toolview slot's render-site fallback (an
+// unregistered tool name lands here); registrants may also compose it as a
+// base, feeding the same owner payload through.
 
 import type { ReactNode } from 'react'
 import {
   IconApiOutline14, IconBrowseOutline16, IconEditOutline16, IconSearchOutline16, IconThinkOutline14,
 } from '@deepseek-ai/dsh-client-ui-primitives'
-import type { ToolViewProps } from '../contract/toolview.ts'
-import { toolRowModel, type ToolCallBlock, type ToolRowVariant } from '../contract/tool-call-model.ts'
+import type { ToolRowOwnerProps } from '../contract/slots.ts'
+import { toolRowModel, type ToolRowVariant } from '../contract/tool-call-model.ts'
 import { ToolRow } from './ToolRow.tsx'
 import { IconSparkle16 } from './IconSparkle16.tsx'
 
@@ -22,8 +24,8 @@ const VARIANT_ICONS: Record<ToolRowVariant, ReactNode> = {
   others: <IconSparkle16 />,
 }
 
-export function GenericToolCard({ toolName, block, actions }: ToolViewProps) {
-  const model = toolRowModel(toolName, block as ToolCallBlock)
+export function GenericToolCard({ toolName, block, openDetails }: ToolRowOwnerProps) {
+  const model = toolRowModel(toolName, block)
   return (
     <ToolRow
       variant={model.variant}
@@ -32,7 +34,7 @@ export function GenericToolCard({ toolName, block, actions }: ToolViewProps) {
       summary={model.summary}
       body={model.body}
       state={model.state}
-      onOpenDetails={actions.openDetails}
+      onOpenDetails={openDetails}
     />
   )
 }

packages/client/ui-conversation/src/client/chat/StatsLine.tsx

@@ -1,14 +1,13 @@
 // StatsLine: the session stats row (figma 122:11212 "cache hit 92% · 1,284
-// tokens · 45.2s · 5 turns · 32 steps"), mounted as the chat view's
-// chrome.footer — the first chrome-attachment consumer. Duration has no data
-// source in P-I (ledger). Subscribes to `nodes` only: chunk batches never swap
-// that reference, so the row renders zero times during streaming (the RFC
-// performance model's acceptance row).
+// tokens · 45.2s · 5 turns · 32 steps"), rendered by ChatView under the flow
+// (part of the chat view body — the chrome attachment mechanism retired with
+// the view ring). Duration has no data source in P-I (ledger). Subscribes to
+// `nodes` only: chunk batches never swap that reference, so the row renders
+// zero times during streaming (the RFC performance model's acceptance row).
 
 import { memo, useMemo } from 'react'
 import type { ConversationSnapshot } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
-import type { ChromeProps } from '../contract/views.ts'
 import css from './StatsLine.module.css'
 
 interface UsageTotals {
@@ -55,8 +54,11 @@ export function deriveStats(nodes: ConversationSnapshot['nodes']): UsageTotals {
   }
 }
 
-export const StatsLine = memo(function StatsLine({ useSession }: ChromeProps) {
-  const nodes = (useSession as SnapshotSelectorHook<ConversationSnapshot>)((s) => s.nodes)
+/** Props: the conversation-snapshot selector hook (handed down by ChatView). */
+export interface StatsLineProps { useSession: SnapshotSelectorHook<ConversationSnapshot> }
+
+export const StatsLine = memo(function StatsLine({ useSession }: StatsLineProps) {
+  const nodes = useSession((s) => s.nodes)
   const stats = useMemo(() => deriveStats(nodes), [nodes])
   if (stats.steps === 0) return null
   const parts: string[] = []

packages/client/ui-conversation/src/client/chat/ToolViewOutlet.tsx

@@ -1,80 +0,0 @@
-// ToolViewOutlet: resolves the toolview for one call through ctx.toolviews
-// (uSES over the registry version so unload falls back live) and renders it
-// behind a per-row error boundary. GenericToolCard is the render-side
-// fallback for both a registry miss and a crashed custom row. Pure props
-// machinery, zero React context: a registrant inject factory receives the
-// sessionId this outlet already holds, is called once per (registration x
-// session) and cached, mirroring the slot injection discipline.
-
-import { Component, useSyncExternalStore, type ReactNode } from 'react'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ToolViewInject, ToolViewProps, ToolViewResolver } from '../contract/toolview.ts'
-import { GenericToolCard } from './GenericToolCard.tsx'
-
-export interface ToolViewOutletProps {
-  registry: ToolViewResolver
-  sessionId: SessionId
-  toolName: string
-  viewProps: ToolViewProps
-}
-
-/** Inject cache: per inject-factory (stable per registration) x session id.
- *  The inner Map lives and dies with its factory (WeakMap entry), so entries
- *  are bounded by the session count over the registration's lifetime. */
-const injectCache = new WeakMap<ToolViewInject<object>, Map<SessionId, object>>()
-
-function cachedInject(inject: ToolViewInject<object>, sessionId: SessionId): object {
-  let perSession = injectCache.get(inject)
-  if (!perSession) {
-    perSession = new Map()
-    injectCache.set(inject, perSession)
-  }
-  let props = perSession.get(sessionId)
-  if (!props) {
-    props = inject(sessionId)
-    perSession.set(sessionId, props)
-  }
-  return props
-}
-
-class RowErrorBoundary extends Component<
-  { resetKey: unknown; fallback: ReactNode; children: ReactNode }, { failed: boolean }
-> {
-  override state = { failed: false }
-  // Fallback state MUST flip here (render phase): a boundary whose derived
-  // state does not change re-renders the crashing children and React gives
-  // up after the second throw, escalating past the boundary.
-  static getDerivedStateFromError(): { failed: boolean } {
-    return { failed: true }
-  }
-  override componentDidCatch(error: unknown): void {
-    console.error('toolview row crashed:', error)
-  }
-  // A re-registration (resetKey bump) retries the custom row.
-  override componentDidUpdate(prev: { resetKey: unknown }): void {
-    if (this.state.failed && prev.resetKey !== this.props.resetKey) {
-      this.setState({ failed: false })
-    }
-  }
-  override render(): ReactNode {
-    if (this.state.failed) return this.props.fallback
-    return this.props.children
-  }
-}
-
-export function ToolViewOutlet({ registry, sessionId, toolName, viewProps }: ToolViewOutletProps) {
-  const version = useSyncExternalStore(
-    (fn) => registry.subscribe(fn),
-    () => registry.getVersion(),
-  )
-  const resolved = registry.resolve(toolName, sessionId)
-  if (resolved === undefined) return <GenericToolCard {...viewProps} />
-  const Row = resolved.component
-  return (
-    <RowErrorBoundary resetKey={version} fallback={<GenericToolCard {...viewProps} />}>
-      {resolved.inject === undefined
-        ? <Row {...viewProps} />
-        : <Row {...{ ...cachedInject(resolved.inject, sessionId), ...viewProps }} />}
-    </RowErrorBoundary>
-  )
-}

packages/client/ui-conversation/src/client/chat/register.ts

@@ -1,52 +0,0 @@
-/**
- * Chat-side registration entry, called from the plugin apply (the assembly
- * point): registers the chat view with the stats-line footer chrome. The
- * chat domain touches the tool ring only through the contract resolver face;
- * bash sample registration moved to apply (cross-domain assembly).
- */
-import type { SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ConversationService } from '../service.ts'
-import type { Translate } from '../contract/views.ts'
-import type { ToolViewResolver } from '../contract/toolview.ts'
-import { createChatView } from './ChatView.tsx'
-import { StatsLine } from './StatsLine.tsx'
-
-/** Read face of the sessions list store (subscription not needed: the filter
- *  reads the latest snapshot at each resolve). */
-export interface SessionListReader { getSnapshot(): SessionListState }
-
-/**
- * Default scoped-sample filter: the sub-session family. Sub-agent rows
- * rendering differently is the registry's canonical product scenario, and
- * forking gives W5 acceptance a real entry point to observe the differential.
- * @param list - injected sessions list read face.
- * @returns filter matching sessions with a parent.
- */
-export function childSessionScope(list: SessionListReader): (sessionId: SessionId) => boolean {
-  return sessionId => list.getSnapshot().byId[sessionId]?.parentId !== undefined
-}
-
-/** Assembly inputs for {@link registerChat} (resolved by apply, not here). */
-export interface RegisterChatDeps {
-  conversation: ConversationService
-  /** Toolview read face consumed by the chat rows' outlet. */
-  toolviews: ToolViewResolver
-  /** Translator bound to the conversation namespace. */
-  t: Translate
-}
-
-/**
- * Register the chat view (footer chrome included).
- * @param deps - assembled service instances.
- * @returns disposer removing the registration.
- */
-export function registerChat(deps: RegisterChatDeps): () => void {
-  const { conversation, toolviews, t } = deps
-  return conversation.registerView({
-    id: 'chat',
-    label: 'Chat',
-    order: 0,
-    component: createChatView({ toolviews, t }),
-    chrome: { footer: StatsLine },
-  })
-}

packages/client/ui-conversation/src/client/contract/slots.ts

@@ -1,31 +1,101 @@
 /**
- * Slot-ring contract for the conversation package: the composed props shapes
- * its registrants mount into the layout-owned slots (conversation / details /
- * conversation.empty). Terminal slot design (§3): full component props are the
- * automatic shares — PropsRuntime<K> (framework standard kit) & PropsStore<H>
+ * Slot-ring contract for the conversation package: the 'conversation.view'
+ * slot this package declares (the view ring — one list entry per conversation
+ * view tab), the chat view's per-tool row hole ('conversation.chat.toolview',
+ * keyed on the wire tool name), and the composed props shapes its registrants
+ * mount into the layout-owned slots (conversation / details /
+ * conversation.empty) plus its own slots. Terminal slot design (§3): full
+ * component props are the automatic shares — PropsRuntime<K> (framework
+ * standard kit) & PropsRenderSlots<S> (declared children) & PropsStore<H>
  * (declared store's read/write faces) & the injected business face declared
- * here. No renderSlot share: none of the three registrations declares
- * children, so the zero-renderSlot inference applies.
+ * here.
  */
-import type { PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
+import type { PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
+import type { SessionId, ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
 import type { createChatStore } from '../stores.ts'
-import type { SelectionTarget, ViewEntry } from './views.ts'
+import type { CallId, SelectionTarget, ViewTab } from './views.ts'
 
-/** The shared chat store handle type (apply constructs one; conversation and details both declare it). */
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+  interface SlotMap {
+    /**
+     * The conversation view ring: one list entry per view tab (chat here;
+     * trajectory/waterfall from ui-trajectory), rendered one-at-a-time by
+     * ConversationRoot via `only: <active id>`. Declared by this package's
+     * 'conversation' entry (declaring is claiming). Session scope: views read
+     * the conversation snapshot through the standard kit.
+     */
+    'conversation.view': { kind: 'list'; scope: 'session'; owner: ConvViewOwnerProps }
+    /**
+     * The chat view's per-tool row hole: keyed dispatch on the wire tool name
+     * (the key space is runtime-open — SlotMap declares slots, never keys).
+     * Declared by the chat view entry (declaring is claiming); the render
+     * site dispatches via `entryKey: toolName` with GenericToolCard as the
+     * `fallback` for unregistered tools.
+     */
+    'conversation.chat.toolview': { kind: 'keyed'; scope: 'session'; owner: ToolRowOwnerProps }
+  }
+}
+
+/**
+ * View-slot owner share: deliberately empty — ConversationRoot supplies
+ * nothing at its renderSlot site (sessionId and the snapshot hook arrive as
+ * framework-standard props; tool rows go through each view's own declared
+ * toolview hole). Kept as the named owner seat so a future cross-view
+ * payload has a home.
+ */
+export interface ConvViewOwnerProps {}
+
+/**
+ * Owner share of a per-view toolview slot: the call material the rendering
+ * view supplies per row. Uniform across views — the trajectory/waterfall
+ * toolview slots (same kind/scope/owner, names fixed by the slot-naming
+ * discipline) land with their own row render sites; today only the chat slot
+ * is declared (RendersCheck rejects a declaration nobody renders).
+ */
+export interface ToolRowOwnerProps {
+  /** Tool call identity (details linkage; stable across running → settled). */
+  callId: CallId
+  /** Wire tool name (also the keyed dispatch key at the render site). */
+  toolName: string
+  /** Frozen call slice: the running call or the settled result node. */
+  block: ToolCallBlock
+  /** Open the details panel for this call (session-level facility, supplied by the view). */
+  openDetails(): void
+}
+
+/**
+ * Full props of a registered tool-row component: the slot's runtime share
+ * (owner payload + session standard kit + global seat). Registrants type
+ * their component `FC<ToolRowProps & I>` with `I` inferred from their inject
+ * factory. Declared against the chat slot; the three per-view toolview slots
+ * share one declaration shape, so this alias serves them all.
+ */
+export type ToolRowProps = PropsRuntime<'conversation.chat.toolview'>
+
+/**
+ * Base props of a conversation view entry: the framework standard kit for the
+ * session-scope 'conversation.view' slot (useSession narrowed to the
+ * conversation snapshot by the runtime merge, sessionId, useSessions).
+ * Entries declaring the shared store or an inject face compose their shares
+ * on top (the chat entry's {@link ChatViewSlotProps}); store-less pure
+ * readers (ui-trajectory) take this base alone.
+ */
+export type ConvViewProps = PropsRuntime<'conversation.view'>
+
+/** The shared chat store handle type (apply constructs one; the conversation, details, and chat-view registrations all declare it). */
 export type ChatStore = ReturnType<typeof createChatStore>
 
 /**
  * Injected share of the conversation slot: plain data and callbacks only
  * (design §5 — hooks are framework-made). The store lines that used to ride
- * here live in the declared {@link ChatStore} now; ancestry derives from the
- * standard useSessions hook in-component; view rendering moved into the
- * component, which holds every share a view needs.
+ * here live in the declared {@link ChatStore}; ancestry derives from the
+ * standard useSessions hook in-component; views render through the declared
+ * 'conversation.view' child slot, with this face projecting the tab strip.
  */
 export interface ConversationInjected {
-  /** View registry read face (uSES triple from the conversation service). */
+  /** View tab read face (uSES triple over the 'conversation.view' slot ledger). */
   views: {
-    list(): readonly ViewEntry[]
+    list(): readonly ViewTab[]
     subscribe(fn: () => void): () => void
     version(): number
   }
@@ -33,17 +103,29 @@ export interface ConversationInjected {
   send(text: string, mode: 'queue' | 'steer'): void
   /** Cancel the in-flight turn (failure surfaces via snapshot.promptError). */
   stop(): void
-  /** Selection write + details panel opening in one gesture (store action + layout orchestration). */
-  openDetails(target: SelectionTarget): void
-  /** Pull one older history page. */
-  loadOlder(): void
   /** Navigate to another session (breadcrumb ancestors). */
   open(id: SessionId): void
 }
 
-/** Full conversation-slot component props: runtime share & store share & injected share. */
+/** Full conversation-slot component props: runtime share & view-slot render share & store share & injected share. */
 export type ConversationSlotProps =
-  PropsRuntime<'conversation'> & PropsStore<ChatStore> & ConversationInjected
+  PropsRuntime<'conversation'> & PropsRenderSlots<'conversation.view'> & PropsStore<ChatStore> & ConversationInjected
+
+/**
+ * Injected share of the chat view entry: the two callbacks whose targets live
+ * outside the view (layout orchestration; the session object layer).
+ */
+export interface ChatViewInjected {
+  /** Selection write + details panel opening in one gesture (store action + layout orchestration). */
+  openDetails(target: SelectionTarget): void
+  /** Pull one older history page. */
+  loadOlder(): void
+}
+
+/** Full chat-view component props: runtime share & the declared toolview hole's render share & store share & injected share. */
+export type ChatViewSlotProps =
+  PropsRuntime<'conversation.view'> & PropsRenderSlots<'conversation.chat.toolview'>
+  & PropsStore<ChatStore> & ChatViewInjected
 
 /**
  * Injected share of the details slot: the panel is otherwise a pure reader of

packages/client/ui-conversation/src/client/contract/tool-call-model.ts

@@ -3,9 +3,12 @@
  * one-line summary and expanded-body text from the frozen call slice. No
  * inline output ever — full results live in the details panel.
  */
-import type { ToolCallBlock } from './toolview.ts'
+// The block union's defining home is runtime (fold-product types); this
+// contract only forwards it (type-definition authority stays with the layer
+// that produces the values).
+import type { ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
 
-export type { ToolCallBlock } from './toolview.ts'
+export type { ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
 
 /** The frozen slice the chat view hands to toolview components as `block`
  *  (both members are cache-stable references off ConversationSnapshot). */

packages/client/ui-conversation/src/client/contract/toolview.ts

@@ -1,78 +0,0 @@
-/**
- * Tool-ring contract: the props surface handed to toolview components, the
- * registry's resolve/registration shapes, and the tool-call block union.
- * Shared face between the chat domain (ToolViewOutlet consumes resolve) and
- * the toolviews domain (registry implementation + sample rows); domain
- * implementation files import this, never each other.
- */
-import type { FC } from 'react'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
-import type { SessionId, ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
-import type { CallId, Translate } from './views.ts'
-
-// The block union's defining home is runtime (fold-product types); the
-// contract only forwards it (type-definition authority stays with the layer
-// that produces the values).
-export type { ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client'
-
-/** Props handed to registered toolview components. */
-export interface ToolViewProps {
-  callId: CallId
-  toolName: string
-  block: ToolCallBlock
-  useSession: UseSession
-  actions: { openDetails(): void }
-  t: Translate
-}
-
-/**
- * Toolview inject factory: produces the registrant's private injected share
- * `I`, called once per (registration x session) and cached by the render
- * outlet. Mirrors the slot inject shape (parameters derive from the
- * declaration): toolviews are session-domain by nature, so the factory
- * receives the session id only — service access goes through the
- * registrant's own apply-closure ctx (design §5; binding objects retired).
- */
-export type ToolViewInject<I extends object> = (sessionId: SessionId) => I
-
-/** Options accepted by the toolview registry's register; `I` is inferred from the inject factory. */
-export interface ToolViewOptions<I extends object = object> {
-  /** Session filter; absent = global registration. */
-  scope?: (sessionId: SessionId) => boolean
-  /** Private inject factory merged into the row's props by the render outlet. */
-  inject?: ToolViewInject<I>
-}
-
-/**
- * A resolved toolview registration. `I` is erased to `object` on the resolve
- * read face (storage erases the per-registration parameter; the outlet merges
- * injected props untyped — the register site already proved component ⊇ I).
- */
-export interface ResolvedToolView<I extends object = object> {
-  component: FC<ToolViewProps & I>
-  inject?: ToolViewInject<I>
-}
-
-/** The registry's read face consumed by render outlets (implementation lives in the toolviews domain). */
-export interface ToolViewResolver {
-  /**
-   * Resolve the renderer for a tool in a session. Order: scope match (later
-   * registration wins) > global > undefined (caller falls back to the
-   * generic card).
-   * @param tool - tool name.
-   * @param sessionId - session the row renders in.
-   * @returns resolved view, or undefined when nothing matches.
-   */
-  resolve(tool: string, sessionId: SessionId): ResolvedToolView | undefined
-  /**
-   * Subscribe to registration changes (synchronous).
-   * @param fn - change callback.
-   * @returns unsubscribe.
-   */
-  subscribe(fn: () => void): () => void
-  /**
-   * Monotonic version for uSES pairing.
-   * @returns current version.
-   */
-  getVersion(): number
-}

packages/client/ui-conversation/src/client/contract/views.ts

@@ -1,89 +1,39 @@
 /**
- * View-ring contract: the typed conversation view table, the chat store state
- * shared through it, and the props surfaces handed to registered views.
- * Shared face between the skeleton domain (ConversationRoot renders views)
- * and the chat domain (registers the chat view); domain implementation files
- * import this, never each other.
+ * Shared conversation contract primitives: the view tab projection (slot
+ * entries in 'conversation.view' surface as tabs), the chat store state
+ * shared through the declared store, and the selection primitives every
+ * domain consumes. Shared face between the skeleton domain (tab strip +
+ * view outlet) and the chat domain; domain implementation files import this,
+ * never each other. The view ring itself IS the 'conversation.view' slot
+ * (contract in slots.ts) — the package-local view registry is retired, and
+ * so is the hand-threaded translate channel (framework-level per-slot i18n
+ * injection is the planned replacement).
  */
-import type { FC } from 'react'
-import type { SnapshotSelectorHook, UseSession } from '@deepseek-ai/dsh-client-ui-slots'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-
-/**
- * One ConversationViewMap entry: per-view props extension shapes (design
- * ledger, view ring). `chromeProps` extends {@link ChromeProps} for the
- * view's chrome attachments; `extraProps` extends {@link ConvViewProps} for
- * the view component itself. Both optional — the common bases stay the floor.
- */
-export interface ViewEntryDef { chromeProps?: object; extraProps?: object }
-
-/**
- * Typed conversation view table; ui-trajectory merges {trajectory, waterfall}.
- * The chat entry is declared inline here (self-merge from a sibling module
- * trips TS6305 under tsc -b).
- */
-export interface ConversationViewMap { chat: ViewEntryDef }
-
-/** View id constrained to registered ConversationViewMap keys (all string literals; chat is declared inline). */
-export type ViewId = keyof ConversationViewMap
-
-/** Per-view chrome props: the common base plus the entry's declared extension. */
-export type ChromePropsOf<Id extends ViewId> =
-  ChromeProps & (ConversationViewMap[Id] extends { chromeProps: infer C extends object } ? C : object)
-
-/** Per-view component props: the common base plus the entry's declared extension. */
-export type ConvViewPropsOf<Id extends ViewId> =
-  ConvViewProps & (ConversationViewMap[Id] extends { extraProps: infer E extends object } ? E : object)
 
 /** Tool call identity as carried on the wire (branded upstream in connection). */
 export type CallId = string
 
-/** Translate function bound to a namespace via i18n. */
-export type Translate = (key: string, params?: Record<string, unknown>) => string
-
-/** One registered conversation view (props positions keyed by the entry's declared shapes). */
-export interface ViewEntry<Id extends ViewId = ViewId> {
-  id: Id
-  label: string
-  order?: number
-  component: FC<ConvViewPropsOf<Id>>
-  /** Per-view chrome attachments (chat mounts the stats line as footer). */
-  chrome?: { header?: FC<ChromePropsOf<Id>>; footer?: FC<ChromePropsOf<Id>> }
-}
-
-/** Props for view chrome attachments. */
-export interface ChromeProps { sessionId: SessionId; useSession: UseSession }
-
 /** Selection target for the details linkage channel (toolcall is the step special case). */
 export interface SelectionTarget { turnSeq: number; stepSeq?: number; callId?: CallId; toolName?: string }
 
+/**
+ * One conversation view tab, projected from a 'conversation.view' slot
+ * entry's registration options (label falls back to the entry id).
+ */
+export interface ViewTab { id: string; label: string }
+
 /**
  * Chat store state (slot terminal design §4): the per-session store shared by
- * the conversation and details registrations. `createChatStore` implements
- * this shape; views read it through {@link ConvViewProps}'s pass-through hook.
- * `view` may carry a stale persisted id after a view plugin unloads — the
- * registry is the runtime validator (unknown ids fall back to the first view).
+ * the conversation, chat-view, and details registrations. `createChatStore`
+ * implements this shape. `view` may carry a stale persisted id after a view
+ * plugin unloads — the slot ledger is the runtime validator (unknown ids fall
+ * back to the first registered view).
  */
 export interface ChatStoreState {
   /** Details-linkage channel (conversation writes, details reads). */
   selection: SelectionTarget | null
   /** Composer draft (persisted; survives session switches and reloads). */
   draft: string
-  /** Active conversation view id; null falls back to the first registered view. */
-  view: ViewId | null
-}
-
-/**
- * Props handed to registered conversation views. `useSession` and `useStore`
- * are the framework hooks ConversationRoot received as a slot registrant,
- * passed through unchanged (hook transfer is plain props passing; no
- * business-made subscription exists on this path). No renderSlot share: the
- * view ring delegates no sub-slots.
- */
-export interface ConvViewProps {
-  sessionId: SessionId
-  useSession: UseSession
-  /** Chat store read face (selection is the only slice views consume today). */
-  useStore: SnapshotSelectorHook<ChatStoreState>
-  actions: { openDetails(t: SelectionTarget): void; loadOlder(): void }
+  /** Active conversation view id ('conversation.view' entry id); null falls back to the first view. */
+  view: string | null
 }

packages/client/ui-conversation/src/client/index.ts

@@ -1,34 +1,31 @@
 /**
  * Conversation domain plugin, browser half: skeleton (header/tabs/composer),
- * typed view registry, scope-addressed ConversationService, named toolview
- * registry, minimal details panel. Contract: api-contracts v3 section 7.
- * Thin shell: type surfaces live in contract/, assembly in apply.ts; the
- * three implementation domains (skeleton/chat/toolviews) never import each
- * other — contract/ is their only shared face.
+ * the 'conversation.view' slot ring (chat entry here; other plugins
+ * contribute view tabs through ctx.slots), the chat view's keyed
+ * 'conversation.chat.toolview' row hole, scope-addressed ConversationService,
+ * minimal details panel. Contract: api-contracts v3 section 7. Thin shell:
+ * type surfaces live in contract/, assembly in apply.ts; the implementation
+ * domains (skeleton/chat) never import each other — contract/ is their only
+ * shared face.
  */
 import type { ConversationService } from './service.ts'
-import type { ToolViewRegistry } from './toolviews/registry.ts'
 
 export { apply, inject } from './apply.ts'
 export { ConversationService } from './service.ts'
-export { ToolViewRegistry } from './toolviews/registry.ts'
 
 export type {
-  CallId, ChatStoreState, ChromeProps, ChromePropsOf, ConversationViewMap, ConvViewProps,
-  ConvViewPropsOf, SelectionTarget, Translate, ViewEntry, ViewEntryDef, ViewId,
+  CallId, ChatStoreState, SelectionTarget, ViewTab,
 } from './contract/views.ts'
+export type { ToolCallBlock } from './contract/tool-call-model.ts'
 export type {
-  ResolvedToolView, ToolCallBlock, ToolViewOptions, ToolViewProps, ToolViewResolver,
-} from './contract/toolview.ts'
-export type {
-  ChatStore, ConversationInjected, ConversationSlotProps, DetailsInjected, DetailsSlotProps,
-  EmptyStateInjected, EmptyStateSlotProps,
+  ChatStore, ChatViewInjected, ChatViewSlotProps, ConversationInjected, ConversationSlotProps,
+  ConvViewOwnerProps, ConvViewProps, DetailsInjected, DetailsSlotProps,
+  EmptyStateInjected, EmptyStateSlotProps, ToolRowOwnerProps, ToolRowProps,
 } from './contract/slots.ts'
 // Export discipline: packages/client/AGENTS.md.
 
 declare module 'cordis' {
   interface Context {
     conversation: ConversationService
-    toolviews: ToolViewRegistry
   }
 }

packages/client/ui-conversation/src/client/service.ts

@@ -1,10 +1,10 @@
 /**
- * ConversationService implementation: scope-addressed send/cancel, view
- * registry with a uSES read face, and the empty-state startSession chain.
- * Contract: api-contracts v3 section 7. Selection/draft state moved to the
- * declared chat store (slot terminal design §4) — the per-scope store maps,
- * lazy construction, and prune bookkeeping this service used to carry are
- * retired; what remains is the send/stop orchestration face.
+ * ConversationService implementation: scope-addressed send/cancel and the
+ * empty-state startSession chain. Contract: api-contracts v3 section 7.
+ * Selection/draft state moved to the declared chat store (slot terminal
+ * design §4); the view registry moved to the 'conversation.view' slot (slot
+ * ledger owns registration, ordering, and disposal) — what remains is the
+ * send/stop orchestration face.
  *
  * Scope addressing rides the cordis Service tracker: property access through
  * `ctx.conversation` rebinds `this.ctx` to the caller's context, so methods
@@ -23,23 +23,9 @@ import type { Context } from 'cordis'
 // in the browser while unit tests (single-instance path resolution) stay green.
 import { scopeOf } from '@deepseek-ai/dsh-client-runtime/client'
 import type { Session, SessionsService } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ViewEntry, ViewId } from './index.ts'
-
-/** Mutable view-registry cell (plain object: mutation never crosses the tracker proxy). */
-interface ViewsState {
-  entries: Map<string, ViewEntry>
-  /** Sorted projection cache; null = rebuild on next read. */
-  cache: readonly ViewEntry[] | null
-  tick: number
-  listeners: Set<() => void>
-}
 
 /** Scope-addressed conversation service (root singleton, provided as `conversation`). */
 export class ConversationService extends Service {
-  private readonly viewsState: ViewsState = {
-    entries: new Map(), cache: null, tick: 0, listeners: new Set(),
-  }
-
   /**
    * @param ctx - owning root context (the plugin apply context; the service
    * registers itself and follows that fiber's lifetime).
@@ -68,60 +54,6 @@ export class ConversationService extends Service {
     if (!result.ok) throw new Error(`conversation.cancel failed: ${result.error.code}: ${result.error.message}`)
   }
 
-  /**
-   * Register a conversation view. Duplicate ids throw; the registration is an
-   * effect on the caller's fiber (plugin unload collects it).
-   * @param entry - the view entry.
-   * @returns disposer removing the view.
-   */
-  registerView<Id extends ViewId>(entry: ViewEntry<Id>): () => void {
-    const views = this.viewsState
-    const dispose = this.ctx.effect(() => {
-      if (views.entries.has(entry.id)) {
-        throw new Error(`conversation view "${entry.id}" is already registered`)
-      }
-      views.entries.set(entry.id, entry)
-      bumpViews(views)
-      return () => {
-        views.entries.delete(entry.id)
-        bumpViews(views)
-      }
-    }, 'conversation.registerView()')
-    // The effect disposer settles asynchronously; the registry face stays a
-    // synchronous fire-and-forget disposer.
-    return () => { void dispose() }
-  }
-
-  /**
-   * Registered views ordered by `order` (ties keep registration sequence).
-   * Stable array reference between mutations (uSES getSnapshot source).
-   * @returns the view entries.
-   */
-  views(): readonly ViewEntry[] {
-    const state = this.viewsState
-    state.cache ??= [...state.entries.values()].sort((a, b) => (a.order ?? 0) - (b.order ?? 0))
-    return state.cache
-  }
-
-  /**
-   * Subscribe to view registry changes (synchronous, like the toolview registry).
-   * @param fn - change callback.
-   * @returns unsubscribe.
-   */
-  subscribeViews(fn: () => void): () => void {
-    const { listeners } = this.viewsState
-    listeners.add(fn)
-    return () => { listeners.delete(fn) }
-  }
-
-  /**
-   * Monotonic view registry version for uSES pairing.
-   * @returns current version.
-   */
-  viewsVersion(): number {
-    return this.viewsState.tick
-  }
-
   /**
    * Empty-state first-send chain (root-context method; does not read scope):
    * create the session, navigate to it, then send through the new scope.
@@ -167,9 +99,3 @@ export class ConversationService extends Service {
     return sessions
   }
 }
-
-function bumpViews(state: ViewsState): void {
-  state.cache = null
-  state.tick += 1
-  for (const fn of [...state.listeners]) fn()
-}

packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx

@@ -1,16 +1,17 @@
 // ConversationRoot: the conversation slot's skeleton (figma Header 39:27730 +
 // Tab_Group + view area + composer). Pure component — everything arrives via
 // props: the framework standard kit (useSession/sessionId/useSessions), the
-// declared chat store's useStore/actions, and the injected business face.
+// declared chat store's useStore/actions, the injected business face, and the
+// renderSlot share for the declared 'conversation.view' child slot (views are
+// slot entries; the active one renders via the list `only` filter).
 // Breadcrumbs derive from useSessions with a pure parentId walk; the active
 // view id lives in the chat store's `view` field (per-session by store scope).
 
-import { useMemo, useSyncExternalStore, type ReactNode } from 'react'
+import { useSyncExternalStore } from 'react'
 import clsx from 'clsx'
 import { shallowEqual } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SessionId, SessionListState, SessionSummary } from '@deepseek-ai/dsh-client-runtime/client'
 import type { ConversationSlotProps } from '../contract/slots.ts'
-import type { ConvViewProps, ViewEntry } from '../contract/views.ts'
 import { InputBar } from './InputBar.tsx'
 import type { InputBarError } from './InputBar.tsx'
 import css from './ConversationRoot.module.css'
@@ -35,15 +36,15 @@ function deriveAncestry(list: SessionListState, id: SessionId): readonly Session
 }
 
 export function ConversationRoot({
-  sessionId, useSession, useSessions, useStore, actions,
-  views, send, stop, openDetails, loadOlder, open,
+  sessionId, useSession, useSessions, useStore, actions, renderSlot,
+  views, send, stop, open,
 }: ConversationRootProps) {
   useSyncExternalStore(views.subscribe, views.version)
-  const list = views.list()
+  const tabs = views.list()
   // The store's persisted view id may be stale (view plugin unloaded); the
-  // registry is the runtime validator — unknown ids fall to the first view.
+  // slot ledger is the runtime validator — unknown ids fall to the first view.
   const activeId = useStore(s => s.view) ?? 'chat'
-  const active = list.find(v => v.id === activeId) ?? list[0]
+  const active = tabs.find(v => v.id === activeId) ?? tabs[0]
 
   const ancestry = useSessions(s => deriveAncestry(s, sessionId), shallowEqual)
   const draft = useStore(s => s.draft)
@@ -56,27 +57,6 @@ export function ConversationRoot({
     ? null
     : { op: promptError.op, message: `${promptError.error.message}（${promptError.error.code}）` }
 
-  // Views receive the shares this component already holds (hook transfer is
-  // plain props passing); the callback slice is referentially stable per
-  // injected identity so memoized view rows hold.
-  const viewProps = useMemo<ConvViewProps>(() => ({
-    sessionId, useSession, useStore,
-    actions: { openDetails, loadOlder },
-  }), [sessionId, useSession, useStore, openDetails, loadOlder])
-
-  const renderView = (entry: ViewEntry): ReactNode => {
-    const Header = entry.chrome?.header
-    const Footer = entry.chrome?.footer
-    const View = entry.component
-    return (
-      <>
-        {Header !== undefined && <Header sessionId={sessionId} useSession={useSession} />}
-        <View {...viewProps} />
-        {Footer !== undefined && <Footer sessionId={sessionId} useSession={useSession} />}
-      </>
-    )
-  }
-
   return (
     <div className={css.root}>
       <header className={css.header}>
@@ -104,9 +84,9 @@ export function ConversationRoot({
           {/* Header button row (Fork / Session log / I/O Details): a P-I visual
               placeholder registry slot is deferred — buttons land with their features. */}
         </div>
-        {list.length > 1 && (
+        {tabs.length > 1 && (
           <div className={css.tabs} role="tablist">
-            {list.map(v => (
+            {tabs.map(v => (
               <button
                 key={v.id}
                 type="button"
@@ -123,7 +103,7 @@ export function ConversationRoot({
       </header>
 
       <div className={css.viewArea}>
-        {active !== undefined && renderView(active)}
+        {active !== undefined && renderSlot('conversation.view', {}, { only: active.id })}
       </div>
 
       <InputBar

packages/client/ui-conversation/src/client/stores.ts

@@ -10,7 +10,7 @@
  * in the module cache (a de-facto singleton surviving plugin reloads).
  */
 import { defineStore, type EngineStoreHandle } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ChatStoreState, SelectionTarget, ViewId } from './contract/views.ts'
+import type { ChatStoreState, SelectionTarget } from './contract/views.ts'
 
 /**
  * Annotation twin of the actions literal below (the export needs a declared
@@ -21,22 +21,22 @@ type ChatActions = {
   setDraft: (draft: ChatStoreState, text: string) => void
   clearDraft: (draft: ChatStoreState) => void
   restoreDraft: (draft: ChatStoreState, text: string) => void
-  setView: (draft: ChatStoreState, view: ViewId) => void
+  setView: (draft: ChatStoreState, view: string) => void
 }
 
 /**
  * Declare the per-session chat store. `selection` is the details-linkage
  * channel (conversation writes, details reads); `draft` is the composer text
  * (persisted so it survives session switches and reloads); `view` is the
- * active conversation view id (previously layout.viewFor — store seat is the
- * cross-remount survival channel, null falls back to the first registered view).
+ * active conversation view id (a 'conversation.view' entry id — store seat is
+ * the cross-remount survival channel, null falls back to the first view).
  * @returns the store handle (spec + identity + factory in one value).
  */
 export function createChatStore(): EngineStoreHandle<ChatStoreState, ChatActions> {
   return defineStore({
-    // Anchored to the contract shape: views consume the store through
-    // ConvViewProps' SnapshotSelectorHook<ChatStoreState>, so init and the
-    // contract cannot drift.
+    // Anchored to the contract shape: consumers read the store through
+    // PropsStore<ChatStore>'s SnapshotSelectorHook<ChatStoreState>, so init
+    // and the contract cannot drift.
     init: (): ChatStoreState => ({ selection: null, draft: '', view: null }),
     persist: 'dsh.conversation.chat',
     actions: {
@@ -46,7 +46,7 @@ export function createChatStore(): EngineStoreHandle<ChatStoreState, ChatActions
       // Optimistic-send failure restore: only when the user typed nothing new
       // since the clear (send choreography lives in the inject factory).
       restoreDraft: (d, text: string) => { if (d.draft === '') d.draft = text },
-      setView: (d, view: ViewId) => { d.view = view },
+      setView: (d, view: string) => { d.view = view },
     },
   })
 }

packages/client/ui-conversation/src/client/toolviews/bash-sample.tsx

@@ -1,20 +1,32 @@
 // Bash toolview sample, written in third-party posture: everything below uses
-// only the public registration surface (ctx.toolviews.register + ToolViewProps)
-// — the differential-rendering acceptance proof for the registry chain.
-// Two registrations: a global bash row, and a scope-filtered variant that
-// takes over for matching sessions only (later registration wins its tier).
+// only the public slot surface (ctx.slots.register into the keyed
+// 'conversation.chat.toolview' hole + ToolRowProps) — the acceptance proof
+// that a plain plugin can take over a tool row with zero dedicated machinery.
+// Session-dimension differentiation happens INSIDE the component (the
+// canonical sub-agent scenario): rows in child sessions render the scoped
+// variant, derived from the standard useSessions kit — no registry predicates.
 
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ToolViewProps } from '../contract/toolview.ts'
-import type { ToolViewRegistry } from './registry.ts'
-import { toolRowModel, type ToolCallBlock } from '../contract/tool-call-model.ts'
+import type { Context } from 'cordis'
+import type { ToolRowProps } from '../contract/slots.ts'
+import { toolRowModel } from '../contract/tool-call-model.ts'
 import css from './bash-sample.module.css'
 
-/** Global bash row: command-first monospace summary (replaces the generic row). */
-export function BashRow({ toolName, block, actions }: ToolViewProps) {
-  const model = toolRowModel(toolName, block as ToolCallBlock)
+/** Bash row: command-first monospace summary replacing the generic card.
+ *  Sub-session rows (parentId present) swap the prompt for a scoped badge —
+ *  the differential stays observable per session from one registration. */
+export function BashRow({ toolName, block, openDetails, sessionId, useSessions }: ToolRowProps) {
+  const model = toolRowModel(toolName, block)
+  const isChild = useSessions(list => list.byId[sessionId]?.parentId !== undefined)
+  if (isChild) {
+    return (
+      <div className={css.row} data-sample="bash-scoped" onClick={openDetails}>
+        <span className={css.scopeBadge}>scoped</span>
+        <span className={css.command}>{model.summary}</span>
+      </div>
+    )
+  }
   return (
-    <div className={css.row} data-sample="bash-global" onClick={actions.openDetails}>
+    <div className={css.row} data-sample="bash-global" onClick={openDetails}>
       <span className={css.prompt} aria-hidden>$</span>
       <span className={css.command}>{model.summary}</span>
       {model.state === 'error' && <span className={css.err}>failed</span>}
@@ -22,31 +34,20 @@ export function BashRow({ toolName, block, actions }: ToolViewProps) {
   )
 }
 
-/** Scoped variant: visually distinct so the differential hit is observable. */
-export function ScopedBashRow({ toolName, block, actions }: ToolViewProps) {
-  const model = toolRowModel(toolName, block as ToolCallBlock)
-  return (
-    <div className={css.row} data-sample="bash-scoped" onClick={actions.openDetails}>
-      <span className={css.scopeBadge}>scoped</span>
-      <span className={css.command}>{model.summary}</span>
-    </div>
-  )
-}
-
 /**
- * Register both sample rows.
- * @param toolviews - the conversation plugin's registry service.
- * @param scope - session filter for the scoped variant.
- * @returns disposer removing both registrations.
+ * The sample as a plain registrant plugin. `inject` carries the load-order
+ * seam: requiring the conversation service guarantees the chat entry (and
+ * with it the 'conversation.chat.toolview' declaration) is registered —
+ * ui-conversation's apply mounts the service after the chat entry.
  */
-export function registerBashSamples(
-  toolviews: ToolViewRegistry,
-  scope: (sessionId: SessionId) => boolean,
-): () => void {
-  const offGlobal = toolviews.register('bash', BashRow)
-  const offScoped = toolviews.register('bash', ScopedBashRow, { scope })
-  return () => {
-    offGlobal()
-    offScoped()
-  }
+export const bashToolviewSample = {
+  name: 'bash-toolview-sample',
+  inject: ['slots', 'conversation'],
+  /**
+   * Register the bash row into the chat view's keyed toolview hole.
+   * @param ctx - registrant context (disposal rides ctx.effect inside slots.register).
+   */
+  apply(ctx: Context): void {
+    ctx.slots.register({ name: 'conversation.chat.toolview', key: 'bash' }, BashRow)
+  },
 }

packages/client/ui-conversation/src/client/toolviews/registry.ts

@@ -1,103 +0,0 @@
-/**
- * ToolViewRegistry: named per-tool component registry, session-scope aware
- * (api-contracts v3 section 7). Consumed by chat now, trajectory/waterfall
- * later — deliberately a named service, not a SlotMap key. The tool key set
- * is deliberately open (model-side tools arrive at runtime): the strong
- * typing lives inside the Entry — `I` is inferred from the inject factory at
- * the register site and proves component props ⊇ ToolViewProps & I.
- */
-import type { FC } from 'react'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ResolvedToolView, ToolViewOptions, ToolViewProps } from '../contract/toolview.ts'
-
-/** Stored registration: the per-registration inject parameter is erased
- *  (storage-erase/read-restore is the typed-Map boundary, one cast budgeted). */
-interface Registration extends ToolViewOptions {
-  component: FC<ToolViewProps & object>
-}
-
-/**
- * Per-tool renderer registry. Resolution order: scope match (later
- * registration wins) > global (same tie-break) > undefined, where the caller
- * falls back to GenericToolCard.
- */
-export class ToolViewRegistry {
-  private byTool = new Map<string, Registration[]>()
-  private version = 0
-  private listeners = new Set<() => void>()
-
-  /**
-   * Register a tool row renderer. The component must accept the shared
-   * ToolViewProps plus its own injected share `I` — mismatches (missing keys,
-   * wrong types, an inject factory that does not produce what the component
-   * declares) are register-site compile errors.
-   * @param tool - tool name the renderer takes over.
-   * @param component - row component over ToolViewProps & I.
-   * @param opts - optional session-scope filter and private inject factory.
-   * @returns disposer removing this registration.
-   */
-  register<I extends object = object>(
-    tool: string, component: FC<ToolViewProps & I>, opts?: ToolViewOptions<I>): () => void {
-    const list = this.byTool.get(tool) ?? []
-    if (list.length === 0) this.byTool.set(tool, list)
-    // Storage erases I (heterogeneous registrations share one list); resolve
-    // restores the erased shape on the read face.
-    const entry: Registration = { component: component as FC<ToolViewProps & object>, ...opts }
-    list.push(entry)
-    this.bump()
-    let disposed = false
-    return () => {
-      if (disposed) return
-      disposed = true
-      const at = list.indexOf(entry)
-      /* v8 ignore next -- negative arm: an entry lives in one list and only its
-         own once-guarded disposer removes it, so a live disposer always finds it. */
-      if (at >= 0) list.splice(at, 1)
-      if (list.length === 0) this.byTool.delete(tool)
-      this.bump()
-    }
-  }
-
-  /**
-   * Resolve the renderer for a tool in a session.
-   * @param tool - tool name.
-   * @param sessionId - session the row renders in (fed to scope filters).
-   * @returns resolved view, or undefined when nothing matches.
-   */
-  resolve(tool: string, sessionId: SessionId): ResolvedToolView | undefined {
-    const list = this.byTool.get(tool)
-    if (list === undefined) return undefined
-    let global: Registration | undefined
-    let scoped: Registration | undefined
-    for (const entry of list) {
-      if (entry.scope === undefined) global = entry
-      else if (entry.scope(sessionId)) scoped = entry
-    }
-    const hit = scoped ?? global
-    if (hit === undefined) return undefined
-    return hit.inject === undefined ? { component: hit.component } : { component: hit.component, inject: hit.inject }
-  }
-
-  /**
-   * Subscribe to registration changes (render outlets re-resolve on notify).
-   * @param fn - change listener.
-   * @returns disposer.
-   */
-  subscribe(fn: () => void): () => void {
-    this.listeners.add(fn)
-    return () => this.listeners.delete(fn)
-  }
-
-  /**
-   * Monotonic registration version for uSES getSnapshot.
-   * @returns current version.
-   */
-  getVersion(): number {
-    return this.version
-  }
-
-  private bump(): void {
-    this.version += 1
-    for (const fn of this.listeners) fn()
-  }
-}

packages/client/ui-conversation/src/invariant.ts

@@ -15,11 +15,10 @@ export const name = 'client-ui-conversation-invariant'
 export const inject = ['invariants']
 
 /**
- * No runtime invariant: the conversation service emits no cordis events — its
- * view and toolview registries notify through package-local subscribe faces
- * whose ordering (synchronous version bump before notification) is exercised
- * directly by the behavior specs, and the per-scope store accounts are owned
- * mutable state with no cross-plugin observer to contradict.
+ * No runtime invariant: the conversation service emits no cordis events, and
+ * both rings this package owns (the 'conversation.view' tab ring and the
+ * 'conversation.chat.toolview' row hole) ride the slot system, whose ledger
+ * invariants live with the runtime slots package.
  */
 const install: InvariantInstaller = () => {}
 

packages/client/ui-conversation/tests/apply-inject.spec.tsx

@@ -2,10 +2,12 @@
 // apply inject factories exercised end to end against the terminal thin
 // shape: the conversation surface (views triple, send choreography incl.
 // optimistic clear + failure restore THROUGH the declared store actions,
-// openDetails = select action + layout orchestration, watch-driven open,
-// sessions.open navigation), the injectless-but-closeDetails details surface,
-// and the one-callback empty surface. Complements chat-apply.spec.tsx
-// (registration) and selection-survival.spec.ts (store axis).
+// openDetails = select action + layout orchestration, sessions.open
+// navigation), the injectless-but-closeDetails details surface, and the
+// one-callback empty surface. Complements chat-apply.spec.tsx (registration)
+// and selection-survival.spec.ts (store axis). History opening is NOT an
+// inject concern anymore — the runtime sessions service opens on watch
+// (sessions-service.spec.ts owns that behavior).
 
 import { Context } from 'cordis'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -13,10 +15,10 @@ import { cleanup } from '@testing-library/react'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
 import { SlotsService, scopeOf } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import type { SlotRendererHost } from '@deepseek-ai/dsh-client-ui-slots'
-import { apply, inject } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { SlotRendererHost } from '@deepseek-ai/dsh-client-web-react'
+import { ConversationService, apply, inject } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import type {
-  ConversationInjected, DetailsInjected, EmptyStateInjected,
+  ChatViewInjected, ConversationInjected, DetailsInjected, EmptyStateInjected,
 } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import type { createChatStore } from '../src/client/stores.ts'
 
@@ -103,7 +105,7 @@ async function bench() {
   slots.install({ renderRoot: (h) => { host = h; return null } })
   slots.renderSlot('root', {})
   const hostFace = host!
-  const entryOf = (key: 'conversation' | 'details' | 'conversation.empty') => hostFace.entriesOf(key)[0]!
+  const entryOf = (key: 'conversation' | 'conversation.view' | 'details' | 'conversation.empty') => hostFace.entriesOf(key)[0]!
   /** Resolve store instance + call the inject the way the outlet would. */
   const conversationSurface = (id: SessionId) => {
     const entry = entryOf('conversation')
@@ -112,18 +114,30 @@ async function bench() {
       id, instance.actions)
     return { instance, injected }
   }
-  return { ctx, slots, hostFace, entryOf, conversationSurface, sessionFake, sessionsFake, layoutFake, mint }
+  /** Same resolution for the chat entry riding the view ring. */
+  const chatViewSurface = (id: SessionId) => {
+    const entry = entryOf('conversation.view')
+    const instance = hostFace.storeOf(entry, id) as ChatInstance
+    const injected = (entry.inject as unknown as (sessionId: SessionId, actions: ChatActions) => ChatViewInjected)(
+      id, instance.actions)
+    return { instance, injected }
+  }
+  return { ctx, slots, hostFace, entryOf, conversationSurface, chatViewSurface, sessionFake, sessionsFake, layoutFake, mint }
 }
 
 describe('conversation slot inject surface', () => {
-  it('assembles the thin surface, pulls history through the watch signal, navigates via sessions.open', async () => {
+  it('assembles the thin surface side-effect-free, navigates via sessions.open', async () => {
     const b = await bench()
     const { injected } = b.conversationSurface(ROOT)
-    expect(b.sessionFake.open).toHaveBeenCalledTimes(1)
+    // Assembly has no session side effects: opening the event window belongs
+    // to the runtime watch path, not the inject factory.
+    expect(b.sessionFake.open).not.toHaveBeenCalled()
     expect(injected.views.list().map(v => v.id)).toEqual(['chat'])
     injected.open(ROOT)
     expect(b.sessionsFake.open).toHaveBeenCalledWith(ROOT)
-    injected.loadOlder()
+    // loadOlder moved to the chat view entry's face (the ring rider).
+    const chatView = b.chatViewSurface(ROOT)
+    chatView.injected.loadOlder()
     expect(b.sessionFake.loadOlder).toHaveBeenCalledTimes(1)
   })
 
@@ -161,27 +175,51 @@ describe('conversation slot inject surface', () => {
     expect(b.sessionFake.cancel).toHaveBeenCalledTimes(1)
   })
 
-  it('openDetails writes the selection through the store actions and opens the panel', async () => {
+  it('inject fails loud when the session resolves no scope or the scope lacks the service', async () => {
     const b = await bench()
-    const { instance, injected } = b.conversationSurface(ROOT)
+    const entry = b.entryOf('conversation')
+    const instance = b.hostFace.storeOf(entry, ROOT) as ChatInstance
+    const injectFn = entry.inject as unknown as (sessionId: SessionId, actions: ChatActions) => ConversationInjected
+    // Unknown session: sessions.scope answers nothing.
+    ;(b.sessionsFake.scope as unknown) = () => undefined
+    expect(() => injectFn(ROOT, instance.actions)).toThrow(/resolved no scope/)
+    // A scope minted outside the service tree: no conversation service on it.
+    const foreign = new Context()
+    ;(b.sessionsFake.scope as unknown) = () => foreign.plugin(() => {}).ctx.extend({})
+    expect(() => injectFn(ROOT, instance.actions)).toThrow(/unavailable through the session scope/)
+  })
+
+  it('openDetails (chat view face) writes the selection through the store actions and opens the panel', async () => {
+    const b = await bench()
+    const { instance, injected } = b.chatViewSurface(ROOT)
     injected.openDetails({ turnSeq: 2, callId: 'c1' })
     expect(instance.store.getSnapshot().selection).toEqual({ turnSeq: 2, callId: 'c1' })
     expect(b.layoutFake.openDetails).toHaveBeenCalledTimes(1)
+    // The chat view shares the conversation entry's store instance: selection
+    // writes land where the skeleton and details read.
+    const conv = b.conversationSurface(ROOT)
+    expect(conv.instance).toBe(instance)
   })
 
-  it('views read face forwards to the service registry (subscribe/version)', async () => {
+  it('views read face projects the ring ledger (subscribe/version through ctx.slots)', async () => {
     const b = await bench()
     const { injected } = b.conversationSurface(ROOT)
     const before = injected.views.version()
     const listener = vi.fn()
     const unsub = injected.views.subscribe(listener)
-    const conversation = b.ctx.get('conversation') as
-      import('@deepseek-ai/dsh-client-ui-conversation/client').ConversationService
-    const off = conversation.registerView({ id: 'chat2', label: 'X', component: () => null } as never)
+    // A second ring rider (what ui-trajectory does in production).
+    const off = b.slots.register(
+      { name: 'conversation.view', id: 'chat2', order: 5, label: 'X' } as never, (() => null) as never)
+    await Promise.resolve() // ledger notifications batch per microtask
     expect(listener).toHaveBeenCalled()
     expect(injected.views.version()).toBeGreaterThan(before)
     expect(injected.views.list().map(v => v.id)).toEqual(['chat', 'chat2'])
+    // Label falls back to the id when a rider declares none.
+    const off2 = b.slots.register(
+      { name: 'conversation.view', id: 'bare', order: 6 } as never, (() => null) as never)
+    expect(injected.views.list().map(v => v.label)).toEqual(['Chat', 'X', 'bare'])
     off()
+    off2()
     unsub()
   })
 })
@@ -211,4 +249,14 @@ describe('details and empty inject surfaces', () => {
     expect(b.sessionsFake.open).toHaveBeenCalledWith(ROOT)
     expect(b.sessionFake.prompt).toHaveBeenCalledWith([{ type: 'text', text: 'go' }], 'queue')
   })
+
+  it('startSession fails loud on a torn boot (conversation service fiber gone)', async () => {
+    const b = await bench()
+    const injected = (b.entryOf('conversation.empty').inject as unknown as () => EmptyStateInjected)()
+    // Tear the service's own fiber (registry keyed by the class): the slot
+    // entries survive, so the gesture-time read hits the loud branch.
+    b.ctx.registry.delete(ConversationService)
+    await vi.waitFor(() => { expect(b.ctx.get('conversation')).toBeUndefined() })
+    expect(() => injected.startSession({ text: 'go', mode: 'queue' })).toThrow(/conversation service unavailable/)
+  })
 })

packages/client/ui-conversation/tests/chat-apply.spec.tsx

@@ -1,9 +1,11 @@
 // @vitest-environment jsdom
-// apply wiring: services provided, chat view + footer chrome registered, the
-// three slot registrations land against a root entry's children declarations
-// (the AppFrame role), the shared store handle rides both session slots, and
-// the bash samples resolve differentially (sub-session default scope).
-// Full-chain rendering belongs to the shell e2e; this spec stops at the
+// apply wiring: the conversation service provided, the chat view registered
+// as the first 'conversation.view' ring entry declaring the keyed toolview
+// hole, the three slot registrations land against a root entry's children
+// declarations (the AppFrame role), the shared store handle rides all session
+// entries, and the bash sample mounts through the load-order seam as a keyed
+// entry. Full-chain rendering belongs to the machinery spec
+// (chat-toolview-slot.spec.tsx) and the shell e2e; this spec stops at the
 // assembly surface.
 
 import { Context } from 'cordis'
@@ -11,8 +13,7 @@ import { describe, expect, it, vi } from 'vitest'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
 import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import { apply, inject, ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import type { ConversationService } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import { apply, inject } from '@deepseek-ai/dsh-client-ui-conversation/client'
 
 const ROOT = 'root-1' as SessionId
 const CHILD = 'child-1' as SessionId
@@ -60,62 +61,69 @@ async function bench() {
 }
 
 /** First stored entry for a key (inject/store live directly on StoredEntry). */
-function renderEntryOf(slots: SlotsService, key: 'conversation' | 'details' | 'conversation.empty') {
+function renderEntryOf(slots: SlotsService, key: 'conversation' | 'conversation.view' | 'details' | 'conversation.empty') {
   return slots.entries(key)[0] as undefined | { inject?: unknown; store?: unknown }
 }
 
 describe('apply wiring', () => {
-  it('provides conversation and toolviews services', async () => {
+  it('provides the conversation service', async () => {
     const b = await bench()
     await b.fiber.await()
     expect(b.ctx.get('conversation')).toBeDefined()
-    expect(b.ctx.get('toolviews')).toBeInstanceOf(ToolViewRegistry)
   })
 
-  it('registers the chat view with the stats footer', async () => {
+  it('registers the chat view as the first ring entry, declaring the keyed toolview hole', async () => {
     const b = await bench()
     await b.fiber.await()
-    const conversation = b.ctx.get('conversation') as ConversationService
-    const views = conversation.views()
-    expect(views.map((v) => v.id)).toEqual(['chat'])
-    expect(views[0]?.chrome?.footer).toBeDefined()
+    const entries = b.slots.entries('conversation.view')
+    expect(entries.map((e) => e.options.id)).toEqual(['chat'])
+    expect(entries[0]?.options.label).toBe('Chat')
+    expect(entries[0]?.options.order).toBe(0)
+    // Declaring is claiming: the chat entry's registration put the hole on
+    // the ledger with the contract's kind/scope.
+    expect(b.slots.spec('conversation.chat.toolview')).toEqual({ kind: 'keyed', scope: 'session' })
   })
 
-  it('occupies the three slots; session pair shares one store handle, empty declares none', async () => {
+  it('occupies the three slots + the ring; session entries share one store handle, empty declares none', async () => {
     const b = await bench()
     await b.fiber.await()
     const conversation = renderEntryOf(b.slots, 'conversation')
+    const chatView = renderEntryOf(b.slots, 'conversation.view')
     const details = renderEntryOf(b.slots, 'details')
     const empty = renderEntryOf(b.slots, 'conversation.empty')
     expect(conversation?.inject).toBeTypeOf('function')
+    expect(chatView?.inject).toBeTypeOf('function')
     expect(details?.inject).toBeTypeOf('function')
     expect(empty?.inject).toBeTypeOf('function')
-    // The shared handle: one apply-built store value on BOTH session entries.
+    // The shared handle: one apply-built store value on ALL session entries.
     expect(conversation?.store).toBeDefined()
     expect(details?.store).toBe(conversation?.store)
+    expect(chatView?.store).toBe(conversation?.store)
     // The empty slot is storeless (local state + useSessions derivation).
     expect(empty?.store).toBeUndefined()
   })
 
-  it('bash samples resolve differentially: scoped row for sub-sessions, global for roots', async () => {
+  it('mounts the bash sample as a keyed entry through the load-order seam', async () => {
     const b = await bench()
     await b.fiber.await()
-    const toolviews = b.ctx.get('toolviews') as ToolViewRegistry
-    const forChild = toolviews.resolve('bash', CHILD)
-    const forRoot = toolviews.resolve('bash', ROOT)
-    expect(forChild).toBeDefined()
-    expect(forRoot).toBeDefined()
-    expect(forChild!.component).not.toBe(forRoot!.component)
+    // The sample plugin's inject: ['slots', 'conversation'] resolved — the
+    // service being present implies the chat entry declared the hole first.
+    const entries = b.slots.entries('conversation.chat.toolview')
+    expect(entries.map((e) => e.options.key)).toEqual(['bash'])
   })
 
-  it('plugin fiber disposal collects every registration (unload cascade)', async () => {
+  it('plugin fiber disposal collects every registration (unload cascade, ring and hole included)', async () => {
     const b = await bench()
     await b.fiber.await()
     await b.fiber.dispose()
     expect(b.slots.entries('conversation')).toHaveLength(0)
+    // The declared ring collapses with its declaring entry, and the chat
+    // entry's keyed hole (with the sample's registration) collapses with it.
+    expect(b.slots.entries('conversation.view')).toHaveLength(0)
+    expect(b.slots.entries('conversation.chat.toolview')).toHaveLength(0)
+    expect(b.slots.spec('conversation.chat.toolview')).toBeUndefined()
     expect(b.slots.entries('details')).toHaveLength(0)
     expect(b.slots.entries('conversation.empty')).toHaveLength(0)
     expect(b.ctx.get('conversation')).toBeUndefined()
-    expect(b.ctx.get('toolviews')).toBeUndefined()
   })
 })

packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx

@@ -1,41 +1,20 @@
 // @vitest-environment jsdom
 // Remaining chat branch tails: MessageItem context/unknown/steering arms,
-// ToolViewOutlet inject cache + crash fallback + retry, StatsLine no-cache
-// join, PendingCard reason strip, AssistantMarkdown single-line reasoning,
-// ChatView view-body fallbacks, and apply's action lambdas.
+// StatsLine no-cache join, PendingCard reason strip, AssistantMarkdown
+// single-line reasoning. (Tool-row dispatch tails live with the keyed-slot
+// machinery specs since the tool ring dissolved into renderSlot.)
 
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import { cleanup, render } from '@testing-library/react'
-import { act } from '@testing-library/react'
-import type { SessionId, ToolResultNode } from '@deepseek-ai/dsh-client-runtime/client'
 import type { RpcId } from '@deepseek-ai/dsh-client-connection/client'
-import { hookOf } from './hook.ts'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import type { ToolViewProps, Translate } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
 import { MessageItem } from '../src/client/chat/MessageItem.tsx'
 import { PendingCard } from '../src/client/chat/PendingCard.tsx'
 import { AssistantMarkdown } from '../src/client/chat/AssistantMarkdown.tsx'
-import { StatsLine } from '../src/client/chat/StatsLine.tsx'
-import { ToolViewOutlet } from '../src/client/chat/ToolViewOutlet.tsx'
+import { StatsLine, type StatsLineProps } from '../src/client/chat/StatsLine.tsx'
 
 afterEach(cleanup)
 
-const SID = 's1' as SessionId
-
-const result = (callId: string): ToolResultNode => ({
-  kind: 'tool-result', seq: 3, callId,
-  call: { name: 'bash', argsRaw: '{"command":"x"}' },
-  content: [], isError: false, callView: null, resultView: null,
-})
-
-const viewProps = (): ToolViewProps => ({
-  callId: 'c1', toolName: 'bash', block: result('c1'),
-  useSession: (() => { throw new Error('unused') }) as unknown as UseSession,
-  actions: { openDetails: vi.fn() },
-  t: ((k: string) => k) as Translate,
-})
-
 describe('MessageItem arms', () => {
   it('steering bubbles carry the interjection badge and non-text rest blocks', () => {
     const view = render(
@@ -85,71 +64,8 @@ describe('small branch tails', () => {
     }
     const source = { getSnapshot: () => snap, subscribe: () => () => {} }
     const view = render(
-      <StatsLine sessionId={SID} useSession={hookOf(source) as unknown as UseSession} />,
+      <StatsLine useSession={bindSnapshotSelector(source) as unknown as StatsLineProps['useSession']} />,
     )
     expect(view.getByText('10 tokens · 1 turns · 1 steps')).toBeTruthy()
   })
 })
-
-describe('ToolViewOutlet dispatch', () => {
-  it('caches the inject factory per (registration x session) and merges its props', () => {
-    const registry = new ToolViewRegistry()
-    const inject = vi.fn((sessionId: SessionId) => ({ extra: `injected:${sessionId}` }))
-    registry.register('bash',
-      (p: ToolViewProps & { extra: string }) => <div data-testid="row">{p.extra}</div>,
-      { inject })
-    // Pure props machinery: the outlet feeds its own sessionId to the
-    // factory — no provider/context needed (terminal channel form).
-    const view = render(
-      <ToolViewOutlet registry={registry} sessionId={SID} toolName="bash" viewProps={viewProps()} />,
-    )
-    expect(view.getByTestId('row').textContent).toBe(`injected:${SID}`)
-    expect(inject).toHaveBeenCalledTimes(1)
-    // Remount under the SAME session: cache hit, factory not re-run.
-    view.unmount()
-    const second = render(
-      <ToolViewOutlet registry={registry} sessionId={SID} toolName="bash" viewProps={viewProps()} />,
-    )
-    expect(second.getByTestId('row').textContent).toBe(`injected:${SID}`)
-    expect(inject).toHaveBeenCalledTimes(1)
-    // A different session is a distinct cache key: factory runs once more.
-    second.unmount()
-    const other = render(
-      <ToolViewOutlet registry={registry} sessionId={'s2' as SessionId} toolName="bash" viewProps={viewProps()} />,
-    )
-    expect(other.getByTestId('row').textContent).toBe('injected:s2')
-    expect(inject).toHaveBeenCalledTimes(2)
-  })
-
-  it('a crashing custom row falls back to GenericToolCard and retries on re-registration', () => {
-    const registry = new ToolViewRegistry()
-    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
-    // React dev builds re-dispatch boundary-caught errors as window 'error'
-    // events (invokeGuardedCallback); swallow them so vitest sees the caught path.
-    const swallow = (e: Event): void => { e.preventDefault() }
-    window.addEventListener('error', swallow)
-    try {
-      const Bomb = () => { throw new Error('row bomb') }
-      registry.register('bash', Bomb as never)
-      const view = render(
-        <ToolViewOutlet registry={registry} sessionId={SID} toolName="bash" viewProps={viewProps()} />,
-      )
-      // Crash caught: generic row rendered instead.
-      expect(view.getByText('Bash')).toBeTruthy()
-      // A new registration bumps the version; the boundary retries the custom row.
-      act(() => { registry.register('bash', (() => <div data-testid="fixed" />) as never) })
-      expect(view.getByTestId('fixed')).toBeTruthy()
-    } finally {
-      window.removeEventListener('error', swallow)
-      consoleError.mockRestore()
-    }
-  })
-
-  it('registry miss renders the generic row directly', () => {
-    const registry = new ToolViewRegistry()
-    const view = render(
-      <ToolViewOutlet registry={registry} sessionId={SID} toolName="bash" viewProps={viewProps()} />,
-    )
-    expect(view.getByText('Bash')).toBeTruthy()
-  })
-})

packages/client/ui-conversation/tests/chat-stats-bash-sample.spec.tsx

@@ -1,21 +1,19 @@
 // @vitest-environment jsdom
-// StatsLine (chrome.footer first consumer): totals derivation + the RFC hard
-// acceptance — zero renders during streaming. Bash sample: differential
-// registry hits per session, teardown reverts to the generic row.
+// StatsLine (rendered inside the chat view body): totals derivation + the RFC
+// hard acceptance — zero renders during streaming. Bash sample row: the
+// canonical sub-agent differential decided INSIDE the component off the
+// standard useSessions kit (no registry predicates — tool ring dissolved).
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { act, cleanup, fireEvent, render } from '@testing-library/react'
 import type {
-  AssistantMessageNode, ConversationSnapshot, SessionId, ToolResultNode,
+  AssistantMessageNode, ConversationSnapshot, SessionId, SessionListState, ToolResultNode,
 } from '@deepseek-ai/dsh-client-runtime/client'
-import { hookOf } from './hook.ts'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
-import type { ChromeProps, ToolViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import { StatsLine, deriveStats } from '../src/client/chat/StatsLine.tsx'
-import { BashRow, ScopedBashRow, registerBashSamples } from '../src/client/toolviews/bash-sample.tsx'
-import { ToolViewOutlet } from '../src/client/chat/ToolViewOutlet.tsx'
-import { childSessionScope } from '../src/client/chat/register.ts'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
+import type { ToolRowProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import { StatsLine, deriveStats, type StatsLineProps } from '../src/client/chat/StatsLine.tsx'
+import { BashRow } from '../src/client/toolviews/bash-sample.tsx'
 
 afterEach(cleanup)
 
@@ -77,8 +75,8 @@ describe('deriveStats', () => {
 })
 
 describe('StatsLine', () => {
-  function props(source: { getSnapshot(): ConversationSnapshot; subscribe(fn: () => void): () => void }): ChromeProps {
-    return { sessionId: SID, useSession: hookOf(source) as unknown as UseSession }
+  function props(source: { getSnapshot(): ConversationSnapshot; subscribe(fn: () => void): () => void }): StatsLineProps {
+    return { useSession: bindSnapshotSelector(source) }
   }
 
   it('renders the joined stats row and hides with zero steps', () => {
@@ -95,7 +93,7 @@ describe('StatsLine', () => {
   it('renders ZERO times during streaming chunk frames (RFC hard acceptance)', () => {
     const { set, source } = makeSource({ nodes: [assistant(1, 1)] })
     let renders = 0
-    function Counting(p: ChromeProps) {
+    function Counting(p: StatsLineProps) {
       renders += 1
       return <StatsLine {...p} />
     }
@@ -109,71 +107,79 @@ describe('StatsLine', () => {
   })
 })
 
-describe('bash toolview samples', () => {
+describe('bash sample row', () => {
+  const ROOT = 'root-1' as SessionId
+  const CHILD = 'child-1' as SessionId
+
   const result = (callId: string): ToolResultNode => ({
     kind: 'tool-result', seq: 3, callId,
     call: { name: 'bash', argsRaw: '{"command":"make build","description":"Build"}' },
     content: [], isError: false, callView: null, resultView: null,
   })
 
-  const viewProps = (openDetails = vi.fn()): ToolViewProps => ({
-    callId: 'c1', toolName: 'bash', block: result('c1'),
-    useSession: (() => { throw new Error('unused') }) as unknown as UseSession,
-    actions: { openDetails },
-    t: (k) => k,
-  })
-
-  function outlet(registry: ToolViewRegistry, sessionId: SessionId, p = viewProps()) {
-    return render(
-      <ToolViewOutlet registry={registry} sessionId={sessionId} toolName="bash" viewProps={p} />,
-    )
+  /** Real list-store engine: the family fixture the in-component parentId branch reads. */
+  function listStore() {
+    return createSnapshotStore<SessionListState>({
+      ids: [ROOT, CHILD],
+      byId: {
+        [ROOT]: { id: ROOT, title: 'r', running: false, updatedAt: 0 },
+        [CHILD]: { id: CHILD, title: 'c', parentId: ROOT, running: false, updatedAt: 0 },
+      },
+      current: undefined,
+    } as SessionListState)
   }
 
-  it('differential rendering: scoped row for the matching session, global elsewhere', () => {
-    const registry = new ToolViewRegistry()
-    registerBashSamples(registry, (id) => id === ('swarm' as SessionId))
-    const scoped = outlet(registry, 'swarm' as SessionId)
+  const rowProps = (sessionId: SessionId, over?: {
+    store?: ReturnType<typeof listStore>
+    openDetails?: () => void
+  }): ToolRowProps => ({
+    callId: 'c1', toolName: 'bash', block: result('c1'),
+    openDetails: over?.openDetails ?? vi.fn(),
+    sessionId,
+    useSessions: bindSnapshotSelector(over?.store ?? listStore()),
+  } as unknown as ToolRowProps)
+
+  it('differential rendering: the scoped variant in sub-sessions, global at roots', () => {
+    const scoped = render(<BashRow {...rowProps(CHILD)} />)
     expect(scoped.container.querySelector('[data-sample="bash-scoped"]')).not.toBeNull()
-    const plain = outlet(registry, SID)
+    expect(scoped.getByText('scoped')).toBeTruthy()
+    const plain = render(<BashRow {...rowProps(ROOT)} />)
     expect(plain.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()
   })
 
-  it('teardown removes both registrations and falls back to the generic row', () => {
-    const registry = new ToolViewRegistry()
-    const off = registerBashSamples(registry, () => true)
-    const view = outlet(registry, SID)
-    expect(view.container.querySelector('[data-sample="bash-scoped"]')).not.toBeNull()
-    act(() => off())
-    expect(view.container.querySelector('[data-sample]')).toBeNull()
-    expect(view.getByText('Bash')).toBeTruthy()
+  it('a session outside the list renders the global arm (no parent known)', () => {
+    const view = render(<BashRow {...rowProps('gone' as SessionId)} />)
+    expect(view.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()
   })
 
-  it('childSessionScope matches sub-sessions via the injected list read face', () => {
-    const child = 'child' as SessionId
-    const root = 'root' as SessionId
-    const scope = childSessionScope({
-      getSnapshot: () => ({
-        ids: [root, child],
-        current: undefined,
-        byId: {
-          [root]: { id: root, title: 'r', running: false, updatedAt: 0 },
-          [child]: { id: child, title: 'c', parentId: root, running: false, updatedAt: 0 },
-        },
-      }),
+  it('a live parentId write flips the row to the scoped variant (store subscription)', () => {
+    const store = listStore()
+    const orphan = 'late-child' as SessionId
+    store.update((d) => {
+      d.ids.push(orphan)
+      d.byId[orphan] = { id: orphan, title: 'l', running: false, updatedAt: 0 }
     })
-    expect(scope(child)).toBe(true)
-    expect(scope(root)).toBe(false)
-    expect(scope('gone' as SessionId)).toBe(false)
+    const view = render(<BashRow {...rowProps(orphan, { store })} />)
+    expect(view.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()
+    act(() => {
+      store.update((d) => { d.byId[orphan]!.parentId = ROOT })
+    })
+    expect(view.container.querySelector('[data-sample="bash-scoped"]')).not.toBeNull()
   })
 
-  it('sample rows summarize the command and hand clicks to openDetails', () => {
-    const open = vi.fn()
-    const p = viewProps(open)
-    const global = render(<BashRow {...p} />)
-    expect(global.getByText('Build')).toBeTruthy()
-    fireEvent.click(global.getByText('Build'))
-    expect(open).toHaveBeenCalledTimes(1)
-    const scoped = render(<ScopedBashRow {...p} />)
-    expect(scoped.getByText('scoped')).toBeTruthy()
+  it('summarizes the command and hands clicks to openDetails on both arms', () => {
+    const openGlobal = vi.fn()
+    const global = render(<BashRow {...rowProps(ROOT, { openDetails: openGlobal })} />)
+    // Two renders share document.body: query inside each container.
+    const globalRow = global.container.querySelector('[data-sample="bash-global"]')!
+    expect(globalRow.textContent).toContain('Build')
+    fireEvent.click(globalRow)
+    expect(openGlobal).toHaveBeenCalledTimes(1)
+    const openScoped = vi.fn()
+    const scoped = render(<BashRow {...rowProps(CHILD, { openDetails: openScoped })} />)
+    const scopedRow = scoped.container.querySelector('[data-sample="bash-scoped"]')!
+    expect(scopedRow.textContent).toContain('Build')
+    fireEvent.click(scopedRow)
+    expect(openScoped).toHaveBeenCalledTimes(1)
   })
 })

packages/client/ui-conversation/tests/chat-tool-row.spec.tsx

@@ -4,12 +4,11 @@ import { cleanup, fireEvent, render } from '@testing-library/react'
 
 afterEach(cleanup)
 import type { RunningToolCall, ToolResultNode } from '@deepseek-ai/dsh-client-runtime/client'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
 import { classifyTool, toolRowModel } from '../src/client/contract/tool-call-model.ts'
 import { AssistantMarkdown } from '../src/client/chat/AssistantMarkdown.tsx'
 import { ToolRow } from '../src/client/chat/ToolRow.tsx'
 import { GenericToolCard } from '../src/client/chat/GenericToolCard.tsx'
-import type { ToolViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { ToolRowOwnerProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 
 const running = (over?: Partial<RunningToolCall>): RunningToolCall => ({
   callId: 'c1', name: 'bash', argsRaw: '{"command":"ls -la","description":"List files"}',
@@ -139,11 +138,8 @@ describe('ThinkRow', () => {
 })
 
 describe('GenericToolCard', () => {
-  const props = (toolName: string, block: RunningToolCall | ToolResultNode): ToolViewProps => ({
-    callId: 'c1', toolName, block,
-    useSession: (() => { throw new Error('unused') }) as unknown as UseSession,
-    actions: { openDetails: vi.fn() },
-    t: (k) => k,
+  const props = (toolName: string, block: RunningToolCall | ToolResultNode): ToolRowOwnerProps => ({
+    callId: 'c1', toolName, block, openDetails: vi.fn(),
   })
 
   it('renders the classified variant row from the frozen slice', () => {
@@ -188,10 +184,10 @@ describe('GenericToolCard', () => {
     expect(view.container.querySelector('svg')).not.toBeNull()
   })
 
-  it('row click reaches actions.openDetails', () => {
+  it('row click reaches openDetails', () => {
     const p = props('bash', result())
     const view = render(<GenericToolCard {...p} />)
     fireEvent.click(view.getByText('List files'))
-    expect(p.actions.openDetails).toHaveBeenCalledTimes(1)
+    expect(p.openDetails).toHaveBeenCalledTimes(1)
   })
 })

packages/client/ui-conversation/tests/chat-toolview-slot.spec.tsx

@@ -0,0 +1,232 @@
+// @vitest-environment jsdom
+// The dissolved tool ring's acceptance chain on the REAL machinery stack:
+// cordis Context + SlotsService ledger + the web-react renderer + this
+// package's own apply — no outlet twins. Proves the keyed
+// 'conversation.chat.toolview' hole end to end: registered rows dispatch by
+// entryKey (the bash sample lands through its plugin), unregistered tools
+// fall back to GenericToolCard at the render site, live registration/unload
+// flips rows in place, duplicate keys fail loud, the inject channel feeds
+// (sessionId) => I into row components, and a registrant's
+// inject: ['slots', 'conversation'] load-order seam suspends on real fiber
+// semantics until the service (and with it the hole declaration) is present.
+
+import { Context } from 'cordis'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { act, cleanup, render } from '@testing-library/react'
+import { createSnapshotStore, SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import type {
+  ConversationSnapshot, SessionId, SessionListState, ToolResultNode,
+} from '@deepseek-ai/dsh-client-runtime/client'
+import { createSlotRenderer } from '@deepseek-ai/dsh-client-web-react'
+import type { PropsRenderSlots } from '@deepseek-ai/dsh-client-ui-slots'
+import { apply, inject } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { ToolRowProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
+
+const SID = 's1' as SessionId
+
+afterEach(cleanup)
+// The chat store persists under its declared key; clear between cases.
+beforeEach(() => {
+  localStorage.clear()
+})
+
+const toolResult = (seq: number, callId: string, name: string, args = '{"command":"make build","description":"Build"}'): ToolResultNode => ({
+  kind: 'tool-result', seq, callId,
+  call: { name, argsRaw: args },
+  content: [], isError: false, callView: null, resultView: null,
+})
+
+function snapshotWith(nodes: ToolResultNode[]): ConversationSnapshot {
+  return {
+    sessionId: SID, nodes, foldDegraded: false, partial: null, runningCalls: [],
+    pending: [], running: false, removed: false, openState: 'open', openError: null,
+    hasMore: false, loadingOlder: false, promptError: null, lastAgentError: null,
+  } as ConversationSnapshot
+}
+
+/** Test-owned AppFrame role: declares the layout-owned children and renders the conversation area under the framework session provider. */
+type AppRootProps = PropsRenderSlots<'conversation' | 'details' | 'conversation.empty'>
+function AppRoot({ renderSlot, SessionProvider }: AppRootProps) {
+  return <SessionProvider>{() => renderSlot('conversation', {})}</SessionProvider>
+}
+
+/**
+ * Real-stack bench: SlotsService plugin, renderer installed, sessions/layout
+ * fakes at the service seams only (external boundaries), the package apply on
+ * its own fiber, and the test AppFrame occupying 'root'.
+ */
+async function bench(nodes: ToolResultNode[]) {
+  const ctx = new Context()
+  const slotsFiber = ctx.plugin(SlotsService)
+  await slotsFiber.await()
+  const slots = ctx.get('slots') as SlotsService
+
+  const session = createSnapshotStore<ConversationSnapshot>(snapshotWith(nodes))
+  const list = createSnapshotStore<SessionListState>({
+    ids: [SID],
+    byId: { [SID]: { id: SID, title: 'S', running: false, updatedAt: 1 } },
+    current: SID,
+  } as SessionListState)
+  // Identity-stable cell: the renderer caches hooks per source and inject
+  // results per cell, both by object identity.
+  const cell = { sessionId: SID, session }
+  const scoped = { send: vi.fn(async () => {}), cancel: vi.fn(async () => {}) }
+  const layout = { openDetails: vi.fn(), closeDetails: vi.fn() }
+  ctx.provide('sessions', {
+    list,
+    manager: { get: () => ({ loadOlder: vi.fn() }) },
+    scope: () => ({ get: () => scoped }),
+    cell: (id: string) => (id === SID ? cell : undefined),
+    create: vi.fn(),
+    open: vi.fn(),
+  })
+  ctx.provide('layout', layout)
+  ctx.provide('i18n', { bind: () => (key: string) => key })
+
+  slots.install(createSlotRenderer())
+  slots.register({
+    name: 'root',
+    children: {
+      'conversation': { kind: 'single', scope: 'session' },
+      'details': { kind: 'single', scope: 'session' },
+      'conversation.empty': { kind: 'single', scope: 'root' },
+    },
+  }, AppRoot)
+
+  const fiber = ctx.plugin({ inject: [...inject], apply })
+  await fiber.await()
+  return { ctx, slots, fiber, session, list, layout }
+}
+
+/** Render the whole tree through the ctx-level root seam (the shell's own entry). */
+function mountApp(slots: SlotsService) {
+  return render(<>{slots.renderSlot('root', {})}</>)
+}
+
+describe('keyed toolview hole through the real machinery', () => {
+  it('dispatches registered rows by entryKey and unregistered tools to the GenericToolCard fallback', async () => {
+    const b = await bench([
+      toolResult(3, 'c1', 'bash'),
+      toolResult(4, 'c2', 'mystery', '{"n":1}'),
+    ])
+    const view = mountApp(b.slots)
+    // bash: the sample plugin's keyed registration took the row (root
+    // session → global arm, decided inside the component off useSessions).
+    expect(view.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()
+    expect(view.getByText('Build')).toBeTruthy()
+    // mystery: no registration under that key → render-site fallback.
+    expect(view.getByText('Tool call')).toBeTruthy()
+  })
+
+  it('row clicks travel owner openDetails → chat inject → layout orchestration', async () => {
+    const b = await bench([toolResult(3, 'c1', 'bash')])
+    const view = mountApp(b.slots)
+    view.getByText('Build').click()
+    expect(b.layout.openDetails).toHaveBeenCalledTimes(1)
+  })
+
+  it('a live keyed registration takes over its tool row and unload reverts to the fallback', async () => {
+    const b = await bench([toolResult(3, 'c2', 'mystery', '{"n":1}')])
+    const view = mountApp(b.slots)
+    expect(view.getByText('Tool call')).toBeTruthy()
+    let dispose = (): void => {}
+    await act(async () => {
+      dispose = b.slots.register(
+        { name: 'conversation.chat.toolview', key: 'mystery' },
+        () => <div data-testid="mystery-row" />)
+    })
+    // Per-key version tick: the row flipped without a remount of the view.
+    expect(view.getByTestId('mystery-row')).toBeTruthy()
+    expect(view.queryByText('Tool call')).toBeNull()
+    await act(async () => { dispose() })
+    expect(view.queryByTestId('mystery-row')).toBeNull()
+    expect(view.getByText('Tool call')).toBeTruthy()
+  })
+
+  it('a duplicate key registration fails loud at load', async () => {
+    const b = await bench([])
+    // The bash sample already holds the 'bash' key (later-wins retired with
+    // the ring — the keyed ledger throws instead).
+    expect(() => b.slots.register(
+      { name: 'conversation.chat.toolview', key: 'bash' },
+      () => null,
+    )).toThrow(/key "bash"/)
+  })
+
+  it('the inject channel feeds (sessionId) => I into the row component', async () => {
+    const b = await bench([toolResult(3, 'c3', 'probe', '{"x":1}')])
+    const poked: string[] = []
+    b.slots.register({
+      name: 'conversation.chat.toolview',
+      key: 'probe',
+      // Two-way business face: data derived from the session id out, a
+      // callback closing over it back in — the askuser-pattern inject shape.
+      inject: (sessionId: SessionId) => ({
+        mark: `for:${sessionId}`,
+        poke: () => { poked.push(sessionId) },
+      }),
+    }, ({ mark, poke }: ToolRowProps & { mark: string; poke: () => void }) => (
+      <button data-testid="probe-row" onClick={poke}>{mark}</button>
+    ))
+    const view = mountApp(b.slots)
+    const row = view.getByTestId('probe-row')
+    expect(row.textContent).toBe(`for:${SID}`)
+    row.click()
+    expect(poked).toEqual([SID])
+  })
+})
+
+describe('registrant load-order seam', () => {
+  it("suspends a registrant on inject: ['slots', 'conversation'] until the service (and the hole) exists", async () => {
+    const ctx = new Context()
+    const slotsFiber = ctx.plugin(SlotsService)
+    await slotsFiber.await()
+    const slots = ctx.get('slots') as SlotsService
+    ctx.provide('sessions', {
+      list: createSnapshotStore<SessionListState>({ ids: [], byId: {}, current: undefined } as SessionListState),
+      manager: { get: vi.fn() },
+      scope: () => undefined,
+      cell: () => undefined,
+      create: vi.fn(),
+      open: vi.fn(),
+    })
+    ctx.provide('layout', { openDetails: vi.fn(), closeDetails: vi.fn() })
+    ctx.provide('i18n', { bind: () => (key: string) => key })
+    slots.register({
+      name: 'root',
+      children: {
+        'conversation': { kind: 'single', scope: 'session' },
+        'details': { kind: 'single', scope: 'session' },
+        'conversation.empty': { kind: 'single', scope: 'root' },
+      },
+    }, AppRoot)
+
+    // Third-party posture, mounted BEFORE ui-conversation: real fiber inject
+    // semantics hold it — apply must not run while 'conversation' is absent.
+    // (Plain arrow, not vi.fn: mock functions carry a prototype and trip the
+    // fiber's isConstructor branch.)
+    let applyRuns = 0
+    const registrantApply = (registrantCtx: Context): void => {
+      applyRuns += 1
+      registrantCtx.slots.register(
+        { name: 'conversation.chat.toolview', key: 'late' }, () => null)
+    }
+    const late = ctx.plugin({
+      name: 'late-registrant',
+      inject: ['slots', 'conversation'],
+      apply: registrantApply,
+    })
+    await Promise.resolve()
+    expect(applyRuns).toBe(0)
+
+    // Mounting the package resolves the seam: service present ⟹ the chat
+    // entry (and its hole declaration) is already on the ledger, so the
+    // suspended registrant lands without an undeclared-slot throw.
+    const fiber = ctx.plugin({ inject: [...inject], apply })
+    await fiber.await()
+    await late.await()
+    expect(applyRuns).toBe(1)
+    expect(slots.entries('conversation.chat.toolview').map(e => e.options.key))
+      .toEqual(expect.arrayContaining(['bash', 'late']))
+  })
+})

packages/client/ui-conversation/tests/chat-view.spec.tsx

@@ -7,14 +7,13 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { Profiler } from 'react'
 import { act, cleanup, fireEvent, render } from '@testing-library/react'
 import type {
-  AssistantMessageNode, ConversationNode, ConversationSnapshot, RunningToolCall, SessionId, ToolResultNode, UserMessageNode,
+  AssistantMessageNode, ConversationNode, ConversationSnapshot, RunningToolCall, SessionId, SessionListState, ToolResultNode, UserMessageNode,
 } from '@deepseek-ai/dsh-client-runtime/client'
-import { hookOf } from './hook.ts'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
-import type { ConvViewProps, SelectionTarget } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import type { ChatViewSlotProps, SelectionTarget } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { createChatStore } from '../src/client/stores.ts'
-import { createChatView } from '../src/client/chat/ChatView.tsx'
+import { ChatView } from '../src/client/chat/ChatView.tsx'
 import { deriveChatFlow, flowKeys } from '../src/client/chat/chat-flow.ts'
 
 afterEach(cleanup)
@@ -68,23 +67,41 @@ const runningCall = (callId: string, name = 'bash'): RunningToolCall => ({
   callId, name, argsRaw: `{"command":"cmd-${callId}"}`, turn: 2, step: 1, callView: null,
 })
 
+/** Empty sessions-list hook stub (the global standard-kit seat; engines carry no hook since the store migration — bind here). */
+function emptySessions() {
+  const store = createSnapshotStore<SessionListState>(
+    { ids: [], byId: {}, current: undefined } as SessionListState)
+  return bindSnapshotSelector(store)
+}
+
 function makeHarness(init?: Partial<ConversationSnapshot>) {
   const { set, source } = makeSource(init)
-  const registry = new ToolViewRegistry()
-  const ChatView = createChatView({ toolviews: registry, t: (k) => k })
   const openDetails = vi.fn<(t: SelectionTarget) => void>()
   const loadOlder = vi.fn()
   // Selection rides the REAL chat store (same construction path as
-  // production; the view reads it through the ConvViewProps useStore share).
+  // production; the view reads it through the PropsStore useStore share).
+  // renderSlot stub renders the render-site fallback (an empty keyed ledger:
+  // every tool lands on GenericToolCard); keyed dispatch to registered rows
+  // is the slot machinery's behavior, covered by its own specs.
   const chat = createChatStore().create()
-  const props: ConvViewProps = {
+  const renderSlot = ((_key: string, _owner: object, opts?: { fallback?: React.ReactNode }) =>
+    opts?.fallback ?? null) as unknown as ChatViewSlotProps['renderSlot']
+  // SessionProvider seat arrives with the session-scope child declaration;
+  // ChatView never invokes it (render-prop pass-through stub).
+  const SessionProviderStub: ChatViewSlotProps['SessionProvider'] = ({ children }) => <>{children(SID)}</>
+  const props: ChatViewSlotProps = {
     sessionId: SID,
-    useSession: hookOf(source) as unknown as UseSession,
-    useStore: hookOf(chat),
-    actions: { openDetails, loadOlder },
+    useSession: bindSnapshotSelector(source),
+    useSessions: emptySessions(),
+    useStore: bindSnapshotSelector(chat),
+    actions: chat.actions,
+    renderSlot,
+    SessionProvider: SessionProviderStub,
+    openDetails,
+    loadOlder,
   }
   const setSelection = (next: SelectionTarget | null): void => { chat.actions.select(next) }
-  return { set, registry, ChatView, props, openDetails, loadOlder, setSelection }
+  return { set, ChatView, props, openDetails, loadOlder, setSelection }
 }
 
 describe('chat-flow derivation', () => {
@@ -169,11 +186,13 @@ describe('ChatView', () => {
     const h = makeHarness({
       nodes: [user(1, 'q'), assistant(2, 'old'), toolResult(3, 'a')],
     })
+    // Count renderSlot invocations: the memo boundary holds when CallRow does
+    // not re-render, so the row's renderSlot call count freezes during chunks.
     let rowRenders = 0
-    h.registry.register('bash', () => {
+    h.props.renderSlot = (((_key: string, _owner: object) => {
       rowRenders += 1
       return <div data-testid="counting-row" />
-    })
+    }) as unknown as ChatViewSlotProps['renderSlot'])
     const view = render(<h.ChatView {...h.props} />)
     expect(view.getByTestId('counting-row')).toBeTruthy()
     const afterMount = rowRenders
@@ -211,21 +230,19 @@ describe('ChatView', () => {
     expect(view.getByText('cmd-r1')).toBeTruthy()
   })
 
-  it('a scoped toolview registration takes over rendering for its session only', () => {
+  it('dispatches each tool row through the keyed slot with the tool name as entryKey', () => {
     const h = makeHarness({ nodes: [toolResult(3, 'a')] })
-    h.registry.register('bash', () => <div data-testid="custom-bash" />, { scope: (id) => id === SID })
-    const view = render(<h.ChatView {...h.props} />)
-    expect(view.getByTestId('custom-bash')).toBeTruthy()
-  })
-
-  it('unregistering a toolview falls back to the generic row live', () => {
-    const h = makeHarness({ nodes: [toolResult(3, 'a')] })
-    const off = h.registry.register('bash', () => <div data-testid="custom-bash" />)
-    const view = render(<h.ChatView {...h.props} />)
-    expect(view.getByTestId('custom-bash')).toBeTruthy()
-    act(() => off())
-    expect(view.queryByTestId('custom-bash')).toBeNull()
-    expect(view.getByText('Bash')).toBeTruthy()
+    const calls: { key: string; entryKey?: string }[] = []
+    h.props.renderSlot = (((key: string, _owner: object, opts?: { entryKey?: string; fallback?: React.ReactNode }) => {
+      calls.push({ key, ...(opts?.entryKey !== undefined ? { entryKey: opts.entryKey } : {}) })
+      return opts?.fallback ?? null
+    }) as unknown as ChatViewSlotProps['renderSlot'])
+    render(<h.ChatView {...h.props} />)
+    // Keyed dispatch: slot name is the declared hole, entryKey the wire tool
+    // name, and the fallback (GenericToolCard) renders on an empty ledger.
+    // (Registered-row takeover and live unload are slot machinery behavior,
+    // owned by the slot system's own specs.)
+    expect(calls).toEqual([{ key: 'conversation.chat.toolview', entryKey: 'bash' }])
   })
 
   it('prepend compensates scrollTop by the height delta; a trailing user node force-scrolls', () => {

packages/client/ui-conversation/tests/coverage-tails.spec.tsx

@@ -1,23 +1,21 @@
 // @vitest-environment jsdom
 // Branch tails the acceptance specs do not reach: ToolRow stopped-state dot,
-// PendingCard question arm, bash sample error pill, registry disposer
-// idempotence re-entry, register.ts explicit bashSampleScope override, the
-// node-half empty apply, and AssistantMarkdown reasoning/unknown block arms.
+// PendingCard question arm, bash sample error pill, the node-half empty
+// apply, and AssistantMarkdown reasoning/unknown block arms.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { cleanup, render } from '@testing-library/react'
-import type { ToolResultNode } from '@deepseek-ai/dsh-client-runtime/client'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
+import type { SessionId, SessionListState, ToolResultNode } from '@deepseek-ai/dsh-client-runtime/client'
 import type { RpcId } from '@deepseek-ai/dsh-client-connection/client'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import type { ConversationService, Translate, ToolViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { ToolRowOwnerProps, ToolRowProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { apply as nodeApply } from '../src/index.ts'
 import { GenericToolCard } from '../src/client/chat/GenericToolCard.tsx'
 import { ToolRow } from '../src/client/chat/ToolRow.tsx'
 import { PendingCard } from '../src/client/chat/PendingCard.tsx'
 import { AssistantMarkdown } from '../src/client/chat/AssistantMarkdown.tsx'
 import { BashRow } from '../src/client/toolviews/bash-sample.tsx'
-import { registerChat } from '../src/client/chat/register.ts'
 
 afterEach(cleanup)
 
@@ -67,11 +65,8 @@ describe('tails', () => {
       call: { name: 'todo_write', argsRaw: '{"note":"x"}' },
       content: [], isError: false, callView: null, resultView: null,
     }
-    const props: ToolViewProps = {
-      callId: 'c5', toolName: 'todo_write', block: settled,
-      useSession: (() => { throw new Error('unused') }) as unknown as UseSession,
-      actions: { openDetails: vi.fn() },
-      t: ((k: string) => k) as Translate,
+    const props: ToolRowOwnerProps = {
+      callId: 'c5', toolName: 'todo_write', block: settled, openDetails: vi.fn(),
     }
     const view = render(<GenericToolCard {...props} />)
     // Settled ok state keeps the variant icon (sparkle) instead of a StateDot.
@@ -79,49 +74,25 @@ describe('tails', () => {
     expect(view.container.querySelector('[data-state="ok"]')).not.toBeNull()
   })
 
-  it('BashRow shows the failed pill on error results', () => {
+  it('BashRow shows the failed pill on error results (root session arm)', () => {
     const errorResult: ToolResultNode = {
       kind: 'tool-result', seq: 1, callId: 'c1',
       call: { name: 'bash', argsRaw: '{"command":"boom"}' },
       content: [], isError: true, callView: null, resultView: null,
     }
-    const props: ToolViewProps = {
-      callId: 'c1', toolName: 'bash', block: errorResult,
-      useSession: (() => { throw new Error('unused') }) as unknown as UseSession,
-      actions: { openDetails: vi.fn() },
-      t: ((k: string) => k) as Translate,
-    }
+    // Root session (no parentId): the global arm renders, error pill visible.
+    const sid = 'root-1' as SessionId
+    const list = createSnapshotStore<SessionListState>({
+      ids: [sid],
+      byId: { [sid]: { id: sid, title: 'r', running: false, updatedAt: 0 } },
+      current: undefined,
+    } as SessionListState)
+    const props = {
+      callId: 'c1', toolName: 'bash', block: errorResult, openDetails: vi.fn(),
+      sessionId: sid, useSessions: bindSnapshotSelector(list),
+    } as unknown as ToolRowProps
     const view = render(<BashRow {...props} />)
+    expect(view.container.querySelector('[data-sample="bash-global"]')).not.toBeNull()
     expect(view.getByText('failed')).toBeTruthy()
   })
-
-  it('registry disposer re-entry is a no-op after the entry was already removed', () => {
-    const registry = new ToolViewRegistry()
-    const off = registry.register('bash', (() => null) as never)
-    const v1 = registry.getVersion()
-    off()
-    const v2 = registry.getVersion()
-    off()
-    expect(registry.getVersion()).toBe(v2)
-    expect(v2).toBeGreaterThan(v1)
-  })
-
-  it('registerChat registers the chat view with the stats footer and disposes cleanly', () => {
-    const disposer = vi.fn()
-    const calls: unknown[] = []
-    const conversation = {
-      registerView: (entry: unknown) => {
-        calls.push(entry)
-        return disposer
-      },
-    } as unknown as ConversationService
-    const toolviews = new ToolViewRegistry()
-    const off = registerChat({ conversation, toolviews, t: ((k: string) => k) as Translate })
-    const entry = calls[0] as { id: string; chrome?: { footer?: unknown } }
-    expect(entry.id).toBe('chat')
-    // footer is a memo exotic component (object, not plain function).
-    expect(entry.chrome?.footer).toBeDefined()
-    off()
-    expect(disposer).toHaveBeenCalledTimes(1)
-  })
 })

packages/client/ui-conversation/tests/gate-branch-tails.spec.tsx

@@ -1,18 +1,16 @@
 // @vitest-environment jsdom
-// Final branch tails for the coverage gate, terminal slot form: apply's
-// need() throw, AssistantMarkdown non-final reasoning, StatsLine usage-less
-// node, DetailsPanel titleless selection, registry disposer after a foreign
-// removal emptied the list. (The old cwd WeakMap-cache account retired with
-// the mechanism — derivation lives in EmptyState now, covered by the
-// skeleton specs.)
+// Final branch tails for the coverage gate, terminal slot form:
+// AssistantMarkdown non-final reasoning, StatsLine usage-less node,
+// DetailsPanel titleless selection. (The old cwd WeakMap-cache account
+// retired with the mechanism — derivation lives in EmptyState now, covered
+// by the skeleton specs.)
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { cleanup, render } from '@testing-library/react'
-import { hookOf } from './hook.ts'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
+import type { UseSession } from '@deepseek-ai/dsh-client-web-react'
 import type { ConversationSnapshot, SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import type { SelectionTarget } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { createChatStore } from '../src/client/stores.ts'
 import { AssistantMarkdown } from '../src/client/chat/AssistantMarkdown.tsx'
@@ -54,7 +52,7 @@ describe('render branch tails', () => {
     }
     const source = { getSnapshot: () => snap, subscribe: () => () => {} }
     const view = render(
-      <StatsLine sessionId={SID} useSession={hookOf(source) as unknown as UseSession<ConversationSnapshot>} />,
+      <StatsLine useSession={bindSnapshotSelector(source) as unknown as UseSession<ConversationSnapshot>} />,
     )
     expect(view.getByText('cache hit 0% · 15 tokens · 2 turns · 3 steps')).toBeTruthy()
   })
@@ -76,9 +74,9 @@ describe('render branch tails', () => {
     const view = render(
       <DetailsPanel
         sessionId={SID}
-        useSession={hookOf({ getSnapshot: () => snap, subscribe: () => () => {} }) as unknown as UseSession<ConversationSnapshot>}
-        useSessions={hookOf(emptyList)}
-        useStore={hookOf(chat)}
+        useSession={bindSnapshotSelector({ getSnapshot: () => snap, subscribe: () => () => {} }) as unknown as UseSession<ConversationSnapshot>}
+        useSessions={bindSnapshotSelector(emptyList)}
+        useStore={bindSnapshotSelector(chat)}
         actions={chat.actions}
         closeDetails={vi.fn()}
       />,
@@ -86,15 +84,4 @@ describe('render branch tails', () => {
     expect(view.getByText('详情')).toBeTruthy()
     expect(view.getByText('该调用不在当前窗口内')).toBeTruthy()
   })
-
-  it('registry disposer tolerates the list already emptied by a sibling disposer', () => {
-    const registry = new ToolViewRegistry()
-    const offA = registry.register('bash', () => null)
-    const offB = registry.register('bash', () => null)
-    offA()
-    offB()
-    // Both entries gone; a re-register works from a fresh list.
-    registry.register('bash', () => null)
-    expect(registry.resolve('bash', SID)).toBeDefined()
-  })
 })

packages/client/ui-conversation/tests/service-orchestration.spec.ts

@@ -2,9 +2,10 @@
 /**
  * ConversationService orchestration half after the store-seat slimming:
  * scope-addressed send/cancel (result folding, root throw), the startSession
- * chain (create → sessions.open → scoped send), views ordering, and the
- * service-unavailable loud failures. Selection/draft state left this service
- * for the declared chat store (chat-store.spec.ts / selection-survival.spec.ts).
+ * chain (create → sessions.open → scoped send), and the service-unavailable
+ * loud failures. Selection/draft state left this service for the declared
+ * chat store (chat-store.spec.ts / selection-survival.spec.ts); the view
+ * registry left for the 'conversation.view' slot (views-type-chain.spec.tsx).
  */
 import { Context } from 'cordis'
 import { describe, expect, it, vi } from 'vitest'
@@ -68,7 +69,8 @@ async function bench(opts?: { sessions?: boolean }) {
     scope: (id: SessionId) => (id === sid('new-1') ? mint(id) : scopes.get(id)),
   } as unknown as SessionsService
   if (opts?.sessions !== false) ctx.provide('sessions', sessionsFake)
-  const fiber = ctx.plugin((pluginCtx) => { void new ConversationService(pluginCtx) })
+  // Class-plugin mount — the same form apply.ts uses in production.
+  const fiber = ctx.plugin(ConversationService)
   await fiber.await()
   const svc = ctx.get('conversation') as ConversationService
   const scopedSvc = (id: SessionId) => mint(id).get('conversation') as ConversationService
@@ -149,17 +151,3 @@ describe('service-unavailable loud failures', () => {
       .rejects.toThrow(/conversation service unavailable through the new scope/)
   })
 })
-
-describe('views ordering', () => {
-  it('orders by explicit order with undefined treated as zero (both comparator arms)', async () => {
-    const b = await bench()
-    const entry = (id: string, order?: number) => ({
-      id, label: id, component: () => null,
-      ...(order !== undefined ? { order } : {}),
-    })
-    b.svc.registerView(entry('z-late', 5) as never)
-    b.svc.registerView(entry('default-zero') as never)
-    b.svc.registerView(entry('first', -1) as never)
-    expect(b.svc.views().map(v => v.id)).toEqual(['first', 'default-zero', 'z-late'])
-  })
-})

packages/client/ui-conversation/tests/skeleton-branches.spec.tsx

@@ -11,10 +11,10 @@ import { hookOf } from './hook.ts'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
 import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
 import type { ConversationSnapshot, SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import type { SelectionTarget, ViewEntry } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { SelectionTarget, ViewTab } from '@deepseek-ai/dsh-client-ui-conversation/client'
 // Export discipline: packages/client/AGENTS.md.
 import { createChatStore } from '../src/client/stores.ts'
-import { ConversationRoot } from '../src/client/skeleton/ConversationRoot.tsx'
+import { ConversationRoot, type ConversationRootProps } from '../src/client/skeleton/ConversationRoot.tsx'
 import { DetailsPanel } from '../src/client/skeleton/DetailsPanel.tsx'
 import { EmptyState } from '../src/client/skeleton/EmptyState.tsx'
 
@@ -53,9 +53,11 @@ function listHook(rows: { id: string; title: string; cwd?: string; parentId?: st
 }
 
 describe('ConversationRoot branches', () => {
-  const chatEntry: ViewEntry = {
-    id: 'chat', label: 'Chat', component: () => <div data-testid="view-body" />,
-  } as unknown as ViewEntry
+  const chatTab: ViewTab = { id: 'chat', label: 'Chat' }
+  /** renderSlot stub in the outlet's baked shape (ring key + only filter marker). */
+  const stubRenderSlot = (() => <div data-testid="view-body" />) as unknown as ConversationRootProps['renderSlot']
+  /** SessionProvider seat stub (render-prop pass-through; ConversationRoot never invokes it). */
+  const SessionProviderStub: ConversationRootProps['SessionProvider'] = ({ children }) => <>{children(SID)}</>
 
   function rootProps(over?: {
     rows?: { id: string; title: string; parentId?: string }[]
@@ -70,11 +72,11 @@ describe('ConversationRoot branches', () => {
         useSessions={listHook(over?.rows ?? [])}
         useStore={hookOf(chat)}
         actions={chat.actions}
-        views={{ list: () => [chatEntry], subscribe: () => () => {}, version: () => 1 }}
+        renderSlot={stubRenderSlot}
+        SessionProvider={SessionProviderStub}
+        views={{ list: () => [chatTab], subscribe: () => () => {}, version: () => 1 }}
         send={vi.fn()}
         stop={vi.fn()}
-        openDetails={vi.fn()}
-        loadOlder={vi.fn()}
         open={open}
       />,
     )
@@ -120,7 +122,7 @@ describe('ConversationRoot branches', () => {
   it('an unknown stored view id falls back to the first registered view', () => {
     const { chat } = rootProps({})
     cleanup()
-    chat.actions.setView('gone' as never)
+    chat.actions.setView('gone')
     const view = render(
       <ConversationRoot
         sessionId={SID}
@@ -128,11 +130,11 @@ describe('ConversationRoot branches', () => {
         useSessions={listHook([])}
         useStore={hookOf(chat)}
         actions={chat.actions}
-        views={{ list: () => [chatEntry], subscribe: () => () => {}, version: () => 1 }}
+        renderSlot={stubRenderSlot}
+        SessionProvider={SessionProviderStub}
+        views={{ list: () => [chatTab], subscribe: () => () => {}, version: () => 1 }}
         send={vi.fn()}
         stop={vi.fn()}
-        openDetails={vi.fn()}
-        loadOlder={vi.fn()}
         open={vi.fn()}
       />,
     )

packages/client/ui-conversation/tests/skeleton.spec.tsx

@@ -10,12 +10,12 @@
  */
 import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { FC } from 'react'
-import { hookOf } from './hook.ts'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
+import type { UseSession } from '@deepseek-ai/dsh-client-web-react'
 import type { ConversationSnapshot, SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import type { SelectionTarget, ViewEntry } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { SelectionTarget, ViewTab } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { ConversationRootProps } from '../src/client/skeleton/ConversationRoot.tsx'
 // Export discipline: packages/client/AGENTS.md.
 import { createChatStore } from '../src/client/stores.ts'
 import { ConversationRoot } from '../src/client/skeleton/ConversationRoot.tsx'
@@ -42,7 +42,7 @@ function fakeSession(init: Partial<FakeSnapshot> = {}) {
   const store = createSnapshotStore<FakeSnapshot>({
     nodes: [], runningCalls: [], running: false, removed: false, promptError: null, ...init,
   })
-  return { store, useSession: hookOf(store) as unknown as UseSession<ConversationSnapshot> }
+  return { store, useSession: bindSnapshotSelector(store) as unknown as UseSession<ConversationSnapshot> }
 }
 
 /** Sessions-list stub: the standard useSessions hook over a snapshot store. */
@@ -56,9 +56,12 @@ function fakeSessions(rows: { id: string; title: string; cwd?: string; parentId?
     }])),
     current: undefined,
   } as SessionListState)
-  return { store, useSessions: hookOf(store) }
+  return { store, useSessions: bindSnapshotSelector(store) }
 }
 
+/** SessionProvider seat stub (render-prop pass-through; ConversationRoot never invokes it). */
+const SessionProviderStub: ConversationRootProps['SessionProvider'] = ({ children }) => <>{children(sid('s1'))}</>
+
 describe('EmptyState', () => {
   it('derives cwd options from the sessions list, submits startSession, failure surfaces locally', async () => {
     const { useSessions } = fakeSessions([
@@ -96,49 +99,48 @@ describe('EmptyState', () => {
 })
 
 describe('ConversationRoot', () => {
-  function bench(views: ViewEntry[], activeView?: string) {
+  function bench(tabs: ViewTab[], activeView?: string) {
     const { useSession } = fakeSession({ nodes: [{ kind: 'user' }, { kind: 'user' }] })
     const { useSessions } = fakeSessions([
       { id: 'root', title: 'proj' },
       { id: 's1', title: 'child', parentId: 'root' },
     ])
     const chat = createChatStore().create()
-    if (activeView !== undefined) chat.actions.setView(activeView as never)
+    if (activeView !== undefined) chat.actions.setView(activeView)
     const send = vi.fn()
     const stop = vi.fn()
-    const openDetails = vi.fn()
-    const loadOlder = vi.fn()
     const open = vi.fn()
+    // The renderSlot share as the outlet would bake it: renders a marker for
+    // the ring key carrying the active-id filter (a Mock cannot satisfy the
+    // generic method type directly — cast once at the prop seam).
+    const renderSlot = vi.fn((key: string, _owner: object, opts?: { only?: string }) => (
+      <div data-testid={`view-${opts?.only ?? '(all)'}`} data-slot={key} />
+    ))
     const ui = render(
       <ConversationRoot
         sessionId={sid('s1')}
         useSession={useSession}
         useSessions={useSessions}
-        useStore={hookOf(chat)}
+        useStore={bindSnapshotSelector(chat)}
         actions={chat.actions}
+        renderSlot={renderSlot as unknown as ConversationRootProps['renderSlot']}
+        SessionProvider={SessionProviderStub}
         views={{
-          list: () => views,
+          list: () => tabs,
           subscribe: () => () => {},
           version: () => 1,
         }}
         send={send}
         stop={stop}
-        openDetails={openDetails}
-        loadOlder={loadOlder}
         open={open}
       />)
-    return { ui, chat, send, stop, open }
+    return { ui, chat, send, stop, open, renderSlot }
   }
 
-  /** View bodies record their mount via testid (renderView is in-component now). */
-  const view = (id: string, label: string): ViewEntry =>
-    ({
-      id, label,
-      component: (() => <div data-testid={`view-${id}`} />) as unknown as FC<never>,
-    }) as unknown as ViewEntry
+  const tab = (id: string, label: string): ViewTab => ({ id, label })
 
   it('renders breadcrumb chain (useSessions-derived), meta turns, and the default chat view', () => {
-    const { open } = bench([view('chat', 'Chat'), view('trajectory', 'Trajectory')])
+    const { open } = bench([tab('chat', 'Chat'), tab('trajectory', 'Trajectory')])
     expect(screen.getByText('proj')).toBeTruthy()
     expect(screen.getByText('child')).toBeTruthy()
     expect(screen.getByText(/2 turns/)).toBeTruthy()
@@ -150,33 +152,25 @@ describe('ConversationRoot', () => {
   })
 
   it('switches views through the store view field and falls back on unknown ids', () => {
-    const { chat } = bench([view('chat', 'Chat'), view('trajectory', 'Trajectory')])
+    const { chat } = bench([tab('chat', 'Chat'), tab('trajectory', 'Trajectory')])
     fireEvent.click(screen.getByRole('tab', { name: 'Trajectory' }))
     expect(chat.store.getSnapshot().view).toBe('trajectory')
     expect(screen.getByTestId('view-trajectory')).toBeTruthy()
     cleanup()
     // A stale persisted id (its view plugin unloaded) falls to the first view.
-    bench([view('chat', 'Chat'), view('trajectory', 'Trajectory')], 'ghost-view')
+    bench([tab('chat', 'Chat'), tab('trajectory', 'Trajectory')], 'ghost-view')
     expect(screen.getByTestId('view-chat')).toBeTruthy()
   })
 
-  it('mounts chrome header/footer around the view body', () => {
-    const entry = {
-      id: 'chat', label: 'Chat',
-      component: () => <div data-testid="body" />,
-      chrome: {
-        header: () => <div data-testid="hd" />,
-        footer: () => <div data-testid="ft" />,
-      },
-    } as unknown as ViewEntry
-    bench([entry])
-    expect(screen.getByTestId('hd')).toBeTruthy()
-    expect(screen.getByTestId('body')).toBeTruthy()
-    expect(screen.getByTestId('ft')).toBeTruthy()
+  it('renders the active view through the declared ring slot with the only filter', () => {
+    const { renderSlot } = bench([tab('chat', 'Chat')])
+    // No owner share: views take everything from the standard kit (contract).
+    expect(renderSlot).toHaveBeenCalledWith('conversation.view', {}, { only: 'chat' })
+    expect(screen.getByTestId('view-chat').getAttribute('data-slot')).toBe('conversation.view')
   })
 
   it('hides the tab strip with a single view; composer writes the store draft and sends it', () => {
-    const { chat, send } = bench([view('chat', 'Chat')])
+    const { chat, send } = bench([tab('chat', 'Chat')])
     expect(screen.queryByRole('tablist')).toBeNull()
     const box = screen.getByPlaceholderText(/输入消息/)
     fireEvent.change(box, { target: { value: 'hi' } })
@@ -199,7 +193,7 @@ describe('DetailsPanel', () => {
         sessionId={sid('s1')}
         useSession={useSession}
         useSessions={useSessions}
-        useStore={hookOf(chat)}
+        useStore={bindSnapshotSelector(chat)}
         actions={chat.actions}
         closeDetails={closeDetails}
       />)

packages/client/ui-conversation/tests/toolview-entry-types.spec.ts

@@ -1,62 +0,0 @@
-/**
- * Tool-ring Entry typing (design §7): I inferred from the inject factory at
- * the register site, component must accept ToolViewProps & I, and the resolve
- * read face carries the erased-but-present inject. Compile-time checks via
- * @ts-expect-error pairs; the runtime assertions just keep vitest happy.
- */
-import { describe, expect, it } from 'vitest'
-import type { FC } from 'react'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import type { ToolViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
-
-const sid = (s: string): SessionId => s as SessionId
-
-// Positive control: component's own injected share matches the factory's product.
-interface RowInjected { useMyStore: () => number }
-const InjectedRowComp: FC<ToolViewProps & RowInjected> = () => null
-// Plain rows take the shared props only.
-const PlainRowComp: FC<ToolViewProps> = () => null
-
-describe('tool-ring entry typing', () => {
-  it('register infers I from the inject factory and accepts a matching component', () => {
-    const reg = new ToolViewRegistry()
-    const off = reg.register('bash', InjectedRowComp, {
-      inject: () => ({ useMyStore: () => 1 }),
-    })
-    expect(reg.resolve('bash', sid('s'))?.inject).toBeDefined()
-    off()
-  })
-
-  it('injectless registration needs no options and resolves without inject', () => {
-    const reg = new ToolViewRegistry()
-    reg.register('read', PlainRowComp)
-    expect('inject' in (reg.resolve('read', sid('s')) ?? {})).toBe(false)
-  })
-
-  it('compile-time: factory product must cover the component injected share', () => {
-    const reg = new ToolViewRegistry()
-    reg.register('bash', InjectedRowComp, {
-      // @ts-expect-error the factory misses useMyStore, which the component requires
-      inject: () => ({ somethingElse: 1 }),
-    })
-    expect(true).toBe(true)
-  })
-
-  // Known boundary (not asserted): a component demanding an injected share CAN
-  // register bare — with I defaulting to `object`, FC<ToolViewProps & RowInjected>
-  // is structurally assignable to FC<ToolViewProps & object> (parameter
-  // bivariance over a wider props type). The register-site guarantee holds in
-  // the direction that matters: WITH an inject factory, its product must cover
-  // the component's share (previous case). The bare-register gap is the same
-  // one SlotMap's single-kind register has and is accepted by design §7.
-
-  it('compile-time: scope filter receives the branded SessionId', () => {
-    const reg = new ToolViewRegistry()
-    reg.register('bash', PlainRowComp, {
-      // @ts-expect-error number is not assignable to SessionId
-      scope: (id: number) => id > 0,
-    })
-    expect(true).toBe(true)
-  })
-})

packages/client/ui-conversation/tests/toolview-registry.spec.ts

@@ -1,101 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-import { ToolViewRegistry } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import type { ToolViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
-
-const sid = (s: string) => s as SessionId
-const comp = (name: string) => {
-  const fc = () => null
-  fc.displayName = name
-  return fc as unknown as import('react').FC<ToolViewProps>
-}
-
-describe('ToolViewRegistry', () => {
-  it('resolves a global registration for any session', () => {
-    const reg = new ToolViewRegistry()
-    const bash = comp('Bash')
-    reg.register('bash', bash)
-    expect(reg.resolve('bash', sid('a'))?.component).toBe(bash)
-    expect(reg.resolve('bash', sid('b'))?.component).toBe(bash)
-    expect(reg.resolve('read', sid('a'))).toBeUndefined()
-  })
-
-  it('prefers a matching scope filter over the global registration', () => {
-    const reg = new ToolViewRegistry()
-    const global = comp('Global')
-    const swarm = comp('Swarm')
-    reg.register('bash', global)
-    reg.register('bash', swarm, { scope: id => id === sid('swarm-1') })
-    expect(reg.resolve('bash', sid('swarm-1'))?.component).toBe(swarm)
-    expect(reg.resolve('bash', sid('plain'))?.component).toBe(global)
-  })
-
-  it('later registration wins within the same tier, scoped and global', () => {
-    const reg = new ToolViewRegistry()
-    const s1 = comp('S1')
-    const s2 = comp('S2')
-    const g1 = comp('G1')
-    const g2 = comp('G2')
-    reg.register('bash', g1)
-    reg.register('bash', s1, { scope: () => true })
-    reg.register('bash', s2, { scope: () => true })
-    reg.register('bash', g2)
-    expect(reg.resolve('bash', sid('x'))?.component).toBe(s2)
-    const scopeless = new ToolViewRegistry()
-    scopeless.register('bash', g1)
-    scopeless.register('bash', g2)
-    expect(scopeless.resolve('bash', sid('x'))?.component).toBe(g2)
-  })
-
-  it('a non-matching scope filter falls through to global, then undefined', () => {
-    const reg = new ToolViewRegistry()
-    const scoped = comp('Scoped')
-    reg.register('bash', scoped, { scope: () => false })
-    expect(reg.resolve('bash', sid('x'))).toBeUndefined()
-    const global = comp('Global')
-    reg.register('bash', global)
-    expect(reg.resolve('bash', sid('x'))?.component).toBe(global)
-  })
-
-  it('disposer removes exactly its registration and is idempotent', () => {
-    const reg = new ToolViewRegistry()
-    const g = comp('G')
-    const s = comp('S')
-    const off = reg.register('bash', s, { scope: () => true })
-    reg.register('bash', g)
-    off()
-    off()
-    expect(reg.resolve('bash', sid('x'))?.component).toBe(g)
-  })
-
-  it('unregistering the last entry resolves undefined (GenericToolCard fallback)', () => {
-    const reg = new ToolViewRegistry()
-    const off = reg.register('bash', comp('B'))
-    off()
-    expect(reg.resolve('bash', sid('x'))).toBeUndefined()
-  })
-
-  it('carries the inject factory through resolve', () => {
-    const reg = new ToolViewRegistry()
-    const inject = () => ({})
-    reg.register('bash', comp('B'), { inject })
-    expect(reg.resolve('bash', sid('x'))?.inject).toBe(inject)
-    reg.register('read', comp('R'))
-    expect('inject' in reg.resolve('read', sid('x'))!).toBe(false)
-  })
-
-  it('notifies subscribers and bumps the version on register and dispose', () => {
-    const reg = new ToolViewRegistry()
-    const fn = vi.fn()
-    const unsub = reg.subscribe(fn)
-    const v0 = reg.getVersion()
-    const off = reg.register('bash', comp('B'))
-    expect(fn).toHaveBeenCalledTimes(1)
-    expect(reg.getVersion()).toBeGreaterThan(v0)
-    off()
-    expect(fn).toHaveBeenCalledTimes(2)
-    unsub()
-    reg.register('read', comp('R'))
-    expect(fn).toHaveBeenCalledTimes(2)
-  })
-})

packages/client/ui-conversation/tests/toolviews-type-chain.spec.ts

@@ -1,94 +0,0 @@
-// Tool-ring type-chain samples (design §9 item 5, toolviews half): the
-// register→inject→resolve chain where `I` is inferred from the inject
-// factory and proved against the component at the register site, plus
-// expect-error duals. Tool names stay an open set (no per-tool props table —
-// design §7); the strong typing under test is Entry-internal. The known
-// bare-register variance edge (FC<Props & I> assignable to FC<Props & object>
-// without an inject factory) is accepted by design §7 and deliberately not
-// pinned here. Follows the slots-ring exemplar's shape.
-import { describe, expect, it } from 'vitest'
-import type { FC, ReactNode } from 'react'
-import type { ToolViewOptions, ToolViewProps } from '../src/client/contract/toolview.ts'
-import { ToolViewRegistry } from '../src/client/toolviews/registry.ts'
-import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
-
-const sid = (s: string): SessionId => s as SessionId
-
-/** Registrant's own injected share (locally declared — ownership rule). */
-interface RowInjected { useRuns: () => number; actions2: { rerun: () => void } }
-
-const InjectedRow: FC<ToolViewProps & RowInjected> = () => null
-const PlainRow: FC<ToolViewProps> = () => null
-
-describe('tool-ring type-chain negatives (compile-time; body never runs)', () => {
-  it('holds the negative samples as expect-error sites', () => {
-    const negatives = (registry: ToolViewRegistry) => {
-      // 1. Inject factory under-produces the component's declared share:
-      //    I infers from the factory, and the component position then fails.
-      registry.register(
-        'bash',
-        // @ts-expect-error component wants actions2, which the factory never produces
-        InjectedRow,
-        { inject: () => ({ useRuns: () => 1 }) },
-      )
-      // 2. Inject factory produces a drifted value type for a declared key
-      //    (I infers from the component position here, so TS flags the factory).
-      registry.register(
-        'bash',
-        InjectedRow,
-        // @ts-expect-error useRuns returns string here, component wants number
-        { inject: () => ({ useRuns: () => 'one', actions2: { rerun: () => {} } }) },
-      )
-      // 3. Options object drifts: scope filter with a wrong parameter shape.
-      const badScope: ToolViewOptions<RowInjected> = {
-        // @ts-expect-error scope takes a SessionId, not a numeric index
-        scope: (index: number) => index > 0,
-      }
-      void badScope
-      // 4. Component demanding props outside ToolViewProps & I (a key neither
-      //    standard nor injected) cannot register even with a full factory.
-      const Overreaching: FC<ToolViewProps & RowInjected & { fromNowhere: boolean }> = () => null
-      registry.register(
-        'bash',
-        // @ts-expect-error fromNowhere is neither a standard prop nor produced by the factory
-        Overreaching,
-        { inject: (): RowInjected => ({ useRuns: () => 1, actions2: { rerun: () => {} } }) },
-      )
-      return null as ReactNode
-    }
-    expect(negatives).toBeTypeOf('function')
-  })
-})
-
-describe('tool-ring full chain (positive dual)', () => {
-  it('registers with an inferred inject share, resolves by scope order, and reads the erased face back', () => {
-    const registry = new ToolViewRegistry()
-    // Registration: I inferred from the factory, component proved ⊇ ToolViewProps & I.
-    const disposeGlobal = registry.register('bash', InjectedRow, {
-      // Terminal channel form: the factory receives the session id only.
-      inject: (sessionId: SessionId): RowInjected => ({
-        useRuns: () => sessionId.length,
-        actions2: { rerun: () => {} },
-      }),
-    })
-    const disposeScoped = registry.register('bash', PlainRow, {
-      scope: id => id === sid('swarm-1'),
-    })
-
-    // Resolve: scope match beats global; elsewhere the global row wins.
-    expect(registry.resolve('bash', sid('swarm-1'))?.component).toBe(PlainRow)
-    const global = registry.resolve('bash', sid('other'))
-    expect(global?.component).toBe(InjectedRow)
-    // Read face: I is erased to object, the factory reference survives; the
-    // outlet-side restoration is the budgeted cast (same boundary as slots).
-    const injected = (global?.inject as (sessionId: SessionId) => RowInjected)(sid('ab'))
-    expect(injected.useRuns()).toBe(2)
-    // Unknown tool → undefined (caller falls back to the generic card).
-    expect(registry.resolve('ghost-tool', sid('other'))).toBeUndefined()
-
-    disposeScoped()
-    expect(registry.resolve('bash', sid('swarm-1'))?.component).toBe(InjectedRow)
-    disposeGlobal()
-    expect(registry.resolve('bash', sid('other'))).toBeUndefined()
-  })
-})

packages/client/ui-conversation/tests/views-type-chain.spec.tsx

@@ -1,111 +1,122 @@
-// View-ring type-chain samples (design §9 item 5, views half): the
-// register→inject→render chain composed through ConversationViewMap's
-// per-view extension shapes, plus expect-error duals for each stage.
-// Follows the slots-ring exemplar (ui-slots/tests/type-chain.spec.tsx):
-// negatives live in a never-executed function body; the positive dual runs
-// the real ConversationService view registry.
+// View-ring + toolview-hole type-chain samples, slot form: both are declared
+// slots, so the register→inject→render chain and its compile-time locks are
+// the slot system's (ui-slots/tests/type-chain.spec.tsx owns the generic
+// duals). This spec pins the package-specific surface: the SlotMap rows
+// (kind/scope/owner), list- and keyed-kind registration shapes, the ChatView
+// and tool-row composed-props contracts, and the runtime dual — a real
+// SlotsService ledger driving registration/order/disposal the way
+// ConversationRoot's tab projection consumes it.
 import { Context } from 'cordis'
 import { describe, expect, it } from 'vitest'
-import type { FC, ReactNode } from 'react'
-import type {
-  ChromePropsOf, ConvViewProps, ConvViewPropsOf, ViewEntry,
-} from '../src/client/contract/views.ts'
-import { ConversationService } from '../src/client/service.ts'
+import type { ReactNode } from 'react'
+import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
+import type { ChatViewSlotProps, ConvViewProps, ToolRowProps } from '../src/client/contract/slots.ts'
 
-// Test-only view keys with distinct extension shapes (merged like
-// ui-trajectory does; extension fields are optional per ViewEntryDef).
-declare module '../src/client/contract/views.ts' {
-  interface ConversationViewMap {
-    'vt-extended': { chromeProps: { statLabel: string }; extraProps: { density: 'compact' | 'wide' } }
-    'vt-plain': object
-  }
-}
-
-const ExtendedView: FC<ConvViewPropsOf<'vt-extended'>> = ({ density }) => (density === 'compact' ? null : null)
-const ExtendedChrome: FC<ChromePropsOf<'vt-extended'>> = ({ statLabel }) => (statLabel === '' ? null : null)
-const PlainView: FC<ConvViewPropsOf<'vt-plain'>> = () => null
-
-describe('view-ring type-chain negatives (compile-time; body never runs)', () => {
+describe('view-ring type negatives (compile-time; body never runs)', () => {
   it('holds the negative samples as expect-error sites', () => {
-    const negatives = (service: ConversationService) => {
-      // 1. Registration: a component missing the entry's declared extraProps
-      //    cannot register under that id (props flow from the map entry).
-      const NarrowComp: FC<ConvViewProps & { density: number }> = () => null
-      service.registerView({
-        id: 'vt-extended',
-        label: 'x',
-        // @ts-expect-error density has the wrong value type vs the map entry's extraProps
-        component: NarrowComp,
-      })
-      // 2. Registration: chrome typed for another view's chromeProps drifts.
-      service.registerView({
-        id: 'vt-plain',
-        label: 'x',
-        component: PlainView,
-        // @ts-expect-error vt-plain declares no statLabel chromeProps
-        chrome: { footer: ExtendedChrome },
-      })
-      // 3. Registration: id outside the map is rejected at the entry.
-      service.registerView({
-        // @ts-expect-error unregistered view id
-        id: 'vt-ghost',
-        label: 'x',
-        component: PlainView,
-      })
-      // 4. Render side: per-view props narrow — the extended view's density
-      //    is not accessible under another id's props type.
-      const renderPlain = (props: ConvViewPropsOf<'vt-plain'>): ReactNode => {
-        // @ts-expect-error density belongs to vt-extended's extension, not vt-plain
-        return props.density === 'compact' ? null : null
-      }
-      void renderPlain
-      // 5. Entry-shape drift: ViewEntry<Id> ties chrome and component to the
-      //    SAME id — mixing ids inside one entry fails.
-      const mixed: ViewEntry<'vt-extended'> = {
-        id: 'vt-extended',
-        label: 'x',
-        component: ExtendedView,
-        // @ts-expect-error chrome for vt-plain cannot ride a vt-extended entry
-        chrome: { header: (props: ChromePropsOf<'vt-plain'> & { onlyPlain: true }) => null },
-      }
-      void mixed
-      // 6. Zero-renderSlot inference: the view ring declares no children, so
-      //    view props carry no delegation face (the old hand-written
-      //    ScopedSlots<never> empty surface is retired, not replaced).
-      const renderless = (props: ConvViewPropsOf<'vt-plain'>): ReactNode => {
+    const negatives = (slots: SlotsService) => {
+      // 1. List-kind registration requires the id shape field.
+      // @ts-expect-error missing `id` on a list-slot registration
+      slots.register({ name: 'conversation.view', order: 1 }, (_p: ConvViewProps) => null)
+      // 2. A keyed-kind shape field is rejected on the list slot.
+      slots.register(
+        // @ts-expect-error `key` belongs to keyed slots, not the list ring
+        { name: 'conversation.view', id: 'x', key: 'k' },
+        (_p: ConvViewProps) => null)
+      // 3. Component props must stay within the composed contract: an
+      //    undeclared member cannot be required.
+      // @ts-expect-error component demands a prop no share supplies
+      slots.register(
+        { name: 'conversation.view', id: 'y' },
+        (_p: ConvViewProps & { phantom: number }) => null)
+      // 4. Views receive no renderSlot — the ring's entries declare no children.
+      const renderless = (props: ConvViewProps): ReactNode => {
         // @ts-expect-error views receive no renderSlot — no sub-slot delegation
         void props.renderSlot
-        // @ts-expect-error the legacy slots face is gone from view props
-        void props.slots
         return null
       }
       void renderless
+      // 5. The chat entry's face is its own: openDetails does not exist on the
+      //    base view props (store-less riders never see it).
+      const baseOnly = (props: ConvViewProps): ReactNode => {
+        // @ts-expect-error openDetails lives on ChatViewSlotProps, not the base
+        void props.openDetails
+        return null
+      }
+      void baseOnly
+      // 6. ChatViewSlotProps carries the full composition (standard kit +
+      //    store + inject face) — a handler with a wrong signature is red.
+      const chatProps = (props: ChatViewSlotProps): ReactNode => {
+        // @ts-expect-error openDetails takes a SelectionTarget, not a string
+        props.openDetails('nope')
+        return null
+      }
+      void chatProps
+      // 7. Keyed hole registration requires the key shape field.
+      // @ts-expect-error missing `key` on a keyed-slot registration
+      slots.register({ name: 'conversation.chat.toolview' }, (_p: ToolRowProps) => null)
+      // 8. A list-kind shape field is rejected on the keyed hole.
+      slots.register(
+        // @ts-expect-error `id`/`order` belong to list slots, not the keyed hole
+        { name: 'conversation.chat.toolview', key: 'k', order: 1 },
+        (_p: ToolRowProps) => null)
+      // 9. Tool-row components stay within their composed contract: the
+      //    owner share + standard kit supply no chat-view members.
+      const overreaching = (props: ToolRowProps): ReactNode => {
+        // @ts-expect-error loadOlder lives on ChatViewSlotProps, not the row contract
+        void props.loadOlder
+        return null
+      }
+      void overreaching
+      // 10. Owner-share drift is red at the row component seam: block is the
+      //     call union, not arbitrary payload.
+      const drifted = (props: ToolRowProps): ReactNode => {
+        // @ts-expect-error the block union has no `argsParsed` member
+        void props.block.argsParsed
+        return null
+      }
+      void drifted
       return null as ReactNode
     }
     expect(negatives).toBeTypeOf('function')
   })
 })
 
-describe('view-ring full chain (positive dual)', () => {
-  it('registers, lists, and renders through the per-view extension shapes', () => {
+describe('view-ring runtime dual (real ledger)', () => {
+  function bench() {
     const ctx = new Context()
-    const service = new ConversationService(ctx)
-    // Registration: extension-typed component + same-id chrome compose cleanly.
-    const dispose = service.registerView({
-      id: 'vt-extended',
-      label: '扩展视图',
-      order: 7,
-      component: ExtendedView,
-      chrome: { footer: ExtendedChrome },
-    })
-    const entry = service.views().find(v => v.id === 'vt-extended')
-    expect(entry?.label).toBe('扩展视图')
-    // Render surface: the listed entry's component accepts the composed props
-    // (base ConvViewProps + the map extension), spelled here as the same type
-    // the runtime hands over.
-    expect(typeof entry?.component).toBe('function')
-    expect(typeof entry?.chrome?.footer).toBe('function')
-    dispose()
-    expect(service.views().some(v => v.id === 'vt-extended')).toBe(false)
+    const slots = new SlotsService(ctx)
+    // The conversation entry's role: declare the ring (declaring is claiming).
+    slots.register({
+      name: 'root',
+      children: { 'conversation.view': { kind: 'list', scope: 'session' } },
+    }, (_p: { renderSlot?: unknown }) => null)
+    return { slots }
+  }
+
+  it('registers, orders, projects tabs, and disposes through the slot ledger', () => {
+    const { slots } = bench()
+    const offLate = slots.register(
+      { name: 'conversation.view', id: 'z-late', order: 20, label: '晚' }, () => null)
+    const offEarly = slots.register(
+      { name: 'conversation.view', id: 'early', order: 0, label: '早' }, () => null)
+    // Order-sorted ledger, label fallback for a labelless rider.
+    const offBare = slots.register(
+      { name: 'conversation.view', id: 'bare', order: 10 }, () => null)
+    const tabs = slots.entries('conversation.view')
+      .map(e => ({ id: e.options.id, label: e.options.label ?? e.options.id }))
+    expect(tabs).toEqual([
+      { id: 'early', label: '早' },
+      { id: 'bare', label: 'bare' },
+      { id: 'z-late', label: '晚' },
+    ])
+    // Duplicate ids fail loud at load (the ring's uniqueness contract).
+    expect(() => slots.register({ name: 'conversation.view', id: 'early' }, () => null))
+      .toThrow(/already has an entry with id "early"/)
+    offEarly()
+    expect(slots.entries('conversation.view').map(e => e.options.id)).toEqual(['bare', 'z-late'])
+    offBare()
+    offLate()
+    expect(slots.entries('conversation.view')).toHaveLength(0)
   })
 })

packages/client/ui-trajectory/README.md

@@ -1,6 +1,6 @@
 # @deepseek-ai/dsh-client-ui-trajectory
 
-Trajectory/Waterfall placeholder views; the pure-consumer minimal plugin exemplar (registers two views, provides no service, declares no Context merge). Contract: api-contracts v3 §8.
+Trajectory/Waterfall placeholder views; the pure-consumer minimal plugin exemplar (registers two view tabs into the conversation's `'conversation.view'` slot ring, provides no service, declares no Context merge). Contract: api-contracts v3 §8.
 
 ## Model Experience
 

packages/client/ui-trajectory/src/client/TrajectoryStatsHeader.tsx

@@ -1,28 +1,21 @@
-// TrajectoryStatsHeader: span totals row mounted as chrome.header on both
-// placeholder views — the second chrome-attachment consumer (chat's
-// StatsLine footer is the first), proving both mount points render.
-// Subscribes to `nodes` only: chunk batches never swap that reference, so
-// the row is quiet during streaming.
+// TrajectoryStatsHeader: span totals row rendered at the top of both
+// placeholder view bodies (chrome dissolved into the views — the header is
+// part of what these views ARE, not registration metadata). Subscribes to
+// `nodes` only: chunk batches never swap that reference, so the row is quiet
+// during streaming.
 
 import { memo, useMemo } from 'react'
 import type { ConversationSnapshot } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
-import type { ChromeProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { deriveSpans, deriveSpanStats } from './spans.ts'
 import css from './TrajectoryStatsHeader.module.css'
 
-/** Per-view chrome extension (the view map entry's chromeProps slot). */
-export interface TrajectoryChromeProps {
-  /** Render the tool-calls segment; defaults to true (waterfall lanes already
-   *  visualize calls, so that view may drop the redundant count). */
-  showCalls?: boolean
-}
+/** Props: the conversation-snapshot selector hook (handed down by the view body). */
+export interface TrajectoryStatsHeaderProps { useSession: SnapshotSelectorHook<ConversationSnapshot> }
 
-export const TrajectoryStatsHeader = memo(function TrajectoryStatsHeader({ useSession, showCalls }: ChromeProps & TrajectoryChromeProps) {
-  const nodes = (useSession as SnapshotSelectorHook<ConversationSnapshot>)((s) => s.nodes)
+export const TrajectoryStatsHeader = memo(function TrajectoryStatsHeader({ useSession }: TrajectoryStatsHeaderProps) {
+  const nodes = useSession((s) => s.nodes)
   const stats = useMemo(() => deriveSpanStats(deriveSpans(nodes)), [nodes])
   if (stats.turns === 0) return null
-  const parts = [`${stats.turns} turns`, `${stats.steps} steps`]
-  if (showCalls !== false) parts.push(`${stats.calls} tool calls`)
-  return <div className={css.root}>{parts.join(' · ')}</div>
+  return <div className={css.root}>{`${stats.turns} turns · ${stats.steps} steps · ${stats.calls} tool calls`}</div>
 })

packages/client/ui-trajectory/src/client/TrajectoryView.tsx

@@ -1,28 +1,30 @@
-// TrajectoryView: P-I placeholder body for the trajectory tab — per-turn
-// span list with node-count weights (no timing data exists yet; deviation
-// ledger #3 defers real rendering to P-III).
+// TrajectoryView: P-I placeholder body for the trajectory tab — span stats
+// header over a per-turn span list with node-count weights (no timing data
+// exists yet; deviation ledger #3 defers real rendering to P-III).
 
 import { useMemo } from 'react'
-import type { ConversationSnapshot } from '@deepseek-ai/dsh-client-runtime/client'
-import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
 import type { ConvViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { deriveSpans } from './spans.ts'
+import { TrajectoryStatsHeader } from './TrajectoryStatsHeader.tsx'
 import css from './views.module.css'
 
 export function TrajectoryView({ useSession }: ConvViewProps) {
-  const nodes = (useSession as SnapshotSelectorHook<ConversationSnapshot>)((s) => s.nodes)
+  const nodes = useSession((s) => s.nodes)
   const spans = useMemo(() => deriveSpans(nodes), [nodes])
   if (spans.length === 0) return <div className={css.root}><p className={css.empty}>暂无轨迹数据</p></div>
   return (
-    <div className={css.root}>
-      {spans.map((span) => (
-        <div key={span.turn} className={css.row}>
-          <span className={css.turnTag}>turn {span.turn}</span>
-          <span className={css.meta}>
-            {span.steps} steps · {span.calls} calls · {span.nodes} nodes
-          </span>
-        </div>
-      ))}
-    </div>
+    <>
+      <TrajectoryStatsHeader useSession={useSession} />
+      <div className={css.root}>
+        {spans.map((span) => (
+          <div key={span.turn} className={css.row}>
+            <span className={css.turnTag}>turn {span.turn}</span>
+            <span className={css.meta}>
+              {span.steps} steps · {span.calls} calls · {span.nodes} nodes
+            </span>
+          </div>
+        ))}
+      </div>
+    </>
   )
 }

packages/client/ui-trajectory/src/client/WaterfallView.tsx

@@ -1,20 +1,18 @@
-// WaterfallView: P-I placeholder body for the waterfall tab — node-count
-// bars per turn stand in for duration lanes (no timing data yet; deviation
-// ledger #3 defers real rendering to P-III).
+// WaterfallView: P-I placeholder body for the waterfall tab — span stats
+// header over node-count bars per turn standing in for duration lanes (no
+// timing data yet; deviation ledger #3 defers real rendering to P-III).
 
 import { useMemo } from 'react'
-import type { ConversationSnapshot } from '@deepseek-ai/dsh-client-runtime/client'
-import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
 import type { ConvViewProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { deriveSpans } from './spans.ts'
+import { TrajectoryStatsHeader } from './TrajectoryStatsHeader.tsx'
 import css from './views.module.css'
 
 /** Bar width scale: px per node, clamped so tiny windows still show a bar. */
 const PX_PER_NODE = 14
 const MIN_BAR_PX = 8
 
-/** Per-view extension merged into the waterfall body's props through the
- *  conversation view map ({ extraProps? } entry slot). */
+/** Optional density override (test/standalone knob; the register site passes nothing). */
 export interface WaterfallExtraProps {
   /** Bar-lane density in px per node; defaults to 14. */
   pxPerNode?: number
@@ -22,28 +20,31 @@ export interface WaterfallExtraProps {
 
 export function WaterfallView({ useSession, pxPerNode }: ConvViewProps & WaterfallExtraProps) {
   const scale = pxPerNode ?? PX_PER_NODE
-  const nodes = (useSession as SnapshotSelectorHook<ConversationSnapshot>)((s) => s.nodes)
+  const nodes = useSession((s) => s.nodes)
   const spans = useMemo(() => deriveSpans(nodes), [nodes])
   if (spans.length === 0) return <div className={css.root}><p className={css.empty}>暂无瀑布数据</p></div>
   return (
-    <div className={css.root}>
-      {spans.map((span, i) => (
-        <div key={span.turn} className={css.row} style={{ paddingLeft: i * 12 }}>
-          <span className={css.turnTag}>turn {span.turn}</span>
-          <span
-            className={css.bar}
-            style={{ width: Math.max(span.nodes * scale, MIN_BAR_PX) }}
-            title={`${span.nodes} nodes`}
-          />
-          {span.calls > 0 && (
+    <>
+      <TrajectoryStatsHeader useSession={useSession} />
+      <div className={css.root}>
+        {spans.map((span, i) => (
+          <div key={span.turn} className={css.row} style={{ paddingLeft: i * 12 }}>
+            <span className={css.turnTag}>turn {span.turn}</span>
             <span
-              className={`${css.bar} ${css.barCalls}`}
-              style={{ width: Math.max(span.calls * scale, MIN_BAR_PX) }}
-              title={`${span.calls} tool calls`}
+              className={css.bar}
+              style={{ width: Math.max(span.nodes * scale, MIN_BAR_PX) }}
+              title={`${span.nodes} nodes`}
             />
-          )}
-        </div>
-      ))}
-    </div>
+            {span.calls > 0 && (
+              <span
+                className={`${css.bar} ${css.barCalls}`}
+                style={{ width: Math.max(span.calls * scale, MIN_BAR_PX) }}
+                title={`${span.calls} tool calls`}
+              />
+            )}
+          </div>
+        ))}
+      </div>
+    </>
   )
 }

packages/client/ui-trajectory/src/client/index.ts

@@ -1,44 +1,30 @@
 /**
- * Trajectory/Waterfall plugin, browser half: merges ConversationViewMap and
- * registers the two placeholder views. Pure consumer — no ctx service, no
- * Context declaration merge; the minimal-plugin exemplar. Contract:
- * api-contracts v3 section 8.
+ * Trajectory/Waterfall plugin, browser half: contributes the two placeholder
+ * views into the conversation view ring (the 'conversation.view' list slot
+ * declared by ui-conversation). Pure consumer — no ctx service, no Context
+ * declaration merge; the minimal-plugin exemplar. Contract: api-contracts v3
+ * section 8.
  */
 import type { Context } from 'cordis'
-import { TrajectoryStatsHeader, type TrajectoryChromeProps } from './TrajectoryStatsHeader.tsx'
+// Type-only: the 'conversation.view' SlotMap row (declared by the slot's
+// owning package) must be in the program for the register calls to type.
+import type {} from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { TrajectoryView } from './TrajectoryView.tsx'
-import { WaterfallView, type WaterfallExtraProps } from './WaterfallView.tsx'
-
-export type { TrajectoryChromeProps } from './TrajectoryStatsHeader.tsx'
-export type { WaterfallExtraProps } from './WaterfallView.tsx'
-
-declare module '@deepseek-ai/dsh-client-ui-conversation/client' {
-  interface ConversationViewMap {
-    // Per-view extension shapes merged through the map (view-ring design):
-    // the stats header's chrome props ride both entries; the waterfall body
-    // additionally takes its lane-density extra. P-III widens these.
-    trajectory: { chromeProps: TrajectoryChromeProps }
-    waterfall: { chromeProps: TrajectoryChromeProps; extraProps: WaterfallExtraProps }
-  }
-}
+import { WaterfallView } from './WaterfallView.tsx'
 
 /** Required services (cordis fiber inject — the loader passes the whole export surface as an object plugin). */
-export const inject = ['conversation']
+export const inject = ['slots']
 
 /**
- * Client plugin body: register the trajectory and waterfall views. The
- * registrations are effects on this fiber (plugin unload removes both tabs).
+ * Client plugin body: register the trajectory and waterfall view tabs. The
+ * registrations ride the slot service's effect wrapper (plugin unload
+ * removes both tabs); the span stats header renders inside each view body
+ * (the chrome attachment mechanism retired with the view ring).
  * @param ctx - client root context.
  */
 export function apply(ctx: Context): void {
-  // chrome.header on both views: the second chrome-attachment consumer
-  // (chat's footer StatsLine is the first) — proves both mount points live.
-  ctx.conversation.registerView({
-    id: 'trajectory', label: 'Trajectory', order: 10,
-    component: TrajectoryView, chrome: { header: TrajectoryStatsHeader },
-  })
-  ctx.conversation.registerView({
-    id: 'waterfall', label: 'Waterfall', order: 20,
-    component: WaterfallView, chrome: { header: TrajectoryStatsHeader },
-  })
+  ctx.slots.register(
+    { name: 'conversation.view', id: 'trajectory', order: 10, label: 'Trajectory' }, TrajectoryView)
+  ctx.slots.register(
+    { name: 'conversation.view', id: 'waterfall', order: 20, label: 'Waterfall' }, WaterfallView)
 }

packages/client/ui-trajectory/src/invariant.ts

@@ -16,8 +16,8 @@ export const inject = ['invariants']
 
 /**
  * No runtime invariant: a pure-consumer plugin — it emits no cordis events
- * and owns no mutable cross-plugin state; both view registrations are plain
- * effects whose disposal the conversation registry's own specs and this
+ * and owns no mutable cross-plugin state; both view-slot registrations are
+ * plain effects whose disposal the slot ledger's own specs and this
  * package's behavior specs observe directly.
  */
 const install: InvariantInstaller = () => {}

packages/client/ui-trajectory/tests/client-bundle.spec.ts

@@ -3,14 +3,14 @@
  * Real tsdown artifact shape: lib/client.js hands off through
  * window.DSHClientProxy.loadPlugin, resolves externals through the injected
  * require, returns the export surface (apply + inject), and a mounted apply
- * registers both views into a real ConversationService. Skips when dist/ is
+ * registers both view tabs into a real SlotsService ring. Skips when dist/ is
  * not built (`pnpm --filter @deepseek-ai/dsh-client-ui-trajectory bundle`).
  */
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { Context } from 'cordis'
 import { afterEach, describe, expect, it } from 'vitest'
-import { ConversationService } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
 
 const PLUGIN_ID = '@deepseek-ai/dsh-client-ui-trajectory'
 
@@ -59,18 +59,23 @@ describe('tsdown client artifact', () => {
     const { handoff, surface } = await loadArtifact()
     expect(handoff.id).toBe(PLUGIN_ID)
     expect(surface.apply).toBeTypeOf('function')
-    expect(surface.inject).toEqual(['conversation'])
+    expect(surface.inject).toEqual(['slots'])
   })
 
-  it.skipIf(code === undefined)('mounted as an object plugin, apply registers both views on the real service', async () => {
+  it.skipIf(code === undefined)('mounted as an object plugin, apply registers both view tabs on the real ring', async () => {
     const { surface } = await loadArtifact()
     const ctx = new Context()
-    const svc = new ConversationService(ctx)
+    const slots = new SlotsService(ctx)
+    // The conversation entry's role: the ring must be declared before riders land.
+    slots.register({
+      name: 'root',
+      children: { 'conversation.view': { kind: 'list', scope: 'session' } },
+    }, (_p: { renderSlot?: unknown }) => null)
     const fiber = ctx.plugin(surface as { apply: (ctx: Context) => void })
     await fiber.await()
-    expect(svc.views().map(v => v.id)).toEqual(['trajectory', 'waterfall'])
+    expect(slots.entries('conversation.view').map(e => e.options.id)).toEqual(['trajectory', 'waterfall'])
     await fiber.dispose()
-    expect(svc.views()).toHaveLength(0)
+    expect(slots.entries('conversation.view')).toHaveLength(0)
   })
 
   it.skipIf(code === undefined)('injects plugin-tagged module CSS during factory execution', async () => {

packages/client/ui-trajectory/tests/views.spec.tsx

@@ -1,25 +1,25 @@
 // @vitest-environment jsdom
 /**
  * View registration acceptance on the real framework stack: the plugin fiber
- * registers trajectory/waterfall into a real ConversationService, tabs switch
- * inside ConversationRoot (four-share props form; view rendering is
- * in-component now) without collapsing chat, chrome.header renders the span
- * stats bar, and fiber disposal removes both tabs. Span derivation edge cases
- * ride along.
+ * registers trajectory/waterfall into a real SlotsService view ring, tabs
+ * switch inside ConversationRoot (renderSlot share driven by the same tab
+ * projection apply uses) without collapsing chat, the span stats header
+ * renders inside both view bodies, and fiber disposal removes both tabs.
+ * Span derivation edge cases ride along.
  */
 import { Context } from 'cordis'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { cleanup, fireEvent, render, screen } from '@testing-library/react'
-import { createElement, type FC } from 'react'
-import { bindSnapshotSelector } from '../../web-react/src/bind.ts'
+import { createElement, type FC, type ReactNode } from 'react'
+import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
-import type { UseSession } from '@deepseek-ai/dsh-client-ui-slots'
+import type { UseSession } from '@deepseek-ai/dsh-client-web-react'
+import { SlotsService } from '@deepseek-ai/dsh-client-runtime/client'
 import type { ConversationSnapshot, SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
-import { ConversationService } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type { ConvViewProps, ViewTab } from '@deepseek-ai/dsh-client-ui-conversation/client'
 // Export discipline: packages/client/AGENTS.md.
-import { ConversationRoot } from '@deepseek-ai/dsh-client-ui-conversation/src/client/skeleton/ConversationRoot.tsx'
+import { ConversationRoot, type ConversationRootProps } from '@deepseek-ai/dsh-client-ui-conversation/src/client/skeleton/ConversationRoot.tsx'
 import { createChatStore } from '@deepseek-ai/dsh-client-ui-conversation/src/client/stores.ts'
-import type { ConvViewProps, ViewId } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { apply, inject } from '@deepseek-ai/dsh-client-ui-trajectory/client'
 import { deriveSpans, deriveSpanStats } from '@deepseek-ai/dsh-client-ui-trajectory/src/client/spans.ts'
 import { TrajectoryStatsHeader } from '@deepseek-ai/dsh-client-ui-trajectory/src/client/TrajectoryStatsHeader.tsx'
@@ -49,88 +49,116 @@ function fakeSession(nodes: ConversationSnapshot['nodes']) {
   return { store, useSession: bindSnapshotSelector(store) as unknown as UseSession<ConversationSnapshot> }
 }
 
-/** Empty sessions-list hook stub (breadcrumbs fall back to the raw id). */
+/** Empty sessions-list hook stub (breadcrumbs fall back to the raw id; engines carry no hook since the store migration — bind here). */
 function emptySessions() {
   const store = createSnapshotStore<SessionListState>(
     { ids: [], byId: {}, current: undefined } as SessionListState)
   return bindSnapshotSelector(store)
 }
 
-/** Chat-view stand-in props for standalone view mounts. */
+/** SessionProvider seat stub (render-prop pass-through; ConversationRoot never invokes it). */
+const SessionProviderStub: ConversationRootProps['SessionProvider'] = ({ children }) => <>{children(SID)}</>
+
+/** Standalone view props: the session-scope standard kit the outlet would bake. */
 function standaloneProps(nodes: ConversationSnapshot['nodes']): ConvViewProps {
-  const chat = createChatStore().create()
   return {
     sessionId: SID,
     useSession: fakeSession(nodes).useSession,
-    useStore: bindSnapshotSelector(chat),
-    actions: { openDetails: vi.fn(), loadOlder: vi.fn() },
+    useSessions: emptySessions(),
   } as unknown as ConvViewProps
 }
 
-/** Real-stack bench: root Context + real ConversationService + the plugin fiber. */
+/** Real-stack bench: root Context + real SlotsService ring + the plugin fiber. */
 async function bench() {
   const ctx = new Context()
-  const svc = new ConversationService(ctx)
+  const slots = new SlotsService(ctx)
+  // The conversation entry's role: declare the ring, then seed the chat entry.
+  slots.register({
+    name: 'root',
+    children: { 'conversation.view': { kind: 'list', scope: 'session' } },
+  }, (_p: { renderSlot?: unknown }) => null)
   const chatBody = vi.fn(() => <div data-testid="chat-body" />)
-  svc.registerView({ id: 'chat' as ViewId, label: 'Chat', order: 0, component: chatBody as unknown as FC<ConvViewProps> })
+  slots.register(
+    { name: 'conversation.view', id: 'chat', order: 0, label: 'Chat' } as never, chatBody as never)
   const fiber = ctx.plugin({ inject: [...inject], apply })
   await fiber.await()
-  return { ctx, svc, fiber }
+  return { ctx, slots, fiber }
 }
 
-/** Mount ConversationRoot over the service's registry face (four-share form: chrome/view rendering is in-component). */
-function mount(svc: ConversationService, nodes: ConversationSnapshot['nodes'] = NODES) {
+/** Tab projection twin of apply's viewTabs (the render-side consumption path). */
+function tabsOf(slots: SlotsService): ViewTab[] {
+  return slots.entries('conversation.view')
+    .map(e => ({ id: e.options.id!, label: e.options.label ?? e.options.id! }))
+}
+
+/** Mount ConversationRoot over the ring ledger with an outlet-faithful renderSlot. */
+function mount(slots: SlotsService, nodes: ConversationSnapshot['nodes'] = NODES) {
   const sessionSnapshot = createSnapshotStore<{ running: boolean; removed: boolean; promptError: null; nodes: ConversationSnapshot['nodes'] }>({
     running: false, removed: false, promptError: null, nodes,
   })
+  const useSession = bindSnapshotSelector(sessionSnapshot) as unknown as UseSession<ConversationSnapshot>
   const chat = createChatStore().create()
+  // Minimal outlet twin: resolve the ring entry by the `only` filter and
+  // render it with the session standard kit (what SlotOutlet does for a
+  // list-kind session slot, minus machinery).
+  const renderSlot = ((key: string, _owner: object, opts?: { only?: string }): ReactNode => {
+    const entry = slots.entries('conversation.view').find(e => e.options.id === opts?.only)
+    if (entry === undefined) return null
+    const View = entry.component as FC<ConvViewProps>
+    return (
+      <View
+        {...({ sessionId: SID, useSession, useSessions: emptySessions() } as unknown as ConvViewProps)}
+        key={key}
+      />
+    )
+  }) as unknown as ConversationRootProps['renderSlot']
   return render(
     <ConversationRoot
       sessionId={SID}
-      useSession={bindSnapshotSelector(sessionSnapshot) as unknown as UseSession<ConversationSnapshot>}
+      useSession={useSession}
       useSessions={emptySessions()}
       useStore={bindSnapshotSelector(chat)}
       actions={chat.actions}
+      renderSlot={renderSlot}
+      SessionProvider={SessionProviderStub}
       views={{
-        list: () => svc.views(),
-        subscribe: (fn) => svc.subscribeViews(fn),
-        version: () => svc.viewsVersion(),
+        list: () => tabsOf(slots),
+        subscribe: (fn) => slots.subscribe('conversation.view', fn),
+        version: () => slots.getVersion('conversation.view'),
       }}
       send={vi.fn()}
       stop={vi.fn()}
-      openDetails={vi.fn()}
-      loadOlder={vi.fn()}
       open={vi.fn()}
     />,
   )
 }
 
 describe('plugin registration', () => {
-  it('registers trajectory and waterfall after chat, both with header chrome', async () => {
+  it('registers trajectory and waterfall after chat on the ring', async () => {
     const b = await bench()
-    const views = b.svc.views()
-    expect(views.map((v) => v.id)).toEqual(['chat', 'trajectory', 'waterfall'])
-    expect(views[1]?.chrome?.header).toBeDefined()
-    expect(views[2]?.chrome?.header).toBeDefined()
-    expect(views[1]?.chrome?.footer).toBeUndefined()
+    expect(tabsOf(b.slots)).toEqual([
+      { id: 'chat', label: 'Chat' },
+      { id: 'trajectory', label: 'Trajectory' },
+      { id: 'waterfall', label: 'Waterfall' },
+    ])
   })
 
   it('fiber disposal removes both tabs and leaves chat standing', async () => {
     const b = await bench()
     await b.fiber.dispose()
-    expect(b.svc.views().map((v) => v.id)).toEqual(['chat'])
+    expect(tabsOf(b.slots).map((v) => v.id)).toEqual(['chat'])
   })
 })
 
 describe('tab switching in ConversationRoot', () => {
   it('renders all three tabs, defaults to chat, and switches to trajectory with its header stats', async () => {
     const b = await bench()
-    mount(b.svc)
+    mount(b.slots)
     expect(screen.getByTestId('chat-body')).toBeTruthy()
     expect(screen.getAllByRole('tab').map((t) => t.textContent)).toEqual(['Chat', 'Trajectory', 'Waterfall'])
 
     fireEvent.click(screen.getByRole('tab', { name: 'Trajectory' }))
-    // chrome.header stats over NODES: turns 0/1/2, 2 assistant steps, 1 tool call.
+    // In-body header stats over NODES: turns 0/1/2, 2 assistant steps, 1 tool call.
     expect(screen.getByText('3 turns · 2 steps · 1 tool calls')).toBeTruthy()
     expect(screen.getByText('turn 0')).toBeTruthy()
     expect(screen.getByText('1 steps · 1 calls · 2 nodes')).toBeTruthy()
@@ -139,7 +167,7 @@ describe('tab switching in ConversationRoot', () => {
 
   it('waterfall renders bars and switching back to chat does not collapse it', async () => {
     const b = await bench()
-    mount(b.svc)
+    mount(b.slots)
     fireEvent.click(screen.getByRole('tab', { name: 'Waterfall' }))
     expect(screen.getByTitle('2 nodes')).toBeTruthy()
     expect(screen.getByTitle('1 tool calls')).toBeTruthy()
@@ -148,9 +176,9 @@ describe('tab switching in ConversationRoot', () => {
     expect(screen.getByTestId('chat-body')).toBeTruthy()
   })
 
-  it('empty window: placeholder copy in the body, header chrome renders nothing', async () => {
+  it('empty window: placeholder copy in the body, the stats header renders nothing', async () => {
     const b = await bench()
-    mount(b.svc, [] as unknown as ConversationSnapshot['nodes'])
+    mount(b.slots, [] as unknown as ConversationSnapshot['nodes'])
     fireEvent.click(screen.getByRole('tab', { name: 'Trajectory' }))
     expect(screen.getByText('暂无轨迹数据')).toBeTruthy()
     expect(screen.queryByText(/turns ·/)).toBeNull()
@@ -175,7 +203,7 @@ describe('span derivation', () => {
   it('empty inputs produce zero stats and standalone components render their empty forms', () => {
     expect(deriveSpanStats(deriveSpans([] as unknown as ConversationSnapshot['nodes']))).toEqual({ turns: 0, steps: 0, calls: 0 })
     const { useSession } = fakeSession([] as unknown as ConversationSnapshot['nodes'])
-    const { container } = render(createElement(TrajectoryStatsHeader, { sessionId: SID, useSession }))
+    const { container } = render(createElement(TrajectoryStatsHeader, { useSession: useSession as never }))
     expect(container.firstChild).toBeNull()
     render(createElement(TrajectoryView as FC<ConvViewProps>,
       standaloneProps([] as unknown as ConversationSnapshot['nodes'])))

packages/code-runtime/code-runtime-worker/README.md

@@ -10,32 +10,33 @@ Worker-thread implementation of the [`@deepseek-ai/dsh-code-runtime`](../code-ru
   config:
     computeMs: 60000              # busy-time budget (measured event-loop active time)
     maxWallMs: 600000             # wall-clock ceiling; never pauses for anything
-    maxLogBytes: 65536            # shared byte budget for captured log text
-    maxValueBytes: 32768          # rendered-completion-value cap
+    maxOutputBytes: 67108864      # combined serialized outer-output cap (64 MiB)
     maxOldGenerationSizeMb: 512   # worker heap cap (resourceLimits)
 ```
 
-Every field is validated (positive numbers) and defaulted; there are no other tunables.
+Every field is validated and defaulted; `maxOutputBytes` is a safe integer of at least four bytes, the remaining fields are positive finite numbers, and there are no other tunables.
 
 ## Design
 
 - **One fresh worker per run, no pooling** — a program's world dies with its worker: no cross-run state to log, state bleed unrepresentable, runs reconstructable from the session log alone.
 - **Type-strip host-side, in execution context** — the program is wrapped in an async-function shell, stripped with `node:module`'s `stripTypeScriptTypes` (erasable syntax only — `enum`/namespaces are rejected as a program `exception` and no worker spawns), and sliced back out byte-positioned; it then executes as the body of an `AsyncFunction`, so top-level `await`/`return` work.
-- **The port assumes a hostile peer** — model code can reach `parentPort` and forge traffic, so every inbound message is shape-validated and REBUILT before anything reads it (`null`, primitives, junk types, and malformed payloads drop without a throw; forged extra fields never ride along), the host answers each call id at most once, resolves binding names as OWN properties only (a forged `constructor` cannot walk a prototype chain), drops post-settlement replies, and converts a non-cloneable binding resolution into an error reply. Forged `log`/`done` messages cannot bypass the caps: one host-side ledger bounds everything that lands in `logs`, and the completion value is re-capped host-side. Worker-side namespaces are null-prototype with `defineProperty`, so `__proto__`-shaped binding names are ordinary keys.
+- **The port assumes a hostile peer** — model code can reach `parentPort` and forge traffic, so every inbound message is shape-validated and REBUILT before anything reads it (`null`, primitives, junk types, and malformed payloads drop without a throw; forged extra fields never ride along), the host answers each call id at most once, resolves binding names as OWN properties only (a forged `constructor` cannot walk a prototype chain), drops post-settlement replies, and validates every binding resolution and completion as lossless JSON. Forged `log`/`done` messages cannot bypass the outer cap: the host repeats validation and accounts every admitted log plus the completion or diagnostic. Worker-side namespaces are null-prototype with `defineProperty`, so `__proto__`-shaped binding names are ordinary keys.
+- **Binding rejection classes are request data** — an optional namespace descriptor names the constructor global and the own property that receives the failed member name. The worker materializes and injects that real class, so `instanceof` works without hardcoding `tools` or `ToolCallError`; declarations with invalid or colliding globals fail before a worker spawns. Failures use module-captured error and property-definition intrinsics plus null-prototype descriptors, so later model mutations cannot turn a rejected binding into a worker crash.
 - **Two independent budgets, because the peer is hostile** — `computeMs` meters the worker's MEASURED busy time (`worker.performance.eventLoopUtilization()` polling): a hot loop cannot hide behind a pending decoy dispatch, and a program awaiting a slow tool accrues nothing. `maxWallMs` backstops what busy time cannot see (awaiting a promise nobody resolves). Both funnel into `worker.terminate()`, which ends hot synchronous loops too; heap overflow surfaces as the worker's OOM exit (`kind: 'worker-exit'`).
-- **Logs stream eagerly** — console/stdout/stderr text crosses the port in emission order, so a timed-out or killed program still shows what it printed. ONE shared `maxLogBytes` ledger bounds everything: streamed text, forged port traffic, and pipe bytes that bypass the patched streams (appended after), with the overflow marked in-band once.
+- **Intermediate binding values are complete JSON** — binding arguments and resolutions undergo iterative lossless-JSON validation. Before program execution, the worker captures its own realm's plain-container prototype identities plus the native function-source check used only for foreign realms, so constructor-slot mutation and user-authored impostors cannot change container classification. It also captures every structural and metering intrinsic used by this JSON boundary, creates property descriptors without a prototype, and bypasses mutable collection prototypes for private traversal state; model mutations of globals, prototype methods, or descriptor-shaped `Object.prototype` fields therefore cannot alter validation, wire transport, or byte accounting. Values flatten into a bounded-depth pre-order wire value for structured clone and rebuild iteratively on the other side. They have no byte, JavaScript call-stack, or nested structured-clone depth cap. They never enter the outer-output ledger or model context; provider/executor acquisition bounds and process/worker memory remain the limits.
+- **Logs stream eagerly into one outer ledger** — console/stdout/stderr text crosses the port in emission order, so a timed-out or killed program still shows what it printed. The worker charges exact JSON-string bytes and preflights completion values and exception diagnostics against the remaining combined budget before posting them; a thrown million-byte stack therefore becomes the fixed `output-limit` diagnostic at the worker boundary. Native writes that bypass the patched stream slots arrive on pipes independent of the completion port, so the host repeats the ledger for those bytes and hostile forged traffic; settlement continues bounded pipe capture until worker termination completes before materializing the result. `maxOutputBytes` accounts the JSON serialization of the outer `logs` array plus the completion value or failure-message payload; fixed `CodeRunResult` field names, braces, the bounded error-kind tag, and later presentation whitespace are outside that variable-payload ledger. At or below the cap the exact value returns; a lossy completion is `invalid-output`, and a combined overflow is `output-limit` rather than a substituted inspected string. The failure retains the fitting captured prefix and later follows the normal outer `run_code` spill policy.
 - **Empty environment** — the worker gets `env: {}` and `execArgv: []`: no ambient credentials (stronger than the scrubbed-env rule for spawned commands) and no inherited loader flags.
 - **Dispose to quiescence** — teardown fails in-flight runs as `abort` and AWAITS each worker's exit before resolving.
 
 ## The worker entry, unbuilt and built
 
-Source mode loads erasable-only `src/worker.ts` through Node's native type stripping. Built mode passes the sibling `lib/worker.cjs` as a filesystem path because pkg's VFS Worker hook expects CommonJS; the same path works under ordinary Node. `tests/built-lib.e2e.ts` pins the real load path required by [docs/testing.md](../../../docs/testing.md).
+Source mode loads erasable-only `src/worker.ts` through Node's native type stripping. Its transitive runtime closure contains only Node built-ins and relative source modules, so a fresh checkout never requires a sibling workspace package's unbuilt `lib/` export. The worker-local JSON snapshotter is parity-tested against the session-owned canonical boundary; both sides flatten and rebuild validated values around the message port so application nesting never reaches structured clone. Built mode passes the sibling `lib/worker.cjs` as a filesystem path because pkg's VFS Worker hook expects CommonJS; the same path works under ordinary Node. `tests/built-lib.e2e.ts` pins the real load path required by [docs/testing.md](../../../docs/testing.md).
 
 The SDK surface is the default/named `WorkerCodeRuntime` class plus `Config`. The operational `./worker` subpath exists only as the packaged spawn entry; the wire protocol and bootstrap helpers are source-private implementation details.
 
 ## Model Experience
 
-Indirectly, through Code Mode in [`dsh-tools`](../../core/tools/README.md), which renders this worker's capped printed or returned data and exact `[dsh-code-runtime-worker] log capture truncated at <maxLogBytes> bytes` and `… [truncated]` markers into a retained `run_code` result. Binding traffic and worker internals stay outside context.
+Indirectly, through Code Mode in [`dsh-tools`](../../core/tools/README.md), which renders the exact outer value when it fits or an explicit `invalid-output` / `output-limit` failure. Only the outer `run_code` result enters model context and its ordinary spill policy; binding traffic and intermediate values remain execution-local.
 
 #### KV Cache effect
 
@@ -47,4 +48,5 @@ No direct invalidation; the named consumer owns any request-prefix changes.
 - **Type-strip rides Node's experimental `stripTypeScriptTypes` API** — the relied-on behavior is pinned by unit tests, with amaro/sucrase as named drop-in replacements if it shifts.
 - **`computeMs` expiry can overshoot by up to one poll interval** — busy time is sampled every 25 ms (an internal constant, deliberately not config).
 - **Programs get a five-method `console` shim** (`log`/`info`/`warn`/`error`/`debug`) — deliberately not Node's full console surface.
-- **A non-cloneable or oversize completion value does not cross as a value** — it arrives as a bounded, truncation-marked `util.inspect` rendering in `value`'s place.
+- **Intermediate binding values have no byte cap** — a program can exhaust process or worker memory with a value that never becomes outer output.
+- **The 64 MiB default is a rejection boundary, not recoverable storage** — outer spill can save only the bounded logs and diagnostic returned after `output-limit`; bytes rejected beyond the runtime cap never reach the spill layer.

packages/code-runtime/code-runtime-worker/package.json

@@ -33,6 +33,7 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-code-runtime": "^0.0.1",
     "@deepseek-ai/dsh-invariants": "^0.0.1",
+    "@deepseek-ai/dsh-session": "^0.0.1",
     "cordis": "^4.0.0-rc.7"
   },
   "dependencies": {
@@ -41,6 +42,7 @@
   "devDependencies": {
     "@deepseek-ai/dsh-code-runtime": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
     "cordis": "^4.0.0-rc.7"
   }
 }

packages/code-runtime/code-runtime-worker/src/bootstrap.ts

@@ -6,9 +6,21 @@
  */
 
 import { inspect } from 'node:util'
-import { serialize } from 'node:v8'
-import { logTruncationMarker } from './protocol.ts'
 import type { DoneMessage, ReplyMessage, WorkerBootData, WorkerToHost } from './protocol.ts'
+import { jsonStringBytesUpTo, jsonValueBytesUpTo, truncateJsonStringBytes } from './output-json.ts'
+import { decodeWorkerJson, encodeWorkerJson, snapshotCodeJsonValue } from './worker-json.ts'
+
+const CapturedError = Error
+const capturedObjectCreate = Object.create
+const capturedObjectDefineProperty = Object.defineProperty
+
+/** Define one public binding-error field without consulting mutable globals or descriptor prototypes. */
+function defineBindingErrorField(error: Error, key: string, value: string): void {
+  const attributes = capturedObjectCreate(null) as PropertyDescriptor
+  attributes.enumerable = true
+  attributes.value = value
+  capturedObjectDefineProperty(error, key, attributes)
+}
 
 /** The port surface the bootstrap needs — satisfied by `parentPort` and by the tests' fake. */
 export interface BootstrapPort {
@@ -27,26 +39,28 @@ export interface PatchableStream {
 }
 
 /**
- * Ordered text capture under one shared byte budget, delivered to a sink as
- * each item lands (the real sink streams text over the port eagerly, so
- * captured output survives a mid-run termination). Once the budget is
- * exhausted it emits exactly one in-band marker and silently drops everything
- * after. The cap is a blast-radius bound, so "how much was lost" intentionally
- * stays unmeasured.
+ * Ordered text capture under the shared outer JSON-byte budget, delivered to
+ * a sink as each item lands (the real sink streams text over the port eagerly,
+ * so captured output survives a mid-run termination). It includes the log
+ * array syntax and string escaping in its accounting. Once exhausted it emits
+ * the fitting prefix and reports the limit once; the host turns that condition
+ * into an explicit `output-limit` run failure.
  */
 export class LogBuffer {
-  private remaining: number
+  private bytes = 2 // JSON serialization of the empty logs array: []
+  private entries = 0
   private truncated = false
   // Explicit fields, not constructor parameter properties: this module loads
   // under Node's native strip-only mode, which rejects non-erasable syntax —
   // and parameter properties are non-erasable.
-  private readonly maxBytes: number
   private readonly sink: (text: string) => void
+  private readonly onLimit: () => void
+  private readonly maxBytes: number
 
-  constructor(maxBytes: number, sink: (text: string) => void) {
+  constructor(maxBytes: number, sink: (text: string) => void, onLimit: () => void = () => {}) {
     this.maxBytes = maxBytes
     this.sink = sink
-    this.remaining = maxBytes
+    this.onLimit = onLimit
   }
 
   /**
@@ -55,15 +69,32 @@ export class LogBuffer {
    */
   push(text: string): void {
     if (this.truncated) return
-    const cost = Buffer.byteLength(text, 'utf8')
-    if (cost > this.remaining) {
+    const separatorBytes = this.entries > 0 ? 1 : 0
+    const availableBytes = this.maxBytes - this.bytes - separatorBytes
+    const stringBytes = jsonStringBytesUpTo(text, availableBytes)
+    if (stringBytes === undefined) {
       this.truncated = true
-      this.sink(logTruncationMarker(this.maxBytes))
+      const prefix = truncateJsonStringBytes(text, availableBytes)
+      if (prefix.length > 0) {
+        const prefixBytes = jsonStringBytesUpTo(prefix, availableBytes)
+        /* v8 ignore next -- truncateJsonStringBytes guarantees the returned prefix fits. */
+        if (prefixBytes === undefined) throw new CapturedError('worker output ledger produced an oversized log prefix')
+        this.bytes += prefixBytes + separatorBytes
+        this.entries += 1
+        this.sink(prefix)
+      }
+      this.onLimit()
       return
     }
-    this.remaining -= cost
+    this.bytes += stringBytes + separatorBytes
+    this.entries += 1
     this.sink(text)
   }
+
+  /** Remaining exact JSON-byte budget for the completion value or failure message. */
+  remainingOutputBytes(): number {
+    return this.maxBytes - this.bytes
+  }
 }
 
 /** The five console methods the shim captures, in the seam's level vocabulary. */
@@ -122,59 +153,79 @@ export function captureStreamWrites(logs: LogBuffer, stream: PatchableStream): (
 const INSPECT_OPTIONS = { depth: 4, maxArrayLength: 100, maxStringLength: 10_000 } as const
 
 /**
- * The longest prefix of `text` whose UTF-8 encoding fits `maxBytes`, cut at
- * a code-point boundary (never mid-surrogate-pair). The byte caps are BYTE
- * caps — `String.prototype.slice` counts UTF-16 code units, up to 3× smaller
- * than what a multibyte string actually costs across the boundary.
- * @param text - the string to bound.
- * @param maxBytes - the UTF-8 byte budget the prefix must fit.
- * @returns the prefix (all of `text` when it already fits).
+ * Prepare the program's completion value for the done message. Only lossless
+ * JSON crosses, and a value that does not fit the remaining combined outer
+ * budget reports `output-limit`; the host revalidates hostile traffic and
+ * remains authoritative for native pipe writes the worker cannot observe.
+ *
+ * @param value - the program's completion value.
+ * @param remainingOutputBytes - exact bytes left after captured logs.
+ * @param maxOutputBytes - the configured cap named in an overflow diagnostic.
+ * @returns the done-message fragment: `{}` for `undefined`, else a flat wire `{ value }`.
  */
-export function truncateUtf8Bytes(text: string, maxBytes: number): string {
-  if (Buffer.byteLength(text, 'utf8') <= maxBytes) return text
-  let bytes = 0
-  let end = 0
-  for (const char of text) {
-    const cost = Buffer.byteLength(char, 'utf8')
-    if (bytes + cost > maxBytes) break
-    bytes += cost
-    end += char.length
+export function prepareCompletion(
+  value: unknown,
+  remainingOutputBytes: number,
+  maxOutputBytes: number = remainingOutputBytes,
+): Omit<DoneMessage, 'type'> {
+  if (value === undefined) return {}
+  let snapshot: ReturnType<typeof snapshotCodeJsonValue>
+  try {
+    snapshot = snapshotCodeJsonValue(value)
+  } catch {
+    snapshot = undefined
   }
-  return text.slice(0, end)
+  if (snapshot === undefined) {
+    return prepareFailure(
+      'invalid-output',
+      'program completion must be lossless JSON',
+      remainingOutputBytes,
+      maxOutputBytes,
+    )
+  }
+  if (jsonValueBytesUpTo(snapshot, remainingOutputBytes) === undefined) {
+    return outputLimit(maxOutputBytes)
+  }
+  return { value: encodeWorkerJson(snapshot) }
+}
+
+/** Build the fixed overflow fragment without carrying rejected variable bytes. */
+function outputLimit(maxOutputBytes: number): Omit<DoneMessage, 'type'> {
+  return { error: { kind: 'output-limit', message: `outer output exceeded ${maxOutputBytes} bytes` } }
+}
+
+/** Admit one bounded failure message or replace it with the fixed overflow diagnostic. */
+function prepareFailure(
+  kind: 'exception' | 'invalid-output',
+  message: string,
+  remainingOutputBytes: number,
+  maxOutputBytes: number,
+): Omit<DoneMessage, 'type'> {
+  if (jsonStringBytesUpTo(message, remainingOutputBytes) === undefined) return outputLimit(maxOutputBytes)
+  return { error: { kind, message } }
 }
 
 /**
- * Prepare the program's completion value for the done message: a value whose MEASURED
- * cross-boundary size fits `maxValueBytes` crosses raw — exact bytes for a string, the
- * structured-clone wire size (`v8.serialize`) for everything else, so a huge container whose
- * bounded inspect rendering happens to be small cannot smuggle itself past the cap. Oversized
- * or non-cloneable values are replaced by a bounded string rendering with an in-band marker.
- *
- * @param value - the program's completion value.
- * @param maxValueBytes - the byte cap for the value.
- * @returns the done-message fragment: `{}` for `undefined`, else `{ value }`.
+ * Prepare a thrown program value without sending an unbounded stack or
+ * string across the worker port.
+ * @param error - the value thrown by the program.
+ * @param remainingOutputBytes - exact bytes left after captured logs.
+ * @param maxOutputBytes - the configured cap named in an overflow diagnostic.
+ * @returns a bounded exception or fixed output-limit fragment.
  */
-export function prepareValue(value: unknown, maxValueBytes: number): { value?: unknown } {
-  if (value === undefined) return {}
-  if (typeof value === 'string') {
-    if (Buffer.byteLength(value, 'utf8') <= maxValueBytes) return { value }
-  } else {
-    let size: number | undefined
-    try {
-      size = serialize(value).byteLength
-    } catch {
-      // Only the verdict matters: the value has parts the structured-clone
-      // algorithm rejects (functions, classes, …) and must cross as its
-      // rendering instead.
-      size = undefined
-    }
-    if (size !== undefined && size <= maxValueBytes) return { value }
+export function prepareException(
+  error: unknown,
+  remainingOutputBytes: number,
+  maxOutputBytes: number = remainingOutputBytes,
+): Omit<DoneMessage, 'type'> {
+  let message: string
+  try {
+    const detail: unknown = error instanceof CapturedError ? error.stack ?? error.message : error
+    message = typeof detail === 'string' ? detail : String(detail)
+  } catch {
+    message = 'program threw an unrenderable value'
   }
-  const rendered = typeof value === 'string' ? value : inspect(value, INSPECT_OPTIONS)
-  const capped = Buffer.byteLength(rendered, 'utf8') > maxValueBytes
-    ? `${truncateUtf8Bytes(rendered, maxValueBytes)}… [truncated]`
-    : rendered
-  return { value: capped }
+  return prepareFailure('exception', message, remainingOutputBytes, maxOutputBytes)
 }
 
 /** One awaited binding call's settlement handles, keyed by call id in the pending map. */
@@ -183,6 +234,46 @@ export interface PendingCall {
   reject(error: Error): void
 }
 
+/** Constructor shape for one program-visible binding rejection class. */
+export type BindingErrorConstructor = new (memberName: string, message: string) => Error
+
+/**
+ * Materialize the real error constructor declared by one namespace.
+ * @param descriptor - program-global class name and member-name property.
+ * @returns the constructor injected into the program and used for rejections.
+ */
+function makeBindingErrorClass(
+  descriptor: { name: string; memberNameProperty: string },
+): BindingErrorConstructor {
+  return class BindingCallError extends CapturedError {
+    constructor(memberName: string, message: string) {
+      super(message)
+      defineBindingErrorField(this, 'name', descriptor.name)
+      defineBindingErrorField(this, descriptor.memberNameProperty, memberName)
+    }
+  }
+}
+
+/** Create the namespace-specific rejection for one failed binding call. */
+function bindingFailure(errorClass: BindingErrorConstructor | undefined, memberName: string, message: string): Error {
+  return errorClass ? new errorClass(memberName, message) : new CapturedError(message)
+}
+
+/**
+ * Build each declared error class once so calls and `instanceof` share constructor identity.
+ * @param data - binding namespace declarations from the boot payload.
+ * @returns constructors keyed by their owning namespace global.
+ */
+export function makeBindingErrorClasses(
+  data: Pick<WorkerBootData, 'namespaces'>,
+): Map<string, BindingErrorConstructor> {
+  const classes = new Map<string, BindingErrorConstructor>()
+  for (const namespace of data.namespaces) {
+    if (namespace.errorClass) classes.set(namespace.global, makeBindingErrorClass(namespace.errorClass))
+  }
+  return classes
+}
+
 /**
  * Route host replies into the pending-call map: each reply settles its call
  * at most once, and a reply for an unknown id (stray, or a duplicate answer
@@ -197,8 +288,13 @@ export function wireReplies(port: BootstrapPort, pending: Map<number, PendingCal
     const entry = pending.get(message.id)
     if (!entry) return
     pending.delete(message.id)
-    if (message.ok) entry.resolve(message.value)
-    else entry.reject(new Error(message.message))
+    if (message.ok) {
+      const value = decodeWorkerJson(message.value)
+      if (value === undefined) entry.reject(new CapturedError('binding resolution must be lossless JSON'))
+      else entry.resolve(value)
+    } else {
+      entry.reject(new CapturedError(message.message))
+    }
   })
 }
 
@@ -206,12 +302,14 @@ export function wireReplies(port: BootstrapPort, pending: Map<number, PendingCal
  * Build the binding namespace objects the program sees: one null-prototype global per
  * namespace, each declared name an own enumerable async function that bridges over the port
  * (`__proto__`/`constructor`/`toString` are ordinary keys, never prototype collisions).
- * Non-cloneable arguments and host failure replies reject only the corresponding call.
+ * Lossy arguments reject before posting; clone failures and host failure
+ * replies reject only the corresponding call.
  *
  * @param data - the boot payload's namespace declarations (globals + names).
  * @param port - the port binding calls are posted to.
  * @param pending - the id-keyed map each posted call parks its handles in.
  * @param nextId - the shared mutable id counter (worker-issued correlation ids).
+ * @param errorClasses - per-namespace constructors shared with program globals.
  * @returns one namespace object per declaration, in declaration order.
  */
 export function makeNamespaces(
@@ -219,22 +317,41 @@ export function makeNamespaces(
   port: BootstrapPort,
   pending: Map<number, PendingCall>,
   nextId: { value: number },
+  errorClasses: Map<string, BindingErrorConstructor> = makeBindingErrorClasses(data),
 ): Record<string, unknown>[] {
   return data.namespaces.map(({ global, names }) => {
+    const errorClass = errorClasses.get(global)
     const namespace = Object.create(null) as Record<string, unknown>
     for (const name of names) {
       Object.defineProperty(namespace, name, {
         enumerable: true,
-        value: (args: unknown): Promise<unknown> => new Promise((resolve, reject) => {
-          const id = nextId.value++
-          pending.set(id, { resolve, reject })
+        value: (args: unknown): Promise<unknown> => {
+          let detached: ReturnType<typeof snapshotCodeJsonValue>
           try {
-            port.postMessage({ type: 'call', id, global, name, args })
-          } catch (error: unknown) {
-            pending.delete(id)
-            reject(new Error(`binding arguments must be structured-cloneable: ${error instanceof Error ? error.message : String(error)}`))
+            detached = snapshotCodeJsonValue(args)
+          } catch {
+            detached = undefined
           }
-        }),
+          if (detached === undefined) {
+            return Promise.reject(bindingFailure(errorClass, name, 'binding arguments must be lossless JSON'))
+          }
+          return new Promise((resolve, reject) => {
+            const id = nextId.value++
+            pending.set(id, {
+              resolve,
+              reject: (error) => {
+                reject(bindingFailure(errorClass, name, error.message))
+              },
+            })
+            try {
+              port.postMessage({ type: 'call', id, global, name, args: encodeWorkerJson(detached) })
+            } catch (error: unknown) {
+              pending.delete(id)
+              const message = `binding arguments must be structured-cloneable: ${error instanceof CapturedError ? error.message : String(error)}`
+              reject(bindingFailure(errorClass, name, message))
+            }
+          })
+        },
       })
     }
     return namespace
@@ -254,7 +371,11 @@ export async function runWorkerMain(
   data: WorkerBootData,
   streams: { stdout: PatchableStream; stderr: PatchableStream },
 ): Promise<void> {
-  const logs = new LogBuffer(data.maxLogBytes, (text) => { port.postMessage({ type: 'log', text }) })
+  const logs = new LogBuffer(
+    data.maxOutputBytes,
+    (text) => { port.postMessage({ type: 'log', text }) },
+    () => { port.postMessage({ type: 'output-limit' }) },
+  )
   captureStreamWrites(logs, streams.stdout)
   captureStreamWrites(logs, streams.stderr)
 
@@ -262,7 +383,18 @@ export async function runWorkerMain(
   wireReplies(port, pending)
 
   const nextId = { value: 1 }
-  const namespaces = makeNamespaces(data, port, pending, nextId)
+  const errorClasses = makeBindingErrorClasses(data)
+  const namespaces = makeNamespaces(data, port, pending, nextId, errorClasses)
+  const errorClassParameters: string[] = []
+  const errorClassValues: BindingErrorConstructor[] = []
+  for (const namespace of data.namespaces) {
+    if (!namespace.errorClass) continue
+    errorClassParameters.push(namespace.errorClass.name)
+    const errorClass = errorClasses.get(namespace.global)
+    /* v8 ignore next -- makeBindingErrorClasses covers every declaration in the same data. */
+    if (!errorClass) throw new CapturedError(`missing binding error class for ${namespace.global}`)
+    errorClassValues.push(errorClass)
+  }
   const consoleShim = makeConsoleShim(logs)
 
   let done: DoneMessage
@@ -271,12 +403,22 @@ export async function runWorkerMain(
     // `AsyncFunction` is not a global. The program body is strict-mode.
     /* v8 ignore next -- the arrow exists only to reach the AsyncFunction constructor; it is never invoked. */
     const AsyncFunction = (async () => {}).constructor as new (...args: string[]) => (...fnArgs: unknown[]) => Promise<unknown>
-    const fn = new AsyncFunction(...data.namespaces.map(namespace => namespace.global), 'console', `'use strict';\n${data.code}`)
-    const value = await fn(...namespaces, consoleShim)
-    done = { type: 'done', ...prepareValue(value, data.maxValueBytes) }
+    const fn = new AsyncFunction(
+      ...data.namespaces.map(namespace => namespace.global),
+      ...errorClassParameters,
+      'console',
+      `'use strict';\n${data.code}`,
+    )
+    const value = await fn(...namespaces, ...errorClassValues, consoleShim)
+    done = {
+      type: 'done',
+      ...prepareCompletion(value, logs.remainingOutputBytes(), data.maxOutputBytes),
+    }
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.stack ?? error.message : String(error)
-    done = { type: 'done', error: { message } }
+    done = {
+      type: 'done',
+      ...prepareException(error, logs.remainingOutputBytes(), data.maxOutputBytes),
+    }
   }
   port.postMessage(done)
 }

packages/code-runtime/code-runtime-worker/src/index.ts

@@ -8,14 +8,17 @@
 
 import { Worker } from 'node:worker_threads'
 import { stripTypeScriptTypes } from 'node:module'
+import type { Readable } from 'node:stream'
 import { fileURLToPath } from 'node:url'
 import { Context } from 'cordis'
 import z from 'schemastery'
 import { CodeRuntime } from '@deepseek-ai/dsh-code-runtime'
-import type { CodeBindingFunction, CodeRunFailure, CodeRunRequest, CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
-import { prepareValue, truncateUtf8Bytes } from './bootstrap.ts'
-import { logTruncationMarker } from './protocol.ts'
+import type { CodeBindingNamespace, CodeJsonValue, CodeRunFailure, CodeRunRequest, CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
+import { snapshotJsonValue } from '@deepseek-ai/dsh-session'
 import type { ReplyMessage, WorkerBootData, WorkerToHost } from './protocol.ts'
+import { jsonStringBytesUpTo, jsonValueBytesUpTo, truncateJsonStringBytes } from './output-json.ts'
+import { decodeWorkerJson, encodeWorkerJson } from './worker-json.ts'
+import type { WorkerJsonWire } from './worker-json.ts'
 
 /** Plugin config: every execution cap, changeable from `cordis.yml` (no hardcoded tunables). */
 export interface Config {
@@ -35,14 +38,11 @@ export interface Config {
    * nobody will resolve).
    */
   maxWallMs?: number
-  /** Shared byte budget for captured log text (console + raw stream writes), truncation marked in-band. */
-  maxLogBytes?: number
   /**
-   * Byte cap for the completion value, measured by its real cross-boundary
-   * size (string bytes, or structured-clone wire size); an oversized or
-   * non-cloneable value crosses as a capped string rendering.
+   * Hard cap for serialized log-array, completion-value, and failure-message payloads;
+   * fixed result-envelope syntax is excluded.
    */
-  maxValueBytes?: number
+  maxOutputBytes?: number
   /** The worker's max old-generation heap in MiB (`resourceLimits`); overflow kills the worker, surfacing as kind `'worker-exit'`. */
   maxOldGenerationSizeMb?: number
 }
@@ -59,6 +59,9 @@ type ResolvedConfig = Required<Config>
  */
 const ELU_POLL_INTERVAL_MS = 25
 
+/** Smallest cap that can represent the counted payloads: an empty logs array plus an empty JSON failure message. */
+const MIN_OUTPUT_BYTES = 4
+
 /** ECMAScript reserved words that cannot be async-function parameter names — rejected as binding globals. */
 const RESERVED_WORDS = new Set([
   'await', 'break', 'case', 'catch', 'class', 'const', 'continue', 'debugger', 'default', 'delete', 'do',
@@ -71,6 +74,9 @@ const RESERVED_WORDS = new Set([
 /** Valid async-function parameter name (the binding global becomes one). */
 const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/
 
+/** Error properties whose binding-member replacement would destroy the promised Error contract. */
+const RESERVED_ERROR_PROPERTIES = new Set(['name', 'message', 'stack'])
+
 /**
  * The shell a program is wrapped in for the type-strip, matching the
  * grammatical context it will execute in (an async function body, where
@@ -109,6 +115,26 @@ function messageOf(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
 
+/** Resolve after a worker pipe emits all queued data, or closes/errors during termination. */
+function waitForPipeDrain(stream: Readable): Promise<void> {
+  if (stream.readableEnded || stream.destroyed) return Promise.resolve()
+  return new Promise((resolve) => {
+    const done = (): void => {
+      stream.off('end', done)
+      stream.off('close', done)
+      stream.off('error', done)
+      resolve()
+    }
+    stream.once('end', done)
+    stream.once('close', done)
+    stream.once('error', done)
+    // Close the event-registration race if termination finished between the
+    // initial state check and the listeners above.
+    /* v8 ignore next -- this race cannot be scheduled deterministically between the adjacent state check and listener registration. */
+    if (stream.readableEnded || stream.destroyed) done()
+  })
+}
+
 /**
  * Runtime shape gate for inbound port traffic. The peer runs MODEL CODE and
  * can post anything — `null`, primitives, objects with poisoned fields — so
@@ -124,31 +150,88 @@ function parseWorkerMessage(raw: unknown): WorkerToHost | undefined {
   switch (m.type) {
     case 'call': {
       if (typeof m.id !== 'number' || typeof m.global !== 'string' || typeof m.name !== 'string') return undefined
-      return { type: 'call', id: m.id, global: m.global, name: m.name, args: m.args }
+      return { type: 'call', id: m.id, global: m.global, name: m.name, args: m.args as WorkerJsonWire }
     }
     case 'log': {
       if (typeof m.text !== 'string') return undefined
       return { type: 'log', text: m.text }
     }
+    case 'output-limit': return { type: 'output-limit' }
     case 'done': {
-      if (m.error === undefined) return { type: 'done', ...m.value !== undefined ? { value: m.value } : {} }
+      if (m.error === undefined) return { type: 'done', ...m.value !== undefined ? { value: m.value as WorkerJsonWire } : {} }
       const error = m.error
       if (typeof error !== 'object' || error === null) return undefined
-      const message = (error as Record<string, unknown>).message
-      if (typeof message !== 'string') return undefined
-      return { type: 'done', ...m.value !== undefined ? { value: m.value } : {}, error: { message } }
+      const { kind, message } = error as Record<string, unknown>
+      if ((kind !== 'exception' && kind !== 'invalid-output' && kind !== 'output-limit') || typeof message !== 'string') return undefined
+      return { type: 'done', error: { kind, message } }
     }
     default: return undefined
   }
 }
 
-/**
- * Headroom the host's value re-cap grants over `maxValueBytes`: exactly the
- * truncation suffix {@link prepareValue} appends, so a value the WORKER
- * already capped (byte-exact prefix + this marker) passes through unchanged
- * instead of being marked twice.
- */
-const VALUE_RENDER_SLACK = Buffer.byteLength('… [truncated]', 'utf8')
+
+/** One run's combined outer-output ledger; binding values never enter it. */
+class OutputLedger {
+  private bytes = 2 // JSON serialization of the empty logs array: []
+  private entries = 0
+
+  constructor(private readonly maxBytes: number) {}
+
+  /** Admit one exact log entry, or report that the hard cap was crossed. */
+  admit(text: string, sink: string[]): boolean {
+    const separatorBytes = this.entries > 0 ? 1 : 0
+    const stringBytes = jsonStringBytesUpTo(text, this.maxBytes - this.bytes - separatorBytes)
+    if (stringBytes === undefined) return false
+    this.bytes += stringBytes + separatorBytes
+    this.entries += 1
+    sink.push(text)
+    return true
+  }
+
+  /** Finalize a successful absent-or-JSON completion against the combined cap. */
+  success(logs: string[], value?: CodeJsonValue): CodeRunResult {
+    if (value !== undefined && jsonValueBytesUpTo(value, this.maxBytes - this.bytes) === undefined) return this.limit(logs)
+    return { logs, ...value !== undefined ? { value } : {} }
+  }
+
+  /** Finalize a failure diagnostic, with output-limit taking precedence when combined bytes exceed the cap. */
+  failure(logs: string[], error: CodeRunFailure): CodeRunResult {
+    if (jsonStringBytesUpTo(error.message, this.maxBytes - this.bytes) === undefined) return this.limit(logs)
+    return { logs, error }
+  }
+
+  /** Build the explicit output-limit failure while retaining a fitting prefix of the final log. */
+  limit(logs: string[]): CodeRunResult {
+    const fullMessage = `outer output exceeded ${this.maxBytes} bytes`
+    // The fixed diagnostic is ASCII, so every character is one byte plus the quotes.
+    const messageBytes = fullMessage.length + 2
+    const retained: string[] = []
+    let retainedBytes = 2
+    const logBudget = this.maxBytes - messageBytes
+    for (const text of logs) {
+      const separatorBytes = retained.length > 0 ? 1 : 0
+      const availableBytes = logBudget - retainedBytes - separatorBytes
+      const stringBytes = jsonStringBytesUpTo(text, availableBytes)
+      if (stringBytes !== undefined) {
+        retained.push(text)
+        retainedBytes += stringBytes + separatorBytes
+        continue
+      }
+      const prefix = truncateJsonStringBytes(text, availableBytes)
+      if (prefix.length > 0) {
+        const prefixBytes = jsonStringBytesUpTo(prefix, availableBytes)
+        /* v8 ignore next -- truncateJsonStringBytes guarantees its returned prefix fits the same budget. */
+        if (prefixBytes === undefined) throw new Error('output ledger produced an oversized log prefix')
+        retained.push(prefix)
+        retainedBytes += prefixBytes + separatorBytes
+      }
+      break
+    }
+    const availableMessageBytes = this.maxBytes - retainedBytes
+    const message = truncateJsonStringBytes(fullMessage, availableMessageBytes)
+    return { logs: retained, error: { kind: 'output-limit', message } }
+  }
+}
 
 /**
  * The shipped {@link CodeRuntime} backend (`ctx.codeRuntime`). Registers as
@@ -161,8 +244,7 @@ export class WorkerCodeRuntime extends CodeRuntime {
   static Config: z<Config> = z.object({
     computeMs: z.number().default(60_000),
     maxWallMs: z.number().default(600_000),
-    maxLogBytes: z.number().default(65_536),
-    maxValueBytes: z.number().default(32_768),
+    maxOutputBytes: z.number().default(67_108_864),
     maxOldGenerationSizeMb: z.number().default(512),
   })
 
@@ -181,6 +263,9 @@ export class WorkerCodeRuntime extends CodeRuntime {
     for (const [key, value] of Object.entries(this.config)) {
       if (!(Number.isFinite(value) && value > 0)) throw new Error(`dsh-code-runtime-worker: config.${key} must be a positive number, got ${String(value)}`)
     }
+    if (!Number.isSafeInteger(this.config.maxOutputBytes) || this.config.maxOutputBytes < MIN_OUTPUT_BYTES) {
+      throw new Error(`dsh-code-runtime-worker: config.maxOutputBytes must be a safe integer of at least ${MIN_OUTPUT_BYTES}, got ${String(this.config.maxOutputBytes)}`)
+    }
     ctx.effect(() => () => this.teardown(), 'worker code-runtime teardown')
   }
 
@@ -208,7 +293,7 @@ export class WorkerCodeRuntime extends CodeRuntime {
     if (this.disposed) throw new Error('dsh-code-runtime-worker: run() after disposal')
     const bindings = this.validateBindings(request)
     if (request.signal?.aborted) {
-      return { logs: [], error: { kind: 'abort', message: String(request.signal.reason) } }
+      return this.failureBeforeWorker({ kind: 'abort', message: String(request.signal.reason) })
     }
 
     let code: string
@@ -219,15 +304,20 @@ export class WorkerCodeRuntime extends CodeRuntime {
       // A program that does not survive the type-strip (syntax error,
       // non-erasable syntax like `enum`) is a program failure, reported the
       // same way a thrown exception would be — and no worker ever spawns.
-      return { logs: [], error: { kind: 'exception', message: messageOf(error) } }
+      return this.failureBeforeWorker({ kind: 'exception', message: messageOf(error) })
     }
 
     return await this.execute(request, code, bindings)
   }
 
-  /** Reject (seam misuse) malformed binding namespaces: non-identifier or reserved globals, duplicates, and the `console` collision. */
-  private validateBindings(request: CodeRunRequest): Map<string, Record<string, CodeBindingFunction>> {
-    const bindings = new Map<string, Record<string, CodeBindingFunction>>()
+  /** Apply the outer-output ledger to failures that occur before a worker owns one. */
+  private failureBeforeWorker(error: CodeRunFailure): CodeRunResult {
+    return new OutputLedger(this.config.maxOutputBytes).failure([], error)
+  }
+
+  /** Reject malformed binding globals or typed-error declarations as seam misuse. */
+  private validateBindings(request: CodeRunRequest): Map<string, CodeBindingNamespace> {
+    const bindings = new Map<string, CodeBindingNamespace>()
     for (const namespace of request.bindings) {
       if (!IDENTIFIER.test(namespace.global) || RESERVED_WORDS.has(namespace.global)) {
         throw new Error(`dsh-code-runtime-worker: binding global ${JSON.stringify(namespace.global)} is not a usable identifier`)
@@ -235,7 +325,23 @@ export class WorkerCodeRuntime extends CodeRuntime {
       if (namespace.global === 'console' || bindings.has(namespace.global)) {
         throw new Error(`dsh-code-runtime-worker: duplicate binding global ${JSON.stringify(namespace.global)}`)
       }
-      bindings.set(namespace.global, namespace.functions)
+      bindings.set(namespace.global, namespace)
+    }
+
+    const errorClassNames = new Set<string>()
+    for (const namespace of request.bindings) {
+      const descriptor = namespace.errorClass
+      if (!descriptor) continue
+      if (!IDENTIFIER.test(descriptor.name) || RESERVED_WORDS.has(descriptor.name)) {
+        throw new Error(`dsh-code-runtime-worker: binding error class ${JSON.stringify(descriptor.name)} is not a usable identifier`)
+      }
+      if (descriptor.name === 'console' || bindings.has(descriptor.name) || errorClassNames.has(descriptor.name)) {
+        throw new Error(`dsh-code-runtime-worker: duplicate injected global ${JSON.stringify(descriptor.name)}`)
+      }
+      if (descriptor.memberNameProperty.length === 0 || RESERVED_ERROR_PROPERTIES.has(descriptor.memberNameProperty)) {
+        throw new Error(`dsh-code-runtime-worker: binding error member property ${JSON.stringify(descriptor.memberNameProperty)} is not usable`)
+      }
+      errorClassNames.add(descriptor.name)
     }
     return bindings
   }
@@ -244,13 +350,16 @@ export class WorkerCodeRuntime extends CodeRuntime {
   private execute(
     request: CodeRunRequest,
     code: string,
-    bindings: Map<string, Record<string, CodeBindingFunction>>,
+    bindings: Map<string, CodeBindingNamespace>,
   ): Promise<CodeRunResult> {
     const bootData: WorkerBootData = {
       code,
-      namespaces: [...bindings].map(([global, functions]) => ({ global, names: Object.keys(functions) })),
-      maxLogBytes: this.config.maxLogBytes,
-      maxValueBytes: this.config.maxValueBytes,
+      namespaces: [...bindings].map(([global, namespace]) => ({
+        global,
+        names: Object.keys(namespace.functions),
+        ...namespace.errorClass ? { errorClass: namespace.errorClass } : {},
+      })),
+      maxOutputBytes: this.config.maxOutputBytes,
     }
     const worker = new Worker(WORKER_PATH, {
       workerData: bootData,
@@ -274,28 +383,22 @@ export class WorkerCodeRuntime extends CodeRuntime {
       const answered = new Set<number>()
       const logs: string[] = []
       const strayLogs: string[] = []
+      const output = new OutputLedger(this.config.maxOutputBytes)
+      let terminalOverride: CodeRunResult | undefined
 
-      // One host-side budget covers normal, forged, and stray-pipe log entries. The first
-      // overflow emits the shared in-band marker and drops everything after it.
-      let logBudget = this.config.maxLogBytes
-      let logsTruncated = false
-      const admit = (text: string, sink: string[]): void => {
-        if (logsTruncated) return
-        const cost = Buffer.byteLength(text, 'utf8')
-        if (cost > logBudget) {
-          logsTruncated = true
-          sink.push(logTruncationMarker(this.config.maxLogBytes))
-          return
-        }
-        logBudget -= cost
-        sink.push(text)
-      }
-
-      // No settled guard: `finish` snapshots the arrays when it resolves, so
-      // a chunk flushing after settlement mutates only the discarded buffers,
-      // and the ledger bounds that growth until the pipes close.
+      // Pipe and message-port delivery are independent. Continue bounded pipe
+      // capture after a terminal message while worker termination drains bytes
+      // that were already queued; `finish` materializes the result only after
+      // termination completes.
       const captureStray = (chunk: Buffer): void => {
-        admit(chunk.toString('utf8'), strayLogs)
+        /* v8 ignore next -- a second post-overflow chunk races immediate worker termination; the first overflow path is covered. */
+        if (terminalOverride !== undefined) return
+        const text = chunk.toString('utf8')
+        if (!output.admit(text, strayLogs)) {
+          const limited = output.limit([...logs, ...strayLogs, text])
+          terminalOverride = limited
+          finish(limited)
+        }
       }
       worker.stdout.on('data', captureStray)
       worker.stderr.on('data', captureStray)
@@ -304,27 +407,42 @@ export class WorkerCodeRuntime extends CodeRuntime {
       // logs captured before timeout, abort, or failure remain in the result.
       let finishResolve!: () => void
       const finished = new Promise<void>((done) => { finishResolve = done })
-      const finish = (result: Omit<CodeRunResult, 'logs'>): void => {
+      const finish = (finalize: CodeRunResult | (() => CodeRunResult)): void => {
         if (settled) return
         settled = true
         clearInterval(eluTimer)
         clearTimeout(wallTimer)
         request.signal?.removeEventListener('abort', onAbort)
         this.live.delete(live)
-        void worker.terminate().then(() => {
+        // Let the poll phase deliver pipe bytes already queued independently
+        // of the terminal port message before termination closes the streams.
+        void new Promise<void>((resume) => { setImmediate(resume) }).then(async () => {
+          const stdoutDrained = waitForPipeDrain(worker.stdout)
+          const stderrDrained = waitForPipeDrain(worker.stderr)
+          await Promise.all([worker.terminate(), stdoutDrained, stderrDrained])
+          const result = terminalOverride ?? (typeof finalize === 'function' ? finalize() : finalize)
           finishResolve()
-          resolve({ ...result, logs: [...logs, ...strayLogs] })
+          resolve(result)
         })
       }
 
       const onDone = (message: WorkerToHost): void => {
         if (message.type !== 'done') return
-        // Re-cap forged completion traffic at the hostile boundary. Honest worker-capped values
-        // pass unchanged via VALUE_RENDER_SLACK; error text is bounded too.
-        finish({
-          ...prepareValue(message.value, this.config.maxValueBytes + VALUE_RENDER_SLACK),
-          ...message.error ? { error: { kind: 'exception' as const, message: truncateUtf8Bytes(message.error.message, this.config.maxValueBytes) } } : {},
-        })
+        if (message.error) {
+          const error = message.error
+          finish(() => output.failure([...logs, ...strayLogs], error))
+          return
+        }
+        if (message.value === undefined) {
+          finish(() => output.success([...logs, ...strayLogs]))
+          return
+        }
+        const value = decodeWorkerJson(message.value)
+        if (value === undefined) {
+          finish(() => output.failure([...logs, ...strayLogs], { kind: 'invalid-output', message: 'program completion must be lossless JSON' }))
+        } else {
+          finish(() => output.success([...logs, ...strayLogs], value))
+        }
       }
 
       const onCall = (message: WorkerToHost): void => {
@@ -336,15 +454,11 @@ export class WorkerCodeRuntime extends CodeRuntime {
         answered.add(message.id)
         const reply = (payload: ReplyMessage): void => {
           if (settled) return
-          try {
-            worker.postMessage(payload)
-          } catch {
-            // The reply value failed structured clone; renegotiate as an error
-            // reply, which is always clone-plain. Nothing else throws here.
-            worker.postMessage({ type: 'reply', id: message.id, ok: false, message: 'binding resolution is not structured-cloneable' })
-          }
+          // Canonical resolutions were snapshotted as lossless JSON before
+          // this point, so this payload is structured-cloneable by contract.
+          worker.postMessage(payload)
         }
-        const record = bindings.get(message.global)
+        const record = bindings.get(message.global)?.functions
         // Own-property lookup only: a forged name like 'constructor' or
         // 'hasOwnProperty' must not walk the record's prototype chain and
         // reach a callable the consumer never declared.
@@ -353,9 +467,25 @@ export class WorkerCodeRuntime extends CodeRuntime {
           reply({ type: 'reply', id: message.id, ok: false, message: `unknown binding ${JSON.stringify(`${message.global}.${message.name}`)}` })
           return
         }
+        const args = decodeWorkerJson(message.args)
+        if (args === undefined) {
+          reply({ type: 'reply', id: message.id, ok: false, message: 'binding arguments must be lossless JSON' })
+          return
+        }
         void (async () => {
           try {
-            reply({ type: 'reply', id: message.id, ok: true, value: await fn(message.args) })
+            const resolved = await fn(args)
+            let value: CodeJsonValue | undefined
+            try {
+              value = snapshotJsonValue(resolved)
+            } catch {
+              value = undefined
+            }
+            if (value === undefined) {
+              reply({ type: 'reply', id: message.id, ok: false, message: 'binding resolution must be lossless JSON' })
+            } else {
+              reply({ type: 'reply', id: message.id, ok: true, value: encodeWorkerJson(value) })
+            }
           } catch (error: unknown) {
             reply({ type: 'reply', id: message.id, ok: false, message: messageOf(error) })
           }
@@ -367,15 +497,24 @@ export class WorkerCodeRuntime extends CodeRuntime {
         // this listener would crash the host process. Junk drops silently.
         const message = parseWorkerMessage(raw)
         if (!message) return
-        if (message.type === 'log' && !settled) admit(message.text, logs)
+        if (message.type === 'log' && !settled && !output.admit(message.text, logs)) {
+          const limited = output.limit([...logs, ...strayLogs, message.text])
+          finish(limited)
+          return
+        }
+        if (message.type === 'output-limit' && !settled) {
+          const limited = output.limit([...logs, ...strayLogs])
+          finish(limited)
+          return
+        }
         onCall(message)
         onDone(message)
       })
       worker.on('error', (error: Error) => {
-        finish({ error: { kind: 'worker-exit', message: `worker error: ${error.message}` } })
+        finish(() => output.failure([...logs, ...strayLogs], { kind: 'worker-exit', message: `worker error: ${error.message}` }))
       })
       worker.on('exit', (exitCode: number) => {
-        finish({ error: { kind: 'worker-exit', message: `worker exited with code ${exitCode} before completing` } })
+        finish(() => output.failure([...logs, ...strayLogs], { kind: 'worker-exit', message: `worker exited with code ${exitCode} before completing` }))
       })
 
       // The compute budget reads the worker's own measured busy time, so a
@@ -384,21 +523,21 @@ export class WorkerCodeRuntime extends CodeRuntime {
       const eluTimer = setInterval(() => {
         const elu = worker.performance.eventLoopUtilization()
         if (elu.active > this.config.computeMs) {
-          finish({ error: { kind: 'timeout', message: `compute budget exhausted (${this.config.computeMs}ms busy)` } })
+          finish(() => output.failure([...logs, ...strayLogs], { kind: 'timeout', message: `compute budget exhausted (${this.config.computeMs}ms busy)` }))
         }
       }, ELU_POLL_INTERVAL_MS)
       const wallTimer = setTimeout(() => {
-        finish({ error: { kind: 'timeout', message: `wall-clock ceiling reached (${this.config.maxWallMs}ms)` } })
+        finish(() => output.failure([...logs, ...strayLogs], { kind: 'timeout', message: `wall-clock ceiling reached (${this.config.maxWallMs}ms)` }))
       }, this.config.maxWallMs)
       const onAbort = (): void => {
-        finish({ error: { kind: 'abort', message: String(request.signal?.reason) } })
+        finish(() => output.failure([...logs, ...strayLogs], { kind: 'abort', message: String(request.signal?.reason) }))
       }
       request.signal?.addEventListener('abort', onAbort, { once: true })
 
       const live: LiveRun = {
         worker,
         finished,
-        settle: (failure: CodeRunFailure) => { finish({ error: failure }) },
+        settle: (failure: CodeRunFailure) => { finish(() => output.failure([...logs, ...strayLogs], failure)) },
       }
       this.live.add(live)
     })

packages/code-runtime/code-runtime-worker/src/output-json.ts

@@ -0,0 +1,179 @@
+/** JSON string-prefix accounting for the outer-output ledger. @module @deepseek-ai/dsh-code-runtime-worker/output-json */
+
+import type { CodeJsonValue } from '@deepseek-ai/dsh-code-runtime'
+
+type IntrinsicCallable = (this: unknown, ...args: unknown[]) => unknown
+
+const intrinsicReflectApply = Reflect.apply as (
+  target: IntrinsicCallable,
+  thisArgument: unknown,
+  argumentsList: readonly unknown[],
+) => unknown
+const intrinsicArrayIsArray = Array.isArray
+const IntrinsicBuffer = Buffer
+const intrinsicBufferByteLength = Reflect.get(Buffer, 'byteLength') as IntrinsicCallable
+const intrinsicObjectCreate = Object.create
+const intrinsicObjectDefineProperty = Object.defineProperty
+const intrinsicObjectKeys = Object.keys
+const intrinsicString = String
+const intrinsicStringCharCodeAt = Reflect.get(String.prototype, 'charCodeAt') as IntrinsicCallable
+const intrinsicStringCodePointAt = Reflect.get(String.prototype, 'codePointAt') as IntrinsicCallable
+const intrinsicStringSlice = Reflect.get(String.prototype, 'slice') as IntrinsicCallable
+
+/** Build a data descriptor that cannot inherit model-defined accessor fields. */
+function dataDescriptor(value: unknown): PropertyDescriptor {
+  const descriptor = intrinsicObjectCreate(null) as PropertyDescriptor
+  descriptor.value = value
+  return descriptor
+}
+
+/** Define an ordinary enumerable data slot without a prototype-bearing descriptor. */
+function defineEnumerableDataProperty(target: object, key: PropertyKey, value: unknown): void {
+  const descriptor = dataDescriptor(value)
+  descriptor.enumerable = true
+  descriptor.configurable = true
+  descriptor.writable = true
+  intrinsicObjectDefineProperty(target, key, descriptor)
+}
+
+/** UTF-8 byte length through the module-captured Node intrinsic. */
+function byteLength(text: string): number {
+  return intrinsicReflectApply(intrinsicBufferByteLength, IntrinsicBuffer, [text, 'utf8']) as number
+}
+
+/** Append without consulting a model-mutated `Array.prototype`. */
+function append<T>(target: T[], value: T): void {
+  defineEnumerableDataProperty(target, target.length, value)
+}
+
+/** Pop without consulting a model-mutated `Array.prototype`. */
+function takeLast<T>(target: T[]): T | undefined {
+  if (target.length === 0) return undefined
+  const index = target.length - 1
+  const value = target[index]
+  intrinsicObjectDefineProperty(target, 'length', dataDescriptor(index))
+  return value
+}
+
+/** One code-point-aligned character from a string. */
+function characterAt(text: string, index: number): string {
+  const codePoint = intrinsicReflectApply(intrinsicStringCodePointAt, text, [index]) as number
+  const width = codePoint > 0xffff ? 2 : 1
+  return intrinsicReflectApply(intrinsicStringSlice, text, [index, index + width]) as string
+}
+
+/** Serialized bytes contributed by one complete Unicode code point inside JSON quotes. */
+function serializedCharacterBytes(character: string): number {
+  if (character.length === 2) return 4
+  if (character === '"' || character === '\\') return 2
+  const code = intrinsicReflectApply(intrinsicStringCharCodeAt, character, [0]) as number
+  if (code >= 0xd800 && code <= 0xdfff) return 6
+  if (code < 0x20) return code === 0x08 || code === 0x09 || code === 0x0a || code === 0x0c || code === 0x0d ? 2 : 6
+  return byteLength(character)
+}
+
+/**
+ * Measure one JSON string without materializing its complete escaped form.
+ * @param text - the candidate string.
+ * @param maxBytes - largest serialized size the caller can admit.
+ * @returns Exact serialized bytes, or `undefined` as soon as the cap is crossed.
+ */
+export function jsonStringBytesUpTo(text: string, maxBytes: number): number | undefined {
+  if (maxBytes < 2) return undefined
+  let bytes = 2
+  for (let index = 0; index < text.length;) {
+    const character = characterAt(text, index)
+    bytes += serializedCharacterBytes(character)
+    if (bytes > maxBytes) return undefined
+    index += character.length
+  }
+  return bytes
+}
+
+/**
+ * Measure one lossless JSON value without allocating its serialized form.
+ * @param value - already validated lossless JSON.
+ * @param maxBytes - largest serialized size the caller can admit.
+ * @returns Exact serialized bytes, or `undefined` as soon as the cap is crossed.
+ */
+export function jsonValueBytesUpTo(value: CodeJsonValue, maxBytes: number): number | undefined {
+  type Task =
+    | { kind: 'value'; value: CodeJsonValue }
+    | { kind: 'array'; value: CodeJsonValue[]; index: number }
+    | { kind: 'object'; value: Record<string, CodeJsonValue>; keys: string[]; index: number }
+
+  let bytes = 0
+  const add = (cost: number): boolean => {
+    bytes += cost
+    return bytes <= maxBytes
+  }
+  const tasks: Task[] = [{ kind: 'value', value }]
+  for (let task = takeLast(tasks); task !== undefined; task = takeLast(tasks)) {
+    if (task.kind === 'value') {
+      const current = task.value
+      if (current === null) {
+        if (!add(4)) return undefined
+      } else if (typeof current === 'string') {
+        const stringBytes = jsonStringBytesUpTo(current, maxBytes - bytes)
+        if (stringBytes === undefined) return undefined
+        bytes += stringBytes
+      } else if (typeof current === 'number') {
+        if (!add(byteLength(intrinsicString(current)))) return undefined
+      } else if (typeof current === 'boolean') {
+        if (!add(current ? 4 : 5)) return undefined
+      } else if (intrinsicArrayIsArray(current)) {
+        if (!add(2)) return undefined
+        if (current.length > 0) append(tasks, { kind: 'array', value: current, index: 0 })
+      } else {
+        if (!add(2)) return undefined
+        const keys = intrinsicObjectKeys(current)
+        if (keys.length > 0) append(tasks, { kind: 'object', value: current, keys, index: 0 })
+      }
+      continue
+    }
+
+    if (task.index > 0 && !add(1)) return undefined
+    if (task.kind === 'array') {
+      const item = task.value[task.index]
+      if (item === undefined) return undefined
+      if (task.index + 1 < task.value.length) append(tasks, { ...task, index: task.index + 1 })
+      append(tasks, { kind: 'value', value: item })
+      continue
+    }
+
+    const key = task.keys[task.index]
+    /* v8 ignore next -- an object frame is created and advanced only for an existing Object.keys entry. */
+    if (key === undefined) return undefined
+    const keyBytes = jsonStringBytesUpTo(key, maxBytes - bytes)
+    if (keyBytes === undefined) return undefined
+    if (!add(keyBytes + 1)) return undefined
+    const item = task.value[key]
+    if (item === undefined) return undefined
+    if (task.index + 1 < task.keys.length) append(tasks, { ...task, index: task.index + 1 })
+    append(tasks, { kind: 'value', value: item })
+  }
+  return bytes
+}
+
+/**
+ * Return the longest code-point-aligned prefix whose JSON string encoding,
+ * including its surrounding quotes, fits `maxBytes`.
+ *
+ * @param text - the candidate string.
+ * @param maxBytes - serialized JSON-string bytes available.
+ * @returns the fitting prefix, or an empty string when even useful content cannot fit.
+ */
+export function truncateJsonStringBytes(text: string, maxBytes: number): string {
+  if (maxBytes < 2) return ''
+  let bytes = 2
+  let end = 0
+  for (let index = 0; index < text.length;) {
+    const character = characterAt(text, index)
+    const cost = serializedCharacterBytes(character)
+    if (bytes + cost > maxBytes) break
+    bytes += cost
+    end += character.length
+    index += character.length
+  }
+  return end === text.length ? text : intrinsicReflectApply(intrinsicStringSlice, text, [0, end]) as string
+}

packages/code-runtime/code-runtime-worker/src/protocol.ts

@@ -5,16 +5,20 @@
  * @module @deepseek-ai/dsh-code-runtime-worker/src/protocol
  */
 
+import type { WorkerJsonWire } from './worker-json.ts'
+
 /** What the host hands the worker at spawn, via `workerData`. */
 export interface WorkerBootData {
   /** The type-stripped (plain JS) program body. */
   code: string
-  /** Binding namespaces to materialize: the global name plus the function names (functions themselves stay host-side). */
-  namespaces: { global: string; names: string[] }[]
-  /** Shared byte budget for captured log text; exceeding it drops further entries after one in-band marker. */
-  maxLogBytes: number
-  /** Byte cap for the rendered completion value (see the value-preparation contract in bootstrap.ts). */
-  maxValueBytes: number
+  /** Binding namespaces to materialize; functions themselves stay host-side. */
+  namespaces: {
+    global: string
+    names: string[]
+    errorClass?: { name: string; memberNameProperty: string }
+  }[]
+  /** Hard cap for the combined serialized outer logs plus completion value or failure diagnostic. */
+  maxOutputBytes: number
 }
 
 /** Worker → host: one bridged binding call. */
@@ -26,8 +30,8 @@ interface CallMessage {
   global: string
   /** The function name within the namespace. */
   name: string
-  /** The single argument, structured-clone-plain. */
-  args: unknown
+  /** The single argument as a flat lossless-JSON wire value. */
+  args: WorkerJsonWire
 }
 
 /** Worker → host: captured text, streamed eagerly so output survives a mid-run termination (timeout, abort, OOM). */
@@ -36,37 +40,29 @@ interface LogMessage {
   text: string
 }
 
+/** Worker → host: worker-side capture or completion measurement exceeded the outer cap. */
+interface OutputLimitMessage {
+  type: 'output-limit'
+}
+
 /**
- * Worker → host: the program settled. `error` carries a program exception
- * (the only failure the bootstrap itself can report — budgets, aborts, and
- * substrate death are observed host-side). `value` is present only on a
- * clean completion that produced one (already size-capped and
- * clone-safe per the bootstrap's value preparation). Logs are NOT carried
- * here — they streamed eagerly as {@link LogMessage}s.
+ * Worker → host: the program settled. `error` carries a program exception,
+ * invalid completion, or output overflow (budgets, aborts, and substrate death
+ * are observed host-side). `value` is present only on a clean completion that
+ * produced one, as a flat wire value already lossless and admitted against
+ * the remaining combined output cap. Logs are NOT carried here — they streamed
+ * eagerly as {@link LogMessage}s.
  */
 export interface DoneMessage {
   type: 'done'
-  value?: unknown
-  error?: { message: string }
+  value?: WorkerJsonWire
+  error?: { kind: 'exception' | 'invalid-output' | 'output-limit'; message: string }
 }
 
 /** Every message the worker sends. */
-export type WorkerToHost = CallMessage | LogMessage | DoneMessage
+export type WorkerToHost = CallMessage | LogMessage | OutputLimitMessage | DoneMessage
 
 /** Host → worker: the answer to one {@link CallMessage}. */
 export type ReplyMessage =
-  | { type: 'reply'; id: number; ok: true; value: unknown }
+  | { type: 'reply'; id: number; ok: true; value: WorkerJsonWire }
   | { type: 'reply'; id: number; ok: false; message: string }
-
-/**
- * The in-band marker entry text announcing that log capture stopped at the
- * byte budget. Shared wire vocabulary: the worker's LogBuffer emits it when
- * ITS budget exhausts, and the host emits the identical text when its own
- * ledger drops an entry first (forged port traffic, stray pipe bytes) — so
- * a truncated run reads the same however the cap was hit.
- * @param maxBytes - the configured `maxLogBytes` the marker names.
- * @returns the marker line.
- */
-export function logTruncationMarker(maxBytes: number): string {
-  return `[dsh-code-runtime-worker] log capture truncated at ${maxBytes} bytes`
-}

packages/code-runtime/code-runtime-worker/src/worker-json.ts

@@ -0,0 +1,417 @@
+/** Lossless-JSON snapshots for the dependency-free source worker closure. @module @deepseek-ai/dsh-code-runtime-worker/worker-json */
+
+import type { CodeJsonValue } from '@deepseek-ai/dsh-code-runtime'
+
+/* jscpd:ignore-start -- the source worker mirrors session JSON helpers without workspace runtime imports */
+type IntrinsicCallable = (this: unknown, ...args: unknown[]) => unknown
+
+const intrinsicFunctionToString = Reflect.get(Function.prototype, 'toString') as IntrinsicCallable
+const intrinsicReflectApply = Reflect.get(Reflect, 'apply') as (
+  target: IntrinsicCallable,
+  thisArgument: unknown,
+  argumentsList: readonly unknown[],
+) => unknown
+const IntrinsicError = Error
+const IntrinsicSet = Set
+const intrinsicArrayIsArray = Array.isArray
+const intrinsicArrayPrototype = Array.prototype
+const intrinsicNumberIsFinite = Number.isFinite
+const intrinsicNumberIsSafeInteger = Number.isSafeInteger
+const intrinsicObjectCreate = Object.create
+const intrinsicObjectDefineProperty = Object.defineProperty
+const intrinsicObjectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor
+const intrinsicObjectGetPrototypeOf = Object.getPrototypeOf
+const intrinsicObjectHasOwn = Object.hasOwn
+const intrinsicObjectIs = Object.is
+const intrinsicObjectKeys = Object.keys
+const intrinsicObjectPrototype = Object.prototype
+const intrinsicObjectPropertyIsEnumerable = Reflect.get(intrinsicObjectPrototype, 'propertyIsEnumerable') as IntrinsicCallable
+const intrinsicReflectOwnKeys = Reflect.ownKeys
+const intrinsicSetAdd = Reflect.get(Set.prototype, 'add') as IntrinsicCallable
+const intrinsicSetDelete = Reflect.get(Set.prototype, 'delete') as IntrinsicCallable
+const intrinsicSetHas = Reflect.get(Set.prototype, 'has') as IntrinsicCallable
+
+/** Build a data descriptor that cannot inherit model-defined accessor fields. */
+function dataDescriptor(value: unknown): PropertyDescriptor {
+  const descriptor = intrinsicObjectCreate(null) as PropertyDescriptor
+  descriptor.value = value
+  return descriptor
+}
+
+/** Define an ordinary enumerable data slot without a prototype-bearing descriptor. */
+function defineEnumerableDataProperty(target: object, key: PropertyKey, value: unknown): void {
+  const descriptor = dataDescriptor(value)
+  descriptor.enumerable = true
+  descriptor.configurable = true
+  descriptor.writable = true
+  intrinsicObjectDefineProperty(target, key, descriptor)
+}
+
+/** Append without consulting a model-mutated `Array.prototype`. */
+function append<T>(target: T[], value: T): void {
+  defineEnumerableDataProperty(target, target.length, value)
+}
+
+/** Pop without consulting a model-mutated `Array.prototype`. */
+function takeLast<T>(target: T[]): T | undefined {
+  if (target.length === 0) return undefined
+  const index = target.length - 1
+  const value = target[index]
+  intrinsicObjectDefineProperty(target, 'length', dataDescriptor(index))
+  return value
+}
+
+/** Whether one captured-intrinsic Set contains a value. */
+function setHas<T>(target: Set<T>, value: T): boolean {
+  return intrinsicReflectApply(intrinsicSetHas, target, [value]) as boolean
+}
+
+/** Add to one captured-intrinsic Set. */
+function setAdd<T>(target: Set<T>, value: T): void {
+  intrinsicReflectApply(intrinsicSetAdd, target, [value])
+}
+
+/** Delete from one captured-intrinsic Set. */
+function setDelete<T>(target: Set<T>, value: T): void {
+  intrinsicReflectApply(intrinsicSetDelete, target, [value])
+}
+
+/** Whether a realm-owned intrinsic prototype is backed by its native constructor. */
+function hasIntrinsicConstructor(prototype: object, name: 'Array' | 'Object'): boolean {
+  const descriptor = intrinsicObjectGetOwnPropertyDescriptor(prototype, 'constructor')
+  const constructor: unknown = descriptor?.value
+  if (typeof constructor !== 'function') return false
+  try {
+    return constructor.name === name
+      && constructor.prototype === prototype
+      && intrinsicReflectApply(intrinsicFunctionToString, constructor, []) === `function ${name}() { [native code] }`
+  } catch {
+    return false
+  }
+}
+
+/** Whether a candidate is a foreign realm's intrinsic `Object.prototype`. */
+function isForeignIntrinsicObjectPrototype(value: object): boolean {
+  return intrinsicObjectGetPrototypeOf(value) === null && hasIntrinsicConstructor(value, 'Object')
+}
+
+/** Whether an array uses one realm's intrinsic `Array.prototype`, not a subclass or forged prototype. */
+function hasPlainArrayPrototype(value: unknown[]): boolean {
+  const prototype: unknown = intrinsicObjectGetPrototypeOf(value)
+  if (prototype === intrinsicArrayPrototype) return true
+  if (!intrinsicArrayIsArray(prototype) || !hasIntrinsicConstructor(prototype, 'Array')) return false
+  const objectPrototype: unknown = intrinsicObjectGetPrototypeOf(prototype)
+  return typeof objectPrototype === 'object'
+    && objectPrototype !== null
+    && isForeignIntrinsicObjectPrototype(objectPrototype)
+}
+
+/** Whether an object is a plain or null-prototype record from any JavaScript realm. */
+function hasPlainObjectPrototype(value: object): boolean {
+  const prototype: unknown = intrinsicObjectGetPrototypeOf(value)
+  return prototype === null
+    || prototype === intrinsicObjectPrototype
+    || typeof prototype === 'object' && isForeignIntrinsicObjectPrototype(prototype)
+}
+
+/** Return every JSON-visible object key, or reject own data JSON would discard. */
+function enumerableStringKeys(value: object): string[] | undefined {
+  const keys = intrinsicReflectOwnKeys(value)
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index]
+    if (typeof key !== 'string' || !intrinsicReflectApply(intrinsicObjectPropertyIsEnumerable, value, [key])) return undefined
+  }
+  return keys as string[]
+}
+
+type SnapshotDestination =
+  | { kind: 'root' }
+  | { kind: 'array'; target: CodeJsonValue[]; index: number }
+  | { kind: 'object'; target: Record<string, CodeJsonValue>; key: string }
+
+type SnapshotTask =
+  | { kind: 'visit'; value: unknown; destination: SnapshotDestination }
+  | { kind: 'array-item'; source: unknown[]; index: number; target: CodeJsonValue[] }
+  | { kind: 'object-property'; source: Record<string, unknown>; key: string; target: Record<string, CodeJsonValue> }
+  | { kind: 'leave'; source: object }
+
+/**
+ * Validate and detach one worker-boundary value without loading another
+ * workspace package at runtime. This mirrors the session-owned canonical
+ * JSON boundary while remaining safe to import from the unbuilt worker.
+ * Its iterative traversal adds no JavaScript call-stack depth limit.
+ *
+ * @param value - the candidate completion value.
+ * @returns a detached lossless-JSON snapshot, or `undefined` when invalid.
+ */
+export function snapshotCodeJsonValue(value: unknown): CodeJsonValue | undefined {
+  const active = new IntrinsicSet<object>()
+  let root: CodeJsonValue | undefined
+  const assign = (destination: SnapshotDestination, item: CodeJsonValue): void => {
+    if (destination.kind === 'root') {
+      root = item
+    } else if (destination.kind === 'array') {
+      defineEnumerableDataProperty(destination.target, destination.index, item)
+    } else {
+      defineEnumerableDataProperty(destination.target, destination.key, item)
+    }
+  }
+
+  const tasks: SnapshotTask[] = [{ kind: 'visit', value, destination: { kind: 'root' } }]
+  for (let task = takeLast(tasks); task !== undefined; task = takeLast(tasks)) {
+    if (task.kind === 'leave') {
+      setDelete(active, task.source)
+      continue
+    }
+    if (task.kind === 'array-item') {
+      if (!intrinsicObjectHasOwn(task.source, task.index)) return undefined
+      append(tasks, {
+        kind: 'visit',
+        value: task.source[task.index],
+        destination: { kind: 'array', target: task.target, index: task.index },
+      })
+      continue
+    }
+    if (task.kind === 'object-property') {
+      append(tasks, {
+        kind: 'visit',
+        value: task.source[task.key],
+        destination: { kind: 'object', target: task.target, key: task.key },
+      })
+      continue
+    }
+
+    const candidate = task.value
+    if (candidate === null) {
+      assign(task.destination, null)
+      continue
+    }
+    if (typeof candidate === 'boolean' || typeof candidate === 'string') {
+      assign(task.destination, candidate)
+      continue
+    }
+    if (typeof candidate === 'number') {
+      if (!intrinsicNumberIsFinite(candidate) || intrinsicObjectIs(candidate, -0)) return undefined
+      assign(task.destination, candidate)
+      continue
+    }
+    if (typeof candidate !== 'object') return undefined
+    if (setHas(active, candidate)) return undefined
+
+    if (intrinsicArrayIsArray(candidate)) {
+      if (!hasPlainArrayPrototype(candidate)) return undefined
+      const length = candidate.length
+      if (intrinsicReflectOwnKeys(candidate).length !== length + 1) return undefined
+      const target: CodeJsonValue[] = []
+      assign(task.destination, target)
+      setAdd(active, candidate)
+      append(tasks, { kind: 'leave', source: candidate })
+      for (let index = length - 1; index >= 0; index--) {
+        append(tasks, { kind: 'array-item', source: candidate, index, target })
+      }
+      continue
+    }
+
+    if (!hasPlainObjectPrototype(candidate)) return undefined
+    const keys = enumerableStringKeys(candidate)
+    if (keys === undefined) return undefined
+    const target: Record<string, CodeJsonValue> = {}
+    assign(task.destination, target)
+    setAdd(active, candidate)
+    append(tasks, { kind: 'leave', source: candidate })
+    for (let index = keys.length - 1; index >= 0; index--) {
+      const key = keys[index]
+      /* v8 ignore next -- the loop is bounded by the captured key count. */
+      if (key === undefined) return undefined
+      append(tasks, { kind: 'object-property', source: candidate as Record<string, unknown>, key, target })
+    }
+  }
+  return root
+}
+
+interface ArrayWireToken {
+  kind: 'array'
+  length: number
+}
+
+interface ObjectWireToken {
+  kind: 'object'
+  keys: string[]
+}
+
+type WorkerJsonToken = null | boolean | number | string | ArrayWireToken | ObjectWireToken
+
+/**
+ * A pre-order, bounded-depth transport for one lossless JSON value. Container
+ * markers and scalar leaves share one flat token array, so `worker_threads`
+ * never has to structured-clone the value's application nesting.
+ */
+export type WorkerJsonWire = WorkerJsonToken[]
+
+/**
+ * Flatten one validated JSON value for the worker-thread message port.
+ * @param value - the lossless JSON value to transport.
+ * @returns a pre-order token stream whose own nesting is bounded.
+ */
+export function encodeWorkerJson(value: CodeJsonValue): WorkerJsonWire {
+  const wire: WorkerJsonWire = []
+  const pending: CodeJsonValue[] = [value]
+  for (let current = takeLast(pending); current !== undefined; current = takeLast(pending)) {
+    if (current === null || typeof current === 'boolean' || typeof current === 'number' || typeof current === 'string') {
+      append(wire, current)
+      continue
+    }
+    if (intrinsicArrayIsArray(current)) {
+      append(wire, { kind: 'array', length: current.length })
+      for (let index = current.length - 1; index >= 0; index--) {
+        const item = current[index]
+        if (item === undefined) throw new IntrinsicError('cannot encode a sparse JSON array')
+        append(pending, item)
+      }
+      continue
+    }
+    const keys = intrinsicObjectKeys(current)
+    append(wire, { kind: 'object', keys })
+    for (let index = keys.length - 1; index >= 0; index--) {
+      const key = keys[index]
+      /* v8 ignore next -- the loop is bounded by the captured key count. */
+      if (key === undefined) throw new IntrinsicError('cannot encode a missing JSON object key')
+      const item = current[key]
+      if (item === undefined) throw new IntrinsicError('cannot encode an undefined JSON object property')
+      append(pending, item)
+    }
+  }
+  return wire
+}
+
+type DecodeFrame =
+  | { kind: 'array'; target: CodeJsonValue[]; length: number; index: number }
+  | { kind: 'object'; target: Record<string, CodeJsonValue>; keys: string[]; index: number }
+
+/** Whether an array contains exactly its dense indexed slots and `length`. */
+function isDenseArray(value: unknown[]): boolean {
+  if (!hasPlainArrayPrototype(value) || intrinsicReflectOwnKeys(value).length !== value.length + 1) return false
+  for (let index = 0; index < value.length; index++) {
+    if (!intrinsicObjectHasOwn(value, index)) return false
+  }
+  return true
+}
+
+/** Whether one exact string-key list contains a key, without consulting its prototype. */
+function keysContain(keys: string[], expected: string): boolean {
+  for (let index = 0; index < keys.length; index++) {
+    if (keys[index] === expected) return true
+  }
+  return false
+}
+
+/** Return one exact container marker, or reject any extra/missing fields. */
+function containerToken(value: object): ArrayWireToken | ObjectWireToken | undefined {
+  if (intrinsicArrayIsArray(value) || !hasPlainObjectPrototype(value)) return undefined
+  const keys = enumerableStringKeys(value)
+  if (keys === undefined) return undefined
+  const token = value as Record<string, unknown>
+  if (token.kind === 'array') {
+    if (keys.length !== 2 || !keysContain(keys, 'kind') || !keysContain(keys, 'length')) return undefined
+    const length = token.length
+    return typeof length === 'number' && intrinsicNumberIsSafeInteger(length) && length >= 0
+      ? { kind: 'array', length }
+      : undefined
+  }
+  if (token.kind === 'object') {
+    if (keys.length !== 2 || !keysContain(keys, 'kind') || !keysContain(keys, 'keys')) return undefined
+    const objectKeys = token.keys
+    if (!intrinsicArrayIsArray(objectKeys) || !isDenseArray(objectKeys)) return undefined
+    const unique = new IntrinsicSet<string>()
+    const normalizedKeys: string[] = []
+    const objectKeyValues = objectKeys as unknown[]
+    for (let index = 0; index < objectKeyValues.length; index++) {
+      const key = objectKeyValues[index]
+      if (typeof key !== 'string' || setHas(unique, key)) return undefined
+      setAdd(unique, key)
+      append(normalizedKeys, key)
+    }
+    return { kind: 'object', keys: normalizedKeys }
+  }
+  return undefined
+}
+
+/**
+ * Rebuild one lossless JSON value from the flat worker-thread wire format.
+ * Malformed or incomplete traffic returns `undefined`; traversal is iterative
+ * and therefore independent of the transported value's application depth.
+ * @param input - untrusted message-port payload.
+ * @returns the detached JSON value, or `undefined` when the wire is invalid.
+ */
+export function decodeWorkerJson(input: unknown): CodeJsonValue | undefined {
+  try {
+    if (!intrinsicArrayIsArray(input) || !isDenseArray(input) || input.length === 0) return undefined
+    const wire = input as unknown[]
+    const frames: DecodeFrame[] = []
+    let root: CodeJsonValue | undefined
+    let rootAssigned = false
+
+    const attach = (value: CodeJsonValue): boolean => {
+      const parent = frames[frames.length - 1]
+      if (!parent) {
+        if (rootAssigned) return false
+        root = value
+        rootAssigned = true
+        return true
+      }
+      /* v8 ignore next -- completed frames are popped before another token can attach. */
+      if (parent.index >= (parent.kind === 'array' ? parent.length : parent.keys.length)) return false
+      if (parent.kind === 'array') {
+        append(parent.target, value)
+      } else {
+        const key = parent.keys[parent.index]
+        /* v8 ignore next -- object frames are built from validated keys and their exact length. */
+        if (key === undefined) return false
+        defineEnumerableDataProperty(parent.target, key, value)
+      }
+      parent.index += 1
+      return true
+    }
+
+    for (let tokenIndex = 0; tokenIndex < wire.length; tokenIndex++) {
+      const token = wire[tokenIndex]
+      let value: CodeJsonValue
+      let frame: DecodeFrame | undefined
+      if (token === null || typeof token === 'boolean' || typeof token === 'string') {
+        value = token
+      } else if (typeof token === 'number') {
+        if (!intrinsicNumberIsFinite(token) || intrinsicObjectIs(token, -0)) return undefined
+        value = token
+      } else {
+        if (typeof token !== 'object') return undefined
+        const marker = containerToken(token)
+        if (!marker) return undefined
+        const remainingTokens = wire.length - tokenIndex - 1
+        if (marker.kind === 'array') {
+          if (marker.length > remainingTokens) return undefined
+          const target: CodeJsonValue[] = []
+          value = target
+          if (marker.length > 0) frame = { kind: 'array', target, length: marker.length, index: 0 }
+        } else {
+          if (marker.keys.length > remainingTokens) return undefined
+          const target: Record<string, CodeJsonValue> = {}
+          value = target
+          if (marker.keys.length > 0) frame = { kind: 'object', target, keys: marker.keys, index: 0 }
+        }
+      }
+      if (!attach(value)) return undefined
+      if (frame) append(frames, frame)
+      while (frames.length > 0) {
+        const current = frames[frames.length - 1]
+        /* v8 ignore next -- the loop condition guarantees a final frame. */
+        if (current === undefined) break
+        if (current.index < (current.kind === 'array' ? current.length : current.keys.length)) break
+        takeLast(frames)
+      }
+    }
+    return frames.length === 0 ? root : undefined
+  } catch {
+    return undefined
+  }
+}
+/* jscpd:ignore-end */

packages/code-runtime/code-runtime-worker/tests/bootstrap.spec.ts

@@ -1,8 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import { EventEmitter } from 'node:events'
-import { LogBuffer, makeConsoleShim, makeNamespaces, captureStreamWrites, prepareValue, runWorkerMain, truncateUtf8Bytes, wireReplies } from '../src/bootstrap.ts'
+import { LogBuffer, makeBindingErrorClasses, makeConsoleShim, makeNamespaces, captureStreamWrites, prepareCompletion, prepareException, runWorkerMain, wireReplies } from '../src/bootstrap.ts'
 import type { BootstrapPort, PatchableStream, PendingCall } from '../src/bootstrap.ts'
 import type { ReplyMessage, WorkerToHost } from '../src/protocol.ts'
+import { decodeWorkerJson, encodeWorkerJson } from '../src/worker-json.ts'
 
 /**
  * An in-process stand-in for the worker's parentPort: the test plays the
@@ -37,25 +38,52 @@ class FakePort implements BootstrapPort {
   done(): WorkerToHost | undefined {
     return this.sent.find(message => message.type === 'done')
   }
+
+  doneValue(): unknown {
+    const done = this.done()
+    return done?.type === 'done' && done.value !== undefined ? decodeWorkerJson(done.value) : undefined
+  }
 }
 
 function fakeStreams(): { stdout: PatchableStream; stderr: PatchableStream } {
   return { stdout: { write: () => true }, stderr: { write: () => true } }
 }
 
-const BOOT = { maxLogBytes: 65_536, maxValueBytes: 32_768 }
+/** Capture one promise rejection without Vitest's intentionally `any` matcher channel. */
+async function rejectionOf(promise: Promise<unknown>): Promise<unknown> {
+  try {
+    await promise
+    return undefined
+  } catch (error: unknown) {
+    return error
+  }
+}
+
+const BOOT = { maxOutputBytes: 65_536 }
+const TOOL_ERROR_CLASS = { name: 'ToolCallError', memberNameProperty: 'toolName' } as const
+
+/** One worker declaration for the Code Mode tools namespace. */
+function toolNamespace(names: string[]) {
+  return { global: 'tools', names, errorClass: TOOL_ERROR_CLASS }
+}
 
 describe('LogBuffer', () => {
-  it('streams entries to the sink until the byte budget, then emits one marker and drops the rest', () => {
+  it('streams entries to the sink until the byte budget, then emits one fitting prefix and reports the limit once', () => {
     const seen: string[] = []
-    const buffer = new LogBuffer(10, text => seen.push(text))
+    let limits = 0
+    const buffer = new LogBuffer(15, text => seen.push(text), () => { limits += 1 })
     buffer.push('12345')
     buffer.push('123456')
     buffer.push('dropped')
-    expect(seen).toEqual([
-      '12345',
-      '[dsh-code-runtime-worker] log capture truncated at 10 bytes',
-    ])
+    expect(seen).toEqual(['12345', '123'])
+    expect(limits).toBe(1)
+    expect(buffer.remainingOutputBytes()).toBe(0)
+
+    const exactlyFull: string[] = []
+    const fullBuffer = new LogBuffer(6, text => exactlyFull.push(text))
+    fullBuffer.push('12')
+    fullBuffer.push('no-prefix-fits')
+    expect(exactlyFull).toEqual(['12'])
   })
 })
 
@@ -109,66 +137,87 @@ describe('captureStreamWrites', () => {
   })
 })
 
-describe('prepareValue', () => {
-  it('omits undefined, passes small cloneable values raw', () => {
-    expect(prepareValue(undefined, 100)).toEqual({})
-    expect(prepareValue({ a: [1, 'two'] }, 100)).toEqual({ value: { a: [1, 'two'] } })
+describe('prepareCompletion', () => {
+  it('omits undefined and passes lossless JSON values exactly', () => {
+    expect(prepareCompletion(undefined, 100)).toEqual({})
+    expect(prepareCompletion({ a: [1, 'two'] }, 100)).toEqual({ value: encodeWorkerJson({ a: [1, 'two'] }) })
   })
 
-  it('replaces a non-cloneable value with its rendering', () => {
-    const { value } = prepareValue({ fn: () => 1 }, 1_000)
-    expect(typeof value).toBe('string')
-    expect(value).toContain('fn')
+  it('turns every lossy completion shape into invalid-output', () => {
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+    const sparse = Array(2)
+    class Exotic { readonly marker = true }
+    for (const value of [{ fn: () => 1 }, -0, Number.POSITIVE_INFINITY, sparse, cyclic, new Exotic()]) {
+      expect(prepareCompletion(value, 1_000)).toEqual({
+        error: { kind: 'invalid-output', message: 'program completion must be lossless JSON' },
+      })
+    }
   })
 
-  it('replaces an oversized value with a truncation-marked capped rendering', () => {
-    const { value } = prepareValue('x'.repeat(50), 10)
-    expect(value).toBe(`${'x'.repeat(10)}… [truncated]`)
+  it('reports an oversized value instead of substituting rendered text', () => {
+    expect(prepareCompletion('x'.repeat(50), 10)).toEqual({
+      error: { kind: 'output-limit', message: 'outer output exceeded 10 bytes' },
+    })
   })
 
-  it('measures a container by its structured-clone wire size, not its bounded rendering', () => {
-    // The bounded inspect rendering of a huge array is tiny ("... N more
-    // items"), but its real cross-boundary size is not — the cap must catch
-    // it, replacing the value with that bounded rendering.
-    const huge = new Array(50_000).fill(7)
-    const { value } = prepareValue(huge, 1_000)
-    expect(typeof value).toBe('string')
-    expect(value).toContain('more items')
+  it('measures the exact JSON serialization at and over the boundary', () => {
+    expect(prepareCompletion('€', 5)).toEqual({ value: encodeWorkerJson('€') })
+    expect(prepareCompletion('€', 4)).toEqual({
+      error: { kind: 'output-limit', message: 'outer output exceeded 4 bytes' },
+    })
   })
 
-  it('caps a multibyte string by UTF-8 bytes, not UTF-16 length', () => {
-    // 4 code units but 12 UTF-8 bytes: a length-counting cap would pass the
-    // full string through untruncated.
-    expect(prepareValue('€€€€', 4)).toEqual({ value: '€… [truncated]' })
+  it('contains a getter failure as invalid-output', () => {
+    const value = Object.defineProperty({}, 'x', { enumerable: true, get() { throw new Error('getter exploded') } })
+    expect(prepareCompletion(value, 1_000)).toEqual({
+      error: { kind: 'invalid-output', message: 'program completion must be lossless JSON' },
+    })
   })
 
-  it('caps a multibyte rendering by UTF-8 bytes too', () => {
-    // Wire size (24-byte string inside an array) exceeds the cap, so the
-    // value crosses as its rendering — whose truncation must also be
-    // byte-exact: "[ '" (3 bytes) + two € (6 bytes) = 9; a third € would
-    // overflow the 10-byte budget.
-    expect(prepareValue(['€€€€€€€€'], 10)).toEqual({ value: "[ '€€… [truncated]" })
+  it('uses the remaining combined budget for invalid-output diagnostics', () => {
+    expect(prepareCompletion(() => 1, 4, 64)).toEqual({
+      error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' },
+    })
   })
 })
 
-describe('truncateUtf8Bytes', () => {
-  it('returns a fitting string whole', () => {
-    expect(truncateUtf8Bytes('fits', 4)).toBe('fits')
+describe('prepareException', () => {
+  it('passes a fitting diagnostic and rejects one byte over without carrying its text', () => {
+    expect(prepareException('boom', 6, 64)).toEqual({ error: { kind: 'exception', message: 'boom' } })
+    expect(prepareException('boom', 5, 64)).toEqual({
+      error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' },
+    })
   })
 
-  it('cuts at a code-point boundary, never mid-surrogate-pair', () => {
-    // Each 😀 is one code point, two code units, four UTF-8 bytes: a 5-byte
-    // budget fits exactly one — and never leaves a lone surrogate behind.
-    const cut = truncateUtf8Bytes('😀😀', 5)
-    expect(cut).toBe('😀')
-    expect(Buffer.byteLength(truncateUtf8Bytes('😀😀', 3), 'utf8')).toBe(0)
+  it('contains a thrown value whose string conversion fails', () => {
+    const thrown = { toString() { throw new Error('cannot render') } }
+    expect(prepareException(thrown, 1_000)).toEqual({
+      error: { kind: 'exception', message: 'program threw an unrenderable value' },
+    })
+
+    const strangeStack = Object.defineProperty(new Error('ignored'), 'stack', { value: 42 })
+    expect(prepareException(strangeStack, 1_000)).toEqual({
+      error: { kind: 'exception', message: '42' },
+    })
   })
 })
 
 describe('makeNamespaces', () => {
+  it('rejects a malformed success reply instead of resolving a lossy binding value', async () => {
+    const port = new FakePort()
+    const pending = new Map<number, PendingCall>()
+    wireReplies(port, pending)
+    const result = new Promise<unknown>((resolve, reject) => { pending.set(1, { resolve, reject }) })
+    port.deliver({ type: 'reply', id: 1, ok: true, value: [undefined] as never })
+    await expect(result).rejects.toThrow('binding resolution must be lossless JSON')
+  })
+
   it('exposes prototype-colliding names as ordinary own properties', async () => {
     const port = new FakePort()
-    port.respond = message => message.type === 'call' ? { type: 'reply', id: message.id, ok: true, value: `${message.name}-ok` } : undefined
+    port.respond = message => message.type === 'call'
+      ? { type: 'reply', id: message.id, ok: true, value: encodeWorkerJson(`${message.name}-ok`) }
+      : undefined
     const pending = new Map<number, PendingCall>()
     wireReplies(port, pending)
     const [tools] = makeNamespaces({ namespaces: [{ global: 'tools', names: ['__proto__', 'constructor', 'toString'] }] }, port, pending, { value: 1 }) as [Record<string, (args: unknown) => Promise<unknown>>]
@@ -178,7 +227,7 @@ describe('makeNamespaces', () => {
     await expect(tools['toString']?.({})).resolves.toBe('toString-ok')
   })
 
-  it('rejects a non-cloneable argument without leaking the pending entry', async () => {
+  it('rejects a postMessage clone failure without leaking the pending entry', async () => {
     let firstCall = true
     const throwingPort: BootstrapPort = {
       // First call throws an Error (the real DataCloneError shape), the
@@ -190,24 +239,108 @@ describe('makeNamespaces', () => {
       on: () => {},
     }
     const pending = new Map<number, PendingCall>()
-    const [tools] = makeNamespaces({ namespaces: [{ global: 'tools', names: ['x'] }] }, throwingPort, pending, { value: 1 }) as [Record<string, (args: unknown) => Promise<unknown>>]
-    await expect(tools.x?.(() => 1)).rejects.toThrow(/structured-cloneable: DataCloneError-ish/)
-    await expect(tools.x?.(() => 1)).rejects.toThrow(/structured-cloneable: raw-clone-failure/)
+    const data = { namespaces: [toolNamespace(['x'])] }
+    const errorClasses = makeBindingErrorClasses(data)
+    const ToolCallError = errorClasses.get('tools')
+    const [tools] = makeNamespaces(
+      data,
+      throwingPort,
+      pending,
+      { value: 1 },
+      errorClasses,
+    ) as [Record<string, (args: unknown) => Promise<unknown>>]
+    const first = await rejectionOf(tools.x?.({ first: true }) ?? Promise.resolve())
+    const second = await rejectionOf(tools.x?.({ second: true }) ?? Promise.resolve())
+    expect(first).toMatchObject({ name: 'ToolCallError', toolName: 'x' })
+    expect(second).toMatchObject({ name: 'ToolCallError', toolName: 'x' })
+    expect(first).toBeInstanceOf(ToolCallError)
+    expect(second).toBeInstanceOf(ToolCallError)
+    expect((first as Error).message).toMatch(/DataCloneError-ish/)
+    expect((second as Error).message).toMatch(/raw-clone-failure/)
     expect(pending.size).toBe(0)
   })
+
+  it('rejects lossy arguments before posting or allocating a call id', async () => {
+    let posts = 0
+    const port: BootstrapPort = { postMessage: () => { posts += 1 }, on: () => {} }
+    const pending = new Map<number, PendingCall>()
+    const nextId = { value: 1 }
+    const [tools] = makeNamespaces(
+      { namespaces: [toolNamespace(['x'])] }, port, pending, nextId,
+    ) as [Record<string, (args: unknown) => Promise<unknown>>]
+    const decorated = [1]
+    Object.defineProperty(decorated, 'extra', { value: true })
+    const throwing = Object.defineProperty({}, 'value', {
+      enumerable: true,
+      get: () => { throw new Error('getter exploded') },
+    })
+
+    for (const value of [() => 1, new Date(), decorated, throwing]) {
+      const failure = await rejectionOf(tools.x?.(value) ?? Promise.resolve())
+      expect(failure).toMatchObject({
+        name: 'ToolCallError', toolName: 'x', message: 'binding arguments must be lossless JSON',
+      })
+    }
+    expect(posts).toBe(0)
+    expect(pending.size).toBe(0)
+    expect(nextId.value).toBe(1)
+  })
+
+  it('uses ordinary Error for non-tools namespace failures', async () => {
+    const deniedPort = new FakePort()
+    deniedPort.respond = message => message.type === 'call'
+      ? { type: 'reply', id: message.id, ok: false, message: 'helper denied' }
+      : undefined
+    const deniedPending = new Map<number, PendingCall>()
+    wireReplies(deniedPort, deniedPending)
+    const [helpers] = makeNamespaces({ namespaces: [{ global: 'helpers', names: ['x'] }] }, deniedPort, deniedPending, { value: 1 }) as [Record<string, (args: unknown) => Promise<unknown>>]
+    const denied = await rejectionOf(helpers.x?.({}) ?? Promise.resolve())
+    expect(denied).toBeInstanceOf(Error)
+    expect(denied).toMatchObject({ name: 'Error', message: 'helper denied' })
+    expect(denied).not.toHaveProperty('toolName')
+
+    const invalid = await rejectionOf(helpers.x?.(() => 1) ?? Promise.resolve())
+    expect(invalid).toBeInstanceOf(Error)
+    expect((invalid as Error).message).toBe('binding arguments must be lossless JSON')
+
+    const clonePort: BootstrapPort = { postMessage: () => { throw new Error('clone failed') }, on: () => {} }
+    const [cloneHelpers] = makeNamespaces({ namespaces: [{ global: 'helpers', names: ['x'] }] }, clonePort, new Map(), { value: 1 }) as [Record<string, (args: unknown) => Promise<unknown>>]
+    const cloneFailure = await rejectionOf(cloneHelpers.x?.({}) ?? Promise.resolve())
+    expect(cloneFailure).toBeInstanceOf(Error)
+    expect(cloneFailure).not.toHaveProperty('toolName')
+  })
 })
 
 describe('runWorkerMain', () => {
   it('runs a program end-to-end: bindings, console, return value', async () => {
     const port = new FakePort()
-    port.respond = message => message.type === 'call' ? { type: 'reply', id: message.id, ok: true, value: (message.args as { n: number }).n * 2 } : undefined
+    port.respond = (message) => {
+      if (message.type !== 'call') return undefined
+      const args = decodeWorkerJson(message.args) as { n: number }
+      return { type: 'reply', id: message.id, ok: true, value: encodeWorkerJson(args.n * 2) }
+    }
     await runWorkerMain(port, {
       ...BOOT,
       code: 'const doubled = await tools.double({ n: 21 }); console.log("got", doubled); return { doubled };',
       namespaces: [{ global: 'tools', names: ['double'] }],
     }, fakeStreams())
     expect(port.logs()).toEqual(['got 42'])
-    expect(port.done()).toEqual({ type: 'done', value: { doubled: 42 } })
+    expect(port.doneValue()).toEqual({ doubled: 42 })
+  })
+
+  it('reports worker-side log capture overflow before completing', async () => {
+    const port = new FakePort()
+    await runWorkerMain(port, {
+      maxOutputBytes: 4,
+      code: 'console.log("12345"); return null',
+      namespaces: [],
+    }, fakeStreams())
+    expect(port.logs()).toEqual([])
+    expect(port.sent).toContainEqual({ type: 'output-limit' })
+    expect(port.done()).toEqual({
+      type: 'done',
+      error: { kind: 'output-limit', message: 'outer output exceeded 4 bytes' },
+    })
   })
 
   it('reports a thrown program error on the done message', async () => {
@@ -215,6 +348,7 @@ describe('runWorkerMain', () => {
     await runWorkerMain(port, { ...BOOT, code: 'throw new Error("boom")', namespaces: [] }, fakeStreams())
     const done = port.done()
     expect(done?.type).toBe('done')
+    expect(done?.type === 'done' ? done.error?.kind : undefined).toBe('exception')
     expect(done?.type === 'done' ? done.error?.message : undefined).toContain('boom')
     expect(done?.type === 'done' ? done.value : undefined).toBeUndefined()
   })
@@ -222,11 +356,35 @@ describe('runWorkerMain', () => {
   it('renders non-Error throws and stack-less Errors on the done message', async () => {
     const rawPort = new FakePort()
     await runWorkerMain(rawPort, { ...BOOT, code: 'throw "raw-throw"', namespaces: [] }, fakeStreams())
-    expect(rawPort.done()).toEqual({ type: 'done', error: { message: 'raw-throw' } })
+    expect(rawPort.done()).toEqual({ type: 'done', error: { kind: 'exception', message: 'raw-throw' } })
 
     const barePort = new FakePort()
     await runWorkerMain(barePort, { ...BOOT, code: 'const e = new Error("bare"); e.stack = undefined; throw e', namespaces: [] }, fakeStreams())
-    expect(barePort.done()).toEqual({ type: 'done', error: { message: 'bare' } })
+    expect(barePort.done()).toEqual({ type: 'done', error: { kind: 'exception', message: 'bare' } })
+  })
+
+  it('replaces giant thrown strings and Error stacks before posting the done message', async () => {
+    const rawPort = new FakePort()
+    await runWorkerMain(rawPort, {
+      maxOutputBytes: 64,
+      code: 'throw "x".repeat(1_000_000)',
+      namespaces: [],
+    }, fakeStreams())
+    expect(rawPort.done()).toEqual({
+      type: 'done',
+      error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' },
+    })
+
+    const stackPort = new FakePort()
+    await runWorkerMain(stackPort, {
+      maxOutputBytes: 64,
+      code: 'throw new Error("x".repeat(1_000_000))',
+      namespaces: [],
+    }, fakeStreams())
+    expect(stackPort.done()).toEqual({
+      type: 'done',
+      error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' },
+    })
   })
 
   it('surfaces a host failure reply as a program-side rejection it can catch', async () => {
@@ -234,10 +392,27 @@ describe('runWorkerMain', () => {
     port.respond = message => message.type === 'call' ? { type: 'reply', id: message.id, ok: false, message: 'denied by host' } : undefined
     await runWorkerMain(port, {
       ...BOOT,
-      code: 'try { await tools.x({}) } catch (error) { return `caught: ${error.message}` }',
-      namespaces: [{ global: 'tools', names: ['x'] }],
+      code: 'try { await tools.x({}) } catch (error) { return { caught: error instanceof ToolCallError, name: error.name, toolName: error.toolName, message: error.message } }',
+      namespaces: [toolNamespace(['x'])],
     }, fakeStreams())
-    expect(port.done()).toEqual({ type: 'done', value: 'caught: denied by host' })
+    expect(port.doneValue()).toEqual({ caught: true, name: 'ToolCallError', toolName: 'x', message: 'denied by host' })
+  })
+
+  it('materializes a consumer-declared rejection class without knowing the namespace', async () => {
+    const port = new FakePort()
+    port.respond = message => message.type === 'call'
+      ? { type: 'reply', id: message.id, ok: false, message: 'helper denied' }
+      : undefined
+    await runWorkerMain(port, {
+      ...BOOT,
+      code: 'try { await helpers.x({}) } catch (error) { return { caught: error instanceof HelperCallError, name: error.name, helperName: error.helperName, message: error.message } }',
+      namespaces: [{
+        global: 'helpers',
+        names: ['x'],
+        errorClass: { name: 'HelperCallError', memberNameProperty: 'helperName' },
+      }],
+    }, fakeStreams())
+    expect(port.doneValue()).toEqual({ caught: true, name: 'HelperCallError', helperName: 'x', message: 'helper denied' })
   })
 
   it('ignores replies for unknown pending ids', async () => {
@@ -245,15 +420,15 @@ describe('runWorkerMain', () => {
     port.respond = (message) => {
       if (message.type !== 'call') return undefined
       // Deliver a stray reply first; the real one follows.
-      port.deliver({ type: 'reply', id: 9_999, ok: true, value: 'stray' })
-      return { type: 'reply', id: message.id, ok: true, value: 'real' }
+      port.deliver({ type: 'reply', id: 9_999, ok: true, value: encodeWorkerJson('stray') })
+      return { type: 'reply', id: message.id, ok: true, value: encodeWorkerJson('real') }
     }
     await runWorkerMain(port, {
       ...BOOT,
       code: 'return await tools.x({})',
       namespaces: [{ global: 'tools', names: ['x'] }],
     }, fakeStreams())
-    expect(port.done()).toEqual({ type: 'done', value: 'real' })
+    expect(port.doneValue()).toBe('real')
   })
 
   it('captures raw stream writes through the patched process streams', async () => {

packages/code-runtime/code-runtime-worker/tests/built-lib.e2e.ts

@@ -23,8 +23,15 @@ describe.skipIf(!built)('built lib real load path (plain node)', () => {
       const ctx = new Context()
       await ctx.plugin(WorkerCodeRuntime, {})
       const result = await ctx.codeRuntime.run({
-        program: 'const doubled: number = await tools.double({ n: 21 }); console.log("halfway", doubled); return doubled;',
-        bindings: [{ global: 'tools', functions: { double: async args => args.n * 2 } }],
+        program: 'const doubled: number = await tools.double({ n: 21 }); console.log("halfway", doubled); let failure; try { await tools.fail({}) } catch (error) { failure = { typed: error instanceof ToolCallError, name: error.name, toolName: error.toolName, message: error.message } } return { doubled, failure };',
+        bindings: [{
+          global: 'tools',
+          functions: {
+            double: async args => args.n * 2,
+            fail: async () => { throw new Error('denied') },
+          },
+          errorClass: { name: 'ToolCallError', memberNameProperty: 'toolName' },
+        }],
       })
       console.log(JSON.stringify(result))
       process.exit(0)
@@ -40,7 +47,10 @@ describe.skipIf(!built)('built lib real load path (plain node)', () => {
     const lastLine = stdout.trim().split('\n').at(-1) ?? ''
     const result = JSON.parse(lastLine) as { value?: unknown; logs: string[]; error?: unknown }
     expect(result.error).toBeUndefined()
-    expect(result.value).toBe(42)
+    expect(result.value).toEqual({
+      doubled: 42,
+      failure: { typed: true, name: 'ToolCallError', toolName: 'fail', message: 'denied' },
+    })
     expect(result.logs).toContain('halfway 42')
   })
 })

packages/code-runtime/code-runtime-worker/tests/output-json.spec.ts

@@ -0,0 +1,109 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { CodeJsonValue } from '@deepseek-ai/dsh-code-runtime'
+import { jsonStringBytesUpTo, jsonValueBytesUpTo, truncateJsonStringBytes } from '../src/output-json.ts'
+
+describe('truncateJsonStringBytes', () => {
+  it('returns a fitting string whole and rejects budgets without JSON quotes', () => {
+    expect(truncateJsonStringBytes('fits', 6)).toBe('fits')
+    expect(truncateJsonStringBytes('x', 1)).toBe('')
+    expect(jsonStringBytesUpTo('fits', 6)).toBe(6)
+    expect(jsonStringBytesUpTo('fits', 5)).toBeUndefined()
+  })
+
+  it('accounts every JSON escape and cuts only between complete code points', () => {
+    const prefix = '"\\\b\t\n\f\r\u0000😀\ud800€a'
+    const text = `${prefix}z`
+    const budget = Buffer.byteLength(JSON.stringify(prefix), 'utf8')
+
+    expect(truncateJsonStringBytes(text, budget)).toBe(prefix)
+    expect(Buffer.byteLength(JSON.stringify(truncateJsonStringBytes(text, budget)), 'utf8')).toBe(budget)
+  })
+
+  it('bounds hostile strings without materializing their complete escaped form', () => {
+    const stringify = vi.spyOn(JSON, 'stringify').mockImplementation(() => { throw new Error('must not stringify') })
+    try {
+      expect(jsonStringBytesUpTo('"'.repeat(10_000), 32)).toBeUndefined()
+      expect(truncateJsonStringBytes('"'.repeat(10_000), 32)).toBe('"'.repeat(15))
+    } finally {
+      stringify.mockRestore()
+    }
+  })
+})
+
+describe('jsonValueBytesUpTo', () => {
+  it('matches JSON serialization for every lossless value branch and stops at the cap', () => {
+    const value = {
+      empty: {},
+      nil: null,
+      yes: true,
+      no: false,
+      number: 1.5,
+      text: '"\n😀',
+      array: [1, 'x'],
+    }
+    const bytes = Buffer.byteLength(JSON.stringify(value), 'utf8')
+
+    expect(jsonValueBytesUpTo(value, bytes)).toBe(bytes)
+    expect(jsonValueBytesUpTo(value, bytes - 1)).toBeUndefined()
+    expect(jsonValueBytesUpTo({}, 1)).toBeUndefined()
+    expect(jsonValueBytesUpTo([], 1)).toBeUndefined()
+    expect(jsonValueBytesUpTo([], 2)).toBe(2)
+    expect(jsonValueBytesUpTo(null, 3)).toBeUndefined()
+    expect(jsonValueBytesUpTo(10, 1)).toBeUndefined()
+    expect(jsonValueBytesUpTo(false, 4)).toBeUndefined()
+    expect(jsonValueBytesUpTo(new Array<never>(1), 10)).toBeUndefined()
+    expect(jsonValueBytesUpTo([null], 5)).toBeUndefined()
+    expect(jsonValueBytesUpTo([0, 0], 3)).toBeUndefined()
+    expect(jsonValueBytesUpTo({ a: null, b: null }, 10)).toBeUndefined()
+    expect(jsonValueBytesUpTo({ long: null }, 2)).toBeUndefined()
+    expect(jsonValueBytesUpTo({ '': null }, 4)).toBeUndefined()
+    expect(jsonValueBytesUpTo({ a: null }, 9)).toBeUndefined()
+    expect(jsonValueBytesUpTo({ a: undefined } as unknown as CodeJsonValue, 100)).toBeUndefined()
+  })
+
+  it('meters deeply nested arrays without recursive stack growth', () => {
+    let value: CodeJsonValue = null
+    for (let depth = 0; depth < 5_000; depth++) value = [value]
+
+    expect(jsonValueBytesUpTo(value, 10_004)).toBe(10_004)
+    expect(jsonValueBytesUpTo(value, 10_003)).toBeUndefined()
+  })
+
+  it('uses module-captured intrinsics after model-visible globals are mutated', () => {
+    const value: CodeJsonValue = { payload: ['€', 42] }
+    const bytes = Buffer.byteLength(JSON.stringify(value), 'utf8')
+    const arrayIsArrayDescriptor = Object.getOwnPropertyDescriptor(Array, 'isArray')!
+    const arrayPopDescriptor = Object.getOwnPropertyDescriptor(Array.prototype, 'pop')!
+    const arrayPushDescriptor = Object.getOwnPropertyDescriptor(Array.prototype, 'push')!
+    const byteLengthDescriptor = Object.getOwnPropertyDescriptor(Buffer, 'byteLength')!
+    const objectKeysDescriptor = Object.getOwnPropertyDescriptor(Object, 'keys')!
+    const charCodeAtDescriptor = Object.getOwnPropertyDescriptor(String.prototype, 'charCodeAt')!
+    const codePointAtDescriptor = Object.getOwnPropertyDescriptor(String.prototype, 'codePointAt')!
+    const sliceDescriptor = Object.getOwnPropertyDescriptor(String.prototype, 'slice')!
+    let measured: number | undefined
+    let prefix = ''
+    try {
+      Array.isArray = (_value: unknown): _value is never[] => false
+      Array.prototype.pop = () => { throw new Error('mutated pop') }
+      Array.prototype.push = () => { throw new Error('mutated push') }
+      Buffer.byteLength = () => 0
+      Object.keys = () => []
+      String.prototype.charCodeAt = () => { throw new Error('mutated charCodeAt') }
+      String.prototype.codePointAt = () => { throw new Error('mutated codePointAt') }
+      String.prototype.slice = () => { throw new Error('mutated slice') }
+      measured = jsonValueBytesUpTo(value, bytes)
+      prefix = truncateJsonStringBytes('€x', 5)
+    } finally {
+      Object.defineProperty(Array, 'isArray', arrayIsArrayDescriptor)
+      Object.defineProperty(Array.prototype, 'pop', arrayPopDescriptor)
+      Object.defineProperty(Array.prototype, 'push', arrayPushDescriptor)
+      Object.defineProperty(Buffer, 'byteLength', byteLengthDescriptor)
+      Object.defineProperty(Object, 'keys', objectKeysDescriptor)
+      Object.defineProperty(String.prototype, 'charCodeAt', charCodeAtDescriptor)
+      Object.defineProperty(String.prototype, 'codePointAt', codePointAtDescriptor)
+      Object.defineProperty(String.prototype, 'slice', sliceDescriptor)
+    }
+    expect(measured).toBe(bytes)
+    expect(prefix).toBe('€')
+  })
+})

packages/code-runtime/code-runtime-worker/tests/runtime.spec.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import { WorkerCodeRuntime } from '@deepseek-ai/dsh-code-runtime-worker'
 import type { Config } from '@deepseek-ai/dsh-code-runtime-worker'
-import type { CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
+import type { CodeBindingFunction, CodeBindingNamespace, CodeRunResult } from '@deepseek-ai/dsh-code-runtime'
 
 /**
  * Integration suite over REAL worker threads (no mocks — workers are cheap
@@ -17,8 +17,12 @@ async function setup(config: Config = {}) {
 }
 
 /** Convenience: one namespace `tools` with the given functions. */
-function tools(functions: Record<string, (args: unknown) => Promise<unknown>>) {
-  return [{ global: 'tools', functions }]
+function tools(functions: Record<string, (args: unknown) => Promise<unknown>>): CodeBindingNamespace[] {
+  return [{
+    global: 'tools',
+    functions: functions as Record<string, CodeBindingFunction>,
+    errorClass: { name: 'ToolCallError', memberNameProperty: 'toolName' },
+  }]
 }
 
 describe('WorkerCodeRuntime — programs and bindings (real workers)', () => {
@@ -52,10 +56,10 @@ describe('WorkerCodeRuntime — programs and bindings (real workers)', () => {
     const result = await runtime.run({
       program: `
         const first = await tools.echo({ n: 1 });
-        let caught = '';
-        try { await tools.fail({}) } catch (error) { caught = error.message }
-        let caughtRaw = '';
-        try { await tools.failRaw({}) } catch (error) { caughtRaw = error.message }
+        let caught = {};
+        try { await tools.fail({}) } catch (error) { caught = { isTyped: error instanceof ToolCallError, name: error.name, toolName: error.toolName, message: error.message } }
+        let caughtRaw = {};
+        try { await tools.failRaw({}) } catch (error) { caughtRaw = { name: error.name, toolName: error.toolName, message: error.message } }
         return { first, caught, caughtRaw };
       `,
       bindings: tools({
@@ -66,10 +70,61 @@ describe('WorkerCodeRuntime — programs and bindings (real workers)', () => {
       }),
     })
     expect(result.error).toBeUndefined()
-    expect(result.value).toEqual({ first: { echoed: { n: 1 } }, caught: 'nope', caughtRaw: 'raw-nope' })
+    expect(result.value).toEqual({
+      first: { echoed: { n: 1 } },
+      caught: { isTyped: true, name: 'ToolCallError', toolName: 'fail', message: 'nope' },
+      caughtRaw: { name: 'ToolCallError', toolName: 'failRaw', message: 'raw-nope' },
+    })
     expect(calls).toEqual([{ n: 1 }])
   })
 
+  it('materializes a typed rejection from a generic namespace descriptor', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: `
+        try { await helpers.fail({}) } catch (error) {
+          return {
+            isTyped: error instanceof HelperCallError,
+            name: error.name,
+            helperName: error.helperName,
+            message: error.message,
+          };
+        }
+      `,
+      bindings: [{
+        global: 'helpers',
+        functions: { fail: async () => { throw new Error('nope') } },
+        errorClass: { name: 'HelperCallError', memberNameProperty: 'helperName' },
+      }],
+    })
+    expect(result.value).toEqual({
+      isTyped: true,
+      name: 'HelperCallError',
+      helperName: 'fail',
+      message: 'nope',
+    })
+  })
+
+  it('bridges a deeply nested lossless JSON argument, resolution, and completion', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: `
+        let value = 'leaf';
+        for (let depth = 0; depth < 3_000; depth++) value = [value];
+        return await tools.echo(value);
+      `,
+      bindings: tools({ echo: async args => args }),
+    })
+
+    expect(result.error).toBeUndefined()
+    let cursor = result.value
+    for (let depth = 0; depth < 3_000; depth++) {
+      expect(Array.isArray(cursor)).toBe(true)
+      cursor = Array.isArray(cursor) ? cursor[0] : undefined
+    }
+    expect(cursor).toBe('leaf')
+  }, 15_000)
+
   it('reports non-erasable syntax as an exception without spawning a worker', async () => {
     const { runtime } = await setup()
     const result = await runtime.run({ program: 'enum E { A }\nreturn 1', bindings: [] })
@@ -90,10 +145,11 @@ describe('WorkerCodeRuntime — programs and bindings (real workers)', () => {
     expect(result.value).toBe('{}')
   })
 
-  it('replaces a non-cloneable return value with a string rendering', async () => {
+  it('rejects a non-lossless completion instead of replacing it with rendered text', async () => {
     const { runtime } = await setup()
     const result = await runtime.run({ program: 'return { f: () => 1 }', bindings: [] })
-    expect(typeof result.value).toBe('string')
+    expect(result.value).toBeUndefined()
+    expect(result.error).toEqual({ kind: 'invalid-output', message: 'program completion must be lossless JSON' })
   })
 
   it('completes a program that returns nothing with no value at all', async () => {
@@ -166,6 +222,19 @@ describe('WorkerCodeRuntime — budgets and containment (real workers)', () => {
     expect(result.error).toEqual({ kind: 'abort', message: 'too-late' })
   })
 
+  it('applies the outer-output cap to failures before worker startup', async () => {
+    const capped = await setup({ maxOutputBytes: 64 })
+    const controller = new AbortController()
+    controller.abort('A'.repeat(1_000))
+    const aborted = await capped.runtime.run({ program: 'return 1', bindings: [], signal: controller.signal })
+    expect(aborted).toEqual({ logs: [], error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' } })
+
+    const minimal = await setup({ maxOutputBytes: 4 })
+    const invalid = await minimal.runtime.run({ program: 'enum E { A }\nreturn 1', bindings: [] })
+    expect(invalid.error?.kind).toBe('output-limit')
+    expect(Buffer.byteLength(JSON.stringify(invalid.logs), 'utf8') + Buffer.byteLength(JSON.stringify(invalid.error?.message), 'utf8')).toBeLessThanOrEqual(4)
+  })
+
   it('drops a binding resolution that lands after the run settled', async () => {
     const { runtime } = await setup()
     const controller = new AbortController()
@@ -201,30 +270,94 @@ describe('WorkerCodeRuntime — budgets and containment (real workers)', () => {
     expect(after.value).toBe('alive')
   }, 30_000)
 
-  it('truncates runaway log output at the byte budget with an in-band marker', async () => {
-    const { runtime } = await setup({ maxLogBytes: 300 })
+  it('reports a worker that exits before publishing a completion', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({ program: 'process.exit(7)', bindings: [] })
+    expect(result).toEqual({
+      logs: [],
+      error: { kind: 'worker-exit', message: 'worker exited with code 7 before completing' },
+    })
+  })
+
+  it('fails runaway log output explicitly while retaining a bounded prefix', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 300 })
     const result = await runtime.run({
       program: 'for (let i = 0; i < 1000; i++) console.log("spam line", i); return 1',
       bindings: [],
     })
-    expect(result.logs.at(-1)).toContain('truncated at 300 bytes')
-    const total = result.logs.reduce((sum, text) => sum + Buffer.byteLength(text, 'utf8'), 0)
-    expect(total).toBeLessThan(1_000)
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 300 bytes' })
+    expect(result.value).toBeUndefined()
+    expect(result.logs.length).toBeGreaterThan(0)
+    expect(Buffer.byteLength(JSON.stringify(result.logs), 'utf8')).toBeLessThan(300)
   })
 
-  it('caps an oversized return value with a truncation marker', async () => {
-    const { runtime } = await setup({ maxValueBytes: 64 })
+  it('retains a fitting prefix when one oversized log is the first output', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 96 })
+    const result = await runtime.run({
+      program: 'console.log(`start-${`😀"\\\\\\n`.repeat(100)}`); return null',
+      bindings: [],
+    })
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 96 bytes' })
+    expect(result.logs).toHaveLength(1)
+    expect(result.logs[0]?.startsWith('start-')).toBe(true)
+    expect(Buffer.byteLength(JSON.stringify(result.logs), 'utf8')
+      + Buffer.byteLength(JSON.stringify(result.error?.message), 'utf8')).toBeLessThanOrEqual(96)
+  })
+
+  it('fails an oversized return value without substituting a string', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 64 })
     const result = await runtime.run({ program: 'return "y".repeat(10_000)', bindings: [] })
-    expect(result.value).toBe(`${'y'.repeat(64)}… [truncated]`)
+    expect(result.value).toBeUndefined()
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 64 bytes' })
   })
 
-  it('caps a multibyte return value by UTF-8 bytes, not string length', async () => {
-    // 4 code units, 12 UTF-8 bytes: a length-counting cap would let the full
-    // string cross. The worker's byte-exact capped rendering then passes the
-    // host re-cap unchanged (cap + marker is exactly the granted slack).
-    const { runtime } = await setup({ maxValueBytes: 4 })
-    const result = await runtime.run({ program: 'return "€€€€"', bindings: [] })
-    expect(result.value).toBe('€… [truncated]')
+  it('uses UTF-8 serialized bytes at the exact completion boundary', async () => {
+    const exact = await setup({ maxOutputBytes: 7 })
+    const exactResult = await exact.runtime.run({ program: 'return "€"', bindings: [] })
+    // [] costs two bytes and JSON serialization of "€" costs five.
+    expect(exactResult).toEqual({ logs: [], value: '€' })
+
+    const over = await setup({ maxOutputBytes: 6 })
+    const overResult = await over.runtime.run({ program: 'return "€"', bindings: [] })
+    expect(overResult.error?.kind).toBe('output-limit')
+  })
+
+  it('accounts logs and completion in one exact combined ledger', async () => {
+    // JSON(["abc"]) is seven bytes and JSON("xy") is four.
+    const exact = await setup({ maxOutputBytes: 11 })
+    expect(await exact.runtime.run({ program: 'console.log("abc"); return "xy"', bindings: [] }))
+      .toEqual({ logs: ['abc'], value: 'xy' })
+
+    const over = await setup({ maxOutputBytes: 10 })
+    const result = await over.runtime.run({ program: 'console.log("abc"); return "xy"', bindings: [] })
+    expect(result.value).toBeUndefined()
+    expect(result.error?.kind).toBe('output-limit')
+    expect(Buffer.byteLength(JSON.stringify(result.logs), 'utf8') + Buffer.byteLength(JSON.stringify(result.error?.message), 'utf8')).toBeLessThanOrEqual(10)
+  })
+
+  it('accounts logs and exception diagnostics before the worker port boundary', async () => {
+    // JSON(["abc"]) is seven bytes and JSON("xy") is four.
+    const exact = await setup({ maxOutputBytes: 11 })
+    expect(await exact.runtime.run({ program: 'console.log("abc"); throw "xy"', bindings: [] }))
+      .toEqual({ logs: ['abc'], error: { kind: 'exception', message: 'xy' } })
+
+    const over = await setup({ maxOutputBytes: 10 })
+    const result = await over.runtime.run({ program: 'console.log("abc"); throw "xy"', bindings: [] })
+    expect(result.error?.kind).toBe('output-limit')
+    expect(Buffer.byteLength(JSON.stringify(result.logs), 'utf8')
+      + Buffer.byteLength(JSON.stringify(result.error?.message), 'utf8')).toBeLessThanOrEqual(10)
+  })
+
+  it('does not send a giant Error stack across the worker port', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 64 })
+    const result = await runtime.run({
+      program: 'throw new Error("x".repeat(1_000_000))',
+      bindings: [],
+    })
+    expect(result).toEqual({
+      logs: [],
+      error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' },
+    })
   })
 
   it('completes a program that awaits its write callback, capturing the chunk', async () => {
@@ -241,32 +374,67 @@ describe('WorkerCodeRuntime — budgets and containment (real workers)', () => {
     expect(result.logs).toContain('flushed')
   })
 
-  it('caps a huge container whose bounded rendering is small (wire size, not rendering, is what counts)', async () => {
+  it('returns a large JSON container exactly when the outer cap permits it', async () => {
     const { runtime } = await setup()
     const result = await runtime.run({ program: 'return new Array(50_000).fill(7)', bindings: [] })
     expect(result.error).toBeUndefined()
-    expect(typeof result.value).toBe('string')
-    expect(result.value).toContain('more items')
+    expect(result.value).toEqual(new Array(50_000).fill(7))
   })
 
-  it('captures pipe writes that bypass the patched write slot as stray logs, capped by the same budget', async () => {
-    const { runtime } = await setup({ maxLogBytes: 4 })
+  it('returns an exact completion at the default 64 MiB combined boundary', async () => {
+    const { runtime } = await setup()
+    // [] costs two bytes and the JSON string contributes two quotes, leaving
+    // exactly this many payload bytes under the 67_108_864-byte default.
+    const result = await runtime.run({ program: 'return "x".repeat(67_108_860)', bindings: [] })
+    expect(result.error).toBeUndefined()
+    expect(result.logs).toEqual([])
+    expect(result.value).toHaveLength(67_108_860)
+  }, 60_000)
+
+  it('fails one byte over the default 64 MiB combined boundary', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({ program: 'return "x".repeat(67_108_861)', bindings: [] })
+    expect(result.value).toBeUndefined()
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 67108864 bytes' })
+  }, 60_000)
+
+  it('accounts pipe writes that bypass the patched write slot in the same outer ledger', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 80 })
     const result = await runtime.run({
       // The prototype write bypasses the patched instance and reaches the real pipe. Pauses keep
       // writes in separate chunks and let both reach the host before settlement.
       program: `
         const write = (text) => Object.getPrototypeOf(process.stdout).write.call(process.stdout, text);
-        write('abcd');
+        write('a'.repeat(20));
         await new Promise(resolve => setTimeout(resolve, 150));
-        write('ef');
+        write('b'.repeat(100));
         await new Promise(resolve => setTimeout(resolve, 100));
         return 1;
       `,
       bindings: [],
     })
+    expect(result.error?.kind).toBe('output-limit')
+    expect(result.logs).toContain('a'.repeat(20))
+    expect(result.logs[1]?.length).toBeGreaterThan(0)
+    expect('b'.repeat(100).startsWith(result.logs[1] ?? '')).toBe(true)
+  }, 15_000)
+
+  it('drains pipe output queued before terminal worker teardown completes', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 200_000 })
+    const payload = `late-pipe-${'x'.repeat(100_000)}`
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        const write = (text) => Object.getPrototypeOf(process.stdout).write.call(process.stdout, text);
+        write('late-pipe-' + 'x'.repeat(100_000));
+        parentPort.postMessage({ type: 'done', value: ['done'] });
+        for (;;) {}
+      `,
+      bindings: [],
+    })
     expect(result.error).toBeUndefined()
-    expect(result.logs).toContain('abcd')
-    expect(result.logs).not.toContain('ef')
+    expect(result.value).toBe('done')
+    expect(result.logs.join('') === payload).toBe(true)
   }, 15_000)
 })
 
@@ -305,7 +473,8 @@ describe('WorkerCodeRuntime — hostile programs (real workers)', () => {
           { type: 'log', text: 7 },
           { type: 'log', text: {} },
           { type: 'done', error: 5 },
-          { type: 'done', error: { message: 5 } },
+          { type: 'done', error: { kind: 'exception', message: 5 } },
+          { type: 'done', error: { kind: 'invented', message: 'bad kind' } },
         ]) parentPort.postMessage(junk);
         return await tools.real({});
       `,
@@ -316,67 +485,288 @@ describe('WorkerCodeRuntime — hostile programs (real workers)', () => {
     expect(result.logs).toEqual([])
   })
 
-  it('caps forged log floods and forged done values at the configured budgets, dropping forged extra fields', async () => {
-    const { runtime } = await setup({ maxLogBytes: 200, maxValueBytes: 64 })
+  it('fails forged log floods and forged done values through the same outer cap', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 200 })
     const result = await runtime.run({
-      // Forged messages bypass the worker-side LogBuffer and prepareValue
+      // Forged messages bypass the worker-side LogBuffer and completion check
       // entirely — only the host-side ledger and re-cap stand between model
       // code and an unbounded result.
       program: `
         const { parentPort } = await import('node:worker_threads');
         for (let i = 0; i < 50; i++) parentPort.postMessage({ type: 'log', text: 'F'.repeat(100), forged: true });
-        parentPort.postMessage({ type: 'done', value: 'V'.repeat(100000) });
+        parentPort.postMessage({ type: 'done', value: ['V'.repeat(100000)] });
         for (;;) {}
       `,
       bindings: [],
     })
-    expect(typeof result.value).toBe('string')
-    const value = result.value as string
-    expect(value.startsWith('V'.repeat(64))).toBe(true)
-    expect(value.endsWith('… [truncated]')).toBe(true)
-    expect(value.length).toBeLessThan(120)
-    const marker = '[dsh-code-runtime-worker] log capture truncated at 200 bytes'
-    const total = result.logs.reduce((sum, text) => sum + Buffer.byteLength(text, 'utf8'), 0)
-    expect(total).toBeLessThanOrEqual(200 + Buffer.byteLength(marker, 'utf8'))
-    expect(result.logs.at(-1)).toBe(marker)
+    expect(result.value).toBeUndefined()
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 200 bytes' })
+    expect(Buffer.byteLength(JSON.stringify(result.logs), 'utf8')).toBeLessThan(200)
   })
 
-  it('accepts a forged done carrying both value and error (self-sabotage, contained)', async () => {
+  it('re-caps an oversized forged done value at the host boundary', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 64 })
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        parentPort.postMessage({ type: 'done', value: ['V'.repeat(100_000)] });
+        for (;;) {}
+      `,
+      bindings: [],
+    })
+    expect(result).toEqual({
+      logs: [],
+      error: { kind: 'output-limit', message: 'outer output exceeded 64 bytes' },
+    })
+  })
+
+  it('bounds one oversized forged log while retaining its fitting escaped prefix', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 96 })
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        parentPort.postMessage({ type: 'log', text: '"'.repeat(1_000_000) });
+        for (;;) {}
+      `,
+      bindings: [],
+    })
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 96 bytes' })
+    expect(result.logs).toHaveLength(1)
+    expect(result.logs[0]).toMatch(/^"+$/)
+    expect(Buffer.byteLength(JSON.stringify(result.logs), 'utf8') + Buffer.byteLength(JSON.stringify('outer output exceeded 96 bytes'), 'utf8')).toBeLessThanOrEqual(96)
+  })
+
+  it('drops a malformed forged done carrying both value and error', async () => {
     const { runtime } = await setup()
     const result = await runtime.run({
       program: `
         const { parentPort } = await import('node:worker_threads');
-        parentPort.postMessage({ type: 'done', value: 'lied', error: { message: 'fake failure' } });
-        for (;;) {}
+        parentPort.postMessage({ type: 'done', value: 'lied', error: { kind: 'exception', message: 'fake failure' } });
+        return 'honest';
       `,
       bindings: [],
     })
-    expect(result.value).toBe('lied')
-    expect(result.error).toEqual({ kind: 'exception', message: 'fake failure' })
+    expect(result).toEqual({ logs: [], error: { kind: 'exception', message: 'fake failure' } })
   })
 
-  it('byte-bounds forged multibyte error text at the host', async () => {
-    // Forged error text bypasses the worker entirely; the host bound is a
-    // BYTE bound (two € = 6 bytes fit an 8-byte cap, a third would not).
-    const { runtime } = await setup({ maxValueBytes: 8 })
+  it('contains a deeply nested forged completion without overflowing the host meter', async () => {
+    const { runtime } = await setup()
     const result = await runtime.run({
       program: `
         const { parentPort } = await import('node:worker_threads');
-        parentPort.postMessage({ type: 'done', error: { message: '€'.repeat(1000) } });
+        const value = [];
+        for (let depth = 0; depth < 3_000; depth++) value.push({ kind: 'array', length: 1 });
+        value.push(null);
+        setTimeout(() => { parentPort.postMessage({ type: 'done', value }) }, 25);
+        // Prevent bootstrap's normal undefined completion from racing the forged terminal.
+        await new Promise(() => {});
+      `,
+      bindings: [],
+    })
+    expect(result.error).toBeUndefined()
+    let value = result.value
+    let depth = 0
+    while (Array.isArray(value)) {
+      expect(value).toHaveLength(1)
+      value = value[0]
+      depth += 1
+    }
+    expect(depth).toBe(3_000)
+    expect(value).toBeNull()
+  }, 15_000)
+
+  it('turns forged over-limit error text into output-limit at the host', async () => {
+    const { runtime } = await setup({ maxOutputBytes: 64 })
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        parentPort.postMessage({ type: 'done', error: { kind: 'exception', message: '€'.repeat(1000) } });
         for (;;) {}
       `,
       bindings: [],
     })
-    expect(result.error).toEqual({ kind: 'exception', message: '€€' })
+    expect(result.error).toEqual({ kind: 'output-limit', message: 'outer output exceeded 64 bytes' })
   })
 
-  it('answers a binding whose resolution cannot be cloned with a failure reply', async () => {
+  it('answers a binding whose resolution is not lossless JSON with a typed failure reply', async () => {
     const { runtime } = await setup()
     const result = await runtime.run({
-      program: 'try { await tools.bad({}) } catch (error) { return error.message }',
+      program: 'try { await tools.bad({}) } catch (error) { return { name: error.name, toolName: error.toolName, message: error.message } }',
       bindings: tools({ bad: async () => (() => 1) }),
     })
-    expect(result.value).toContain('not structured-cloneable')
+    expect(result.value).toEqual({ name: 'ToolCallError', toolName: 'bad', message: 'binding resolution must be lossless JSON' })
+  })
+
+  it('rejects lossy binding arguments in the worker before invoking the host binding', async () => {
+    const { runtime } = await setup()
+    let calls = 0
+    const result = await runtime.run({
+      program: `
+        const decorated = [1]; Object.defineProperty(decorated, 'extra', { value: true });
+        const values = [new Date(), decorated, () => 1];
+        const failures = [];
+        for (const value of values) {
+          try { await tools.never(value) } catch (error) {
+            failures.push({ typed: error instanceof ToolCallError, name: error.name, toolName: error.toolName, message: error.message });
+          }
+        }
+        return failures;
+      `,
+      bindings: tools({ never: async () => { calls += 1; return null } }),
+    })
+    expect(calls).toBe(0)
+    expect(result.value).toEqual(new Array(3).fill({
+      typed: true,
+      name: 'ToolCallError',
+      toolName: 'never',
+      message: 'binding arguments must be lossless JSON',
+    }))
+  })
+
+  it('rejects intrinsic-looking exotic objects as arguments and completions', async () => {
+    const { runtime } = await setup()
+    let calls = 0
+    const forgeObject = `
+      const prototype = Object.create(null);
+      const SpoofedObject = function Object() {};
+      SpoofedObject.prototype = prototype;
+      Object.defineProperty(prototype, 'constructor', { value: SpoofedObject });
+      const forged = Object.assign(Object.create(prototype), { value: 1 });
+      Function.prototype.toString = () => 'function Object() { [native code] }';
+    `
+    const argument = await runtime.run({
+      program: `${forgeObject}
+        try { await tools.never(forged) } catch (error) {
+          return { typed: error instanceof ToolCallError, name: error.name, toolName: error.toolName, message: error.message };
+        }
+      `,
+      bindings: tools({ never: async () => { calls += 1; return null } }),
+    })
+    expect(calls).toBe(0)
+    expect(argument.value).toEqual({
+      typed: true,
+      name: 'ToolCallError',
+      toolName: 'never',
+      message: 'binding arguments must be lossless JSON',
+    })
+
+    const completion = await runtime.run({ program: `${forgeObject}\nreturn forged`, bindings: [] })
+    expect(completion).toEqual({
+      logs: [],
+      error: { kind: 'invalid-output', message: 'program completion must be lossless JSON' },
+    })
+  })
+
+  it('preserves binding and completion JSON after model code mutates boundary globals', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: `
+        const arrayPrototype = Array.prototype;
+        const objectPrototype = Object.prototype;
+        const setPrototype = Set.prototype;
+        const stringPrototype = String.prototype;
+        Array.isArray = () => false;
+        arrayPrototype.at = arrayPrototype.includes = arrayPrototype.pop = arrayPrototype.push = () => { throw new Error('mutated array method') };
+        Object.defineProperty = Object.getOwnPropertyDescriptor = Object.getPrototypeOf = Object.keys = () => { throw new Error('mutated object method') };
+        Object.hasOwn = () => false;
+        Object.is = () => true;
+        objectPrototype.propertyIsEnumerable = () => false;
+        Number.isFinite = Number.isSafeInteger = () => false;
+        Reflect.apply = Reflect.ownKeys = () => { throw new Error('mutated reflect method') };
+        setPrototype.add = setPrototype.delete = setPrototype.has = () => { throw new Error('mutated set method') };
+        stringPrototype.charCodeAt = stringPrototype.codePointAt = stringPrototype.slice = () => { throw new Error('mutated string method') };
+        Buffer.byteLength = () => 0;
+        Function.prototype.toString = () => 'mutated';
+        objectPrototype.get = () => undefined;
+        objectPrototype.constructor = arrayPrototype.constructor = null;
+        globalThis.Array = globalThis.Buffer = globalThis.Error = globalThis.Function = globalThis.Number = globalThis.Object = globalThis.Reflect = globalThis.Set = globalThis.String = undefined;
+        const echoed = await tools.echo({ request: ['€', 1] });
+        let failure;
+        try { await tools.fail({}) } catch (error) {
+          failure = { typed: error instanceof ToolCallError, name: error.name, toolName: error.toolName, message: error.message };
+        }
+        return { echoed, failure, completion: { ok: true, amount: 42 } };
+      `,
+      bindings: tools({ echo: async args => args, fail: async () => { throw new Error('nope') } }),
+    })
+    expect(result).toEqual({
+      logs: [],
+      value: {
+        echoed: { request: ['€', 1] },
+        failure: { typed: true, name: 'ToolCallError', toolName: 'fail', message: 'nope' },
+        completion: { ok: true, amount: 42 },
+      },
+    })
+  })
+
+  it('rejects forged lossy binding arguments again at the host boundary', async () => {
+    const { runtime } = await setup()
+    let calls = 0
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        const forged = (id, args) => new Promise((resolve) => {
+          const receive = (message) => {
+            if (message?.type !== 'reply' || message.id !== id) return;
+            parentPort.off('message', receive);
+            resolve(message);
+          };
+          parentPort.on('message', receive);
+          parentPort.postMessage({ type: 'call', id, global: 'tools', name: 'never', args });
+        });
+        const sparse = []; sparse.length = 1;
+        const cycle = {}; cycle.self = cycle;
+        return await Promise.all([
+          forged(8001, new Date()),
+          forged(8002, -0),
+          forged(8003, sparse),
+          forged(8004, cycle),
+        ]);
+      `,
+      bindings: tools({ never: async () => { calls += 1; return null } }),
+    })
+    expect(calls).toBe(0)
+    expect(result.value).toEqual([8001, 8002, 8003, 8004].map(id => ({
+      type: 'reply',
+      id,
+      ok: false,
+      message: 'binding arguments must be lossless JSON',
+    })))
+  })
+
+  it('contains throwing getters while snapshotting binding resolutions', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: 'try { await tools.bad({}) } catch (error) { return { name: error.name, toolName: error.toolName, message: error.message } }',
+      bindings: tools({ bad: async () => Object.defineProperty({}, 'bad', { enumerable: true, get() { throw new Error('getter exploded') } }) }),
+    })
+    expect(result.value).toEqual({ name: 'ToolCallError', toolName: 'bad', message: 'binding resolution must be lossless JSON' })
+  })
+
+  it('revalidates a forged lossy completion at the host boundary', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        parentPort.postMessage({ type: 'done', value: -0 });
+        for (;;) {}
+      `,
+      bindings: [],
+    })
+    expect(result).toEqual({ logs: [], error: { kind: 'invalid-output', message: 'program completion must be lossless JSON' } })
+  })
+
+  it('honors a forged worker-side output-limit signal', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: `
+        const { parentPort } = await import('node:worker_threads');
+        parentPort.postMessage({ type: 'output-limit' });
+        for (;;) {}
+      `,
+      bindings: [],
+    })
+    expect(result).toEqual({ logs: [], error: { kind: 'output-limit', message: 'outer output exceeded 67108864 bytes' } })
   })
 
   it('exposes binding names that collide with Object.prototype as ordinary functions', async () => {
@@ -392,7 +782,7 @@ describe('WorkerCodeRuntime — hostile programs (real workers)', () => {
 })
 
 describe('WorkerCodeRuntime — seam misuse and lifecycle', () => {
-  it('rejects invalid binding globals loudly (identifier, reserved word, duplicate, console)', async () => {
+  it('rejects invalid and duplicate binding globals loudly', async () => {
     const { runtime } = await setup()
     const cases: [string, RegExp][] = [
       ['not valid!', /not a usable identifier/],
@@ -406,6 +796,32 @@ describe('WorkerCodeRuntime — seam misuse and lifecycle', () => {
       program: 'return 1',
       bindings: [{ global: 'tools', functions: {} }, { global: 'tools', functions: {} }],
     })).rejects.toThrow(/duplicate binding global/)
+
+    await expect(runtime.run({
+      program: 'return typeof ToolCallError',
+      bindings: [{ global: 'ToolCallError', functions: {} }],
+    })).resolves.toMatchObject({ value: 'object' })
+  })
+
+  it('rejects malformed or colliding binding error-class declarations', async () => {
+    const { runtime } = await setup()
+    const run = async (bindings: CodeBindingNamespace[]) => await runtime.run({ program: 'return 1', bindings })
+    const namespace = (global: string, name: string, memberNameProperty = 'memberName'): CodeBindingNamespace => ({
+      global,
+      functions: {},
+      errorClass: { name, memberNameProperty },
+    })
+
+    await expect(run([namespace('tools', 'not valid!')])).rejects.toThrow(/error class.*not a usable identifier/)
+    await expect(run([namespace('tools', 'await')])).rejects.toThrow(/error class.*not a usable identifier/)
+    await expect(run([namespace('tools', 'console')])).rejects.toThrow(/duplicate injected global/)
+    await expect(run([namespace('tools', 'tools')])).rejects.toThrow(/duplicate injected global/)
+    await expect(run([
+      namespace('tools', 'CallError'),
+      namespace('helpers', 'CallError'),
+    ])).rejects.toThrow(/duplicate injected global/)
+    await expect(run([namespace('tools', 'CallError', '')])).rejects.toThrow(/member property.*not usable/)
+    await expect(run([namespace('tools', 'CallError', 'message')])).rejects.toThrow(/member property.*not usable/)
   })
 
   it('rejects config values that are not positive numbers', async () => {
@@ -413,6 +829,12 @@ describe('WorkerCodeRuntime — seam misuse and lifecycle', () => {
     await expect(ctx.plugin(WorkerCodeRuntime, { computeMs: -1 })).rejects.toThrow(/positive number/)
   })
 
+  it('requires maxOutputBytes to fit the smallest counted outer payloads', async () => {
+    const ctx = new Context()
+    await expect(ctx.plugin(WorkerCodeRuntime, { maxOutputBytes: 3 })).rejects.toThrow(/safe integer of at least 4/)
+    await expect(ctx.plugin(WorkerCodeRuntime, { maxOutputBytes: 4.5 })).rejects.toThrow(/safe integer of at least 4/)
+  })
+
   it('keeps runs isolated: no state survives from one run to the next', async () => {
     const { runtime } = await setup()
     await runtime.run({ program: 'globalThis.leak = "value"; return 1', bindings: [] })

packages/code-runtime/code-runtime-worker/tests/source-worker.compat.spec.ts

@@ -0,0 +1,39 @@
+import { copyFile, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { expect, it } from 'vitest'
+import { decodeWorkerJson } from '../src/worker-json.ts'
+
+/**
+ * Prove the unbuilt worker is a self-contained source closure. Copying it out
+ * of the workspace makes any package runtime import fail even when local
+ * `lib/` artifacts happen to exist.
+ */
+it('boots the source worker without workspace package outputs', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'dsh-code-source-worker-'))
+  let worker: Worker | undefined
+  try {
+    const files = ['worker.ts', 'bootstrap.ts', 'protocol.ts', 'worker-json.ts', 'output-json.ts']
+    await Promise.all(files.map(async (file) => {
+      await copyFile(new URL(`../src/${file}`, import.meta.url), join(directory, file))
+    }))
+
+    worker = new Worker(join(directory, 'worker.ts'), {
+      workerData: { code: 'return { answer: 42 }', namespaces: [], maxOutputBytes: 65_536 },
+      env: {},
+      execArgv: [],
+    })
+    const message = await new Promise<unknown>((resolve, reject) => {
+      worker?.once('message', resolve)
+      worker?.once('error', reject)
+    })
+
+    expect(message).toMatchObject({ type: 'done' })
+    const value = typeof message === 'object' && message !== null ? (message as { value?: unknown }).value : undefined
+    expect(decodeWorkerJson(value)).toEqual({ answer: 42 })
+  } finally {
+    if (worker) await worker.terminate()
+    await rm(directory, { recursive: true, force: true })
+  }
+})

packages/code-runtime/code-runtime-worker/tests/worker-json.spec.ts

@@ -0,0 +1,257 @@
+import { runInNewContext } from 'node:vm'
+import { describe, expect, it } from 'vitest'
+import { snapshotJsonValue } from '@deepseek-ai/dsh-session'
+import { decodeWorkerJson, encodeWorkerJson, snapshotCodeJsonValue } from '../src/worker-json.ts'
+
+describe('snapshotCodeJsonValue', () => {
+  it('matches the canonical scalar boundary', () => {
+    const unsupported = [undefined, 1n, Symbol('value'), () => 1]
+    for (const value of [null, false, 'text', 1.25, -0, Number.NaN, Number.POSITIVE_INFINITY, ...unsupported]) {
+      expect(snapshotCodeJsonValue(value)).toEqual(snapshotJsonValue(value))
+    }
+  })
+
+  it('detaches dense arrays and plain or null-prototype records', () => {
+    const shared = { value: 1 }
+    const nullPrototype = Object.assign(Object.create(null) as Record<string, unknown>, { shared })
+    const source = { list: [nullPrototype, shared], alias: shared }
+
+    const snapshot = snapshotCodeJsonValue(source) as Record<string, unknown>
+    shared.value = 2
+
+    expect(snapshot).toEqual({ list: [{ shared: { value: 1 } }, { value: 1 }], alias: { value: 1 } })
+    expect(snapshot).not.toBe(source)
+    expect((snapshot.list as unknown[])[0]).not.toBe(nullPrototype)
+    expect(snapshot.alias).not.toBe(shared)
+  })
+
+  it('accepts intrinsic plain containers from another JavaScript realm', () => {
+    const foreign = runInNewContext('({ object: { nested: [1] }, array: [2, { ok: true }] })') as {
+      object: unknown
+      array: unknown
+    }
+
+    expect(snapshotCodeJsonValue(foreign.object)).toEqual({ nested: [1] })
+    expect(snapshotCodeJsonValue(foreign.array)).toEqual([2, { ok: true }])
+  })
+
+  it('reads each accepted slot once and preserves a literal __proto__ key', () => {
+    let objectReads = 0
+    let arrayReads = 0
+    const source = Object.create(null) as Record<string, unknown>
+    Object.defineProperty(source, '__proto__', {
+      enumerable: true,
+      get: () => {
+        objectReads += 1
+        return { safe: true }
+      },
+    })
+    const array = new Array<unknown>(1)
+    Object.defineProperty(array, 0, {
+      enumerable: true,
+      get: () => {
+        arrayReads += 1
+        return arrayReads === 1 ? source : undefined
+      },
+    })
+
+    const snapshot = snapshotCodeJsonValue(array) as Record<string, unknown>[]
+
+    expect(objectReads).toBe(1)
+    expect(arrayReads).toBe(1)
+    expect(Object.getPrototypeOf(snapshot[0])).toBe(Object.prototype)
+    expect(Object.hasOwn(snapshot[0]!, '__proto__')).toBe(true)
+    expect(snapshot[0]?.['__proto__']).toEqual({ safe: true })
+  })
+
+  it('accepts deeply nested valid JSON without using the JavaScript call stack', () => {
+    let value: unknown = 'leaf'
+    for (let depth = 0; depth < 5_000; depth++) value = [value]
+
+    let cursor = snapshotCodeJsonValue(value)
+    for (let depth = 0; depth < 5_000; depth++) {
+      expect(Array.isArray(cursor)).toBe(true)
+      cursor = Array.isArray(cursor) ? cursor[0] : undefined
+    }
+    expect(cursor).toBe('leaf')
+  })
+
+  it('rejects exotic containers, sparse arrays, cycles, and invalid children', () => {
+    class ExoticObject {
+      readonly value = 1
+    }
+    class ExoticArray extends Array<number> {}
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+    const decorated = [1]
+    Object.defineProperty(decorated, 'extra', { value: true })
+    const compensatedSparse = new Array(1)
+    Object.defineProperty(compensatedSparse, 'extra', { value: true })
+    const symbolDecorated = [1]
+    Object.defineProperty(symbolDecorated, Symbol('extra'), { value: true })
+    const hiddenObject = Object.defineProperty({}, 'hidden', { value: true })
+    const symbolObject = { [Symbol('extra')]: true }
+    const customPrototype = Object.create(null) as Record<string, unknown>
+    const customPrototypeObject = Object.assign(Object.create(customPrototype) as Record<string, unknown>, { value: 1 })
+    const forgedPrototype: unknown[] = []
+    Object.setPrototypeOf(forgedPrototype, null)
+    const forgedArray = [1]
+    Object.setPrototypeOf(forgedArray, forgedPrototype)
+    const spoofedObjectPrototype = Object.create(null) as Record<string, unknown>
+    const SpoofedObject = function Object() {}
+    SpoofedObject.prototype = spoofedObjectPrototype
+    Object.defineProperty(spoofedObjectPrototype, 'constructor', { value: SpoofedObject })
+    const spoofedObject = Object.create(spoofedObjectPrototype) as Record<string, unknown>
+    spoofedObject.value = 1
+    const revokedPrototype = Object.create(null) as Record<string, unknown>
+    const RevokedObject = function Object() {}
+    RevokedObject.prototype = revokedPrototype
+    const revokedConstructor = Proxy.revocable(RevokedObject, {})
+    Object.defineProperty(revokedPrototype, 'constructor', { value: revokedConstructor.proxy })
+    const revokedObject = Object.create(revokedPrototype) as Record<string, unknown>
+    revokedConstructor.revoke()
+    const spoofedArrayPrototype: unknown[] = []
+    Object.setPrototypeOf(spoofedArrayPrototype, Object.prototype)
+    const SpoofedArray = function Array() {}
+    SpoofedArray.prototype = spoofedArrayPrototype
+    Object.defineProperty(spoofedArrayPrototype, 'constructor', { value: SpoofedArray })
+    const spoofedArray = [1]
+    Object.setPrototypeOf(spoofedArray, spoofedArrayPrototype)
+
+    for (const value of [
+      new ExoticObject(),
+      new Map([['value', 1]]),
+      new ExoticArray(1),
+      new Array(1),
+      decorated,
+      compensatedSparse,
+      symbolDecorated,
+      hiddenObject,
+      symbolObject,
+      customPrototypeObject,
+      forgedArray,
+      spoofedObject,
+      revokedObject,
+      spoofedArray,
+      cyclic,
+      [undefined],
+      { value: undefined },
+    ]) {
+      const canonical = snapshotJsonValue(value)
+      expect(canonical).toBeUndefined()
+      expect(snapshotCodeJsonValue(value)).toEqual(canonical)
+    }
+  })
+
+  it('rejects an array whose getter mutates the validated length', () => {
+    const array = [0, 2]
+    Object.defineProperty(array, 0, {
+      enumerable: true,
+      get: () => {
+        array.length = 1
+        return 1
+      },
+    })
+
+    expect(snapshotCodeJsonValue(array)).toBeUndefined()
+  })
+
+  it('propagates a throwing getter and releases its recursion guard', () => {
+    const failure = new Error('getter failed')
+    const source = Object.defineProperty({}, 'value', {
+      enumerable: true,
+      get: () => { throw failure },
+    })
+
+    expect(() => snapshotCodeJsonValue(source)).toThrow(failure)
+    expect(snapshotCodeJsonValue({ after: true })).toEqual({ after: true })
+  })
+})
+
+describe('flat worker JSON wire', () => {
+  it('round-trips every JSON root while preserving object keys and container order', () => {
+    const withPrototypeKey = Object.create(null) as Record<string, unknown>
+    withPrototypeKey.__proto__ = { safe: true }
+    const values = [null, false, true, 1.25, 'text', [], {}, [1, { nested: [2] }], withPrototypeKey]
+    for (const value of values) {
+      const snapshot = snapshotCodeJsonValue(value)
+      expect(snapshot).not.toBeUndefined()
+      expect(decodeWorkerJson(encodeWorkerJson(snapshot!))).toEqual(snapshot)
+    }
+    const decoded = decodeWorkerJson(encodeWorkerJson(snapshotCodeJsonValue(withPrototypeKey)!)) as Record<string, unknown>
+    expect(Object.hasOwn(decoded, '__proto__')).toBe(true)
+    expect(decoded.__proto__).toEqual({ safe: true })
+  })
+
+  it('round-trips deep values through a bounded-depth token array', () => {
+    let value: unknown = 'leaf'
+    for (let depth = 0; depth < 5_000; depth++) value = [value]
+    const snapshot = snapshotCodeJsonValue(value)!
+    const wire = encodeWorkerJson(snapshot)
+    expect(wire).toHaveLength(5_001)
+
+    let cursor = decodeWorkerJson(wire)
+    for (let depth = 0; depth < 5_000; depth++) {
+      expect(Array.isArray(cursor)).toBe(true)
+      cursor = Array.isArray(cursor) ? cursor[0] : undefined
+    }
+    expect(cursor).toBe('leaf')
+  })
+
+  it('rejects malformed, incomplete, lossy, sparse, decorated, and throwing wire values', () => {
+    const sparse = new Array(1)
+    const compensatedSparse = new Array(1)
+    Object.defineProperty(compensatedSparse, 'extra', { value: true })
+    const decorated: unknown[] = [null]
+    Object.defineProperty(decorated, 'extra', { value: true })
+    const throwing: unknown[] = []
+    Object.defineProperty(throwing, 0, { enumerable: true, get: () => { throw new Error('wire getter') } })
+    const decoratedKeys: unknown[] = ['x']
+    Object.defineProperty(decoratedKeys, 'extra', { value: true })
+    const foreignMarker: Record<string, unknown> = { kind: 'array', length: 0 }
+    Object.setPrototypeOf(foreignMarker, {})
+    const hiddenMarker = Object.defineProperty({ kind: 'array', length: 0 }, 'hidden', { value: true })
+
+    for (const value of [
+      undefined,
+      null,
+      {},
+      [],
+      sparse,
+      compensatedSparse,
+      decorated,
+      throwing,
+      [undefined],
+      [-0],
+      [Number.NaN],
+      [Number.POSITIVE_INFINITY],
+      [1, 2],
+      [[]],
+      [foreignMarker],
+      [hiddenMarker],
+      [{ kind: 'unknown' }],
+      [{ kind: 'array', bogus: 0 }],
+      [{ kind: 'array' }],
+      [{ kind: 'array', length: '1' }],
+      [{ kind: 'array', length: -1 }],
+      [{ kind: 'array', length: Number.MAX_SAFE_INTEGER + 1 }],
+      [{ kind: 'array', length: 1 }],
+      [{ kind: 'array', length: 2 }, { kind: 'array', length: 1 }, null],
+      [{ kind: 'array', length: 0, extra: true }],
+      [{ kind: 'object' }],
+      [{ kind: 'object', keys: 'x' }],
+      [{ kind: 'object', keys: decoratedKeys }],
+      [{ kind: 'object', keys: [1] }],
+      [{ kind: 'object', keys: ['x', 'x'] }, 1, 2],
+      [{ kind: 'object', keys: ['x'] }],
+      [{ kind: 'object', keys: [], extra: true }],
+    ]) {
+      expect(decodeWorkerJson(value)).toBeUndefined()
+    }
+  })
+
+  it('rejects invalid values passed through a forged static type', () => {
+    expect(() => encodeWorkerJson([undefined] as never)).toThrow(/sparse JSON array/)
+    expect(() => encodeWorkerJson({ value: undefined } as never)).toThrow(/undefined JSON object property/)
+  })
+})

packages/code-runtime/code-runtime-worker/tsconfig.json

@@ -8,6 +8,9 @@
     "src"
   ],
   "references": [
+    {
+      "path": "../../core/session"
+    },
     {
       "path": "../../../vendor/cosmokit"
     },

packages/code-runtime/code-runtime/README.md

@@ -8,15 +8,15 @@ This package is the interface third of the capability (the bash trio is the temp
 
 | Member | Semantics |
 |---|---|
-| `run(request)` | Execute one program against the request's bindings. **Resolves with an error FIELD for every program outcome** — parse/transform failure, thrown exception, budget expiry, abort, substrate death (`CodeRunFailure`'s orthogonal `kind` taxonomy); it rejects only for caller misuse of the seam itself (e.g. a run submitted after disposal). The program runs as the body of an async function: top-level `await`/`return` work, and the completion value becomes `result.value` when it survives the serialization boundary. |
+| `run(request)` | Execute one program against the request's bindings. **Resolves with an error FIELD for every program outcome** — parse/transform failure, thrown exception, invalid completion, output overflow, budget expiry, abort, or substrate death (`CodeRunFailure`'s orthogonal `kind` taxonomy); it rejects only for caller misuse of the seam itself (e.g. a run submitted after disposal). The program runs as the body of an async function: top-level `await`/`return` work, and a lossless JSON completion becomes `result.value`. |
 | `language` | Readonly descriptor: the source language `run` expects (`'typescript'` is the well-known value). Informational, not gating — a consumer that generates language-specific presentation switches on it and fails loud on a language it cannot present. |
 | `isolation` | Readonly descriptor: the execution substrate (`'worker-thread'`, `'process'`, `'container'`). A label for deployments and diagnostics, **not a security claim**. |
 
-Semantics every implementation must honor (contract details in the class JSDoc): binding calls bridge to the caller's functions verbatim with structured-cloneable arguments/resolutions; the program is treated as a hostile peer (arbitrary binding names are own properties, malformed traffic never crashes the host); no state survives between runs; disposal terminates in-flight runs AND awaits their exit before completing.
+Semantics every implementation must honor (contract details in the class JSDoc): binding calls bridge complete lossless-JSON arguments and resolutions with no seam-level byte cap; the program is treated as a hostile peer (arbitrary binding names are own properties, malformed traffic never crashes the host); no state survives between runs; disposal terminates in-flight runs AND awaits their exit before completing.
 
 ## Vocabulary
 
-`CodeRunRequest` (`program`, `bindings`, `signal?`) carries everything the runtime acts on — defaulting (time budgets, output caps) is the implementation's validated config, never a hidden `??` inside `run()`. `bindings` is a list of `CodeBindingNamespace`s (`global` + `functions`), each exposed to the program as one global object of async callables. `CodeRunResult` reports the completion `value?`, ordered capped `logs: string[]`, and the `error?` (`CodeRunFailure`: `kind` + model-feedable `message`). See `src/types.ts` for the full contracts.
+`CodeRunRequest` (`program`, `bindings`, `signal?`) carries everything the runtime acts on — defaulting (time budgets and outer-output cap) is the implementation's validated config, never a hidden `??` inside `run()`. `bindings` is a list of `CodeBindingNamespace`s (`global` + `functions` + optional `errorClass`), each exposed to the program as one global object of async callables returning `CodeJsonValue`, the seam-local structural equivalent of canonical `JsonValue` that keeps this interface package independent of sessions. An `errorClass` descriptor names a real program-global constructor and the own property that receives the rejected member name; runtimes remain independent of consumer terms such as `ToolCallError`. `CodeRunResult` reports the lossless JSON completion `value?`, ordered `logs: string[]`, and the `error?` (`CodeRunFailure`: `kind` + model-feedable `message`). See `src/types.ts` for the full contracts.
 
 ## Model Experience
 
@@ -31,3 +31,4 @@ No direct invalidation; the named consumer owns any request-prefix changes.
 - **`run()` is one-shot** — `logs` arrive only on the resolved `CodeRunResult`; the seam exposes no streaming-log or progress surface for a live program's output.
 - **A persistent REPL-style kernel is recorded future work** — the no-state-between-runs contract stands until a persistent-kernel backend brings its own logging story ([Code Mode Agent Note](../../../.agents/notes/implemented/feature/2026-06-15-code-mode.md)).
 - **Only the worker-thread backend ships** — `'process'`/`'container'` are declared well-known `isolation` values with no implementation; a hard security boundary awaits a container backend.
+- **Intermediate binding values have no byte cap** — implementations remain subject to structured-clone cost and process memory, while a provider or executor may already have imposed its own acquisition bound.

packages/code-runtime/code-runtime/src/index.ts

@@ -8,8 +8,10 @@ import { Context, Service } from 'cordis'
 import type { CodeRunRequest, CodeRunResult } from './types.ts'
 
 export type {
+  CodeBindingErrorClass,
   CodeBindingFunction,
   CodeBindingNamespace,
+  CodeJsonValue,
   CodeRunFailure,
   CodeRunRequest,
   CodeRunResult,
@@ -24,8 +26,9 @@ declare module 'cordis' {
 /**
  * Registers one `ctx.codeRuntime` implementation. Program, budget, abort, and substrate
  * failures resolve in {@link CodeRunResult}; only seam misuse rejects. Implementations bridge
- * structured-cloneable bindings while treating programs as hostile peers, isolate runs from
- * one another, and terminate and await in-flight runs during disposal.
+ * structured-cloneable bindings, materialize each declared namespace rejection
+ * class, treat programs as hostile peers, isolate runs from one another, and
+ * terminate and await in-flight runs during disposal.
  */
 export abstract class CodeRuntime extends Service {
   /**

packages/code-runtime/code-runtime/src/types.ts

@@ -9,12 +9,30 @@
 /**
  * One host-side function exposed to the program as an async callable. The
  * runtime bridges calls to it (possibly across a serialization boundary), so
- * `args` and the resolution value MUST be structured-cloneable; a runtime
- * rejects a non-cloneable value with a descriptive error rather than
- * corrupting the run. A rejection of this function surfaces inside the
- * program as a rejection of the corresponding call.
+ * `args` and the resolution value MUST be lossless JSON. A runtime rejects a
+ * lossy or non-cloneable value with a descriptive error rather than corrupting
+ * the run. No seam-level byte cap applies to a binding resolution. A rejection
+ * of this function surfaces inside the program as a rejection of the
+ * corresponding call.
  */
-export type CodeBindingFunction = (args: unknown) => Promise<unknown>
+export type CodeBindingFunction = (args: unknown) => Promise<CodeJsonValue>
+
+/** A lossless JSON value transferable across the dependency-light code-runtime seam. */
+export type CodeJsonValue = null | boolean | number | string | CodeJsonValue[] | { [key: string]: CodeJsonValue }
+
+/**
+ * Program-visible typed rejection for one binding namespace. The runtime
+ * injects a real error constructor under `name`; rejected member calls become
+ * its instances and expose the exact member name through
+ * `memberNameProperty`. Both strings are runtime data rather than knowledge
+ * of a particular consumer such as Code Mode.
+ */
+export interface CodeBindingErrorClass {
+  /** Constructor global and resulting `Error.name` (must be a usable JS identifier). */
+  name: string
+  /** Non-empty own property for the member name; cannot replace `name`, `message`, or `stack`. */
+  memberNameProperty: string
+}
 
 /**
  * A named group of {@link CodeBindingFunction}s the runtime exposes to the
@@ -28,6 +46,8 @@ export interface CodeBindingNamespace {
   global: string
   /** The callable members, keyed by the exact name the program calls. */
   functions: Record<string, CodeBindingFunction>
+  /** Optional program-visible typed rejection contract for this namespace. */
+  errorClass?: CodeBindingErrorClass
 }
 
 /**
@@ -63,10 +83,12 @@ export interface CodeRunRequest {
  * - `'timeout'` — an implementation-owned budget expired; the message says which.
  * - `'abort'` — {@link CodeRunRequest.signal} fired.
  * - `'worker-exit'` — the execution substrate died without settling (e.g. OOM).
+ * - `'invalid-output'` — the completion value was not lossless JSON.
+ * - `'output-limit'` — the serialized outer logs/value/diagnostic exceeded the configured cap.
  */
 export interface CodeRunFailure {
   /** The failure class (see the interface doc for each kind's meaning). */
-  kind: 'exception' | 'timeout' | 'abort' | 'worker-exit'
+  kind: 'exception' | 'timeout' | 'abort' | 'worker-exit' | 'invalid-output' | 'output-limit'
   /** Human-readable detail, suitable for feeding back to a model to self-correct. */
   message: string
 }
@@ -79,12 +101,12 @@ export interface CodeRunFailure {
 export interface CodeRunResult {
   /**
    * The program's completion value (its top-level `return`), when it ran to
-   * completion and the value survived the runtime's serialization boundary;
-   * a non-transferable value is replaced by a string rendering, and a failed
-   * or value-less run leaves this absent.
+   * completion and the value crossed the runtime's lossless-JSON boundary.
+   * Invalid or over-limit completions fail the run instead of substituting a
+   * rendered string; a failed or value-less run leaves this absent.
    */
-  value?: unknown
-  /** Text the program emitted, in order (capped by the implementation). */
+  value?: CodeJsonValue
+  /** Text the program emitted, in order, bounded only as part of the outer result. */
   logs: string[]
   /** Present iff the run failed; see {@link CodeRunFailure} for the taxonomy. */
   error?: CodeRunFailure

packages/code-runtime/code-runtime/tests/service.spec.ts

@@ -45,7 +45,7 @@ describe('CodeRuntime service seam', () => {
     const calls: unknown[] = []
     const result = await runtime.run({
       program: 'return 1',
-      bindings: [{ global: 'tools', functions: { probe: async args => void calls.push(args) } }],
+      bindings: [{ global: 'tools', functions: { probe: async (args) => { calls.push(args); return null } } }],
     })
     expect(result).toEqual({ logs: [] })
     expect(calls).toEqual([{ from: 'stub' }])

packages/compact/compact-basic/tests/compact-loop-repro.spec.ts

@@ -4,7 +4,7 @@ import { toolPairingBalancedAfter, toolPairingBalancedBefore } from '@deepseek-a
 import { CONTEXT_WINDOW_EXCEEDED_CODE, LlmError } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import { CallId, LlmAdapter } from '@deepseek-ai/dsh-llm'
-import { defineTool } from '@deepseek-ai/dsh-tools'
+import { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { mountAgentLoopTestDependencies } from '@deepseek-ai/dsh-agent-loop-testkit'
@@ -134,7 +134,7 @@ async function harness(toolSteps: number): Promise<{ ctx: Context; compact: Repr
   await ctx.plugin(AgentLoop, { agents: [] })
   await ctx.plugin(TokenMeterService)
   ctx.llm.registerAdapter(['mock'], new StepwiseToolAdapter(toolSteps))
-  ctx.tools.register(defineTool({
+  ctx.tools.register(defineContentToolFixture({
     name: 'work',
     description: 'does work',
     parameters: { i: { type: 'number' } },

packages/context/time-context/tests/time-context.spec.ts

@@ -5,7 +5,7 @@ import { CallId, LlmAdapter } from '@deepseek-ai/dsh-llm'
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import { Session, SessionId } from '@deepseek-ai/dsh-session'
 import AgentRegistry, { agentEvents, type Agent } from '@deepseek-ai/dsh-agent'
-import { defineTool } from '@deepseek-ai/dsh-tools'
+import { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { mountAgentLoopTestDependencies } from '@deepseek-ai/dsh-agent-loop-testkit'
 import * as timeContext from '@deepseek-ai/dsh-time-context'
@@ -386,7 +386,7 @@ describe('real agent-loop request history', () => {
   it('persists one ordered context per request, accumulates readings, and leaves system headers unchanged', async () => {
     const adapter = new ScriptedAdapter([toolCallResponse(), textResponse('done')])
     const ctx = await loopHarness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'tick',
       description: 'advance fake time',
       parameters: {},

packages/context/workspace-context/src/index.ts

@@ -129,8 +129,7 @@ export function apply(ctx: Context, config: Config): void {
     if (update === undefined) return downstream
     pendingVersionUpdates.set(exec.token, update.versionUpdates)
     return {
-      kind: 'accept',
-      ...downstream.content !== undefined ? { content: downstream.content } : {},
+      ...downstream,
       additionalContexts: [update.context, ...downstream.additionalContexts ?? []],
     }
   })

packages/context/workspace-context/tests/workspace-context.spec.ts

@@ -22,8 +22,11 @@ import type {
 } from '@deepseek-ai/dsh-fs'
 import LocalFileSystem from '@deepseek-ai/dsh-fs-local'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
-import type { ToolExecution, ToolExecutionToken } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
+import type {
+  ToolExecution,
+  ToolExecutionToken,
+} from '@deepseek-ai/dsh-tools'
 import * as ToolFs from '@deepseek-ai/dsh-tool-fs'
 import {
   discoverBaselineInstructionFiles,
@@ -864,6 +867,7 @@ describe('workspace context request injection', () => {
         agent: stubAgent('/virtual/repo'),
       }), {
         isError: false,
+        value: null,
         content: [{ type: 'text', text: 'file content' }],
       }, async () => ({
         kind: 'accept',
@@ -900,7 +904,8 @@ describe('workspace context request injection', () => {
         agent,
       })
       const result = {
-        isError: false,
+        isError: false as const,
+        value: null,
         content: [{ type: 'text' as const, text: 'hello' }],
       }
 
@@ -1699,7 +1704,7 @@ describe('dynamic nested workspace context injection', () => {
       await ctx.plugin(AgentLoop, { agents: [] })
       ctx.llm.registerAdapter(['mock'], adapter)
       const agent = ctx.agentLoop.create(SessionId('workspace-context-abort'), { provider: 'mock', model: 'mock' }, { cwd: root })
-      ctx.tools.register(defineTool({
+      ctx.tools.register(defineContentToolFixture({
         name: 'abort_step',
         description: 'Abort the current test step.',
         parameters: {},
@@ -1770,6 +1775,7 @@ describe('dynamic nested workspace context injection', () => {
       const pending = ctx.waterfall('tools/post-execute', exec, {
         content: [{ type: 'text', text: 'ok' }],
         isError: false,
+        value: null,
       }, () => Promise.resolve({ kind: 'accept' as const }))
 
       await expect(pending).rejects.toBe(reason)
@@ -2777,7 +2783,8 @@ describe('dynamic nested workspace context injection', () => {
       const result = {
         callId: CallId('provider-probe-result'),
         content: [{ type: 'text' as const, text: 'ok' }],
-        isError: false,
+        isError: false as const,
+        value: null,
       }
 
       const failedStat = await ctx.waterfall('tools/post-execute', stubToolExecution({
@@ -2837,7 +2844,7 @@ describe('dynamic nested workspace context injection', () => {
     }
   })
 
-  it('preserves nested and downstream post-execute contexts as separate entries', async () => {
+  it('preserves a downstream canonical value replacement and keeps contexts separate', async () => {
     const root = await tempRepo()
     const home = await tempRepo()
     try {
@@ -2848,7 +2855,12 @@ describe('dynamic nested workspace context injection', () => {
       await mountFileToolsAndWorkspaceContext(ctx, { dshHome: home, maxBytes: 65536 })
       ctx.on('tools/post-execute', async () => ({
         kind: 'accept' as const,
-        content: [{ type: 'text' as const, text: 'downstream replacement' }],
+        value: {
+          path: 'pkg/deep/file.txt',
+          offset: 1,
+          lines: [{ number: 1, text: 'downstream replacement' }],
+          totalLines: 1,
+        },
         additionalContexts: [{
           content: [{ type: 'text' as const, text: 'downstream context' }],
           source: { kind: 'plugin' as const, plugin: 'downstream' },
@@ -2863,7 +2875,15 @@ describe('dynamic nested workspace context injection', () => {
         agent: stubAgent(root),
       })
 
-      expect(blocksText(result.content)).toBe('downstream replacement')
+      expect(result.isError).toBe(false)
+      if (result.isError) throw new Error('expected read replacement success')
+      expect(result.value).toEqual({
+        path: 'pkg/deep/file.txt',
+        offset: 1,
+        lines: [{ number: 1, text: 'downstream replacement' }],
+        totalLines: 1,
+      })
+      expect(blocksText(result.content)).toContain('downstream replacement')
       expect(result.additionalContexts).toHaveLength(2)
       expect(workspaceContextOf(result)?.source).toEqual({ kind: 'plugin', plugin: 'workspace-context' })
       expect(workspaceContextOf(result)?.meta).toMatchObject({
@@ -2980,7 +3000,7 @@ describe('dynamic nested workspace context injection', () => {
       await ctx.plugin(ToolRegistry)
       await ctx.plugin(LocalFileSystem, { cwd: '/' })
       await ctx.plugin(ToolFs)
-      ctx.tools.register(defineTool({
+      ctx.tools.register(defineContentToolFixture({
         name: 'composite-read',
         description: 'read through a nested dispatch',
         parameters: {},
@@ -3035,7 +3055,7 @@ describe('dynamic nested workspace context injection', () => {
       await ctx.plugin(workspaceContext, { maxBytes: 65536 })
       const agent = stubAgent('/')
       const parent = Symbol('parent') as ToolExecutionToken
-      const plainResult = { callId: CallId('plain'), content: [], isError: false }
+      const plainResult = { callId: CallId('plain'), content: [], isError: false as const, value: null }
 
       ctx.emit('tools/result', stubToolExecution({
         signal: testToolSignal,
@@ -3077,7 +3097,8 @@ describe('dynamic nested workspace context injection', () => {
       const result = {
         callId: CallId('manual'),
         content: [{ type: 'text' as const, text: 'manual result' }],
-        isError: false,
+        isError: false as const,
+        value: null,
       }
       const cases = [
         { name: 'read', arguments: { file_path: join('pkg', 'deep', 'file.txt') }, agent: undefined },

packages/cordis/tool-cordis/README.md

@@ -10,9 +10,11 @@ The self-referential cordis toolset: three model-facing tools over the live runt
 
 Exact model-facing schemas: [the generated tool catalog](../../../docs/tool-catalog.md).
 
+Canonical successes are the inspection string, mount `{ id, pluginName, state, provides, waitingFor }`, and unmount `{ id, pluginName }`. Native renderers preserve the existing prose, so programs can use `mounted.id` while ordinary function calling still sees `mounted dyn-1 (...)`.
+
 ## Trust stance
 
-The sandbox isolates globals but is not a security boundary. Node globals are absent or redirect to Cordis services such as `ctx.fs`, `ctx.web`, and `ctx.bash`, and writes to `globalThis` stay local, but host-realm helpers make escape possible. Mounted plugins receive a façade without framework internals, yet its allowed services affect the live runtime. Treat this toolset like bash access; see the [design and trust stance](../../../.agents/notes/implemented/feature/2026-07-08-self-referential-cordis-toolset.md).
+The sandbox isolates globals but is not a security boundary. Node globals are absent or redirect to Cordis services such as `ctx.fs`, `ctx.web`, and `ctx.bash`, and writes to `globalThis` stay local, but host-realm helpers make escape possible. Mounted plugins receive a façade without framework internals, yet its allowed services affect the live runtime. Dynamic tool schemas and annotations cross the realm through iterative JSON cloning and schema normalization, so valid deep declarations are memory-bounded rather than call-stack-bounded; records with JSON-invisible keys and subclassed or decorated schema arrays reject before normalization. Treat this toolset like bash access; see the [design and trust stance](../../../.agents/notes/implemented/feature/2026-07-08-self-referential-cordis-toolset.md).
 
 ## Config
 

packages/cordis/tool-cordis/src/api-catalog.ts

@@ -1253,17 +1253,25 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'CallId',
     declaration: 'export type CallId = Branded<\'CallId\'>;',
   },
+  {
+    name: 'CodeBindingErrorClass',
+    declaration: 'export interface CodeBindingErrorClass {\n    name: string;\n    memberNameProperty: string;\n}',
+  },
   {
     name: 'CodeBindingFunction',
-    declaration: 'export type CodeBindingFunction = (args: unknown) => Promise<unknown>;',
+    declaration: 'export type CodeBindingFunction = (args: unknown) => Promise<CodeJsonValue>;',
   },
   {
     name: 'CodeBindingNamespace',
-    declaration: 'export interface CodeBindingNamespace {\n    global: string;\n    functions: Record<string, CodeBindingFunction>;\n}',
+    declaration: 'export interface CodeBindingNamespace {\n    global: string;\n    functions: Record<string, CodeBindingFunction>;\n    errorClass?: CodeBindingErrorClass;\n}',
+  },
+  {
+    name: 'CodeJsonValue',
+    declaration: 'export type CodeJsonValue = null | boolean | number | string | CodeJsonValue[] | {\n    [key: string]: CodeJsonValue;\n};',
   },
   {
     name: 'CodeRunFailure',
-    declaration: 'export interface CodeRunFailure {\n    kind: \'exception\' | \'timeout\' | \'abort\' | \'worker-exit\';\n    message: string;\n}',
+    declaration: 'export interface CodeRunFailure {\n    kind: \'exception\' | \'timeout\' | \'abort\' | \'worker-exit\' | \'invalid-output\' | \'output-limit\';\n    message: string;\n}',
   },
   {
     name: 'CodeRunRequest',
@@ -1271,7 +1279,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'CodeRunResult',
-    declaration: 'export interface CodeRunResult {\n    value?: unknown;\n    logs: string[];\n    error?: CodeRunFailure;\n}',
+    declaration: 'export interface CodeRunResult {\n    value?: CodeJsonValue;\n    logs: string[];\n    error?: CodeRunFailure;\n}',
   },
   {
     name: 'CollectedOutput',
@@ -1473,6 +1481,18 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'InvariantInstaller',
     declaration: 'export interface InvariantInstaller {\n    (ctx: Context, fail: InvariantFailure): void | Promise<void>;\n    readonly inject?: Inject;\n}',
   },
+  {
+    name: 'JsonSchemaNode',
+    declaration: 'export interface JsonSchemaNode {\n    type?: JsonSchemaType;\n    oneOf?: JsonSchemaNode[];\n    properties?: Record<string, JsonSchemaNode>;\n    required?: string[];\n    additionalProperties?: boolean;\n    items?: JsonSchemaNode;\n    enum?: JsonSchemaScalar[];\n    const?: JsonSchemaScalar;\n    description?: string;\n    title?: string;\n    default?: JsonValue;\n    examples?: JsonValue;\n}',
+  },
+  {
+    name: 'JsonSchemaScalar',
+    declaration: 'export type JsonSchemaScalar = string | number | boolean | null;',
+  },
+  {
+    name: 'JsonSchemaType',
+    declaration: 'export type JsonSchemaType = \'object\' | \'array\' | \'string\' | \'number\' | \'integer\' | \'boolean\' | \'null\';',
+  },
   {
     name: 'JsonValue',
     declaration: 'export type JsonValue = null | boolean | number | string | JsonValue[] | {\n    [key: string]: JsonValue;\n};',
@@ -1509,6 +1529,10 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'MessageSourceMap',
     declaration: 'export interface MessageSourceMap {\n    user: {\n        kind: \'user\';\n    };\n    plugin: {\n        kind: \'plugin\';\n        plugin: string;\n    };\n}',
   },
+  {
+    name: 'ObjectJsonSchema',
+    declaration: 'export type ObjectJsonSchema = JsonSchemaNode & {\n    type: \'object\';\n};',
+  },
   {
     name: 'OutOfBandSessionEventMap',
     declaration: 'export interface OutOfBandSessionEventMap {\n}',
@@ -1679,7 +1703,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SessionEventMap',
-    declaration: 'export interface SessionEventMap {\n    \'turn/start\': {\n        turn: number;\n        trigger: TurnTrigger;\n    };\n    \'turn/end\': {\n        turn: number;\n        reason: TurnEndReason;\n    };\n    \'step/start\': {\n        turn: number;\n        step: number;\n    };\n    \'step/end\': {\n        turn: number;\n        step: number;\n    };\n    \'user/message\': PromptMessageData;\n    \'prompt/blocked\': {\n        content: ContentBlock[];\n        source: MessageSource;\n        reason: string;\n    };\n    \'context/message\': {\n        content: ContentBlock[];\n        source: MessageSource;\n        meta?: JsonValue;\n    };\n    \'assistant/chunk\': {\n        turn: number;\n        step: number;\n        chunk: StreamChunk;\n    };\n    \'assistant/message\': {\n        turn: number;\n        step: number;\n        content: ContentBlock[];\n        provenance: AssistantProvenance;\n        usage?: TokenUsage;\n    };\n    \'tool/call\': {\n        turn: number;\n        step: number;\n        callId: CallId;\n        name: string;\n        arguments: string;\n    };\n    \'tool/result\': {\n        turn: number;\n        step: number;\n        callId: CallId;\n        content: ContentBlock[];\n        isError: boolean;\n        error?: {\n            name: string;\n            code: string;\n        };\n        meta?: unknown;\n    };\n    \'steering/message\': PromptMessageData & {\n        turn: number;\n    };\n    \'todo/write\': {\n        todos: TodoItem[];\n    };\n    \'request/header\': {\n        header: EpochHeader;\n        reason: Req /* …truncated — full shape in source */',
+    declaration: 'export interface SessionEventMap {\n    \'turn/start\': {\n        turn: number;\n        trigger: TurnTrigger;\n    };\n    \'turn/end\': {\n        turn: number;\n        reason: TurnEndReason;\n    };\n    \'step/start\': {\n        turn: number;\n        step: number;\n    };\n    \'step/end\': {\n        turn: number;\n        step: number;\n    };\n    \'user/message\': PromptMessageData;\n    \'prompt/blocked\': {\n        content: ContentBlock[];\n        source: MessageSource;\n        reason: string;\n    };\n    \'context/message\': {\n        content: ContentBlock[];\n        source: MessageSource;\n        meta?: JsonValue;\n    };\n    \'assistant/chunk\': {\n        turn: number;\n        step: number;\n        chunk: StreamChunk;\n    };\n    \'assistant/message\': {\n        turn: number;\n        step: number;\n        content: ContentBlock[];\n        provenance: AssistantProvenance;\n        usage?: TokenUsage;\n    };\n    \'tool/call\': {\n        turn: number;\n        step: number;\n        callId: CallId;\n        name: string;\n        arguments: string;\n    };\n    \'tool/result\': {\n        turn: number;\n        step: number;\n        callId: CallId;\n        content: ContentBlock[];\n        isError: boolean;\n        error?: {\n            name: string;\n            code: string;\n        };\n        meta?: JsonValue;\n    };\n    \'steering/message\': PromptMessageData & {\n        turn: number;\n    };\n    \'todo/write\': {\n        todos: TodoItem[];\n    };\n    \'request/header\': {\n        header: EpochHeader;\n        reason: R /* …truncated — full shape in source */',
   },
   {
     name: 'SessionEventReadRequest',
@@ -1841,22 +1865,6 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'StreamChunk',
     declaration: 'export type StreamChunk = {\n    type: \'block-start\';\n    index: number;\n    blockType: ContentBlockType;\n} | {\n    type: \'text-delta\';\n    index: number;\n    text: string;\n} | {\n    type: \'reasoning-delta\';\n    index: number;\n    text: string;\n} | {\n    type: \'tool-call-delta\';\n    index: number;\n    id: CallId;\n    name?: string;\n    argumentsDelta: string;\n} | {\n    type: \'block-end\';\n    index: number;\n    block: ContentBlock;\n} | {\n    type: \'usage\';\n    usage: TokenUsage;\n} | {\n    type: \'finish\';\n    reason: FinishReason;\n    replayState?: unknown;\n};',
   },
-  {
-    name: 'StructuredOutputSchema',
-    declaration: 'export type StructuredOutputSchema = StructuredSchemaNode & {\n    type: \'object\';\n};',
-  },
-  {
-    name: 'StructuredScalar',
-    declaration: 'export type StructuredScalar = string | number | boolean | null;',
-  },
-  {
-    name: 'StructuredSchemaNode',
-    declaration: 'export interface StructuredSchemaNode {\n    type: StructuredSchemaType;\n    properties?: Record<string, StructuredSchemaNode>;\n    required?: string[];\n    additionalProperties?: boolean;\n    items?: StructuredSchemaNode;\n    enum?: StructuredScalar[];\n    const?: StructuredScalar;\n    description?: string;\n    title?: string;\n    default?: unknown;\n    examples?: unknown;\n}',
-  },
-  {
-    name: 'StructuredSchemaType',
-    declaration: 'export type StructuredSchemaType = \'object\' | \'array\' | \'string\' | \'number\' | \'integer\' | \'boolean\' | \'null\';',
-  },
   {
     name: 'SubagentCapabilities',
     declaration: 'export interface SubagentCapabilities {\n    readonly outputSchema: boolean;\n    readonly depthLimit: boolean;\n    readonly toolFilter: boolean;\n    readonly persona: boolean;\n}',
@@ -1875,7 +1883,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SubagentStartRequest',
-    declaration: 'export interface SubagentStartRequest {\n    readonly prompt: ContentBlock[];\n    readonly parent: Agent;\n    readonly signal: AbortSignal;\n    readonly agentOptions?: AgentOptions;\n    readonly outputSchema?: StructuredOutputSchema;\n    readonly maxDepth?: number;\n    readonly toolFilter?: ToolRestriction;\n    readonly persona?: string;\n}',
+    declaration: 'export interface SubagentStartRequest {\n    readonly prompt: ContentBlock[];\n    readonly parent: Agent;\n    readonly signal: AbortSignal;\n    readonly agentOptions?: AgentOptions;\n    readonly outputSchema?: ObjectJsonSchema;\n    readonly maxDepth?: number;\n    readonly toolFilter?: ToolRestriction;\n    readonly persona?: string;\n}',
   },
   {
     name: 'SubagentStopReason',
@@ -1979,20 +1987,20 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ToolDefinition',
-    declaration: 'export interface ToolDefinition extends ToolSchema {\n    execute(args: unknown, exec: ToolRunContext): Promise<ToolExecuteReturn>;\n    timeoutMs?: number;\n    isConcurrencySafe?(args: unknown): boolean;\n    presentCall?(args: unknown): ToolCallView | undefined;\n    presentResult?(args: unknown, result: ToolResult): ToolResultView | undefined;\n}',
+    declaration: 'export interface ToolDefinition extends ToolSchema {\n    readonly output: ToolOutputDefinition;\n    execute(args: unknown, exec: ToolRunContext): Promise<unknown>;\n    timeoutMs?: number;\n    isConcurrencySafe?(args: unknown): boolean;\n    presentCall?(args: unknown): ToolCallView | undefined;\n    presentResult?(args: unknown, result: ToolResult): ToolResultView | undefined;\n}',
   },
   {
     name: 'ToolErrorInfo',
     declaration: 'export interface ToolErrorInfo {\n    name: string;\n    code: string;\n}',
   },
-  {
-    name: 'ToolExecuteReturn',
-    declaration: 'export type ToolExecuteReturn = ContentBlock[] | {\n    content: ContentBlock[];\n    meta?: unknown;\n};',
-  },
   {
     name: 'ToolExecution',
     declaration: 'export interface ToolExecution extends ToolExecutionInput {\n    readonly token: ToolExecutionToken;\n}',
   },
+  {
+    name: 'ToolExecutionFailure',
+    declaration: 'export interface ToolExecutionFailure {\n    readonly isError: true;\n    readonly error: ToolFailure;\n    readonly value?: never;\n    readonly content: ContentBlock[];\n    readonly meta?: JsonValue;\n    readonly additionalContexts?: HookContext[];\n}',
+  },
   {
     name: 'ToolExecutionInput',
     declaration: 'export interface ToolExecutionInput {\n    readonly callId: CallId;\n    readonly name: string;\n    readonly arguments: unknown;\n    readonly agent?: Agent;\n    readonly parent?: ToolExecutionToken;\n    readonly signal: AbortSignal;\n}',
@@ -2003,16 +2011,28 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ToolExecutionResult',
-    declaration: 'export interface ToolExecutionResult {\n    content: ContentBlock[];\n    isError: boolean;\n    error?: ToolErrorInfo;\n    additionalContexts?: HookContext[];\n    meta?: unknown;\n}',
+    declaration: 'export type ToolExecutionResult = ToolExecutionSuccess | ToolExecutionFailure;',
+  },
+  {
+    name: 'ToolExecutionSuccess',
+    declaration: 'export interface ToolExecutionSuccess {\n    readonly isError: false;\n    readonly value: JsonValue;\n    readonly content: ContentBlock[];\n    readonly error?: never;\n    readonly meta?: JsonValue;\n    readonly additionalContexts?: HookContext[];\n}',
   },
   {
     name: 'ToolExecutionToken',
     declaration: 'export type ToolExecutionToken = symbol & {\n    readonly [toolExecutionTokenBrand]: true;\n};',
   },
+  {
+    name: 'ToolFailure',
+    declaration: 'export interface ToolFailure {\n    message: string;\n    info?: ToolErrorInfo;\n}',
+  },
   {
     name: 'ToolGuard',
     declaration: 'export type ToolGuard = (execution: Readonly<ToolExecution>) => string | undefined;',
   },
+  {
+    name: 'ToolOutputDefinition',
+    declaration: 'export interface ToolOutputDefinition {\n    readonly schema: JsonSchemaNode;\n    render(args: unknown, value: JsonValue): ContentBlock[];\n    presentationMeta?(args: unknown, value: JsonValue): JsonValue;\n}',
+  },
   {
     name: 'ToolProviderResult',
     declaration: 'export interface ToolProviderResult {\n    readonly schemas: readonly ToolSchema[];\n    readonly knownNames?: readonly string[];\n}',
@@ -2023,7 +2043,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ToolResult',
-    declaration: 'export interface ToolResult {\n    content: ContentBlock[];\n    isError: boolean;\n    meta?: unknown;\n}',
+    declaration: 'export interface ToolResult {\n    content: ContentBlock[];\n    isError: boolean;\n    meta?: JsonValue;\n}',
   },
   {
     name: 'ToolResultBlock',

packages/cordis/tool-cordis/src/fiber-state.ts

@@ -21,11 +21,11 @@ export const FiberState = {
 export type FiberState = FiberStateEnum
 
 /** Human-readable label for each {@link FiberState}, keyed by member (inlining-safe — no reverse mapping). */
-export const STATE_LABELS: Record<FiberState, string> = {
+export const STATE_LABELS = {
   [FiberState.PENDING]: 'pending',
   [FiberState.LOADING]: 'loading',
   [FiberState.ACTIVE]: 'active',
   [FiberState.FAILED]: 'failed',
   [FiberState.DISPOSED]: 'disposed',
   [FiberState.UNLOADING]: 'unloading',
-}
+} as const satisfies Record<FiberState, string>

packages/cordis/tool-cordis/src/guard.ts

@@ -1,13 +1,13 @@
 /**
- * The registration boundary between sandboxed mount code and the real runtime: SchemaSpec
+ * The registration boundary between sandboxed mount code and the real runtime: ParameterSchemaSpec
  * normalization + validation with teaching errors, the marker-guarded `harness.defineTool` /
  * `harness.registerTool` pair, the SANDBOX CONTEXT FAÇADE a mounted plugin's `apply` receives
  * in place of the real `ctx`, and the plugin-shape helpers the mount lifecycle narrows sandbox
  * return values with. The façade is a whitelist of lifecycle-safe verbs and declared services;
  * framework internals and context-valued service returns are denied.
  *
- * VM-realm schemas are rebuilt as host objects, and tool results are JSON-round-tripped and
- * shape-checked before session logging. Common JSON-Schema spellings are normalized when they
+ * VM-realm schemas and canonical values are rebuilt as host objects, while rendered content and
+ * presentation metadata are shape-checked before entering the registry. Common JSON-Schema spellings are normalized when they
  * have one meaning; invalid vocabulary fails during registration with a teaching error.
  * @module @deepseek-ai/dsh-tool-cordis/guard
  */
@@ -15,84 +15,470 @@
 import { Context } from 'cordis'
 import type { Plugin } from 'cordis'
 import { scopeOf } from '@deepseek-ai/dsh-scope'
-import { defineTool } from '@deepseek-ai/dsh-tools'
-import type { ToolDefinition, ToolExecuteReturn } from '@deepseek-ai/dsh-tools'
+import { assertSupportedJsonSchema, defineTool } from '@deepseek-ai/dsh-tools'
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
+import type { ContentBlock } from '@deepseek-ai/dsh-llm'
+import type { JsonValue } from '@deepseek-ai/dsh-session'
 
 const DYNAMIC_TOOL = Symbol('tool-cordis.dynamic-tool')
-const SCHEMA_TYPES = new Set<unknown>(['string', 'number', 'boolean', 'object', 'array'])
-const VALID_TYPES = '\'string\' | \'number\' | \'boolean\' | \'object\' | \'array\''
+const SCHEMA_TYPES = new Set<unknown>(['string', 'number', 'integer', 'boolean', 'null', 'object', 'array', 'json'])
+const VALID_TYPES = '\'string\' | \'number\' | \'integer\' | \'boolean\' | \'null\' | \'object\' | \'array\' | \'json\''
+const ANNOTATION_KEYS = ['description', 'title', 'default', 'examples'] as const
 
 type DynamicToolDefinition = ToolDefinition & { [DYNAMIC_TOOL]: true }
 type DynamicToolMarker = { [DYNAMIC_TOOL]?: unknown }
 
 function isPlainRecord(value: unknown): value is Record<string, unknown> {
-  return Object.prototype.toString.call(value) === '[object Object]'
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false
+  const prototype: unknown = Object.getPrototypeOf(value)
+  return prototype === null
+    || typeof prototype === 'object'
+      && Object.getPrototypeOf(prototype) === null
+      && hasIntrinsicConstructor(prototype, 'Object')
+}
+
+/* jscpd:ignore-start -- this VM boundary mirrors the session-owned realm-safe intrinsic test */
+/** Whether a realm-owned intrinsic prototype is backed by its native constructor. */
+function hasIntrinsicConstructor(prototype: object, name: 'Array' | 'Object'): boolean {
+  const descriptor = Object.getOwnPropertyDescriptor(prototype, 'constructor')
+  const constructor: unknown = descriptor?.value
+  if (typeof constructor !== 'function') return false
+  try {
+    return constructor.name === name
+      && constructor.prototype === prototype
+      && Function.prototype.toString.call(constructor) === `function ${name}() { [native code] }`
+  } catch {
+    return false
+  }
+}
+
+/** Whether an array uses one realm's intrinsic Array prototype rather than a subclass. */
+function hasPlainArrayPrototype(value: unknown[]): boolean {
+  const prototype: unknown = Object.getPrototypeOf(value)
+  if (!Array.isArray(prototype) || !hasIntrinsicConstructor(prototype, 'Array')) return false
+  const objectPrototype: unknown = Object.getPrototypeOf(prototype)
+  return typeof objectPrototype === 'object'
+    && objectPrototype !== null
+    && Object.getPrototypeOf(objectPrototype) === null
+    && hasIntrinsicConstructor(objectPrototype, 'Object')
+}
+/* jscpd:ignore-end */
+
+/** Whether a schema list is a dense intrinsic array with no JSON-invisible decorations. */
+function isDensePlainArray(value: unknown): value is unknown[] {
+  if (!Array.isArray(value) || !hasPlainArrayPrototype(value) || Reflect.ownKeys(value).length !== value.length + 1) {
+    return false
+  }
+  for (let index = 0; index < value.length; index++) {
+    if (!Object.hasOwn(value, index)) return false
+  }
+  return true
+}
+
+/** Reject schema records whose declarations would disappear from object enumeration. */
+function assertSchemaContainerKeys(value: Record<string, unknown>, path: string): void {
+  if (Reflect.ownKeys(value).some(key => typeof key !== 'string' || !Object.prototype.propertyIsEnumerable.call(value, key))) {
+    throw new Error(`harness.defineTool ${path} must contain only own enumerable string keys`)
+  }
+}
+
+/** Where one cloned JSON value is installed. */
+type CloneDestination =
+  | { kind: 'root' }
+  | { kind: 'array'; target: unknown[]; index: number }
+  | { kind: 'object'; target: Record<string, unknown>; key: string }
+
+/** Deferred work for stack-safe cross-realm JSON cloning. */
+type CloneTask =
+  | { kind: 'visit'; value: unknown; path: string; destination: CloneDestination }
+  | { kind: 'array-item'; source: unknown[]; index: number; path: string; target: unknown[] }
+  | { kind: 'leave'; source: object }
+
+/** Materialize realm-foreign lossless JSON without allowing JSON.stringify coercions. */
+function cloneJson(value: unknown, path: string): unknown {
+  const ancestors = new Set<object>()
+  let root: unknown
+  const assign = (destination: CloneDestination, item: unknown): void => {
+    if (destination.kind === 'root') {
+      root = item
+      return
+    }
+    if (destination.kind === 'array') {
+      destination.target[destination.index] = item
+      return
+    }
+    Object.defineProperty(destination.target, destination.key, {
+      value: item,
+      enumerable: true,
+      configurable: true,
+      writable: true,
+    })
+  }
+  const reject = (at: string): never => {
+    throw new Error(`harness.defineTool ${at} must be lossless JSON data`)
+  }
+
+  const tasks: CloneTask[] = [{ kind: 'visit', value, path, destination: { kind: 'root' } }]
+  for (let task = tasks.pop(); task !== undefined; task = tasks.pop()) {
+    if (task.kind === 'leave') {
+      ancestors.delete(task.source)
+      continue
+    }
+    if (task.kind === 'array-item') {
+      if (!Object.hasOwn(task.source, task.index)) reject(task.path)
+      tasks.push({
+        kind: 'visit',
+        value: task.source[task.index],
+        path: `${task.path}[${task.index}]`,
+        destination: { kind: 'array', target: task.target, index: task.index },
+      })
+      continue
+    }
+
+    const current = task.value
+    if (current === null || typeof current === 'string' || typeof current === 'boolean') {
+      assign(task.destination, current)
+      continue
+    }
+    if (typeof current === 'number') {
+      if (!Number.isFinite(current) || Object.is(current, -0)) reject(task.path)
+      assign(task.destination, current)
+      continue
+    }
+    if (typeof current !== 'object' || ancestors.has(current)) reject(task.path)
+
+    if (Array.isArray(current)) {
+      if (!hasPlainArrayPrototype(current) || Reflect.ownKeys(current).length !== current.length + 1) reject(task.path)
+      const output: unknown[] = []
+      assign(task.destination, output)
+      ancestors.add(current)
+      tasks.push({ kind: 'leave', source: current })
+      for (let index = current.length - 1; index >= 0; index--) {
+        tasks.push({ kind: 'array-item', source: current, index, path: task.path, target: output })
+      }
+      continue
+    }
+    if (!isPlainRecord(current)) reject(task.path)
+    const record = current as Record<string, unknown>
+    if (Reflect.ownKeys(record).some(key => typeof key !== 'string' || !Object.prototype.propertyIsEnumerable.call(record, key))) {
+      reject(task.path)
+    }
+    const output: Record<string, unknown> = {}
+    assign(task.destination, output)
+    ancestors.add(record)
+    tasks.push({ kind: 'leave', source: record })
+    const entries = Object.entries(record)
+    for (let index = entries.length - 1; index >= 0; index--) {
+      const entry = entries[index]
+      /* v8 ignore next -- the loop is bounded by the captured entry count. */
+      if (entry === undefined) continue
+      tasks.push({
+        kind: 'visit',
+        value: entry[1],
+        path: `${task.path}.${entry[0]}`,
+        destination: { kind: 'object', target: output, key: entry[0] },
+      })
+    }
+  }
+  return root
+}
+
+/** Copy and realm-materialize the shared annotation vocabulary. */
+function copyAnnotations(value: Record<string, unknown>, output: Record<string, unknown>, path: string): void {
+  if (Object.hasOwn(value, 'description')) output.description = value.description
+  if (Object.hasOwn(value, 'title')) output.title = value.title
+  if (Object.hasOwn(value, 'default')) output.default = cloneJson(value.default, `${path}.default`)
+  if (Object.hasOwn(value, 'examples')) output.examples = cloneJson(value.examples, `${path}.examples`)
+}
+
+/** Reject sandbox schema keys that the unified DSL would otherwise ignore. */
+function assertSchemaKeys(value: Record<string, unknown>, path: string, allowed: readonly string[]): void {
+  assertSchemaContainerKeys(value, path)
+  for (const key of Object.keys(value)) {
+    if (!allowed.includes(key)) throw new Error(`harness.defineTool ${path}.${key} is not supported by the unified schema DSL`)
+  }
 }
 
 /**
  * Normalize a sandbox-provided `parameters` value into a fresh host-realm
- * SchemaSpec. Accepts the DSL directly, or the JSON-Schema-style
- * `{ type: 'object', properties, required: […] }` wrapper models write by
- * prior — the wrapper unwraps and its `required` array becomes per-property
- * flags (see the module doc).
+ * ParameterSchemaSpec. A raw JSON-Schema object wrapper retains its open root
+ * default, while the direct DSL is already an implicit open property map.
  */
-function normalizeSchemaSpec(value: unknown, path = 'parameters'): Record<string, unknown> {
+function normalizeParameterSchemaSpec(value: unknown, path = 'parameters'): {
+  spec: Record<string, unknown>
+  rootAnnotations?: Record<string, unknown>
+} {
   if (!isPlainRecord(value)) {
-    throw new Error(`harness.defineTool ${path} must be a SchemaSpec object`)
+    throw new Error(`harness.defineTool ${path} must be a ParameterSchemaSpec object`)
   }
-  let entries = value
-  const requiredNames = new Set<unknown>()
-  if (value.type === 'object' && isPlainRecord(value.properties)) {
-    if (Array.isArray(value.required)) {
-      for (const name of value.required) requiredNames.add(name)
+  if (value.type === 'object') {
+    assertSchemaKeys(value, path, ['type', 'properties', 'required', 'additionalProperties', ...ANNOTATION_KEYS])
+    if (!isPlainRecord(value.properties)) {
+      throw new Error(`harness.defineTool ${path}.properties must be an object of schemas`)
+    }
+    if (Object.hasOwn(value, 'additionalProperties') && value.additionalProperties !== true) {
+      throw new Error(`harness.defineTool ${path}.additionalProperties must be true or omitted because the implicit parameter root is open`)
+    }
+    if (Object.hasOwn(value, 'required') && value.required === undefined) {
+      throw new Error(`harness.defineTool ${path}.required must be an array of declared property names`)
+    }
+    const required = normalizeRequiredNames(value.required, value.properties, `${path}.required`)
+    const rootAnnotations: Record<string, unknown> = {}
+    copyAnnotations(value, rootAnnotations, path)
+    return {
+      spec: normalizePropertyMap(value.properties, path, required, true),
+      ...(Object.keys(rootAnnotations).length === 0 ? {} : { rootAnnotations }),
     }
-    entries = value.properties
   }
-  const spec: Record<string, unknown> = {}
-  for (const [key, prop] of Object.entries(entries)) {
-    spec[key] = normalizeSchemaProp(prop, `${path}.${key}`, requiredNames.has(key))
-  }
-  return spec
+  return { spec: normalizePropertyMap(value, path, new Set(), false) }
 }
 
-/** Normalize one property: `integer` → `number`, `required: false` → absent, nested wrappers unwrapped recursively. */
-function normalizeSchemaProp(value: unknown, path: string, forceRequired = false): Record<string, unknown> {
-  if (!isPlainRecord(value)) {
-    throw new Error(`harness.defineTool ${path} must be a SchemaSpec property object`)
+/** Validate raw required names and return their lookup set. */
+function normalizeRequiredNames(value: unknown, properties: Record<string, unknown>, path: string): Set<string> {
+  if (value === undefined) return new Set()
+  if (!isDensePlainArray(value)) {
+    throw new Error(`harness.defineTool ${path} must be an array of declared property names`)
   }
-  const type = value.type === 'integer' ? 'number' : value.type
-  if (!SCHEMA_TYPES.has(type)) {
-    throw new Error(`harness.defineTool ${path} must declare a valid type: ${VALID_TYPES} (got ${JSON.stringify(value.type)})`)
-  }
-  // On an object property a JSON-Schema-style `required` ARRAY names required
-  // children (handled by the nested unwrap below); everywhere else `required`
-  // must be a boolean, and `false` means optional.
-  const nestedRequiredArray = type === 'object' && Array.isArray(value.required)
-  if (value.required !== undefined && typeof value.required !== 'boolean' && !nestedRequiredArray) {
-    throw new Error(`harness.defineTool ${path}.required must be a boolean when present`)
-  }
-  const prop: Record<string, unknown> = { type }
-  if (forceRequired || value.required === true) prop.required = true
-  if (typeof value.description === 'string') prop.description = value.description
-  if (Array.isArray(value.enum)) prop.enum = [...value.enum as unknown[]]
-  if (value.default !== undefined) prop.default = value.default
-  if (value.properties !== undefined) {
-    if (type !== 'object') {
-      throw new Error(`harness.defineTool ${path}.properties is only valid for type "object"`)
+  const names = new Set<string>()
+  for (let index = 0; index < value.length; index++) {
+    const name = value[index]
+    if (typeof name !== 'string') {
+      throw new Error(`harness.defineTool ${path} must be an array of declared property names`)
     }
-    // Re-wrap so the nested unwrap applies a nested `required` array too.
-    prop.properties = normalizeSchemaSpec(
-      { type: 'object', properties: value.properties, required: value.required },
-      `${path}.properties`,
-    )
+    names.add(name)
+    if (!Object.hasOwn(properties, name)) throw new Error(`harness.defineTool ${path} names undeclared property ${JSON.stringify(name)}`)
   }
-  if (value.items !== undefined) {
-    if (type !== 'array') {
-      throw new Error(`harness.defineTool ${path}.items is only valid for type "array"`)
+  return names
+}
+
+/** Mutable holder used only while one normalized property-map root is unresolved. */
+interface NormalizeRoot {
+  value?: Record<string, unknown>
+}
+
+/** Where a normalized value node is installed. */
+type NormalizeValueDestination =
+  | { kind: 'property'; target: Record<string, unknown>; key: string }
+  | { kind: 'item'; target: Record<string, unknown> }
+  | { kind: 'one-of'; target: Record<string, unknown>[]; index: number }
+
+/** Where a normalized property map is installed. */
+type NormalizeMapDestination =
+  | { kind: 'root'; holder: NormalizeRoot }
+  | { kind: 'properties'; target: Record<string, unknown> }
+
+/** Deferred work for stack-safe sandbox schema normalization. */
+type NormalizeTask =
+  | {
+    kind: 'map'
+    entries: Record<string, unknown>
+    path: string
+    requiredNames: ReadonlySet<string>
+    raw: boolean
+    destination: NormalizeMapDestination
+  }
+  | {
+    kind: 'value'
+    value: unknown
+    path: string
+    forceRequired: boolean
+    raw: boolean
+    parameterProperty: boolean
+    destination: NormalizeValueDestination
+  }
+  | { kind: 'leave'; value: object }
+
+/** Install one normalized node without `__proto__` assignment semantics. */
+function assignNormalizedValue(destination: NormalizeValueDestination, value: Record<string, unknown>): void {
+  if (destination.kind === 'property') {
+    Object.defineProperty(destination.target, destination.key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true,
+    })
+  } else if (destination.kind === 'item') {
+    destination.target.items = value
+  } else {
+    destination.target[destination.index] = value
+  }
+}
+
+/** Install one normalized property map at its root or containing object. */
+function assignNormalizedMap(destination: NormalizeMapDestination, value: Record<string, unknown>): void {
+  if (destination.kind === 'root') destination.holder.value = value
+  else destination.target.properties = value
+}
+
+/** Normalize one implicit property map and all descendants with explicit work frames. */
+function normalizePropertyMap(
+  entries: Record<string, unknown>,
+  path: string,
+  requiredNames: ReadonlySet<string>,
+  raw: boolean,
+): Record<string, unknown> {
+  const holder: NormalizeRoot = {}
+  const ancestors = new Set<object>()
+  const tasks: NormalizeTask[] = [{
+    kind: 'map',
+    entries,
+    path,
+    requiredNames,
+    raw,
+    destination: { kind: 'root', holder },
+  }]
+  for (let task = tasks.pop(); task !== undefined; task = tasks.pop()) {
+    if (task.kind === 'leave') {
+      ancestors.delete(task.value)
+      continue
+    }
+    if (task.kind === 'map') {
+      if (ancestors.has(task.entries)) throw new Error(`harness.defineTool ${task.path} is circular`)
+      assertSchemaContainerKeys(task.entries, task.path)
+      ancestors.add(task.entries)
+      const spec: Record<string, unknown> = {}
+      assignNormalizedMap(task.destination, spec)
+      tasks.push({ kind: 'leave', value: task.entries })
+      const mapEntries = Object.entries(task.entries)
+      for (let index = mapEntries.length - 1; index >= 0; index--) {
+        const entry = mapEntries[index]
+        /* v8 ignore next -- the loop is bounded by the captured entry count. */
+        if (entry === undefined) continue
+        tasks.push({
+          kind: 'value',
+          value: entry[1],
+          path: `${task.path}.${entry[0]}`,
+          forceRequired: task.requiredNames.has(entry[0]),
+          raw: task.raw,
+          parameterProperty: true,
+          destination: { kind: 'property', target: spec, key: entry[0] },
+        })
+      }
+      continue
+    }
+
+    const { value, path } = task
+    if (!isPlainRecord(value)) {
+      throw new Error(`harness.defineTool ${path} must be a ParameterSchemaSpec property object`)
+    }
+    assertSchemaContainerKeys(value, path)
+    if (ancestors.has(value)) throw new Error(`harness.defineTool ${path} is circular`)
+    ancestors.add(value)
+    const requiredKey = task.parameterProperty && !task.raw ? ['required'] : []
+    if (task.parameterProperty && task.raw && Object.hasOwn(value, 'required') && value.type !== 'object') {
+      throw new Error(`harness.defineTool ${path}.required belongs to the containing raw object schema`)
+    }
+    if (task.parameterProperty && !task.raw && Object.hasOwn(value, 'required') && value.required !== true) {
+      throw new Error(`harness.defineTool ${path}.required must be true when present`)
+    }
+    const prop: Record<string, unknown> = {}
+    assignNormalizedValue(task.destination, prop)
+    tasks.push({ kind: 'leave', value })
+    if (task.forceRequired || value.required === true) prop.required = true
+    copyAnnotations(value, prop, path)
+
+    if (Object.hasOwn(value, 'oneOf')) {
+      assertSchemaKeys(value, path, ['oneOf', ...requiredKey, ...ANNOTATION_KEYS])
+      if (!isDensePlainArray(value.oneOf) || value.oneOf.length < 2) {
+        throw new Error(`harness.defineTool ${path}.oneOf must contain at least two schemas`)
+      }
+      const oneOf: Record<string, unknown>[] = []
+      prop.oneOf = oneOf
+      for (let index = value.oneOf.length - 1; index >= 0; index--) {
+        tasks.push({
+          kind: 'value',
+          value: value.oneOf[index],
+          path: `${path}.oneOf[${index}]`,
+          forceRequired: false,
+          raw: task.raw,
+          parameterProperty: false,
+          destination: { kind: 'one-of', target: oneOf, index },
+        })
+      }
+      continue
+    }
+
+    if (task.raw && !Object.hasOwn(value, 'type')) {
+      assertSchemaKeys(value, path, ANNOTATION_KEYS)
+      prop.type = 'json'
+      continue
+    }
+    if (!SCHEMA_TYPES.has(value.type) || task.raw && value.type === 'json') {
+      throw new Error(`harness.defineTool ${path} must declare a valid type: ${VALID_TYPES} (got ${JSON.stringify(value.type)})`)
+    }
+    const type = value.type
+    prop.type = type
+
+    switch (type) {
+      case 'object': {
+        assertSchemaKeys(value, path, ['type', 'properties', 'additionalProperties', ...requiredKey, ...(task.raw ? ['required'] : []), ...ANNOTATION_KEYS])
+        if (!task.raw && (!Object.hasOwn(value, 'additionalProperties') || typeof value.additionalProperties !== 'boolean')) {
+          throw new Error(`harness.defineTool ${path}.additionalProperties must be explicitly true or false`)
+        }
+        if (task.raw && Object.hasOwn(value, 'additionalProperties') && typeof value.additionalProperties !== 'boolean') {
+          throw new Error(`harness.defineTool ${path}.additionalProperties must be a boolean`)
+        }
+        if (task.raw && Object.hasOwn(value, 'required') && value.required === undefined) {
+          throw new Error(`harness.defineTool ${path}.required must be an array of declared property names`)
+        }
+        prop.additionalProperties = task.raw ? value.additionalProperties ?? true : value.additionalProperties
+        if (Object.hasOwn(value, 'properties')) {
+          const properties = value.properties
+          if (!isPlainRecord(properties)) throw new Error(`harness.defineTool ${path}.properties must be an object of schemas`)
+          const nestedRequired = task.raw
+            ? normalizeRequiredNames(value.required, properties, `${path}.required`)
+            : new Set<string>()
+          tasks.push({
+            kind: 'map',
+            entries: properties,
+            path: `${path}.properties`,
+            requiredNames: nestedRequired,
+            raw: task.raw,
+            destination: { kind: 'properties', target: prop },
+          })
+        } else if (task.raw && value.required !== undefined) {
+          normalizeRequiredNames(value.required, {}, `${path}.required`)
+        }
+        break
+      }
+      case 'array':
+        assertSchemaKeys(value, path, ['type', 'items', ...requiredKey, ...ANNOTATION_KEYS])
+        if (Object.hasOwn(value, 'items')) {
+          tasks.push({
+            kind: 'value',
+            value: value.items,
+            path: `${path}.items`,
+            forceRequired: false,
+            raw: task.raw,
+            parameterProperty: false,
+            destination: { kind: 'item', target: prop },
+          })
+        }
+        break
+      case 'string':
+      case 'number':
+      case 'integer':
+      case 'boolean':
+      case 'null':
+        assertSchemaKeys(value, path, ['type', 'enum', 'const', ...requiredKey, ...ANNOTATION_KEYS])
+        if (Object.hasOwn(value, 'enum')) {
+          if (!isDensePlainArray(value.enum) || value.enum.length === 0) {
+            throw new Error(`harness.defineTool ${path}.enum must be a non-empty array`)
+          }
+          prop.enum = cloneJson(value.enum, `${path}.enum`)
+        }
+        if (Object.hasOwn(value, 'const')) prop.const = cloneJson(value.const, `${path}.const`)
+        break
+      case 'json':
+        assertSchemaKeys(value, path, ['type', ...requiredKey, ...ANNOTATION_KEYS])
+        break
+      /* v8 ignore next 2 -- SCHEMA_TYPES narrows this closed switch before dispatch. */
+      default:
+        throw new Error(`harness.defineTool ${path} must declare a valid type: ${VALID_TYPES}`)
     }
-    prop.items = normalizeSchemaProp(value.items, `${path}.items`)
   }
-  return prop
+  /* v8 ignore next -- the root map task assigns before scheduling descendants. */
+  return holder.value ?? {}
 }
 
 function markDynamicTool(tool: ToolDefinition): DynamicToolDefinition {
@@ -127,60 +513,75 @@ const RETURN_PREVIEW_LIMIT = 120
  * (`String(…)` for the un-stringifiable undefined case), truncated to
  * {@link RETURN_PREVIEW_LIMIT}.
  */
-function describeReturn(value: unknown): string {
-  // JSON.stringify is TYPED as always returning string, but it yields
-  // undefined for an undefined input (the routed forgot-return case) — the
-  // assertion widens the type back to the runtime truth.
-  const json = JSON.stringify(value) as string | undefined
-  if (json === undefined) return String(value)
+function describeReturn(value: JsonValue): string {
+  // The caller has already crossed cloneJson, so this value is lossless JSON
+  // and serialization cannot produce undefined.
+  const json = JSON.stringify(value)
   return json.length > RETURN_PREVIEW_LIMIT ? `${json.slice(0, RETURN_PREVIEW_LIMIT)}…` : json
 }
 
 /**
- * Validate a round-tripped `execute` return against the two shapes
- * {@link ToolExecuteReturn} allows: an ARRAY of content blocks, or
- * `{ content: blocks, meta? }`. The registry trusts the shape blindly — it
- * spreads `result.content`, so an unvalidated `{ content: 'ok' }` would enter
- * the session log as `['o','k']` and silently corrupt the next model request —
- * so a wrong shape fails THIS call with a teaching error instead.
+ * Validate and host-materialize a sandbox renderer's content blocks.
  */
-function assertExecuteReturn(value: unknown): ToolExecuteReturn {
+function assertRenderedContent(value: JsonValue): ContentBlock[] {
   if (Array.isArray(value) && value.every(isContentBlockShape)) {
-    return value as ToolExecuteReturn
-  }
-  if (isPlainRecord(value) && Array.isArray(value.content) && value.content.every(isContentBlockShape)) {
-    return value as ToolExecuteReturn
+    return value as unknown as ContentBlock[]
   }
   throw new Error(
-    `execute returned ${describeReturn(value)} — a tool's execute must return an ARRAY of content blocks, never a bare string:\n`
-    + '  ✓ return [{ type: \'text\', text: someString }]\n'
-    + '  ✓ return { content: [{ type: \'text\', text: someString }], meta: anyJsonValue }',
+    `output.render returned ${describeReturn(value)} — it must return an ARRAY of content blocks:\n`
+    + '  ✓ return [{ type: \'text\', text: String(value) }]',
   )
 }
 
 /**
  * The `harness.defineTool` handed into the sandbox: the real DSL, with `parameters` normalized
- * into a fresh host-realm SchemaSpec (JSON-Schema wrapper unwrapped, `integer` mapped,
- * `required: false` dropped) and the tool's `execute` return normalized into the host realm
+ * into a fresh host-realm ParameterSchemaSpec (raw object wrappers unwrapped,
+ * required arrays mapped, and explicit DSL object openness enforced) and the tool's `execute` return normalized into the host realm
  * via a JSON round-trip. Non-JSON or wrong-shape output fails that call instead of poisoning
  * the session log.
- * @param options - the standard `defineTool` options; `parameters` may be the SchemaSpec DSL or a JSON-Schema-style wrapper.
+ * @param options - the standard `defineTool` options; `parameters` may be the ParameterSchemaSpec DSL or a JSON-Schema-style wrapper.
  * @returns the marker-tagged definition `harness.registerTool` (and the guarded `ctx.tools.register`) accepts.
  */
-export function sandboxDefineTool(options: Parameters<typeof defineTool>[0]): ToolDefinition {
-  const parameters = normalizeSchemaSpec((options as { parameters?: unknown }).parameters)
-  const tool = defineTool({ ...options, parameters } as Parameters<typeof defineTool>[0])
-  const execute = tool.execute.bind(tool)
+export function sandboxDefineTool(options: unknown): ToolDefinition {
+  if (!isPlainRecord(options)) throw new Error('harness.defineTool options must be an object')
+  const normalized = normalizeParameterSchemaSpec(options.parameters)
+  if (!isPlainRecord(options.output)) {
+    throw new Error('harness.defineTool output must declare { schema, render, presentationMeta? }')
+  }
+  const output = options.output
+  if (typeof output.render !== 'function') throw new Error('harness.defineTool output.render must be a function')
+  if (output.presentationMeta !== undefined && typeof output.presentationMeta !== 'function') {
+    throw new Error('harness.defineTool output.presentationMeta must be a function when present')
+  }
+  if (typeof options.execute !== 'function') throw new Error('harness.defineTool execute must be a function')
+  const schema = cloneJson(output.schema, 'output.schema')
+  const rawExecute = options.execute as (args: unknown, exec: unknown) => Promise<unknown>
+  const rawRender = output.render as (args: unknown, value: unknown) => unknown
+  const rawPresentationMeta = output.presentationMeta as ((args: unknown, value: unknown) => unknown) | undefined
+  const erasedDefineTool = defineTool as unknown as (definition: unknown) => ToolDefinition
+  const tool = erasedDefineTool({
+    ...options,
+    parameters: normalized.spec,
+    output: {
+      schema,
+      render(args: unknown, value: unknown): ContentBlock[] {
+        return assertRenderedContent(cloneJson(rawRender(args, value), 'output.render result') as JsonValue)
+      },
+      ...rawPresentationMeta !== undefined ? {
+        presentationMeta(args: unknown, value: unknown): JsonValue {
+          return cloneJson(rawPresentationMeta(args, value), 'output.presentationMeta result') as JsonValue
+        },
+      } : {},
+    },
+    async execute(args: unknown, exec: unknown): Promise<JsonValue> {
+      return cloneJson(await rawExecute(args, exec), 'execute result') as JsonValue
+    },
+  })
+  const parameters = { ...tool.parameters, ...normalized.rootAnnotations }
+  assertSupportedJsonSchema(parameters)
   return markDynamicTool({
     ...tool,
-    async execute(args, exec) {
-      // JSON.stringify yields NO JSON for an undefined (or function/symbol)
-      // return despite its string-typed signature — route that into
-      // assertExecuteReturn's teaching error rather than letting JSON.parse
-      // throw its cryptic '"undefined" is not valid JSON'.
-      const json = JSON.stringify(await execute(args, exec)) as string | undefined
-      return assertExecuteReturn(json === undefined ? undefined : JSON.parse(json) as unknown)
-    },
+    parameters,
   })
 }
 

packages/cordis/tool-cordis/src/index.ts

@@ -13,7 +13,7 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import { STATE_LABELS } from './fiber-state.ts'
 import { isPlugin, pluginName } from './guard.ts'
 import { EVENT_API, INHERITED_CTX_API, SERVICE_API, TYPE_API } from './api-catalog.ts'
-import { describeApi, describeDynamic, describeEvents, describePlugins, describeServices, describeTools } from './inspect.ts'
+import { describeApi, describeDynamic, describeEvents, describePlugins, describeServices, describeTools, providedServices } from './inspect.ts'
 import { missingServices, mountDynamic, type DynamicMount } from './mount.ts'
 import { presentInspectCall, presentMountCall, presentUnmountCall } from './present.ts'
 import { createSandbox, evaluateMountCode } from './sandbox.ts'
@@ -76,7 +76,11 @@ export function apply(ctx: Context, config: Config): void {
         description: 'Exact service key or event name whose original JSDoc to include; valid only with what:"api" or what:"events".',
       },
     },
-    execute(args, exec): Promise<{ type: 'text'; text: string }[]> {
+    output: {
+      schema: { type: 'string' },
+      render: (_args, value) => [{ type: 'text', text: value }],
+    },
+    execute(args, exec): Promise<string> {
       if (args.name !== undefined && args.what !== 'api' && args.what !== 'events') {
         throw new Error('name is valid only with what:"api" or what:"events"')
       }
@@ -94,7 +98,7 @@ export function apply(ctx: Context, config: Config): void {
       const text = selected
         .map(([heading, body]) => `## ${heading}\n${body().join('\n')}`)
         .join('\n\n')
-      return Promise.resolve([{ type: 'text', text }])
+      return Promise.resolve(text)
     },
     presentCall: presentInspectCall,
   }))
@@ -119,13 +123,14 @@ export function apply(ctx: Context, config: Config): void {
       + 'Inside `apply`, use the standard cordis API: `ctx.on(event, listener)` to observe '
       + 'events (see cordis_inspect what:"events"), or call '
       + '`harness.registerTool(ctx, harness.defineTool({ name, description, parameters: '
-      + '{ text: { type: \'string\', required: true } }, async execute(args) { … } }))` '
+      + '{ text: { type: \'string\', required: true } }, output: { schema: { type: \'string\' }, '
+      + 'render(_args, value) { return [{ type: \'text\', text: value }] } }, async execute(args) { return args.text } }))` '
       + 'to give yourself a new tool — it becomes callable on your NEXT step. '
-      + 'Tool parameters: each key IS a property — { type: \'string\'|\'number\'|\'boolean\'|\'object\'|\'array\', '
-      + 'required?: true, description?, enum?, items?, properties? }; a JSON-Schema-style '
-      + '{ type: \'object\', properties, required: […] } wrapper and type \'integer\' are also accepted and normalized. A '
-      + 'tool\'s `execute` MUST return an ARRAY of content blocks, e.g. `return '
-      + '[{ type: \'text\', text: someString }]` — never a bare string. '
+      + 'Tool parameters: each key IS a property — { type: \'string\'|\'number\'|\'integer\'|\'boolean\'|\'null\'|\'object\'|\'array\'|\'json\', '
+      + 'required?: true, description?, enum?, const?, items?, properties? }; every direct DSL object declares additionalProperties: true|false, and '
+      + 'oneOf: [schema, schema, ...] replaces type for an exact-one union. A raw JSON-Schema { type: \'object\', properties, required?: […] } wrapper is also accepted with open-by-default objects. A '
+      + 'tool\'s `execute` MUST return the lossless JSON value declared by `output.schema`; '
+      + '`output.render(args, value)` separately returns Native/model content blocks. '
       + 'Mounts can COMPOSE: one plugin may `ctx.provide(\'name\', value)` a service and '
       + 'another may declare `inject: [\'name\']` to consume it — the consumer stays pending '
       + 'until the provider exists and returns to pending when the provider is unmounted. '
@@ -157,6 +162,32 @@ export function apply(ctx: Context, config: Config): void {
         description: 'Body of an async JS function; must `return` the plugin to mount.',
       },
     },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          id: { type: 'string', required: true },
+          pluginName: { type: 'string', required: true },
+          state: {
+            type: 'string',
+            required: true,
+            enum: ['pending', 'loading', 'active', 'failed', 'disposed', 'unloading'],
+          },
+          provides: { type: 'array', required: true, items: { type: 'string' } },
+          waitingFor: { type: 'array', required: true, items: { type: 'string' } },
+        },
+      },
+      render: (_args, value) => {
+        const note = value.waitingFor.length > 0
+          ? ` — waiting for service(s): ${value.waitingFor.join(', ')} (activates when provided)`
+          : ''
+        return [{
+          type: 'text',
+          text: `mounted ${value.id} (plugin "${value.pluginName}", state: ${value.state}${note})`,
+        }]
+      },
+    },
     async execute(args) {
       const id = `dyn-${nextId++}`
       const sandbox = createSandbox(id)
@@ -180,10 +211,13 @@ export function apply(ctx: Context, config: Config): void {
       // it mounted but tell the model what it is waiting for.
       const missing = missingServices(ctx, fiber)
       const state = STATE_LABELS[fiber.state]
-      const note = missing.length > 0
-        ? ` — waiting for service(s): ${missing.join(', ')} (activates when provided)`
-        : ''
-      return [{ type: 'text', text: `mounted ${id} (plugin "${pluginName(evaluated)}", state: ${state}${note})` }]
+      return {
+        id,
+        pluginName: pluginName(evaluated),
+        state,
+        provides: providedServices(ctx, fiber),
+        waitingFor: missing,
+      }
     },
     presentCall: presentMountCall,
   }))
@@ -202,6 +236,17 @@ export function apply(ctx: Context, config: Config): void {
         description: 'The dynamic mount id returned by cordis_mount (e.g. "dyn-1").',
       },
     },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          id: { type: 'string', required: true },
+          pluginName: { type: 'string', required: true },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: `unmounted ${value.id} (plugin "${value.pluginName}")` }],
+    },
     async execute(args) {
       const mount = mounts.get(args.id)
       if (!mount) {
@@ -209,7 +254,7 @@ export function apply(ctx: Context, config: Config): void {
       }
       await mount.fiber.dispose()
       mounts.delete(args.id)
-      return [{ type: 'text', text: `unmounted ${args.id} (plugin "${mount.pluginName}")` }]
+      return { id: args.id, pluginName: mount.pluginName }
     },
     presentCall: presentUnmountCall,
   }))

packages/cordis/tool-cordis/src/inspect.ts

@@ -33,8 +33,13 @@ function withinFiber(fiber: Fiber, root: Fiber): boolean {
   }
 }
 
-/** The service names provided by a mount's fiber subtree, sorted. */
-function providedBy(ctx: Context, fiber: Fiber): string[] {
+/**
+ * Return the service names provided by a mount's fiber subtree.
+ * @param ctx - the runtime whose service registrations are inspected.
+ * @param fiber - the root of the mounted fiber subtree.
+ * @returns the provided service names in lexical order.
+ */
+export function providedServices(ctx: Context, fiber: Fiber): string[] {
   return liveImpls(ctx)
     .filter(impl => withinFiber(impl.fiber, fiber))
     .map(impl => impl.name)
@@ -96,7 +101,7 @@ export function describeTools(ctx: Context, scope?: ScopeKey): string[] {
 export function describeDynamic(ctx: Context, mounts: ReadonlyMap<string, DynamicMount>): string[] {
   if (mounts.size === 0) return ['(no dynamic plugins mounted)']
   return [...mounts].map(([id, mount]) => {
-    const provides = providedBy(ctx, mount.fiber)
+    const provides = providedServices(ctx, mount.fiber)
     const waiting = missingServices(ctx, mount.fiber)
     const providesNote = provides.length > 0 ? ` — provides: ${provides.join(', ')}` : ''
     const waitingNote = waiting.length > 0 ? ` — waiting for: ${waiting.join(', ')}` : ''

packages/cordis/tool-cordis/tests/cross-mount.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { call, CONSUMER_CODE, PROVIDER_CODE, setup, text } from './helpers.ts'
+import { call, CONSUMER_CODE, CONTENT_OUTPUT_CODE, PROVIDER_CODE, setup, text } from './helpers.ts'
 
 /**
  * Cross-mount composition through ordinary cordis provide/inject semantics:
@@ -116,6 +116,7 @@ describe('cross-mount provide/inject', () => {
               name: 'answer',
               description: 'Read the provided primitive services.',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() {
                 return [{ type: 'text', text: ctx.answer + '/' + ctx.get('answer') + '/' + ctx.nothing }]
               },

packages/cordis/tool-cordis/tests/helpers.ts

@@ -47,6 +47,13 @@ export const LISTENER_CODE = `
   }
 `
 
+/** Explicit content-array output declaration for dynamic-tool behavior fixtures. */
+export const CONTENT_OUTPUT_CODE = `
+              output: {
+                schema: { type: 'array', items: { type: 'json' } },
+                render(_args, value) { return value },
+              },`
+
 /** Mount code for a self-made tool: registers `reverse_text` via the sandbox's harness helpers. */
 export const REVERSE_TOOL_CODE = `
   return {
@@ -57,8 +64,14 @@ export const REVERSE_TOOL_CODE = `
         name: 'reverse_text',
         description: 'Reverse a string.',
         parameters: { text: { type: 'string', required: true } },
+        output: {
+          schema: { type: 'string' },
+          render(_args, value) {
+            return [{ type: 'text', text: value }]
+          },
+        },
         async execute(args) {
-          return [{ type: 'text', text: args.text.split('').reverse().join('') }]
+          return args.text.split('').reverse().join('')
         },
       }))
     },
@@ -85,8 +98,14 @@ export const CONSUMER_CODE = `
         name: 'greet',
         description: 'Greet someone via the greeter service.',
         parameters: { name: { type: 'string', required: true } },
+        output: {
+          schema: { type: 'string' },
+          render(_args, value) {
+            return [{ type: 'text', text: value }]
+          },
+        },
         async execute(args) {
-          return [{ type: 'text', text: ctx.greeter.greet(args.name) }]
+          return ctx.greeter.greet(args.name)
         },
       }))
     },
@@ -99,8 +118,9 @@ export function dummyTool(name: string): ToolDefinition {
     name,
     description: 'test trigger',
     parameters: { type: 'object' as const, properties: {} },
-    async execute(): Promise<[]> {
-      return []
+    output: { schema: { type: 'null' }, render: () => [] },
+    async execute(): Promise<null> {
+      return null
     },
   }
 }

packages/cordis/tool-cordis/tests/inspect.spec.ts

@@ -16,6 +16,8 @@ describe('cordis_inspect', () => {
     const result = await call(ctx, 'cordis_inspect', {})
     expect(result.isError).toBe(false)
     const report = text(result)
+    if (result.isError) throw new Error('expected cordis_inspect success')
+    expect(result.value).toBe(report)
     for (const heading of ['services', 'plugins', 'tools', 'dynamic', 'api', 'events']) {
       expect(report).toContain(`## ${heading}`)
     }

packages/cordis/tool-cordis/tests/mount.spec.ts

@@ -1,7 +1,8 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { isJsonValue } from '@deepseek-ai/dsh-session'
+import { sandboxDefineTool } from '../src/guard.ts'
 import { syntaxErrorContext } from '../src/sandbox.ts'
-import { call, dummyTool, LISTENER_CODE, REVERSE_TOOL_CODE, setup, text } from './helpers.ts'
+import { call, CONTENT_OUTPUT_CODE, dummyTool, LISTENER_CODE, REVERSE_TOOL_CODE, setup, text } from './helpers.ts'
 
 /**
  * The `cordis_mount` success/failure family: real plugins land on a genuine
@@ -14,12 +15,48 @@ afterEach(() => {
 })
 
 describe('cordis_mount', () => {
+  it.each([
+    [42, 'options must be an object'],
+    [{ parameters: {} }, 'output must declare { schema, render, presentationMeta? }'],
+    [{ parameters: {}, output: { schema: { type: 'json' } }, execute: async (): Promise<null> => null }, 'output.render must be a function'],
+    [{ parameters: {}, output: { schema: { type: 'json' }, render: () => [] }, execute: true }, 'execute must be a function'],
+    [{
+      parameters: {},
+      output: { schema: { type: 'json' }, render: () => [], presentationMeta: true },
+      execute: async (): Promise<null> => null,
+    }, 'output.presentationMeta must be a function'],
+  ])('rejects an invalid dynamic tool declaration before registration: %j', (definition, message) => {
+    expect(() => sandboxDefineTool(definition)).toThrow(message)
+  })
+
+  it('bounds the preview of an invalid dynamic renderer return', () => {
+    const definition = sandboxDefineTool({
+      name: 'invalid-renderer',
+      description: 'invalid renderer',
+      parameters: {},
+      output: {
+        schema: { type: 'string' },
+        render: () => ['x'.repeat(500)],
+      },
+      execute: async () => 'ok',
+    })
+    expect(() => definition.output.render({}, 'ok')).toThrow(/output\.render returned \["x+…/)
+  })
+
   it('mounts a listener plugin that observes real events, tagged-logging through to the host console', async () => {
     const ctx = await setup()
     const log = vi.spyOn(console, 'log').mockImplementation(() => {})
 
     const result = await call(ctx, 'cordis_mount', { code: LISTENER_CODE })
     expect(result.isError).toBe(false)
+    if (result.isError) throw new Error('expected cordis_mount success')
+    expect(result.value).toEqual({
+      id: 'dyn-1',
+      pluginName: 'change-logger',
+      state: 'active',
+      provides: [],
+      waitingFor: [],
+    })
     expect(text(result)).toContain('mounted dyn-1 (plugin "change-logger", state: active)')
 
     // Fire a REAL tools/change by registering a tool; the mounted listener logs.
@@ -44,6 +81,8 @@ describe('cordis_mount', () => {
     expect(ctx.tools.schemas().map(schema => schema.name)).toContain('reverse_text')
     const reversed = await call(ctx, 'reverse_text', { text: 'harness' })
     expect(reversed.isError).toBe(false)
+    if (reversed.isError) throw new Error('expected dynamic tool success')
+    expect(reversed.value).toBe('ssenrah')
     expect(text(reversed)).toBe('ssenrah')
   })
 
@@ -55,7 +94,7 @@ describe('cordis_mount', () => {
     expect(isJsonValue({ content: reversed.content, isError: reversed.isError })).toBe(true)
   })
 
-  it('threads the { content, meta } object return form through to the registry result', async () => {
+  it('projects presentation metadata from a dynamic canonical value', async () => {
     const ctx = await setup()
     await call(ctx, 'cordis_mount', {
       code: `
@@ -67,8 +106,13 @@ describe('cordis_mount', () => {
               name: 'meta_tool',
               description: 'attaches a private presentation payload',
               parameters: {},
+              output: {
+                schema: { type: 'string' },
+                render(_args, value) { return [{ type: 'text', text: value }] },
+                presentationMeta() { return { kind: 'demo' } },
+              },
               async execute() {
-                return { content: [{ type: 'text', text: 'ok' }], meta: { kind: 'demo' } }
+                return 'ok'
               },
             }))
           },
@@ -77,20 +121,20 @@ describe('cordis_mount', () => {
     })
     const result = await call(ctx, 'meta_tool', {})
     expect(result.isError).toBe(false)
+    if (result.isError) throw new Error('expected dynamic tool success')
+    expect(result.value).toBe('ok')
     expect(text(result)).toBe('ok')
     expect(result.meta).toEqual({ kind: 'demo' })
   })
 
   it.each([
-    ['a bare string', 'return \'ok\'', '"ok"'],
-    ['an object whose content is a string', 'return { content: \'ok\' }', '{"content":"ok"}'],
-    ['an array of non-objects', 'return [\'ok\']', '["ok"]'],
-    ['blocks missing the type tag', 'return [{ text: \'hi\' }]', '[{"text":"hi"}]'],
-    ['object-form blocks missing the type tag', 'return { content: [{ text: \'hi\' }] }', '{"content":[{"text":"hi"}]}'],
-    ['undefined — a forgotten return', 'return undefined', 'undefined'],
-  ])('rejects an execute return of %s as that one call\'s teaching error', async (_label, returnStatement, preview) => {
-    // The registry spreads result.content, so { content: 'ok' } would become ['o','k']; reject
-    // it as this call's error before it corrupts the next request.
+    ['a bare string', 'return \'ok\'', 'returned invalid output: "value" must be an array'],
+    ['an object whose content is a string', 'return { content: \'ok\' }', 'returned invalid output: "value" must be an array'],
+    ['an array of non-objects', 'return [\'ok\']', 'output.render returned ["ok"]'],
+    ['blocks missing the type tag', 'return [{ text: \'hi\' }]', 'output.render returned [{"text":"hi"}]'],
+    ['object-form blocks missing the type tag', 'return { content: [{ text: \'hi\' }] }', 'returned invalid output: "value" must be an array'],
+    ['undefined — a forgotten return', 'return undefined', 'execute result must be lossless JSON data'],
+  ])('rejects an execute return of %s against its declared output', async (_label, returnStatement, diagnostic) => {
     const ctx = await setup()
     await call(ctx, 'cordis_mount', {
       code: `
@@ -102,6 +146,7 @@ describe('cordis_mount', () => {
               name: 'bad_return_tool',
               description: 'returns a wrong shape',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() { ${returnStatement} },
             }))
           },
@@ -112,12 +157,10 @@ describe('cordis_mount', () => {
     expect(result.isError).toBe(true)
     expect(result.content).toHaveLength(1)
     expect(result.content[0]!.type).toBe('text')
-    expect(text(result)).toContain(`execute returned ${preview}`)
-    expect(text(result)).toContain('must return an ARRAY of content blocks')
-    expect(text(result)).toContain('✓ return { content: [{ type: \'text\', text: someString }], meta: anyJsonValue }')
+    expect(text(result)).toContain(diagnostic)
   })
 
-  it('truncates a huge invalid execute return in the teaching error', async () => {
+  it('does not echo a huge schema-invalid canonical value in the diagnostic', async () => {
     const ctx = await setup()
     await call(ctx, 'cordis_mount', {
       code: `
@@ -129,6 +172,7 @@ describe('cordis_mount', () => {
               name: 'huge_return_tool',
               description: 'returns a huge wrong shape',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() { return 'x'.repeat(500) },
             }))
           },
@@ -137,7 +181,7 @@ describe('cordis_mount', () => {
     })
     const result = await call(ctx, 'huge_return_tool', {})
     expect(result.isError).toBe(true)
-    expect(text(result)).toContain('…')
+    expect(text(result)).toContain('returned invalid output')
     expect(text(result)).not.toContain('x'.repeat(200))
   })
 
@@ -156,14 +200,18 @@ describe('cordis_mount', () => {
               description: 'written in the JSON-Schema dialect',
               parameters: {
                 type: 'object',
+                title: 'Raw parameters',
+                default: { text: 'default' },
+                examples: [{ text: 'example' }],
                 properties: {
                   text: { type: 'string', description: 'the text' },
                   count: { type: 'integer', default: 1 },
                   mode: { type: 'string', enum: ['fast', 'slow'] },
-                  extra: { type: 'string', required: false },
+                  extra: { type: 'string' },
                 },
                 required: ['text'],
               },
+              ${CONTENT_OUTPUT_CODE}
               async execute(args) { return [{ type: 'text', text: args.text + ':' + (args.count ?? 0) }] },
             }))
           },
@@ -173,14 +221,19 @@ describe('cordis_mount', () => {
     expect(result.isError).toBe(false)
 
     // The registered schema is canonical JSON Schema derived from the DSL:
-    // the required array survived, integer became number, extra is optional.
+    // the required array survived, integer stayed integer, extra is optional.
     const schema = ctx.tools.schemas().find(s => s.name === 'json_schema_tool')!
     const parameters = schema.parameters as {
       properties: Record<string, { type: string; enum?: string[]; default?: unknown }>
       required?: string[]
     }
     expect(parameters.required).toEqual(['text'])
-    expect(parameters.properties.count!.type).toBe('number')
+    expect(parameters).toMatchObject({
+      title: 'Raw parameters',
+      default: { text: 'default' },
+      examples: [{ text: 'example' }],
+    })
+    expect(parameters.properties.count!.type).toBe('integer')
     expect(parameters.properties.count!.default).toBe(1)
     expect(parameters.properties.mode!.enum).toEqual(['fast', 'slow'])
     // Arg validation enforces the normalized spec: text required, extra not.
@@ -202,8 +255,12 @@ describe('cordis_mount', () => {
               name: 'nested_json_schema_tool',
               description: 'nested dialect',
               parameters: {
-                cfg: { type: 'object', properties: { label: { type: 'string' } }, required: ['label'] },
+                type: 'object',
+                properties: {
+                  cfg: { type: 'object', properties: { label: { type: 'string' } }, required: ['label'] },
+                },
               },
+              ${CONTENT_OUTPUT_CODE}
               async execute(args) { return [{ type: 'text', text: args.cfg.label }] },
             }))
           },
@@ -217,14 +274,198 @@ describe('cordis_mount', () => {
     expect(text(await call(ctx, 'nested_json_schema_tool', { cfg: { label: 'hi' } }))).toBe('hi')
   })
 
+  it('normalizes every unified DSL node and lossless annotation shape across the sandbox realm', async () => {
+    const ctx = await setup()
+    const result = await call(ctx, 'cordis_mount', {
+      code: `
+        return {
+          name: 'unified-schema',
+          inject: ['tools'],
+          apply(ctx) {
+            harness.registerTool(ctx, harness.defineTool({
+              name: 'unified_schema_tool',
+              description: 'all unified nodes',
+              parameters: {
+                any: {
+                  type: 'json',
+                  title: 'Any JSON',
+                  default: { nested: [1, 'x', null] },
+                  examples: [{ ok: true }],
+                },
+                choice: {
+                  oneOf: [{ type: 'string', const: 'x' }, { type: 'null' }],
+                  required: true,
+                },
+                flags: { type: 'array' },
+                closed: { type: 'object', additionalProperties: false },
+                count: { type: 'number', enum: [1, 2], const: 1 },
+              },
+              ${CONTENT_OUTPUT_CODE}
+              async execute(args) { return [{ type: 'text', text: String(args.choice) }] },
+            }))
+          },
+        }
+      `,
+    })
+    expect(result.isError).toBe(false)
+    const schema = ctx.tools.schemas().find(s => s.name === 'unified_schema_tool')!
+    expect(schema.parameters).toMatchObject({
+      properties: {
+        any: { title: 'Any JSON', default: { nested: [1, 'x', null] }, examples: [{ ok: true }] },
+        choice: { oneOf: [{ type: 'string', const: 'x' }, { type: 'null' }] },
+        flags: { type: 'array' },
+        closed: { type: 'object', additionalProperties: false },
+        count: { type: 'number', enum: [1, 2], const: 1 },
+      },
+      required: ['choice'],
+    })
+  })
+
+  it('normalizes and snapshots deeply nested sandbox schemas and annotations stack-safely', async () => {
+    const ctx = await setup()
+    const depth = 5_000
+    const result = await call(ctx, 'cordis_mount', {
+      code: `
+        return {
+          name: 'deep-unified-schema',
+          inject: ['tools'],
+          apply(ctx) {
+            let choice = { type: 'string' }
+            let example = 'leaf'
+            for (let index = 0; index < ${depth}; index++) {
+              choice = { oneOf: [choice, { type: 'null' }] }
+              example = [example]
+            }
+            harness.registerTool(ctx, harness.defineTool({
+              name: 'deep_unified_schema_tool',
+              description: 'deep unified nodes',
+              parameters: {
+                choice: { ...choice, required: true },
+                any: { type: 'json', default: example },
+              },
+              ${CONTENT_OUTPUT_CODE}
+              async execute() { return [] },
+            }))
+          },
+        }
+      `,
+    })
+    expect(result.isError).toBe(false)
+
+    const parameters = ctx.tools.schemas().find(s => s.name === 'deep_unified_schema_tool')!.parameters as {
+      properties: Record<string, Record<string, unknown>>
+    }
+    let choice = parameters.properties.choice!
+    let choiceDepth = 0
+    while (Array.isArray(choice.oneOf)) {
+      choice = choice.oneOf[0] as Record<string, unknown>
+      choiceDepth++
+    }
+    let example: unknown = parameters.properties.any!.default
+    let exampleDepth = 0
+    while (Array.isArray(example)) {
+      example = example[0]
+      exampleDepth++
+    }
+    expect({ choiceDepth, choice, exampleDepth, example }).toEqual({
+      choiceDepth: depth,
+      choice: { type: 'string' },
+      exampleDepth: depth,
+      example: 'leaf',
+    })
+  })
+
+  it('normalizes unconstrained and closed nested nodes from a raw JSON Schema wrapper', async () => {
+    const ctx = await setup()
+    const result = await call(ctx, 'cordis_mount', {
+      code: `
+        return {
+          name: 'raw-unified-schema',
+          inject: ['tools'],
+          apply(ctx) {
+            harness.registerTool(ctx, harness.defineTool({
+              name: 'raw_unified_schema_tool',
+              description: 'raw unified nodes',
+              parameters: {
+                type: 'object',
+                additionalProperties: true,
+                properties: {
+                  any: { description: 'unconstrained' },
+                  cfg: {
+                    type: 'object',
+                    additionalProperties: false,
+                    properties: { label: { type: 'string' } },
+                    required: ['label'],
+                  },
+                  choice: { oneOf: [{ type: 'boolean' }, { type: 'null' }] },
+                },
+              },
+              ${CONTENT_OUTPUT_CODE}
+              async execute() { return [] },
+            }))
+          },
+        }
+      `,
+    })
+    expect(result.isError).toBe(false)
+    expect(ctx.tools.schemas().find(s => s.name === 'raw_unified_schema_tool')!.parameters).toMatchObject({
+      properties: {
+        any: {},
+        cfg: { additionalProperties: false, required: ['label'] },
+        choice: { oneOf: [{ type: 'boolean' }, { type: 'null' }] },
+      },
+    })
+  })
+
   it.each([
-    ['parameters: 42', 'must be a SchemaSpec object'],
-    ['parameters: { text: 42 }', 'parameters.text must be a SchemaSpec property object'],
-    ['parameters: { text: { type: \'str\' } }', 'parameters.text must declare a valid type: \'string\' | \'number\' | \'boolean\' | \'object\' | \'array\' (got "str")'],
-    ['parameters: { text: { type: \'string\', required: \'yes\' } }', 'parameters.text.required must be a boolean when present'],
-    ['parameters: { text: { type: \'string\', properties: {} } }', 'parameters.text.properties is only valid for type "object"'],
-    ['parameters: { text: { type: \'string\', items: { type: \'string\' } } }', 'parameters.text.items is only valid for type "array"'],
-  ])('rejects a malformed SchemaSpec (%s) with a teaching error', async (parameters, message) => {
+    ['parameters: 42', 'must be a ParameterSchemaSpec object'],
+    ['parameters: Object.defineProperty({}, \'text\', { value: { type: \'string\' } })', 'parameters must contain only own enumerable string keys'],
+    ['parameters: { text: 42 }', 'parameters.text must be a ParameterSchemaSpec property object'],
+    ['parameters: { text: Object.defineProperty({ type: \'string\' }, \'minimum\', { value: 1 }) }', 'parameters.text must contain only own enumerable string keys'],
+    ['parameters: { text: { type: \'string\', [Symbol(\'hidden\')]: true } }', 'parameters.text must contain only own enumerable string keys'],
+    ['parameters: { text: { type: \'str\' } }', 'parameters.text must declare a valid type: \'string\' | \'number\' | \'integer\' | \'boolean\' | \'null\' | \'object\' | \'array\' | \'json\' (got "str")'],
+    ['parameters: { text: { type: \'string\', required: \'yes\' } }', 'parameters.text.required must be true when present'],
+    ['parameters: { text: { type: \'string\', properties: {} } }', 'parameters.text.properties is not supported by the unified schema DSL'],
+    ['parameters: { text: { type: \'string\', items: { type: \'string\' } } }', 'parameters.text.items is not supported by the unified schema DSL'],
+    ['parameters: { text: { type: \'object\', properties: {} } }', 'parameters.text.additionalProperties must be explicitly true or false'],
+    ['parameters: { text: { type: \'object\', additionalProperties: \'no\' } }', 'parameters.text.additionalProperties must be explicitly true or false'],
+    ['parameters: { type: \'object\' }', 'parameters.properties must be an object of schemas'],
+    ['parameters: { type: \'object\', properties: {}, additionalProperties: false }', 'parameters.additionalProperties must be true or omitted'],
+    ['parameters: { type: \'object\', properties: {}, required: \'text\' }', 'parameters.required must be an array of declared property names'],
+    ['parameters: { type: \'object\', properties: {}, required: undefined }', 'parameters.required must be an array of declared property names'],
+    ['parameters: { type: \'object\', properties: {}, required: [42] }', 'parameters.required must be an array of declared property names'],
+    ['parameters: (() => { const required = []; required.length = 1; return { type: \'object\', properties: {}, required } })()', 'parameters.required must be an array of declared property names'],
+    ['parameters: (() => { const required = []; required.length = 1; required.extra = true; return { type: \'object\', properties: {}, required } })()', 'parameters.required must be an array of declared property names'],
+    ['parameters: (() => { class Names extends Array { *[Symbol.iterator]() {} }; const required = new Names(); required[0] = \'text\'; required.length = 1; return { type: \'object\', properties: { text: { type: \'string\' } }, required } })()', 'parameters.required must be an array of declared property names'],
+    ['parameters: { type: \'object\', properties: {}, required: [\'text\'] }', 'parameters.required names undeclared property "text"'],
+    ['parameters: { type: \'object\', properties: { text: { type: \'string\', required: true } } }', 'parameters.text.required belongs to the containing raw object schema'],
+    ['parameters: { type: \'object\', properties: { text: { oneOf: \'bad\' } } }', 'parameters.text.oneOf must contain at least two schemas'],
+    ['parameters: { type: \'object\', properties: { text: { type: \'json\' } } }', 'parameters.text must declare a valid type'],
+    ['parameters: { type: \'object\', properties: { cfg: { type: \'object\', additionalProperties: \'no\' } } }', 'parameters.cfg.additionalProperties must be a boolean'],
+    ['parameters: { type: \'object\', properties: { cfg: { type: \'object\', properties: 42 } } }', 'parameters.cfg.properties must be an object of schemas'],
+    ['parameters: { type: \'object\', properties: { cfg: { type: \'object\', required: [\'label\'] } } }', 'parameters.cfg.required names undeclared property "label"'],
+    ['parameters: { type: \'object\', properties: { cfg: { type: \'object\', required: undefined } } }', 'parameters.cfg.required must be an array of declared property names'],
+    ['parameters: { value: { oneOf: \'bad\' } }', 'parameters.value.oneOf must contain at least two schemas'],
+    ['parameters: { value: { oneOf: new (class Branches extends Array {})({ type: \'string\' }, { type: \'null\' }) } }', 'parameters.value.oneOf must contain at least two schemas'],
+    ['parameters: { value: { oneOf: Object.assign([{ type: \'string\' }, { type: \'null\' }], { extra: true }) } }', 'parameters.value.oneOf must contain at least two schemas'],
+    ['parameters: { value: { type: \'string\', enum: \'bad\' } }', 'enum must be a non-empty array'],
+    ['parameters: { value: { type: \'string\', enum: new (class Values extends Array {})(\'a\', \'b\') } }', 'parameters.value.enum must be a non-empty array'],
+    ['parameters: { value: { type: \'json\', default: -0 } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: Infinity } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: () => 1 } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: (() => { const v = {}; v.self = v; return v })() } }', 'parameters.value.default.self must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: Array(2) } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: Object.assign([1], { extra: true }) } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: (() => { const v = Array(1); v.extra = true; return v })() } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: Object.defineProperty({}, \'hidden\', { value: true }) } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: { [Symbol(\'hidden\')]: true } } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: new (class DefaultValue { constructor() { this.ok = true } })() } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: new (class DefaultList extends Array {})() } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: { value: { type: \'json\', default: new Date(0) } }', 'parameters.value.default must be lossless JSON data'],
+    ['parameters: (() => { const p = Object.create(null); const C = function C() {}; Object.defineProperty(C, \'name\', { value: \'Object\' }); C.prototype = p; Object.defineProperty(p, \'constructor\', { value: C }); return Object.create(p) })()', 'must be a ParameterSchemaSpec object'],
+    ['parameters: (() => { const p = Object.create(null); const C = function C() {}; Object.defineProperty(C, \'name\', { value: \'Object\' }); C.prototype = p; const r = Proxy.revocable(C, {}); Object.defineProperty(p, \'constructor\', { value: r.proxy }); r.revoke(); return Object.create(p) })()', 'must be a ParameterSchemaSpec object'],
+    ['parameters: Object.create(Object.create(null))', 'must be a ParameterSchemaSpec object'],
+  ])('rejects a malformed ParameterSchemaSpec (%s) with a teaching error', async (parameters, message) => {
     const ctx = await setup()
     const result = await call(ctx, 'cordis_mount', {
       code: `
@@ -236,6 +477,7 @@ describe('cordis_mount', () => {
               name: 'bad_schema_tool',
               description: 'bad',
               ${parameters},
+              ${CONTENT_OUTPUT_CODE}
               async execute() { return [] },
             }))
           },
@@ -246,7 +488,83 @@ describe('cordis_mount', () => {
     expect(text(result)).toContain(message)
   })
 
-  it('accepts a nested object/array SchemaSpec (the DSL recursion)', async () => {
+  it.each([
+    [
+      `
+        const parameters = {}
+        const item = { type: 'array' }
+        item.items = item
+        parameters.item = item
+      `,
+      'parameters.item.items is circular',
+    ],
+    [
+      `
+        const parameters = {}
+        const item = { type: 'object', additionalProperties: true, properties: parameters }
+        parameters.item = item
+      `,
+      'parameters.item.properties is circular',
+    ],
+  ])('rejects circular sandbox schemas without exhausting the call stack', async (declaration, message) => {
+    const ctx = await setup()
+    const result = await call(ctx, 'cordis_mount', {
+      code: `
+        return {
+          name: 'circular-schema',
+          inject: ['tools'],
+          apply(ctx) {
+            ${declaration}
+            harness.registerTool(ctx, harness.defineTool({
+              name: 'circular_schema_tool',
+              description: 'circular',
+              parameters,
+              async execute() { return [] },
+            }))
+          },
+        }
+      `,
+    })
+    expect(result.isError).toBe(true)
+    expect(text(result)).toContain(message)
+  })
+
+  it('preserves literal __proto__ keys in sandbox schemas and annotations', async () => {
+    const ctx = await setup()
+    const result = await call(ctx, 'cordis_mount', {
+      code: `
+        return {
+          name: 'proto-schema',
+          inject: ['tools'],
+          apply(ctx) {
+            harness.registerTool(ctx, harness.defineTool({
+              name: 'proto_schema_tool',
+              description: 'literal JSON keys',
+              parameters: {
+                ['__proto__']: { type: 'string', required: true },
+                value: { type: 'json', default: { ['__proto__']: { safe: true } } },
+              },
+              ${CONTENT_OUTPUT_CODE}
+              async execute() { return [] },
+            }))
+          },
+        }
+      `,
+    })
+
+    expect(result.isError).toBe(false)
+    const parameters = ctx.tools.schemas().find(schema => schema.name === 'proto_schema_tool')!.parameters as {
+      properties: Record<string, { default?: unknown }>
+      required?: string[]
+    }
+    expect(Object.hasOwn(parameters.properties, '__proto__')).toBe(true)
+    expect(parameters.required).toContain('__proto__')
+    const defaultValue = parameters.properties.value!.default as Record<string, unknown>
+    expect(Object.hasOwn(defaultValue, '__proto__')).toBe(true)
+    expect(defaultValue.__proto__).toEqual({ safe: true })
+  })
+
+  it('accepts a nested object/array ParameterSchemaSpec (the DSL recursion)', async () => {
     const ctx = await setup()
     const result = await call(ctx, 'cordis_mount', {
       code: `
@@ -258,9 +576,10 @@ describe('cordis_mount', () => {
               name: 'nested_schema_tool',
               description: 'nested',
               parameters: {
-                item: { type: 'object', required: true, properties: { label: { type: 'string', required: true } } },
+                item: { type: 'object', additionalProperties: true, required: true, properties: { label: { type: 'string', required: true } } },
                 tags: { type: 'array', items: { type: 'string' } },
               },
+              ${CONTENT_OUTPUT_CODE}
               async execute(args) { return [{ type: 'text', text: args.item.label }] },
             }))
           },
@@ -284,6 +603,7 @@ describe('cordis_mount', () => {
               name: 'raw_dynamic_tool',
               description: 'raw',
               parameters: { type: 'object', properties: {} },
+              ${CONTENT_OUTPUT_CODE}
               async execute() { return [] },
             })
           },
@@ -337,6 +657,14 @@ describe('cordis_mount', () => {
       code: 'return { name: \'waiter\', inject: [\'no-such-service\'], apply(ctx) {} }',
     })
     expect(result.isError).toBe(false)
+    if (result.isError) throw new Error('expected pending cordis_mount success')
+    expect(result.value).toEqual({
+      id: 'dyn-1',
+      pluginName: 'waiter',
+      state: 'pending',
+      provides: [],
+      waitingFor: ['no-such-service'],
+    })
     expect(text(result)).toContain('state: pending')
     expect(text(result)).toContain('waiting for service(s): no-such-service')
     // Unmounting a pending mount works like any other.
@@ -397,6 +725,7 @@ describe('cordis_mount', () => {
               name: 'cordis_mount',
               description: 'dup',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() { return [] },
             }))
           },
@@ -543,6 +872,7 @@ describe('cordis_mount', () => {
               name: 'probe_instanceof',
               description: 'report instanceof checks across realms',
               parameters: { items: { type: 'array', required: true, items: { type: 'string' } } },
+              ${CONTENT_OUTPUT_CODE}
               async execute(args) {
                 const checks = {
                   hostArray: args.items instanceof Array,

packages/cordis/tool-cordis/tests/sandbox-context.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { call, setup, text } from './helpers.ts'
+import { call, CONTENT_OUTPUT_CODE, setup, text } from './helpers.ts'
 
 /**
  * The sandbox context façade is a whitelist, not a pass-through proxy. Mounted code reaches only
@@ -51,6 +51,7 @@ describe('sandbox context façade — escape surface is closed', () => {
               name: 'smuggled',
               description: 'raw, unguarded',
               parameters: { type: 'object', properties: {} },
+              ${CONTENT_OUTPUT_CODE}
               async execute() { return [] },
             })
           },
@@ -87,6 +88,7 @@ describe('sandbox context façade — escape surface is closed', () => {
               name: 'smuggled_via_service',
               description: 'raw, unguarded',
               parameters: { type: 'object', properties: {} },
+              ${CONTENT_OUTPUT_CODE}
               async execute() { return [] },
             })
           },
@@ -116,6 +118,7 @@ describe('sandbox context façade — escape surface is closed', () => {
               name: 'do_fetch',
               description: 'awaits the host async service',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() {
                 const value = await ctx.hostAsync.grab()
                 return [{ type: 'text', text: value }]
@@ -203,6 +206,7 @@ describe('sandbox context façade — inject gate on services', () => {
               name: 'greet_undeclared',
               description: 'uses greeter without declaring it',
               parameters: { n: { type: 'string', required: true } },
+              ${CONTENT_OUTPUT_CODE}
               async execute(args) { return [{ type: 'text', text: ctx.greeter.greet(args.n) }] },
             }))
           },
@@ -235,6 +239,7 @@ describe('sandbox tools façade — get is a read-only schema view', () => {
               name: 'report_view',
               description: 'reports the shape of a tool view',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() {
                 const view = ctx.tools.get('cordis_mount')
                 return [{ type: 'text', text: JSON.stringify({
@@ -270,6 +275,7 @@ describe('sandbox tools façade — get is a read-only schema view', () => {
               name: 'probe_unknown',
               description: 'reports whether an unknown tool resolves',
               parameters: {},
+              ${CONTENT_OUTPUT_CODE}
               async execute() {
                 return [{ type: 'text', text: String(ctx.tools.get('no_such_tool') === undefined) }]
               },

packages/cordis/tool-cordis/tests/unmount-hmr.spec.ts

@@ -26,6 +26,8 @@ describe('cordis_unmount', () => {
 
     const result = await call(ctx, 'cordis_unmount', { id: 'dyn-1' })
     expect(result.isError).toBe(false)
+    if (result.isError) throw new Error('expected cordis_unmount success')
+    expect(result.value).toEqual({ id: 'dyn-1', pluginName: 'change-logger' })
     expect(text(result)).toContain('unmounted dyn-1')
 
     // Immediately after the awaited unmount, the listener must be gone — no

packages/core/agent-loop/src/tool-calls.ts

@@ -219,7 +219,10 @@ function appendSkippedToolCall(session: Session, turn: number, step: number, blo
   appendToolResult(session, turn, step, block, {
     content: [{ type: 'text', text: 'Error: tool call aborted before dispatch' }],
     isError: true,
-    error: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH },
+    error: {
+      message: 'tool call aborted before dispatch',
+      info: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH },
+    },
   }, callSeq)
 }
 
@@ -245,7 +248,7 @@ function appendToolResult(
     callId: block.id,
     content: result.content,
     isError: result.isError,
-    ...result.error ? { error: result.error } : {},
+    ...result.error?.info ? { error: result.error.info } : {},
     // The tool's private presentation payload (e.g. a result-time diff),
     // persisted so a UI bridge reproduces the card on replay.
     ...result.meta !== undefined ? { meta: result.meta } : {},

packages/core/agent-loop/tests/agent-initiator.spec.ts

@@ -6,7 +6,7 @@ import LlmService, { CallId, LlmAdapter } from '@deepseek-ai/dsh-llm'
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import { MockAdapter, textResponse, toolCallResponse } from './mock-adapter.ts'
 
 const testToolSignal = new AbortController().signal
@@ -189,7 +189,7 @@ describe('AgentLoop initiator scope', () => {
     ctx.on('agent/turn-stop', (subject, _turn, signal) => {
       if (subject === agent) capture(signal)
     })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'observe',
       description: 'observe explicit turn state',
       parameters: {},
@@ -232,7 +232,7 @@ describe('AgentLoop initiator scope', () => {
     let parentWhileChildDriverActive: Agent | undefined
     let child: Agent | undefined
 
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'spawn-child',
       description: 'create one child agent',
       parameters: {},
@@ -244,7 +244,7 @@ describe('AgentLoop initiator scope', () => {
           setup: (agentCtx) => {
             parentDuringSetup = ctx.agents.requireInitiator()
             explicitChild = agentCtx.agent
-            agentCtx.tools.register(defineTool({
+            agentCtx.tools.register(defineContentToolFixture({
               name: 'observe-child',
               description: 'observe child execution identity',
               parameters: {},
@@ -292,7 +292,7 @@ describe('AgentLoop initiator scope', () => {
     let directAmbient: Agent | undefined
     let captured: Agent | undefined
 
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'agentless-probe',
       description: 'observe an agentless call',
       parameters: {},
@@ -302,7 +302,7 @@ describe('AgentLoop initiator scope', () => {
         return [{ type: 'text', text: 'ok' }]
       },
     }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'capability-request',
       description: 'call the test capability transport',
       parameters: { path: { type: 'string' } },

packages/core/agent-loop/tests/cancel.spec.ts

@@ -11,7 +11,7 @@ import { Context } from 'cordis'
 import LlmService, { type Message } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool, TOOL_ABORTED_BEFORE_DISPATCH } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture, TOOL_ABORTED_BEFORE_DISPATCH } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { MockAdapter, textResponse, toolCallResponse } from './mock-adapter.ts'
@@ -365,7 +365,7 @@ describe('Agent.cancel()', () => {
     ])
     const ctx = await harness(adapter)
     let executions = 0
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'danger',
       description: 'must not run after cancellation',
       parameters: {},
@@ -952,7 +952,7 @@ describe('Agent.cancel()', () => {
         })
         break
       case 'tool':
-        ctx.tools.register(defineTool({
+        ctx.tools.register(defineContentToolFixture({
           name: 'blocked',
           description: 'wait for cancellation',
           parameters: {},

packages/core/agent-loop/tests/contract-regressions.spec.ts

@@ -3,7 +3,7 @@ import { Context } from 'cordis'
 import LlmService, { CallId, ContentBlock, MessageSource, ProviderRequestId, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { Session, SessionEvent, SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool, TOOL_ABORTED, TOOL_ABORTED_BEFORE_DISPATCH, type PostToolDecision } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture, TOOL_ABORTED, TOOL_ABORTED_BEFORE_DISPATCH, type PostToolDecision } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent, type ContinuationDecision, type HookContext } from '@deepseek-ai/dsh-agent'
 import AgentLoop, { DEFAULT_MAX_PARALLEL_TOOL_CALLS } from '@deepseek-ai/dsh-agent-loop'
 import { prepareReactLoopAgent } from '../src/agent.ts'
@@ -60,7 +60,7 @@ describe('session log records what agent/step-result actually produced', () => {
     const adapter = new MockAdapter([original, textResponse('done')])
     const ctx = await harness(adapter)
     const executed: string[] = []
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'injected-tool',
       description: '',
       parameters: {},
@@ -229,7 +229,7 @@ describe('abort during tool execution ends the turn', () => {
     const ctx = await harness(adapter)
     const executed: string[] = []
     const agent = ctx.agentLoop.create(SessionId('a1'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'aborter',
       description: '',
       parameters: {},
@@ -250,7 +250,7 @@ describe('abort during tool execution ends the turn', () => {
         source: { kind: 'plugin', plugin: 'abort-test' },
       }],
     }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'second',
       description: '',
       parameters: {},
@@ -332,7 +332,7 @@ describe('abort during tool execution ends the turn', () => {
     const adapter = new MockAdapter([toolCallResponse('c1', 'aborter', {})])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(SessionId('a-abort-injection'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'aborter',
       description: '',
       parameters: {},
@@ -378,7 +378,7 @@ describe('abort during tool execution ends the turn', () => {
     ] satisfies StreamChunk[]])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(SessionId('a-later-abort-context'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'first',
       description: '',
       parameters: {},
@@ -386,7 +386,7 @@ describe('abort during tool execution ends the turn', () => {
         return [{ type: 'text', text: 'first done' }]
       },
     }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'aborter',
       description: '',
       parameters: {},
@@ -427,7 +427,7 @@ describe('abort during tool execution ends the turn', () => {
     const fiber = await ctx.plugin(Object.assign((inner: Context) => {
       agent = inner.agentLoop.create(SessionId('a-dispose-injection'), { provider: 'mock', model: 'mock' })
     }, { inject: ['agentLoop'] }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'waiter',
       description: '',
       parameters: {},
@@ -479,7 +479,7 @@ describe('abort during tool execution ends the turn', () => {
     ])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(SessionId('a-historical-tool-pair'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'aborter',
       description: '',
       parameters: {},
@@ -488,7 +488,7 @@ describe('abort during tool execution ends the turn', () => {
         return [{ type: 'text', text: 'done' }]
       },
     }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'second',
       description: '',
       parameters: {},
@@ -767,7 +767,7 @@ describe('adapter registration, routing, and accepted-input ownership', () => {
     const adapter = new MockAdapter([toolCallResponse('c1', 'noop', {}), textResponse('done')])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(SessionId('a1'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'noop',
       description: '',
       parameters: {},
@@ -850,7 +850,7 @@ describe('adapter registration, routing, and accepted-input ownership', () => {
     const agent = ctx.agentLoop.create(SessionId('owned-steer'), { provider: 'mock', model: 'mock' })
     const entered = Promise.withResolvers<undefined>()
     const release = Promise.withResolvers<undefined>()
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'gate',
       description: '',
       parameters: {},
@@ -1497,7 +1497,7 @@ describe('tool result call identity', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: 'echo',
       parameters: { x: { type: 'number' } },

packages/core/agent-loop/tests/coverage-edges.spec.ts

@@ -4,7 +4,7 @@ import LlmService, { CallId, LlmError, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
 import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -77,7 +77,7 @@ describe('tool JSON parse', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: 'echo tool',
       parameters: { input: { type: 'string' } },
@@ -110,7 +110,7 @@ describe('tool JSON parse', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'noarg',
       description: 'no-arg tool',
       parameters: {},
@@ -259,7 +259,7 @@ describe('structured tool error propagation (the runtime-validation Agent Note,
     ])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(SessionId('a1'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'boom',
       description: 'always fails',
       parameters: {},

packages/core/agent-loop/tests/interception.spec.ts

@@ -3,7 +3,7 @@ import { Context } from 'cordis'
 import LlmService, { CallId, type Message } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId, type SessionEvent, type TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool, type PostToolDecision, type PreToolDecision } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture, type PostToolDecision, type PreToolDecision } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent, type ContinuationDecision, type PromptDecision, type SessionStartSource } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -399,7 +399,7 @@ describe('agent/session-prefix', () => {
       textResponse('again'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo', description: 'echo', parameters: { text: { type: 'string' } },
       async execute(args) { return [{ type: 'text', text: String(args.text) }] },
     }))
@@ -521,7 +521,7 @@ describe('agent/session-prefix', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo', description: 'echo', parameters: { text: { type: 'string' } },
       async execute(args) { return [{ type: 'text', text: String(args.text) }] },
     }))
@@ -574,7 +574,7 @@ describe('agent/turn-continuation (ContinuationDecision)', () => {
   it('a stop decision ends the turn even when the step had tool calls', async () => {
     const adapter = new MockAdapter([toolCallResponse('c1', 'echo', { text: 'hi' })])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo', description: 'echo', parameters: { text: { type: 'string' } },
       async execute(args) { return [{ type: 'text', text: String(args.text) }] },
     }))
@@ -604,7 +604,7 @@ describe('tool additionalContexts buffering across a step', () => {
     ]
     const adapter = new MockAdapter([twoCalls, textResponse('done')])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo', description: 'echo', parameters: { text: { type: 'string' } },
       async execute(args) { return [{ type: 'text', text: String(args.text) }] },
     }))
@@ -646,7 +646,7 @@ describe('tool additionalContexts buffering across a step', () => {
   it('appends multiple contexts deferred by one composite tool after its outer result', async () => {
     const adapter = new MockAdapter([toolCallResponse('c1', 'composite', {}), textResponse('done')])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'composite', description: 'composite', parameters: {},
       async execute(_args, exec) {
         exec.deferContext({ content: [{ type: 'text', text: 'nested-a' }], source: { kind: 'plugin', plugin: 'a' }, meta: { order: 1 } })
@@ -677,7 +677,7 @@ describe('tools/pre-execute gate (native-plugin permission pattern, end-to-end t
     const adapter = new MockAdapter([toolCallResponse('c1', 'danger', {}), textResponse('ok')])
     const ctx = await harness(adapter)
     let ran = false
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'danger', description: 'danger', parameters: {},
       async execute() { ran = true; return [{ type: 'text', text: 'should not run' }] },
     }))
@@ -739,7 +739,7 @@ describe('worked example: a native hook plugin is just a cordis plugin on the se
     const adapter = new MockAdapter([toolCallResponse('c1', 'echo', { text: 'hi' }), textResponse('done')])
     const ctx = await harness(adapter)
     await ctx.plugin(NativeGuard)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo', description: 'echo', parameters: { text: { type: 'string' } },
       async execute(args) { return [{ type: 'text', text: String(args.text) }] },
     }))

packages/core/agent-loop/tests/loop.spec.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import LlmService, { CallId, StreamChunk } from '@deepseek-ai/dsh-llm'
-import SessionStore, { SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
+import SessionStore, { SessionId, TurnEndReason, type JsonValue } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture, defineTool } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -89,7 +89,7 @@ describe('agent loop', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: 'echo back',
       parameters: { text: { type: 'string' } },
@@ -118,22 +118,27 @@ describe('agent loop', () => {
     const types = agent.session.events.map(e => e.type)
     expect(types).toContain('tool/call')
     expect(types).toContain('tool/result')
+    const durableResult = agent.session.events.find(event => event.type === 'tool/result')
+    expect(durableResult?.type === 'tool/result' && 'value' in durableResult.data).toBe(false)
   })
 
-  it('threads a tool-attached meta (execute object return) onto the tool/result event', async () => {
+  it('persists presentation metadata projected from the canonical value', async () => {
     const adapter = new MockAdapter([
       toolCallResponse('c1', 'writer', { path: 'a.txt' }, 'writing'),
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    // A tool that returns the { content, meta } object form: the loop must
-    // persist `meta` on the tool/result event so a UI reproduces the card on replay.
     ctx.tools.register(defineTool({
       name: 'writer',
       description: 'writes a file',
       parameters: { path: { type: 'string' } },
+      output: {
+        schema: { type: 'string' },
+        render: () => [{ type: 'text', text: 'ok' }],
+        presentationMeta: (_args, value) => ({ diffs: [{ path: value, oldText: null, newText: 'x' }] }),
+      },
       async execute() {
-        return { content: [{ type: 'text', text: 'ok' }], meta: { diffs: [{ path: 'a.txt', oldText: null, newText: 'x' }] } }
+        return 'a.txt'
       },
     }))
     const agent = ctx.agentLoop.create(SessionId('a1'), { provider: 'mock', model: 'mock' })
@@ -152,7 +157,7 @@ describe('agent loop', () => {
     // projecting this agent's configured model, so the model knows its own name.
     const ctx = await harness(adapter, 'You are a test agent on {{model}}.')
     ctx.systemPrompt.section({ name: 'tool:noop', order: 100, text: 'Use the noop tool wisely.' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'noop',
       description: 'does nothing',
       parameters: {},
@@ -248,7 +253,7 @@ describe('agent loop', () => {
     ['BigInt', { n: 1n }],
     ['Map', new Map([['key', 'value']])],
     ['class instance', new (class ResultMeta { x = 1 })()],
-  ])('normalizes non-JSON tool meta (%s) before the durable result commit', async (_kind, meta) => {
+  ])('rejects non-JSON presentation metadata (%s) before the durable result commit', async (_kind, meta) => {
     const adapter = new MockAdapter([
       toolCallResponse('bad-meta-call', 'bad-meta', {}, 'calling'),
       textResponse('recovered'),
@@ -258,7 +263,12 @@ describe('agent loop', () => {
       name: 'bad-meta',
       description: 'returns invalid durable metadata',
       parameters: {},
-      execute: () => Promise.resolve({ content: [{ type: 'text' as const, text: 'apparent success' }], meta }),
+      output: {
+        schema: { type: 'string' },
+        render: (_args, value) => [{ type: 'text', text: value }],
+        presentationMeta: () => meta as unknown as JsonValue,
+      },
+      execute: () => Promise.resolve('apparent success'),
     }))
     const agent = ctx.agentLoop.create(SessionId('bad-meta-agent'), { provider: 'mock', model: 'mock' })
 
@@ -271,15 +281,16 @@ describe('agent loop', () => {
       expect(result.data.callId).toBe('bad-meta-call')
       expect(result.data.isError).toBe(true)
       expect(result.data.meta).toBeUndefined()
+      expect(result.data.error).toEqual({ name: 'ToolOutputError', code: 'INVALID_TOOL_OUTPUT' })
       expect(result.data.content).toEqual([{
         type: 'text',
-        text: 'Error: tool result must be losslessly JSON-serializable',
+        text: 'Error: tool "bad-meta" returned invalid output: output.presentationMeta returned non-lossless JSON',
       }])
     }
     // The normalized failure was durably logged and fed back to the model; the
     // turn continued normally instead of failing after an apparent success.
     expect(adapter.requests).toHaveLength(2)
-    expect(JSON.stringify(adapter.requests[1]!.messages)).toContain('losslessly JSON-serializable')
+    expect(JSON.stringify(adapter.requests[1]!.messages)).toContain('output.presentationMeta returned non-lossless JSON')
   })
 
   it('omits the system field when a system-prompt/assemble veto empties the assembly', async () => {
@@ -326,7 +337,7 @@ describe('agent loop', () => {
     const ctx = await harness(adapter)
 
     const agent = ctx.agentLoop.create(SessionId('a1'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'slow',
       description: '',
       parameters: {},
@@ -432,7 +443,7 @@ describe('agent loop', () => {
     const agent = ctx.agentLoop.create(SessionId('a1'), { provider: 'mock', model: 'mock' })
     let visibleDuringTool = false
     const meta = { kind: 'deferred-test', version: 1 }
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'noticer',
       description: 'injects a notice',
       parameters: {},
@@ -494,7 +505,7 @@ describe('agent loop', () => {
     ])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(SessionId('invalid-context'), { provider: 'mock', model: 'mock' })
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'invalid-injector',
       description: 'attempts an invalid context injection',
       parameters: {},
@@ -541,7 +552,7 @@ describe('agent loop', () => {
   it('agent/turn-continuation can veto continuation despite tool calls (budget-guard pattern)', async () => {
     const adapter = new MockAdapter([toolCallResponse('c1', 'echo', { text: 'x' })])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: '',
       parameters: { text: { type: 'string' } },
@@ -589,7 +600,7 @@ describe('agent loop', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo', description: 'echo', parameters: {},
       async execute() { return [{ type: 'text', text: 'echoed' }] },
     }))
@@ -781,7 +792,7 @@ describe('agent loop', () => {
     ]])
     const ctx = await harness(adapter)
     let executions = 0
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: '',
       parameters: { text: { type: 'string' } },
@@ -821,7 +832,7 @@ describe('agent loop', () => {
       { type: 'finish', reason: { kind: 'max-tokens' } },
     ]])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: '',
       parameters: { text: { type: 'string' } },
@@ -908,7 +919,7 @@ describe('agent loop', () => {
       textResponse('continued after tool call'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: '',
       parameters: { text: { type: 'string' } },
@@ -1240,7 +1251,7 @@ describe('agent loop', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'echo',
       description: '',
       parameters: { text: { type: 'string' } },

packages/core/agent-loop/tests/request-cache.e2e.ts

@@ -3,7 +3,7 @@ import { Context } from 'cordis'
 import LlmService from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -45,7 +45,7 @@ async function loopHarness(): Promise<Context> {
   await created.plugin(AgentRegistry)
   await created.plugin(AgentLoop, { agents: [] })
   await created.plugin(LlmDeepSeek)
-  created.tools.register(defineTool({
+  created.tools.register(defineContentToolFixture({
     name: 'lookup',
     description: 'Look up the stored value for a key.',
     parameters: { key: { type: 'string', description: 'The key to look up.' } },

packages/core/agent-loop/tests/request-reconstruction.spec.ts

@@ -11,7 +11,7 @@ import LlmService from '@deepseek-ai/dsh-llm'
 import type { GenerateOptions } from '@deepseek-ai/dsh-llm'
 import SessionStore, { Session, SessionId, foldRequestHeader } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -53,7 +53,7 @@ function expectPrefixExtension(previous: GenerateOptions, current: GenerateOptio
 }
 
 function registerEcho(ctx: Context) {
-  ctx.tools.register(defineTool({
+  ctx.tools.register(defineContentToolFixture({
     name: 'echo',
     description: 'echo back',
     parameters: { text: { type: 'string' } },

packages/core/agent-loop/tests/request-recovery.spec.ts

@@ -11,7 +11,7 @@ import LlmService, {
 import type { GenerateOptions, LlmFailure, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import type { PostToolDecision } from '@deepseek-ai/dsh-tools'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
 import type { Agent } from '@deepseek-ai/dsh-agent'
@@ -133,7 +133,7 @@ describe('agent post-step and request-error lifecycle', () => {
     ]
     const adapter = new FailureScriptAdapter([twoCalls, textResponse('done')])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'work',
       description: 'do work',
       parameters: {},
@@ -222,7 +222,7 @@ describe('agent post-step and request-error lifecycle', () => {
       textResponse('must not continue'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'work',
       description: 'do work',
       parameters: {},
@@ -535,7 +535,7 @@ describe('agent post-step and request-error lifecycle', () => {
       contextError('later overflow'),
     ])
     const resetCtx = await harness(reset)
-    resetCtx.tools.register(defineTool({
+    resetCtx.tools.register(defineContentToolFixture({
       name: 'work',
       description: 'continue',
       parameters: {},

packages/core/agent-loop/tests/scope-lifecycle.spec.ts

@@ -3,7 +3,7 @@ import { Context, symbols, type EffectMeta, type Fiber } from 'cordis'
 import LlmService from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { agentEvents, assembleContextFor } from '@deepseek-ai/dsh-agent'
 
 import type { Agent } from '@deepseek-ai/dsh-agent'
@@ -172,10 +172,10 @@ describe('agent scope lifecycle', () => {
     const handle = await ctx.agents.create({ sessionId: SessionId('s1'), agentOptions: { provider: 'mock', model: 'mock' } })
     const { agent } = handle
     agent.ctx.systemPrompt.section({ name: 'deployment:persona', order: 0, text: 'You run tests.' })
-    agent.ctx.tools.register({
+    agent.ctx.tools.register(defineContentToolFixture({
       name: 'mine', description: 'scoped', parameters: {},
       execute: () => Promise.resolve(text('ran')),
-    })
+    }))
 
     const scopedAssembly = await ctx.systemPrompt.assemble(assembleContextFor(agent))
     expect(scopedAssembly.sections.find(s => s.name === 'deployment:persona')?.text).toBe('You run tests.')
@@ -587,12 +587,12 @@ describe('agent scope lifecycle', () => {
         sessionId: SessionId('dependency-origin-s'),
         agentOptions: { provider: 'mock', model: 'mock' },
         setup: (agentCtx) => {
-          agentCtx.tools.register({
+          agentCtx.tools.register(defineContentToolFixture({
             name: 'dependency-origin-tool',
             description: 'proves AgentLoop dependency origin',
             parameters: {},
             execute: () => Promise.resolve(text('ok')),
-          })
+          }))
           agentCtx.systemPrompt.section({
             name: 'dependency-origin-section',
             order: 1,

packages/core/agent-loop/tests/tool-calls.spec.ts

@@ -9,7 +9,7 @@ import { CallId, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import LlmService from '@deepseek-ai/dsh-llm'
-import ToolRegistry, { defineTool, TOOL_ABORTED_BEFORE_DISPATCH, type PostToolDecision, type PreToolDecision } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture, TOOL_ABORTED_BEFORE_DISPATCH, type PostToolDecision, type PreToolDecision } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { MockAdapter, textResponse } from './mock-adapter.ts'
@@ -61,7 +61,7 @@ function multiCall(calls: { id: string; name: string; args: object }[]): StreamC
 function gatedTool(name: string, parallel: boolean) {
   const gates = new Map<string, () => void>()
   const started: string[] = []
-  const tool = defineTool({
+  const tool = defineContentToolFixture({
     name,
     description: `gated ${name}`,
     parameters: { id: { type: 'string', required: true } },
@@ -123,12 +123,12 @@ describe('tool-call scheduler: grouping and barriers', () => {
       textResponse('done'),
     ])
     const ctx = await harness(adapter)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'r', description: 'read', parameters: { id: { type: 'string', required: true } },
       isConcurrencySafe: () => true,
       async execute(args) { order.push(`r-start-${args.id}`); order.push(`r-end-${args.id}`); return [{ type: 'text', text: 'r' }] },
     }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'w', description: 'write', parameters: { id: { type: 'string', required: true } },
       async execute(args) { order.push(`w-${args.id}`); return [{ type: 'text', text: 'w' }] },
     }))
@@ -150,14 +150,14 @@ describe('tool-call scheduler: grouping and barriers', () => {
     ])
     const ctx = await harness(adapter)
     const replacement = gatedExclusiveTool('x')
-    const disposeSafe = ctx.tools.register(defineTool({
+    const disposeSafe = ctx.tools.register(defineContentToolFixture({
       name: 'x',
       description: 'initially safe',
       parameters: { id: { type: 'string', required: true } },
       isConcurrencySafe: () => true,
       async execute(args) { return [{ type: 'text', text: `old-${args.id}` }] },
     }))
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'replace',
       description: 'replace x',
       parameters: { id: { type: 'string', required: true } },
@@ -539,10 +539,14 @@ describe('tool-call scheduler: abort handling', () => {
       .toEqual([CallId('c1'), CallId('c2'), CallId('c3'), CallId('c4')])
     expect(events(agent).filter(e => e.type === 'tool/result').map(e => e.data.callId))
       .toEqual([CallId('c1'), CallId('c2'), CallId('c3'), CallId('c4')])
-    expect(events(agent).filter(e => e.type === 'tool/result').slice(-2).map(e => e.data))
+    expect(events(agent).filter(e => e.type === 'tool/result').slice(-2).map(e => ({
+      callId: e.data.callId,
+      isError: e.data.isError,
+      errorInfo: e.data.error,
+    })))
       .toEqual([
-        expect.objectContaining({ callId: CallId('c3'), isError: true, error: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH } }),
-        expect.objectContaining({ callId: CallId('c4'), isError: true, error: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH } }),
+        { callId: CallId('c3'), isError: true, errorInfo: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH } },
+        { callId: CallId('c4'), isError: true, errorInfo: { name: 'AbortError', code: TOOL_ABORTED_BEFORE_DISPATCH } },
       ])
     const settled = events(agent).filter(e => e.type === 'tool/result' || e.type === 'context/message')
     expect(settled.map(e => e.type))
@@ -565,7 +569,7 @@ describe('tool-call scheduler: abort handling', () => {
     const gated = gatedParallelTool('p')
     const exclusive: string[] = []
     ctx.tools.register(gated.tool)
-    ctx.tools.register(defineTool({
+    ctx.tools.register(defineContentToolFixture({
       name: 'x',
       description: 'exclusive',
       parameters: { id: { type: 'string', required: true } },

packages/core/agent-loop/tests/tool-order.spec.ts

@@ -12,7 +12,7 @@ import LlmService from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId, foldRequestHeader } from '@deepseek-ai/dsh-session'
 import SystemPrompt, { TOOL_ORDER_REST } from '@deepseek-ai/dsh-system-prompt'
 import type { Config as SystemPromptConfig } from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -42,7 +42,7 @@ function waitForIdle(ctx: Context, agent: Agent): Promise<void> {
 }
 
 function registerNamed(ctx: Context, name: string) {
-  ctx.tools.register(defineTool({
+  ctx.tools.register(defineContentToolFixture({
     name,
     description: `the ${name} tool`,
     parameters: {},

packages/core/agent-loop/tests/turn-stop.spec.ts

@@ -3,7 +3,7 @@ import { Context } from 'cordis'
 import LlmService from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId, type TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
-import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
+import ToolRegistry, { defineContentToolFixture } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { type Agent, type ContinuationStop } from '@deepseek-ai/dsh-agent'
 
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
@@ -39,7 +39,7 @@ function send(agent: Agent, text = 'go'): Promise<void> {
 }
 
 function registerEcho(ctx: Context): void {
-  ctx.tools.register(defineTool({
+  ctx.tools.register(defineContentToolFixture({
     name: 'echo',
     description: 'echo',
     parameters: { text: { type: 'string' } },