feat(gui): step1 skeleton — dsc web serves built web UI over booted harness host

Five new modules: apps/dsc (bin: parseArgs + node:http static server +
signal shutdown), packages/host/apiproxy (programmatic harness core
composition, agents:[]), packages/client/web-runtime (React-free browser
runtime), packages/client/web-ui (React mount), apps/web (vite build
entry producing dist consumed by apps/dsc via package exports).

Root wiring: apps/* workspace glob, dsh-* paths for host/client groups,
demo:web script, apps/web/dist gitignore. No protocol/API routes yet —
contract lands in step2 (see missions/tasks/20260719-1902-apiproxy-api-design).

Includes the design + implementation archives (spec v2.1, deepseekchat
baseline and harness boot research, implementation run log).

Acceptance: 12/12 passed incl. real-key llm.stream smoke (51 chunks).

feat(gui): apiproxy — four-quadrant RPC contract + fetch carriers, live end to end

Contract layer (src/api/, 14 files): four named wire message types
(ClientRequest / ServerResponse / ServerRequest / ClientResponse) as a
discriminated union over strict bidirectional rpcId (initiator mints,
responder echoes; channel and message fully decoupled — HTTP is the
client->server pipe, SSE the reverse); narrow RpcRequest<P>/
RpcResponse<T> signature forms; RpcMethodMap with RequestPayload<K>/
ResponseValue<K> derivation; typed RpcError details map; approval/
question responses modeled as ClientResponse via a single /api/respond
endpoint (RpcReceipt carrier ack); zod schemas anchored per Wire<T>
against exactOptionalPropertyTypes.

impl/api-proxy.ts: describe/list/create, both SSE streams (frame queue
pump, subscribed baseline, lifecycle frames, signal cleanup); history
pages on message boundaries (tail-back scan, partial included in the
tail page); prompt dispatches queue->agent.send / steer->agent.steer
with rpcId carried through MessageSource; cancel for attached sessions;
cold-session resume deduped via a per-id promise map; host-level
provider/model defaults injected at create/resume.

fetch/: mechanical UNARY_ROUTES table, two-level parse with
path==method check, SSE frames completed to ServerRequest full form;
client mints -> narrows -> envelopes outbound, verifies rpcId echo
inbound, streams SSE frames, four-quadrant onEnvelope tap (debug panel
choke point). Real-browser fixes: URL base resolves to location.origin
(hardcoded internal base broke real pages), browser-safe export paths.

Design archives: contract design.md v2.0 with decision log,
core-coverage audit, comparative studies, step2 impl run log. Probed
end to end over real HTTP: prompt -> live model stream -> history
returns the finished reply.

feat(gui): RpcLog debug panel — fixture-driven milestone, playwright-verified 10/10

web-runtime: rpcLog + ui slices (zustand), four-quadrant RpcLogEntry
(client-request / server-response / server-request / client-response),
onEnvelope tap -> microtask-batched pump with 500-entry ring buffer,
ConnectionController (private state, backoff reconnect), fixture API
with fake envelopes (?fixture switch), bootWebRuntime; contract types
via temporary local copies (api-types.ts, swapped for real imports when
W3 client lands).

web-ui: components/panels/RpcLog five-piece set (badge with unread
count, floating panel, direction glyphs per quadrant, same-rpcId
pair highlighting in two families, JSON payload expand, follow/pause,
clear), App shell, utils/formatRelative, light-theme CSS variables with
dark placeholders.

dsc bin: mime lookup fixed to use the actually-served file (naked
'/?query' no longer falls through to octet-stream download); shutdown
closes SSE keep-alive connections so SIGTERM actually exits.

Acceptance: scripts/verify-rpclog-panel.mjs (chromium headless) ALL
PASS 10/10 over design.md §D 1-6.

pkg: add web scripts for building

feat(gui): session milestone — list + conversation over Session OOP, styled RpcLog v2.1

web-runtime: Session/SessionManager object layer (resident instances,
mux frame routing, lineage flattening), foldSurface adapter with padding
sentinels for paged windows, chunk accumulator for streaming partials,
batched change notification (useSyncExternalStore contract), connection
sinks + reconnect fix (the 300ms self-abort reconnect storm that made
the session list flap is gone), fixture rewritten as a scripted host
(60-turn history, typewriter replay, resident pending approval, child
session); temporary contract copies deleted in favor of real apiproxy
imports.

web-ui: sessions screen (list with lineage indent + selection as
container-local state), conversation view (turn grouping, reasoning
fold, tool cards, steering, pending interaction cards, upward paging
with scroll anchoring), input bar with queue/steer/stop; RpcLog panel
restyled per docs/web-styling.md (tokenized palette, quadrant badge
glyphs now vertical ↑↓⇟⇞, pair highlighting, floating shadow).

docs/web-styling.md: living style guide (tokens, visual baseline,
coding rules, evolution log).

Acceptance: verify-session.mjs 31/31, verify-session-real.mjs 5/5
(real model streaming), verify-rpclog-panel.mjs 10/10.

feat(gui): hostruntime split + repo-wide package prefix rename

Package split (design: 20260720-0101-hostruntime-split-design):
dsh-host-runtime carries bootHost + createApiProxy + startHost()
(RunningHost {api, handler, defaults, ctx, dispose} — the seam Electron
and any future shell reuses; ctx is the official front-door mount
point); dsh-host-webserver carries the node:http static+API bridge
(fixed: abort now keys on res 'close' + writableEnded — req 'close'
fires on body end since Node 16 and was killing every SSE stream
instantly, the reconnect-storm root cause); apps/dsc is now a thin
assembly with web/-p subcommands. dsc -p runs the full isomorphic
carrier chain in process (second real protocol consumer; probed
end-to-end against the live model).

Naming rule (user decree): packages under host/ and client/ carry the
directory prefix in their npm name — dsh-host-apiproxy,
dsh-client-web-runtime, dsh-client-web-ui renamed repo-wide in one
frozen batch; explicit tsconfig paths entries added where the wildcard
no longer matches.

Acceptance: verify-session 31/31, verify-rpclog-panel 10/10,
verify-session-real 7/7 (incl. new 12s connection-stability sentinels),
tsc green, dsc web + dsc -p smoke both pass.

refactor(gui): AbstractApiClient class hierarchy — OO client with inheritable seams

AbstractApiClient (apiproxy) carries every protocol invariant: rpcId
minting, four-quadrant envelope wrap/unwrap, zod parsing, SSE frame
parsing, the payload-direct IApiClient surface (callers no longer mint
rpcIds — the carrier does), and the instance-level envelope observation
pump (batched via microtask; moved off module-level globals in
rpc-log.ts, which is now a pure subscriber mapping envelopes into store
entries — the debug panel observes the connection, it is not part of
it).

Platform subclasses own two abstract seams (doFetch, onEnvelope) plus
three protocol-level virtuals for transportless overrides:
InProcessApiClient (apiproxy; dsc -p uses new InProcessApiClient(
host.handler)), WebApiClient (web-runtime), FixtureApiClient (fixture
now subclasses instead of wrapping). Naming per decree: AbstractApiClient
/ IApiClient; ApiProxy stays the impl-side narrow-form contract.

headless.ts call sites drop rpcRequest wrappers (payload-direct);
split-design archive updated with the naming-rule ledger.

tsc green; verify-session 31/31, verify-rpclog-panel 10/10,
verify-session-real 7/7 (12s connection sentinel count=4); dsc -p smoke
CALLER-OK.

feat(gui): InputBar final form — bug batch, deepseekchat layout, single primary button, running locks input

Squashes the whole InputBar iteration batch: IME/caret/auto-grow/focus/dedup
bug fixes, layout aligned to the deepseekchat baseline, single primary button
with hover flyout, finalized button semantics with the Codex-style icon
circle, and running-state locking where stop is the only mid-turn action.
The same batch carried the Chinese-to-English code comment sweep
(density pruned), folded in here.

docs(gui): purge work-log references from code comments

76 design-doc references cleared across the GUI packages: section
pointers inlined as self-contained constraint statements, pure pointer
comments dropped, milestone codenames and ruling tags out, and the 14
contract file headers switched to the formal RFC (the only sanctioned
external reference). web-styling.md now cites the styling RFC instead
of the disposable research archive. grep for work-log reference
variants is clean across the GUI packages.

docs(gui): file-header comments self-contained — drop RFC filename references

RFC renames/reorgs must not require a source sweep (the 2026-07-20
two-way merge proved it). 11 headers lose only the '(RFC …)' tail and
stay self-contained; api-proxy.ts keeps its minimal-first note.

fix(gui): session streaming — freeze interrupted partials, sweep stale running calls, send force-scrolls

Aborted turns never emit the finalizing assistant/message, so the
accumulated partial and its running tool cards kept rendering below
later messages — the "new message lands above the stopped reply"
illusion. turn/end side effects now freeze content-bearing partials
into interrupted terminal nodes (fractional seq keeps flow order; the
live freeze and history replay converge through applyEventSideEffects,
so a refresh reconstructs identical frozen nodes) and turn running tool
cards into interrupted terminal cards; only content-free partials are
swept outright. ConversationView gains the send-force-scroll rule (own
words must be visible) alongside the pre-update atBottom follow flag.
Regressions pinned as E2-4a–c (real host) and §E1-11h (fixture).

feat(gui): webserver hardening verify script

feat(gui): dark-mode toggle pinned to the sidebar bottom

Interim home before the Settings page exists (the button re-homes with
zero logic change — mechanics live in utils/theme.ts): html[data-theme]
flip + dsc.theme localStorage, stored choice wins over the OS
prefers-color-scheme default, applied in mount() before first paint so
a dark reload never flashes light. Moon/sun inline SVG icon button at
the sidebar's pinned bottom row. Pure front-end local concern: no RPC,
no Session/store involvement. Dark sweep of list/conversation/input
card/RPC panel found no unreadable pairs — no token changes needed.

docs(gui): GUI RFCs and web styling handbook

Layering+RPC protocol and web client architecture RFCs (post-reorg,
developer-facing polish folded in) plus the styling engineering
handbook. Mission work logs live in the commit above; PRs can be cut
from this commit to include formal docs only.

fix(gui): client object-layer hardening — audit timing/reference/resilience batches (S3-S5,C1-C3,C5-C8)

fix(gui): carrier error channel + webserver backpressure (audit A1-A5,A7-A10,R2,R5)

feat(gui): session persistence surface — cold list, project cwd, legacy no-cwd retirement

refactor: rename dsc CLI to dsh — apps/cli, bin name, package scope

Includes the root tsconfig project-references fix for host/* and
client/web-runtime (originally a separate build fix commit).

test(gui): three-tier suite — protocol/object/browser lanes, tier-a fill to per-file 100%

test(gui): jsdom lane for web-ui + web-runtime coverage gate entry

docs(gui): GUI testing system RFC (zh)

feat(gui): tool-card views — contract slot, host-computed delivery, three-level card fallback

fix(gui): lint clean across GUI packages — wrap long doc comments, drop dead type args, sync-return methods without awaits

docs(gui): doc-sync mechanical fixes — JSDoc on apiproxy/host exports, RFC sketch fences ignore-check, md-wrap paragraphs, drop missions links, web-ui plain-ts entry

chore(gui): module-graph regen + knip clean — drop dead re-exports, internalize createFixtureApi, scan web-ui tsx and verify mjs scripts

build(gui): wire client/host packages into the lib build shape — tsc references + tsdown (web-ui css-external), lib manifests, cordis peer, apiproxy typed subpaths, vite src aliases

test(gui): host-side per-file 100% coverage — apiproxy schema/carrier suites, webserver http-bridge suite, host-runtime composition suite; client/* coverage excluded pending the browser-side testing work item

docs(gui): package READMEs for the five GUI packages — model-experience audit entries, limitations sections

docs(gui): bilingual RFC pairs + client JSDoc completion — translate the three GUI RFCs to English with i18n records and manifest ratchet, Consequences sections both sides, full client/* export JSDoc, regen doc graphs and RFC index

fix(scripts): doc-typecheck built-declarations mode maps /src/* subpath wildcards (apiproxy browser-safe channels)

docs(gui): apply dsh rename across pr-gates docs — READMEs, layering RFC en, web-ui entry comment, i18n re-record

fix(gui): post-rebase lint reconciliation — wrap main-tree long doc comments, read-through narrowing guards, abortError Error normalization, handleUnary generic justification

fix(gui): post-rebase doc/test reconciliation — align host specs with evolved carrier contracts (sentinel rpcId, stream/error surfacing, url-path transport messages, defaults.cwd), Agent Note titles and relocated links, KV Cache effect sections, JSDoc on evolved exports

fix(gui): second-rebase reconciliation to 509db0cb3 — restore api panel exports the baseline suites consume, knip workspace entries for jsdom lane and apps/web smokes, hoist result narrowing, align testing.md to the narrowed web-ui exclusion

fix(test): vitest-scoped tsconfig maps bare imports for tsx specs — with GUI manifests now pointing at lib, an unmapped importer loaded a second copy of the web-runtime singletons

fix(gui): typecheck + lint clean over the tool-card batch — brand callIds and object-form turn/end reason in the view spec, narrow fixture arg stringification, wrap long v8-ignore comments

docs(gui): export JSDoc for tool-card surfaces + testing-note pairing header

docs: rfc for web testing

feat: add tools to host-runtime

fix(gui): dispatch agent/error via agentEvents in host-runtime spec — mounted invariants plugin rejects raw ctx.emit without the scope carrier

fix(gui): restore GUI knip workspaces + scripts/mjs entries and regenerate lockfile after master rebase

fix(gui): post-rebase gate repairs — drop context-node envelope (master unwrapped injected content envelopes), regen event matrix, condense testing.md web-ui exclusion within budget

fix(session): browser-safe deep-equal in surface — node:util import broke the vite bundle

ci(gates): frontend vite build joins pre-push — node: imports in the client closure pass tsc but break the browser bundle

test(tui): drop the checkout-dependent process.cwd() harness default — a long worktree path pushes the footer token counters past the 88-column fake terminal

test(gui): jsdom behavior E2E — conversation main path over fixture runtime, reconnect banner lifecycle

test(gui): jsdom RPC panel behavior — ledger rows, expand, pairing, pause/clear, follow-pause, payload truncation

test(gui): jsdom tier-2 — InputBar guards, reasoning fold, JSON blocks, message variants, theme, create-then-select; act-harden banner case

test(gui): jsdom tier-3 — ConversationView states/paging/force-bottom, ToolCallCard arms, PendingCard, list rows

test(gui): jsdom tails — view-card variants, LogRow directions, registry hygiene, badge overflow, hook ops, mount glue

test(gui): jsdom tails round 2 — call-ref blocks, resume follow, view precedence, failed create, empty-diff arm

test(gui): jsdom final arms — anchor compensation, follow-off, interval ticks, view halves, node-over-running precedence

test(gui): web-ui joins the per-file 100% coverage gate

Annotation-only src changes plus the config swap. The web-ui exclusion is
replaced by a single index.tsx entry (stale byte-identical duplicate of
mount.tsx, nothing imports it; same entry-glue treatment as bin.ts) and the
coverage include gains .tsx.

v8-ignore sites (each with its reason inline):
- ConversationView 3x ref-null guards; InputBar disabled-click guard
- ToolCallCard both-null arms + windowless-custom argsRaw arm
- LogRow css-module key fallbacks (start/stop block); RpcLogBody 3x ref-null guards
- web-runtime drift from the tool-card batch: fixture presenter catch/str
  typo-guards, dense-array guards (fold-adapter reset, session rebuild,
  fixture backscan), live view-present arm (fixture replays are text-only;
  view vocabulary is covered by the history samples)

test(gui): close the PR #443 host-side coverage gaps — apiproxy client abort arms, api-proxy cold/view paths, webserver drain

- apiproxy fetch/client.ts: 3 new cases (pre-aborted signal short-circuits
  before transport + string reason mapping, non-Error/string reason falls to
  the default AbortError message, signal-less doFetch passthrough)
- runtime/api-proxy.ts: one v8-ignore (summarizeCold cwd arm — list()
  filters cwd-less legacy metas) + api-proxy-cold.spec.ts (cold list merge:
  mtime source, locate-undefined and vanished-log fallbacks, lineage;
  no-persistence/no-factory resume → internal) + 2 view cases (history views
  with meta passthrough and orphan/bad-args/presenterless soft-falls,
  session/disposed open-call cleanup on the mux stream)
- webserver/index.ts: /api/big fixture drives both drain-wait legs (full
  8MiB readback after drain, mid-chunk disconnect wakes via 'close')

feat: app shell

fix: rebase conflicts

fix: coverage

fix(gui): lint clean after rebase — wrap long v8-ignore comments, unconditional v1 detail-block claim

chore(gui): remove browser/probe verify scripts from scripts/

The six GUI acceptance/probe scripts (carrier-errors, rpclog-panel,
session, session-real, webserver-backpressure, webserver-hardening)
leave the repo's scripts/ tree; the three code comments that pointed at
them now describe the coverage lane without naming a script path.

fix(webserver): guard the request callback — one malformed request must not kill the process

The async handle() had no top-level catch, so any throw inside it (a bad
%-escape reaching decodeURIComponent, a client dropping mid-body, a
response stream erroring) became an unhandled rejection and took the whole
process down (audit R1 must-fix). The guard answers 400 when headers are
not out yet, destroys the socket when they are, and reports the failure to
onError (the package never prints). Spec covers all three legs: %-escape
barrage → 400 + server stays alive, non-Error throw wrapped for onError,
mid-stream explosion → socket teardown.

feat: client AGENTS.md

fix: client/AGENTS.md

fix: rebase

feat(gui): T0 cut 1 — 12 client package skeletons with contract stubs, dshClient declarations, tsdown client preset, theme token sheets

feat(gui): T0 cut 2 — pure git mv migration per v3 §11 (connection six, runtime sessions/kernel, ui-conversation chat, ui-primitives markdown family, web shell + e2e)

feat(gui): T0 cuts 3+4 — import rewiring to new package names, .legacy demotion of owner-rewrite files, legacy web-runtime/web-ui/apps-web retired to attic

feat(gui): connection 对账刀——index.ts 精确导出清单替换 export *，intents.legacy 溶解删除

feat(client/ui-slots): SlotCore real implementation — kind semantics, sync version + microtask-batched notify, onMutate bridge

feat(gui): web shell vite alias — retarget to new client packages, shell static surface only

feat(gui): host 侧刀属地半——HostWebPluginRegistry（entries 扫描+internal/plugin 去抖重扫+dshClient 校验+exports./client 解析）、GET /plugins/<id>/client.js 分发端点、GET / 与 SPA fallback 注入 __DSH_BOOT__（webPlugins 可选注入，不传行为不变）

feat(web-react): add use-sync-external-store dep + local shim typings

feat(web-react): bindSnapshotSelector via uSES with-selector shim

feat(gui): ui-layout concession-chain solver — pure computeColumns with contract geometry

feat(gui): ui-layout LayoutService — four persisted stores, clamped actions, list-driven prune

feat(gui): ui-layout AppFrame styles — grid columns, collapse-safe borders, edge drag handles

test(gui): 存量 spec 平移——connection 三件+runtime 六件自 attic 捞回改包名路径全绿；api-helpers 按归属拆分（wire 半留 connection、classifier 半随 conversation.ts 入 runtime）；boot-intents/preinit/rpc-log 随 intents/rpc-log 退役不迁（记 v3 §3.2 溶解项）

feat(client/ui-primitives): StateDot/Button/Pill/Input/Menu atoms, ConnectionBanner de-legacied to pure props, JsonBlock CSS on --dsw tokens

feat(web-react): createSnapshotStore engine (rafFlush batch, persist opt-in, dev freeze) + spec

feat(gui): ui-layout AppFrame — grid tracks, pointer-capture drag handles with rAF throttle, frame ResizeObserver

feat(web-react): useInvoke (external pending store, stable invoke, concurrency count) + spec

test(web-react): bind spec — equality bail, custom eq, zero resubscribe, StrictMode, method sources

feat(gui): ui-layout index rewiring — real exports, client apply provides ctx.layout and defines three slots

feat(web-react): SessionProvider (renderBody deps) + RootBindingProvider + binding contexts + spec

feat(gui): web shell AppRoot boot-page styles — self-contained with neutral token fallbacks

feat(gui): web shell AppRoot — boot gate over loader status, fail-loud plugin failure list

fix(gui): AppRoot gates on explicit settled signal — status-derived readiness races the incrementally filled table

feat(client/ui-theme): ThemeService real implementation — registry with built-in light/dark, apply toggles body[data-ds-dark-theme], third-party token overrides as body inline vars

feat(web-react): scopedSlots outlet (kind matrix, inject WeakMap caches, per-entry error boundary) + spec

feat(gui): web shell module-table seed — pure-library entities for the loader require surface

feat(client/i18n): I18nService real implementation — ns×locale registry, stable bind(ns) reference, zh fallback chain, zh/en skeleton dictionaries

feat(gui): web shell assembly closure — layout exports via module table, SessionProvider + scopedSlots + RootBindingProvider

feat: client/ui-conversation

feat: code

codedoc

build(gui): root bundle green — web shell excluded from the lib workspace (vite app), ui-primitives lib externalizes css side-effect imports (web-ui precedent)

gates(gui): verify-cordis-config follows aggregate tsconfig references (root is a shell over host/client programs); module graph regenerated for the twelve client packages

chore(gui): retire legacy migration sources — every owner rewrite landed (t0-checklist §7 ledger honored); orphan css of retired components removed

gates(gui): knip green groundwork — e2e/tsx entries for the new packages, loader-runtime deps ignored where loading is by specifier string, fake plugin ids un-bare-named, dead test export dropped

chore(client): manifest shape batch A — ui-slots/web-react/ui-primitives invariant companions, files whitelist, cordis+invariants peer/dev, tsconfig refs

chore(client): manifest shape batch B — connection/runtime/ui-conversation/ui-trajectory files whitelist, cordis peer+dev, explicit invariant lib entries (clientBundle signature)

chore(client): manifest shape batch C — i18n/ui-layout/ui-sidebar/ui-theme invariant companions, files whitelist, invariants peer/dev, tsconfig refs

chore(client): manifest shape batch D — web shell gains node-half lib entry + invariant companion + uniform files whitelist

chore(client): drop verified-unused deps — dsh-tools from runtime/ui-conversation (types ride /presentation), ui-primitives+clsx from ui-layout

gates(gui): doc-gate fixes — theme JSDoc prose, three client type-link exemptions, agent-note paths follow the migration, config catalog regenerated

gates(gui): type-equiv manifest follows the types.ts extraction, approval JSDoc keeps its link form, persistence catalog regenerated

docs(gui): per-constant JSDoc on the contract geometry exports (export-jsdoc gate)

test(gates): loader-composition budget covers cold tsx resolution after the program split (was flaking at the default 5s)

docs(gui): README substantiation batch 1 — ui-slots/ui-primitives/web-react/connection: Model Experience short form, real deferred-work ledgers, description accuracy pass

fix(client): theme/i18n dual-entry split — service classes + cordis merges move to src/client (host catalog scanner no longer misclassifies client services), node halves keep types + empty apply; catalogs regenerated

docs(gui): README substantiation batch 2 — runtime/ui-layout/ui-sidebar/ui-conversation: Model Experience short form, package-owned deferred-work ledgers (unload stub, watch approximation, /client value-import rule, global details state, two-state dots, stats duration gap, single-bundle caches)

docs(gui): README substantiation batch 3 — ui-trajectory/ui-theme/i18n/web: Model Experience short form, deferred-work ledgers (placeholder charter, no theme toggle owner, empty locale dictionaries, one-shot rendering); both README gates green

test(scripts): purity spec adopts clientBundle two-arg signature (explicit libEntry, no default)

gates(gui): knip green — declaration-merge dep ignored, fake plugin id assembled at runtime, invariants dep de-duplicated to peer+dev, stale apps/web section dropped

feat(gui): 门禁波次 host 三包 invariant 形状——apiproxy explained-empty 伴生（wire 契约层零事件面）、webserver 真关系伴生（manifest 行必解析出 clientPath，防 __DSH_BOOT__ 广告 404 bundle；apps/cli 发布 webPlugins 键供审计）、runtime 补 files 白名单；三包 exports/files/peer+dev/tsconfig refs 齐 fw-react 形状；constraints+invariants 双 gate 零违规

build(client): ui-layout/ui-sidebar tsdown configs adopt the explicit two-arg clientBundle signature (orphaned follow-up of the manifest shape batch)

refactor(gui): shell boot becomes a library face — bootWebShell(el) exported for the apps/web entry; main.ts retired

refactor(gui): exports 纪律刀1——ui-theme/i18n node index 收敛为只空 apply（Translate/LocaleDict/ThemeTokens 类型下沉 src/client/），ui-conversation 的 I18nService import 改 /client 子路径

build(typecheck): converge to root host aggregate + tsconfig.client.json — delete tsconfig.host.json, verify-cordis-config seeds both aggregates

feat(gui): apps/web restored as the vite application — thin main over bootWebShell; dsh-client-web becomes a plain lib (index exports shell surface, vite files and e2e moved out)

chore(gates): knip.json rewritten on the master base — same semantics, minimal diff (formatting churn dropped)

docs(gui): 时效清扫②——testing.md 删 web-ui 覆盖豁免残句；web-styling.md 加 token 换代头注（--dsw-* 现行、工程约束条款仍有效并注明收编处）

docs(gui): 时效清扫③——四对 GUI Agent Note 加路径更新头注（web-runtime/web-ui/dsh-frontend→现行 12 包结构；设计结论存续声明；双语对同步）

docs(gui): 时效清扫③b——四对 note 头注的 i18n 配对哈希重录

build(typecheck): minimal-diff tsconfig shape — drop root files entry (purity spec + preset move to client program), compress comments, drop redundant util/home root ref

feat(gui): apps/web restoration follow-through — dsh-frontend package name, cli dist resolve, root build:web filter, tsdown exemption dropped, vitest web lane + knip + client aggregate retargeted, e2e paths rebased

refactor(gui): exports 纪律刀2——connection wire 六件 git mv 进 src/client/（wire 即该 dshClient 插件的 client 半），node index=只空 apply，/client 半边整面导出（v3 §3.2 清单原样），包内 tests 改 src/client 直取

refactor(gui): exports 纪律刀3——runtime 实现整体下沉 src/client/（sessions/slots/loader；契约类型与 cordis merge 随迁 client/index），node index=只空 apply；./loader exports 指 client/loader；全消费面（web 壳/ui-sidebar/ui-trajectory/tests）bare→/client 机械跟改；vitest.e2e 换 tsconfig.vitest paths（root tsconfig 排除 client 会把 /client import 掉到 exports 的浏览器 dist bundle）

refactor(gui): exports 纪律刀3 补遗——ui-layout 三处 bare runtime import 改 /client（刀3 消费面机械跟改漏提交件；跨属地机械一行×3 报备 ui-shell）

test(gui): drop the getSessionManager singleton case — the init/get pair is a dead legacy-boot surface with zero live consumers (SessionsService constructs and holds the manager under the plugin architecture); source removal tracked with rt-core

refactor(gui): 删 manager.ts 尾部 initSessionManager/getSessionManager 单例对——旧 boot 直连遗物，插件化下 SessionsService 构造持有 manager，全仓零活消费者（convo-b 测试清扫对表，其测试用例已先行退役 7e2c51898）；头注释同步去单例措辞

code

refactor

packages/host/apiproxy/README.md

@@ -0,0 +1,27 @@
+# @deepseek-ai/dsh-host-apiproxy
+
+The ApiProxy front layer every client shape shares: the TS contract (`src/api/`, zero Node dependencies, importable from the browser) and the fetch carrier pair (`src/fetch/`: `toFetchHandler` on the host side, `AbstractApiClient` plus platform subclasses on the client side). Host assembly lives in `dsh-host-runtime`.
+
+## Contract layer (`/api`)
+
+Wire messages form a four-quadrant discriminated union — who initiates × request/response — decoupled from the physical channel: `ClientRequest` (POST `/api/<method>` body), `ServerResponse` (that POST's response body), `ServerRequest` (SSE frame), `ClientResponse` (POST `/api/respond` body). Responses always echo the matching request's `rpcId` and never mint a new one. Method parameter/return structures live only in the domain interface signatures (`SessionsApi`, `HostApi`, `EventsApi`); `RpcMethodMap` registers the methods and every other position derives via `RequestPayload<K>`/`ResponseValue<K>`. Zod schemas anchor `satisfies z.ZodType<Wire<T>>` and parse at two levels: envelope first, business payload second, dispatched per method. Business errors ride `RpcResult`'s error branch (`RpcErrorDetailsMap` closes the code set); HTTP status expresses only the carrier.
+
+The layering/protocol decisions are recorded in the [GUI layering and RPC protocol RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.md); the browser-side consumption architecture in the [web client architecture RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md).
+
+## Carrier layer (`/client` + root)
+
+`AbstractApiClient` holds every protocol invariant — rpcId minting, envelope wrap/unwrap, zod parsing, SSE frame decoding, unary timeout, microtask-batched envelope observation (`subscribeEnvelopes`) — while platform subclasses supply only the `doFetch` transport aspect. `InProcessApiClient` over `toFetchHandler(api)` is the isomorphic point: the full wire serialization/validation path with no network, used by `dsh -p` headless.
+
+## Model Experience
+
+None, as the package defines the client↔host wire contract and carriers; nothing here reaches a model request.
+
+#### KV Cache effect
+
+None; this package neither assembles nor sends a provider request.
+
+## Known Limitations and Deferred Work
+
+- **`respond` routing is shipped, but pending-interaction state is host-side work** — the wire shape (POST `/api/respond`, `RpcReceipt`) is final; the pending table that makes late/duplicate answers meaningful lives in `dsh-host-runtime` and is still a stub there.
+- **Reserved seams stay out of `RpcMethodMap`** — `session.fork`, `prompt.mode: 'inject'`, `task.list`, `host.listModels`, and a describe `hostInstanceId` are documented reservations; an unknown method fails loud at envelope parse rather than getting a not-implemented code.
+- **No protocol version field** — client and host ship together; `host.describe` gains a version negotiation field only when an independently released client exists.

packages/host/apiproxy/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@deepseek-ai/dsh-host-apiproxy",
+  "description": "ApiProxy front layer: the TS contract (api/) and the fetch carrier pair (fetch/); host assembly lives in dsh-host-runtime",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json",
+    "./api": {
+      "types": "./lib/types/api/index.d.ts",
+      "default": "./lib/types/api/index.js"
+    },
+    "./api/*": {
+      "types": "./lib/types/api/*.d.ts",
+      "default": "./lib/types/api/*.js"
+    },
+    "./client": {
+      "types": "./lib/types/fetch/client.d.ts",
+      "default": "./lib/types/fetch/client.js"
+    }
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts",
+    "lib/types/**/*.d.ts.map",
+    "src"
+  ],
+  "license": "BSD-3-Clause",
+  "dependencies": {
+    "@deepseek-ai/dsh-brand": "workspace:^",
+    "@deepseek-ai/dsh-llm": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
+    "@deepseek-ai/dsh-tools": "workspace:^",
+    "@deepseek-ai/dsh-user-approval": "workspace:^",
+    "@deepseek-ai/dsh-user-interaction": "workspace:^",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "cordis": "^4.0.0-rc.7",
+    "@deepseek-ai/dsh-invariants": "^0.0.1"
+  },
+  "devDependencies": {
+    "cordis": "^4.0.0-rc.7",
+    "@deepseek-ai/dsh-invariants": "workspace:^"
+  }
+}

packages/host/apiproxy/src/api/approvals.schema.ts

@@ -0,0 +1,21 @@
+/**
+ * approvals domain zod schemas (respond is a client-response; the payload schema serves
+ * the /api/respond endpoint's second parse after routing via the pending table).
+ * ApprovalRequestId brand cast point: one.
+ */
+
+import { z } from 'zod'
+import type { ApprovalRequestId } from '@deepseek-ai/dsh-user-approval/types'
+import type { ApprovalResponsePayload } from './approvals.ts'
+import type { Wire } from './rpc.schema.ts'
+import { sessionIdSchema } from './sessions.schema.ts'
+
+/** ApprovalRequestId: one brand cast after shape validation (the only cast point in this domain). */
+export const approvalRequestIdSchema = z.string().min(1) as unknown as z.ZodType<ApprovalRequestId>
+
+/** Approval answer payload (the result.value slot of a client-response). */
+export const approvalResponsePayloadSchema = z.object({
+  sessionId: sessionIdSchema,
+  approvalId: approvalRequestIdSchema,
+  outcome: z.union([z.literal('allowed-once'), z.literal('rejected')]),
+}) satisfies z.ZodType<Wire<ApprovalResponsePayload>>

packages/host/apiproxy/src/api/approvals.ts

@@ -0,0 +1,21 @@
+/**
+ * approvals domain contract. The approval requested frame is a
+ * server-request (stable rpcId); the answer is a client-response echoing that rpcId (not a
+ * unary method, not in RpcMethodMap, mints no new id), carried on POST /api/respond with an
+ * RpcReceipt carrier receipt as the HTTP response body; the final outcome arrives in the resolved frame.
+ */
+
+import type { ApprovalRequestId } from '@deepseek-ai/dsh-user-approval/types'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+
+/**
+ * Approval answer payload (the result.value slot of a client-response). outcome accepts only
+ * the two values a client can give (cancelled/unavailable are host-side outcomes). approvalId
+ * is the core audit correlation (used by the impl to reconcile `approval/asked`/`decided`;
+ * passes through core's existing brand); wire correlation is governed by the echoed rpcId.
+ */
+export interface ApprovalResponsePayload {
+  sessionId: SessionId
+  approvalId: ApprovalRequestId
+  outcome: 'allowed-once' | 'rejected'
+}

packages/host/apiproxy/src/api/events.schema.ts

@@ -0,0 +1,42 @@
+/**
+ * events domain zod schemas: MuxFrame / HostFrame unions (discriminatedUnion('type')).
+ * A frame is the payload slot of the ServerRequest full form; the SessionEvent inside
+ * a session/event frame reuses sessions.schema's strict-envelope + wide-data passthrough branch.
+ */
+
+import { z } from 'zod'
+import type { AskUserQuestionItem } from '@deepseek-ai/dsh-user-interaction/types'
+import type { HostFrame, MuxFrame } from './events.ts'
+import type { Wire } from './rpc.schema.ts'
+import { rpcErrorSchema, rpcIdSchema } from './rpc.schema.ts'
+import { approvalRequestIdSchema } from './approvals.schema.ts'
+import { sessionEventSchema, sessionIdSchema, toolEventViewSchema } from './sessions.schema.ts'
+
+/** Question shape validated strictly against core dsh-user-interaction. */
+export const askUserQuestionItemSchema = z.object({
+  id: z.string(),
+  question: z.string(),
+  header: z.string().optional(),
+  options: z.array(z.object({ label: z.string(), description: z.string().optional() })).optional(),
+  multiSelect: z.boolean().optional(),
+}) satisfies z.ZodType<Wire<AskUserQuestionItem>>
+
+/** MuxFrame union (payload slot of a mux-stream ServerRequest). */
+export const muxFrameSchema = z.discriminatedUnion('type', [
+  z.object({ type: z.literal('session/event'), sessionId: sessionIdSchema, event: sessionEventSchema, view: toolEventViewSchema.optional() }),
+  z.object({ type: z.literal('session/subscribed'), sessionId: sessionIdSchema, lastSeq: z.number().int() }),
+  z.object({ type: z.literal('approval/requested'), sessionId: sessionIdSchema, approvalId: approvalRequestIdSchema, toolName: z.string(), callId: z.string().optional(), reason: z.string().optional() }),
+  z.object({ type: z.literal('approval/resolved'), sessionId: sessionIdSchema, approvalId: approvalRequestIdSchema, outcome: z.union([z.literal('allowed-once'), z.literal('rejected'), z.literal('cancelled'), z.literal('unavailable')]) }),
+  z.object({ type: z.literal('question/requested'), sessionId: sessionIdSchema, questions: z.array(askUserQuestionItemSchema) }),
+  z.object({ type: z.literal('question/resolved'), sessionId: sessionIdSchema, questionRpcId: rpcIdSchema, outcome: z.union([z.literal('answered'), z.literal('cancelled')]) }),
+  z.object({ type: z.literal('stream/error'), error: rpcErrorSchema }),
+]) as unknown as z.ZodType<MuxFrame>
+
+/** HostFrame union (payload slot of a host-stream ServerRequest). */
+export const hostFrameSchema = z.discriminatedUnion('type', [
+  z.object({ type: z.literal('host/session-added'), sessionId: sessionIdSchema, parentSessionId: sessionIdSchema.optional() }),
+  z.object({ type: z.literal('host/session-removed'), sessionId: sessionIdSchema }),
+  z.object({ type: z.literal('host/session-status'), sessionId: sessionIdSchema, running: z.boolean() }),
+  z.object({ type: z.literal('host/agent-error'), sessionId: sessionIdSchema, message: z.string() }),
+  z.object({ type: z.literal('stream/error'), error: rpcErrorSchema }),
+]) as unknown as z.ZodType<HostFrame>

packages/host/apiproxy/src/api/events.ts

@@ -0,0 +1,69 @@
+/**
+ * events domain contract: signatures and frame unions for the two SSE
+ * streams. Four-quadrant: streams yield the narrow form `RpcRequest<Frame>` (server-request
+ * view) — rpcId must be exposed to the business layer, because responses to answerable frames
+ * (approval/question requested) echo it; for pure pushes it identifies that one push.
+ * signal is a local stream-control parameter, independent of the request (never on the wire).
+ */
+
+import type { AskUserQuestionItem } from '@deepseek-ai/dsh-user-interaction/types'
+import type { ApprovalOutcome, ApprovalRequestId } from '@deepseek-ai/dsh-user-approval/types'
+import type { CallId } from '@deepseek-ai/dsh-llm/brand'
+import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session/types'
+import type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
+import type { RpcError, RpcId, RpcRequest } from './rpc.ts'
+
+// Client-side consumers take the render-intent vocabulary from the contract;
+// dsh-tools remains its owner.
+export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
+
+/**
+ * Host-computed render intent accompanying a `tool/call` or `tool/result`
+ * event. A pure derivation of args/result through the presenter registered at
+ * emission time — never persisted (the session log carries only the event), so
+ * the same event may carry a different view (or none) on a later delivery.
+ * `for` names which vocabulary applies without re-inspecting the event type.
+ * An absent view means the client's documented default (generic JSON card).
+ */
+export type ToolEventView =
+  | { for: 'call'; view: ToolCallView }
+  | { for: 'result'; view: ToolResultView }
+
+/** Streaming face of the contract: the two SSE stream openers (mux + host). */
+export interface EventsApi {
+  /**
+   * All-session aggregated mux stream. On open, emits a subscribed control frame for every
+   * attached session and replays each session's still-pending approval/question requested
+   * frames (rpcId reused verbatim — the refresh-recovery baseline).
+   * since: resume seam, unimplemented in v1 (ignored if passed); reconnection = reopen the
+   * stream + refetch history.
+   */
+  mux(request: RpcRequest<{ since?: Record<SessionId, number> }>, signal: AbortSignal): AsyncIterable<RpcRequest<MuxFrame>>
+
+  /**
+   * Host-level info stream: session create/destroy, running-status flips, and
+   * agent failures with no turn position. Empty payload uses `{}`.
+   */
+  host(request: RpcRequest<{}>, signal: AbortSignal): AsyncIterable<RpcRequest<HostFrame>>
+}
+
+/**
+ * Mux stream frames: raw session-event passthrough + control frames +
+ * approval/question frames (requested = answerable server-request, the rest are pure pushes).
+ */
+export type MuxFrame =
+  | { type: 'session/event'; sessionId: SessionId; event: SessionEvent; view?: ToolEventView }
+  | { type: 'session/subscribed'; sessionId: SessionId; lastSeq: number }
+  | { type: 'approval/requested'; sessionId: SessionId; approvalId: ApprovalRequestId; toolName: string; callId?: CallId; reason?: string }
+  | { type: 'approval/resolved'; sessionId: SessionId; approvalId: ApprovalRequestId; outcome: ApprovalOutcome }
+  | { type: 'question/requested'; sessionId: SessionId; questions: AskUserQuestionItem[] }
+  | { type: 'question/resolved'; sessionId: SessionId; questionRpcId: RpcId; outcome: 'answered' | 'cancelled' }
+  | { type: 'stream/error'; error: RpcError }
+
+/** Host stream frames. session-added carries the lineage anchor; agent-error is the only outlet for live failures with no turn position. */
+export type HostFrame =
+  | { type: 'host/session-added'; sessionId: SessionId; parentSessionId?: SessionId }
+  | { type: 'host/session-removed'; sessionId: SessionId }
+  | { type: 'host/session-status'; sessionId: SessionId; running: boolean }
+  | { type: 'host/agent-error'; sessionId: SessionId; message: string }
+  | { type: 'stream/error'; error: RpcError }

packages/host/apiproxy/src/api/host.schema.ts

@@ -0,0 +1,19 @@
+/**
+ * host domain zod schemas (names derived from map keys).
+ */
+
+import { z } from 'zod'
+import type { RequestPayload, ResponseValue } from './rpc-map.ts'
+import type { Wire } from './rpc.schema.ts'
+
+/** host.describe request payload (empty object literal). */
+export const hostDescribeRequestSchema = z.object({}) satisfies z.ZodType<Wire<RequestPayload<'host.describe'>>>
+
+/** host.describe response value. */
+export const hostDescribeValueSchema = z.object({
+  version: z.string(),
+  cwd: z.string(),
+  provider: z.string().optional(),
+  model: z.string().optional(),
+  attachedSessions: z.number().int().nonnegative(),
+}) satisfies z.ZodType<Wire<ResponseValue<'host.describe'>>>

packages/host/apiproxy/src/api/host.ts

@@ -0,0 +1,25 @@
+/**
+ * host domain contract. No protocol version: client and host ship
+ * together; introduce protocolVersion only when an independently released client appears.
+ */
+
+import type { RpcRequest, RpcResponse } from './rpc.ts'
+
+/** Host-level unary methods. */
+export interface HostApi {
+  /**
+   * One-shot host snapshot. Empty payload uses the literal `{}` (extend in place when fields arrive).
+   * version = the host app's (apps/cli) package.json version; cwd = the host process working
+   * directory (root for session persistence and tool execution); provider/model = the defaults
+   * applied when a new agent doesn't specify them explicitly, absent when the host configures
+   * no explicit default (the adapter falls back internally);
+   * attachedSessions = count of currently attached sessions (those with a live agent).
+   */
+  describe(request: RpcRequest<{}>): Promise<RpcResponse<{
+    version: string
+    cwd: string
+    provider?: string
+    model?: string
+    attachedSessions: number
+  }>>
+}

packages/host/apiproxy/src/api/index.ts

@@ -0,0 +1,46 @@
+/**
+ * apiproxy contract-layer barrel. api/ has zero Node dependencies and is
+ * importable from the browser; the TS interfaces are the authoritative contract, HTTP/SSE are
+ * merely physical channels (four-quadrant message model).
+ */
+
+import type { SessionsApi } from './sessions.ts'
+import type { HostApi } from './host.ts'
+import type { EventsApi } from './events.ts'
+import type { ClientResponse, RpcReceipt } from './rpc.ts'
+
+/** Root interface of the unified API surface. New client-request domain = one new file pair + one field here + one map row. */
+export interface ApiProxy {
+  sessions: SessionsApi
+  host: HostApi
+  events: EventsApi
+  /** Response entry for server-requests (client-response, echoing their rpcId); not a domain method (four-quadrant model). */
+  respond(message: ClientResponse): Promise<RpcReceipt>
+}
+
+// ---- Domain interfaces and payload entities ----
+export type { HistoryEntry, SessionsApi, SessionSummary } from './sessions.ts'
+export type { HostApi } from './host.ts'
+export type { EventsApi, MuxFrame, HostFrame, ToolCallView, ToolEventView, ToolResultView } from './events.ts'
+export type { ApprovalResponsePayload } from './approvals.ts'
+export type { QuestionResponsePayload } from './questions.ts'
+
+// ---- Message layer: narrow forms (domain-signature view) ----
+export type { RpcRequest, RpcResponse } from './rpc.ts'
+
+// ---- Message layer: the four wire full forms + carrier receipt ----
+export type {
+  ClientRequest,
+  ClientResponse,
+  RpcMessage,
+  RpcReceipt,
+  ServerRequest,
+  ServerResponse,
+} from './rpc.ts'
+
+// ---- Errors and ids ----
+export { RpcId } from './rpc.ts'
+export type { RpcError, RpcErrorCode, RpcErrorDetailsMap, RpcResult } from './rpc.ts'
+
+// ---- Method registry and derived generics ----
+export type { RequestPayload, ResponseValue, RpcMethodMap } from './rpc-map.ts'

packages/host/apiproxy/src/api/questions.schema.ts

@@ -0,0 +1,26 @@
+/**
+ * questions domain zod schemas (respond is a client-response; the payload schema serves
+ * the /api/respond endpoint's second parse after routing via the pending table). The question
+ * identifier is the echoed rpcId; the payload carries no resource id.
+ */
+
+import { z } from 'zod'
+import type { AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-interaction/types'
+import type { QuestionResponsePayload } from './questions.ts'
+import type { Wire } from './rpc.schema.ts'
+import { sessionIdSchema } from './sessions.schema.ts'
+
+/** AskUserQuestionAnswer validated strictly against core dsh-user-interaction. */
+export const askUserQuestionAnswerSchema = z.object({
+  answers: z.array(z.object({
+    id: z.string(),
+    selected: z.array(z.string()),
+    custom: z.string().optional(),
+  })),
+}) satisfies z.ZodType<Wire<AskUserQuestionAnswer>>
+
+/** Question answer payload (the result.value slot of a client-response). */
+export const questionResponsePayloadSchema = z.object({
+  sessionId: sessionIdSchema,
+  answer: askUserQuestionAnswerSchema,
+}) satisfies z.ZodType<Wire<QuestionResponsePayload>>

packages/host/apiproxy/src/api/questions.ts

@@ -0,0 +1,19 @@
+/**
+ * questions domain contract. The question requested frame is a
+ * server-request whose rpcId is the question's stable logical id (minted when the host accepts
+ * ask(); core user-interaction has no request-level id); the answer is a client-response
+ * echoing that rpcId, with no resource id in the payload (rpcId suffices).
+ */
+
+import type { AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-interaction/types'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+
+/**
+ * Question answer payload (the result.value slot of a client-response):
+ * answers one ask() as a whole batch (core: one ask, many questions, one
+ * answer — never split per question).
+ */
+export interface QuestionResponsePayload {
+  sessionId: SessionId
+  answer: AskUserQuestionAnswer
+}

packages/host/apiproxy/src/api/rpc-map.ts

@@ -0,0 +1,26 @@
+/**
+ * RPC method registry and signature-derived generics. The map
+ * registers only client-request methods (respond is a client-response, so it is absent);
+ * map keys are the wire path segments (POST /api/session.list).
+ */
+
+import type { SessionsApi } from './sessions.ts'
+import type { HostApi } from './host.ts'
+import type { RpcResponse } from './rpc.ts'
+
+/** Method name → method signature. Signatures are the single source of truth; payload/value types are always derived from here. */
+export interface RpcMethodMap {
+  'session.list': SessionsApi['list']
+  'session.create': SessionsApi['create']
+  'session.history': SessionsApi['history']
+  'session.prompt': SessionsApi['prompt']
+  'session.cancel': SessionsApi['cancel']
+  'host.describe': HostApi['describe']
+}
+
+/** Business request payload of method K (reaches through the RpcRequest narrow form to payload). */
+export type RequestPayload<K extends keyof RpcMethodMap> = Parameters<RpcMethodMap[K]>[0]['payload']
+
+/** Business return value of method K (reaches through the RpcResponse narrow form to infer the ok value of result). */
+export type ResponseValue<K extends keyof RpcMethodMap> =
+  Awaited<ReturnType<RpcMethodMap[K]>> extends RpcResponse<infer T> ? T : never

packages/host/apiproxy/src/api/rpc.schema.ts

@@ -0,0 +1,97 @@
+/**
+ * Message-layer zod schemas: the four wire full forms + error body +
+ * carrier receipt. The payload slot is unknown in the full-form schemas — business payloads
+ * get a second parse dispatched by method (two-level parse discipline).
+ * Brand cast point: rpcIdSchema, and only there.
+ */
+
+import { z } from 'zod'
+import type { z as zCore } from 'zod'
+type ZodIssue = zCore.core.$ZodIssue
+import type { ClientRequest, ClientResponse, RpcError, RpcId, RpcReceipt, ServerRequest, ServerResponse } from './rpc.ts'
+
+/**
+ * Wire widening of a contract type: widens every property (deeply) to `original | undefined`.
+ * The repo enables exactOptionalPropertyTypes while zod `.optional()` outputs `T | undefined`,
+ * so `satisfies z.ZodType<ContractType>` is unusable across the board; anchoring is always
+ * written `satisfies z.ZodType<Wire<ContractType>>` — the widening only adds undefined, so
+ * missing fields / wrong types still fail to compile. On the JSON wire, "absent" and
+ * "value undefined" serialize identically, so the widening loses no validation semantics.
+ */
+export type Wire<T> = T extends readonly (infer E)[] ? Wire<E>[]
+  : T extends object ? { [K in keyof T]: Wire<T[K]> | undefined }
+    : T
+
+/**
+ * RpcId: one brand cast after shape validation (the only cast point in this
+ * file). No min-length: the id is an opaque echo token, and rejecting shapes
+ * here would only turn a correlatable error report into a client-side parse
+ * failure (the handler substitutes a sentinel when a request's id is unreadable).
+ */
+export const rpcIdSchema = z.string() as unknown as z.ZodType<RpcId>
+
+/** Error body: discriminated by code, per-branch details aligned to RpcErrorDetailsMap; details is required. */
+export const rpcErrorSchema: z.ZodType<RpcError> = z.discriminatedUnion('code', [
+  z.object({ code: z.literal('bad-request'), message: z.string(), details: z.object({ issues: z.array(z.custom<ZodIssue>()) }) }),
+  z.object({ code: z.literal('session-not-found'), message: z.string(), details: z.object({ sessionId: z.string() }) }),
+  z.object({ code: z.literal('agent-busy'), message: z.string(), details: z.object({ reason: z.string() }) }),
+  z.object({ code: z.literal('internal'), message: z.string(), details: z.object({}) }),
+]) as unknown as z.ZodType<RpcError>
+
+/**
+ * Business success/failure result schema (generic, reusable).
+ * @param value - Schema for the business value.
+ * @returns Schema for RpcResult<T>.
+ */
+export function rpcResultSchema<T>(value: z.ZodType<T>): z.ZodUnion<readonly [z.ZodType, z.ZodType]> {
+  return z.union([
+    z.object({ ok: z.literal(true), value }),
+    z.object({ ok: z.literal(false), error: rpcErrorSchema }),
+  ])
+}
+
+// ---- The four wire full-form schemas (payload/result.value slots stay wide — business layer does the second parse) ----
+
+/** ClientRequest full form (payload stays wide — the business layer runs the second parse). */
+export const clientRequestSchema = z.object({
+  type: z.literal('client-request'),
+  rpcId: rpcIdSchema,
+  method: z.string(),
+  payload: z.unknown(),
+}) as unknown as z.ZodType<ClientRequest>
+
+/** ServerResponse full form (result.value stays wide). */
+export const serverResponseSchema = z.object({
+  type: z.literal('server-response'),
+  rpcId: rpcIdSchema,
+  result: rpcResultSchema(z.unknown()),
+}) as unknown as z.ZodType<ServerResponse>
+
+/** ServerRequest full form (payload stays wide). */
+export const serverRequestSchema = z.object({
+  type: z.literal('server-request'),
+  rpcId: rpcIdSchema,
+  method: z.string(),
+  payload: z.unknown(),
+}) as unknown as z.ZodType<ServerRequest>
+
+/** ClientResponse full form (result.value stays wide). */
+export const clientResponseSchema = z.object({
+  type: z.literal('client-response'),
+  rpcId: rpcIdSchema,
+  result: rpcResultSchema(z.unknown()),
+}) as unknown as z.ZodType<ClientResponse>
+
+/** Wire full-form union (discriminated by type). */
+export const rpcMessageSchema = z.discriminatedUnion('type', [
+  clientRequestSchema as unknown as z.ZodObject<z.ZodRawShape>,
+  serverResponseSchema as unknown as z.ZodObject<z.ZodRawShape>,
+  serverRequestSchema as unknown as z.ZodObject<z.ZodRawShape>,
+  clientResponseSchema as unknown as z.ZodObject<z.ZodRawShape>,
+])
+
+/** Carrier receipt schema. */
+export const rpcReceiptSchema = z.union([
+  z.object({ accepted: z.literal(true) }),
+  z.object({ accepted: z.literal(false), reason: z.union([z.literal('not-pending'), z.literal('bad-response')]) }),
+]) satisfies z.ZodType<Wire<RpcReceipt>>

packages/host/apiproxy/src/api/rpc.ts

@@ -0,0 +1,113 @@
+/**
+ * Four-quadrant RPC message model. Channels and messages are
+ * decoupled: HTTP is the client→server physical channel, SSE the server→client one; logical
+ * messages are channel-independent, and the wire full form is a four-member discriminated union.
+ * api/ contract layer: zero Node dependencies, importable from the browser.
+ */
+
+import type { z as zCore } from 'zod'
+type ZodIssue = zCore.core.$ZodIssue
+import type { Branded } from '@deepseek-ai/dsh-brand'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+
+/**
+ * Message correlation id: the initiator mints it on a request; a response
+ * echoes the matching request's rpcId and never mints a new one.
+ */
+export type RpcId = Branded<'rpc-id'>
+
+/**
+ * Brands a string as RpcId (same precedent as core `SessionId()`). Minted by the initiator:
+ * client-request → client mints; server-request → host mints (answerable frames get a stable
+ * logical id, pure pushes mint a fresh one each time).
+ * @param id - Raw id string (implementations mint UUIDs; tests may pass fixtures).
+ * @returns The same string, branded (compile-time cast, zero runtime cost).
+ */
+export function RpcId(id: string): RpcId {
+  return id as RpcId
+}
+
+/** Error code → details type map (a second table isomorphic to RpcMethodMap). New code = one row here + one branch in the error schema. */
+export interface RpcErrorDetailsMap {
+  'bad-request': { issues: ZodIssue[] }
+  'session-not-found': { sessionId: SessionId }
+  'agent-busy': { reason: string }
+  'internal': {}
+}
+
+/** Closed error-code union (the keys of RpcErrorDetailsMap). */
+export type RpcErrorCode = keyof RpcErrorDetailsMap
+
+/**
+ * Distributive union expanded from the map: code is the discriminant, so
+ * `switch (error.code)` narrows details. details is required (internal uses an explicit {}).
+ */
+export type RpcError = {
+  [C in RpcErrorCode]: { code: C; message: string; details: RpcErrorDetailsMap[C] }
+}[RpcErrorCode]
+
+/** Business success/failure result: the result slot of a unary response; methods never throw business errors. */
+export type RpcResult<T> = { ok: true; value: T } | { ok: false; error: RpcError }
+
+/**
+ * Signature-layer narrow form, request side (domain-interface view, shared by
+ * both directions): rpcId is explicit in the signature, never mixed into the
+ * business payload; the type tag and method are filled in by the carrier layer.
+ */
+export interface RpcRequest<P> {
+  rpcId: RpcId
+  payload: P
+}
+
+/** Signature-layer narrow form, response side: rpcId always echoes the matching request. */
+export interface RpcResponse<T> {
+  rpcId: RpcId
+  result: RpcResult<T>
+}
+
+// ---- Wire full forms: four named members of a discriminated union (discriminant = the four `type` literals) ----
+
+/** Call initiated by the client (wire carrier: POST /api/<method> body). */
+export interface ClientRequest {
+  type: 'client-request'
+  rpcId: RpcId
+  method: string
+  payload: unknown
+}
+
+/** Response to a ClientRequest (wire carrier: the HTTP response body of that POST); rpcId echoed. */
+export interface ServerResponse {
+  type: 'server-response'
+  rpcId: RpcId
+  result: RpcResult<unknown>
+}
+
+/**
+ * Message initiated by the server (wire carrier: SSE frame). Answerable interactions
+ * (approval/question requested — stable rpcId, reused on replay) and pure pushes
+ * (session/event etc. — rpcId identifies that one push) share this shape; whether a
+ * response is expected is determined statically by method (a strict dichotomy, no third kind).
+ */
+export interface ServerRequest {
+  type: 'server-request'
+  rpcId: RpcId
+  method: string
+  payload: unknown
+}
+
+/** Response to a ServerRequest (wire carrier: POST /api/respond body); rpcId echoed, never minted anew. */
+export interface ClientResponse {
+  type: 'client-response'
+  rpcId: RpcId
+  result: RpcResult<unknown>
+}
+
+/** Authoritative wire full-form union; narrow via `switch (message.type)`. */
+export type RpcMessage = ClientRequest | ServerResponse | ServerRequest | ClientResponse
+
+/**
+ * Carrier receipt (not an RpcMessage — it belongs to the carrier layer, same
+ * discipline as "HTTP status describes only the carrier"): the HTTP response
+ * body of the POST carrying a client-response. Late/duplicate responses yield not-pending.
+ */
+export type RpcReceipt = { accepted: true } | { accepted: false; reason: 'not-pending' | 'bad-response' }

packages/host/apiproxy/src/api/sessions.schema.ts

@@ -0,0 +1,110 @@
+/**
+ * sessions domain zod schemas (names derived from map keys: sessionListRequestSchema /
+ * sessionListValueSchema). SessionEvent passthrough = strict envelope (type/seq/time) + wide
+ * data: the merge-extensible event surface keeps an unknown-type branch at the union level,
+ * with no field-level passthrough. SessionId brand cast point: sessionIdSchema, and only there.
+ */
+
+import { z } from 'zod'
+import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session/types'
+import type { RequestPayload, ResponseValue } from './rpc-map.ts'
+import type { Wire } from './rpc.schema.ts'
+import type { HistoryEntry, SessionSummary } from './sessions.ts'
+import type { ToolEventView } from './events.ts'
+
+/** SessionId: one brand cast after shape validation (the only cast point in this domain). */
+export const sessionIdSchema = z.string().min(1) as unknown as z.ZodType<SessionId>
+
+/** SessionEvent passthrough: strict envelope, wide data (the client fold handles unknown types via its documented default). */
+export const sessionEventSchema = z.object({
+  type: z.string(),
+  seq: z.number().int().nonnegative(),
+  time: z.number(),
+  data: z.unknown(),
+  sourceEventSeqs: z.array(z.number()).optional(),
+  surfaceOp: z.unknown().optional(),
+}) as unknown as z.ZodType<SessionEvent>
+
+/** SessionSummary row of session.list. */
+export const sessionSummarySchema = z.object({
+  sessionId: sessionIdSchema,
+  updatedAt: z.number(),
+  running: z.boolean(),
+  parentSessionId: sessionIdSchema.optional(),
+  cwd: z.string().optional(),
+}) satisfies z.ZodType<Wire<SessionSummary>>
+
+/** session.list request payload (cursor is a reserved seat, unimplemented in v1). */
+export const sessionListRequestSchema = z.object({
+  cursor: z.string().optional(),
+}) satisfies z.ZodType<Wire<RequestPayload<'session.list'>>>
+
+/** session.list response value. */
+export const sessionListValueSchema = z.object({
+  items: z.array(sessionSummarySchema),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.list'>>>
+
+/** session.create request payload. */
+export const sessionCreateRequestSchema = z.object({
+  cwd: z.string().optional(),
+}) satisfies z.ZodType<Wire<RequestPayload<'session.create'>>>
+
+/** session.create response value. */
+export const sessionCreateValueSchema = z.object({
+  sessionId: sessionIdSchema,
+}) satisfies z.ZodType<Wire<ResponseValue<'session.create'>>>
+
+/** session.history request payload (beforeSeq/maxMessages page backwards from the window tail). */
+export const sessionHistoryRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+  beforeSeq: z.number().int().nonnegative().optional(),
+  maxMessages: z.number().int().positive().optional(),
+}) satisfies z.ZodType<Wire<RequestPayload<'session.history'>>>
+
+/**
+ * ToolEventView passthrough: lock only the `for` discriminant and the presence
+ * of a card-tagged `view` object. The view interior is a host-computed product
+ * the client reads without echoing back; deep-validating it would hand-copy
+ * the dsh-tools vocabulary into this schema and drift with it.
+ */
+export const toolEventViewSchema = z.discriminatedUnion('for', [
+  z.object({ for: z.literal('call'), view: z.looseObject({ card: z.string() }) }),
+  z.object({ for: z.literal('result'), view: z.looseObject({ card: z.string() }) }),
+]) as unknown as z.ZodType<ToolEventView>
+
+/** One session.history item: the session event plus its optional host-computed tool view. */
+export const historyEntrySchema = z.object({
+  event: sessionEventSchema,
+  view: toolEventViewSchema.optional(),
+}) satisfies z.ZodType<Wire<HistoryEntry>>
+
+/** session.history response value. */
+export const sessionHistoryValueSchema = z.object({
+  events: z.array(historyEntrySchema),
+  hasMore: z.boolean(),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.history'>>>
+
+/** ContentBlock passthrough: core is merge-extensible — the type discriminant envelope is strict, the rest stays wide. */
+export const contentBlockSchema = z.looseObject({ type: z.string() })
+
+/** session.prompt request payload. */
+export const sessionPromptRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+  mode: z.union([z.literal('queue'), z.literal('steer')]),
+  content: z.array(contentBlockSchema),
+}) as unknown as z.ZodType<RequestPayload<'session.prompt'>>
+
+/** session.prompt response value. */
+export const sessionPromptValueSchema = z.object({
+  accepted: z.literal(true),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.prompt'>>>
+
+/** session.cancel request payload. */
+export const sessionCancelRequestSchema = z.object({
+  sessionId: sessionIdSchema,
+}) satisfies z.ZodType<Wire<RequestPayload<'session.cancel'>>>
+
+/** session.cancel response value. */
+export const sessionCancelValueSchema = z.object({
+  accepted: z.literal(true),
+}) satisfies z.ZodType<Wire<ResponseValue<'session.cancel'>>>

packages/host/apiproxy/src/api/sessions.ts

@@ -0,0 +1,73 @@
+/**
+ * sessions domain contract. Method signatures are the source of truth:
+ * unary methods take the RpcRequest<P> narrow form and the impl echoes rpcId; everything
+ * else references RequestPayload<'session.*'> / ResponseValue<'session.*'>.
+ */
+
+import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
+import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session/types'
+import type { RpcId, RpcRequest, RpcResponse } from './rpc.ts'
+import type { ToolEventView } from './events.ts'
+
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    /**
+     * The prompt's rpcId is passed through MessageSource into the `user/message` event
+     * (the client uses it to reconcile the optimistically
+     * echoed provisional message with the event stream). kind stays `'user'` — the model face
+     * carries no transport vocabulary; rpcId is an extra durable-JSON field passed back to the client with the event.
+     */
+    'user-rpc': { kind: 'user'; rpcId: RpcId }
+  }
+}
+
+/**
+ * One history page entry: the raw event plus the optional host-computed render
+ * intent (same semantics as the mux frame's `view` slot — a pagination-time
+ * derivation, never persisted).
+ */
+export interface HistoryEntry {
+  event: SessionEvent
+  view?: ToolEventView
+}
+
+/** Session list entry (v1 builds no index: list does readdir+stat). */
+export interface SessionSummary {
+  sessionId: SessionId
+  /** Persisted file mtime. */
+  updatedAt: number
+  /** Status of the attached agent; always false for cold (unattached) sessions. */
+  running: boolean
+  /** fork/spawn lineage (session.header.parentSession passthrough); absent for root sessions. */
+  parentSessionId?: SessionId
+  /** Session working directory (header.cwd passthrough); absent when unrecorded. */
+  cwd?: string
+}
+
+/** Session-domain unary methods (the map keys session.* of RpcMethodMap). */
+export interface SessionsApi {
+  /** Lists persisted sessions (updatedAt descending). v1 returns everything; cursor is a reserved seat, unimplemented. */
+  list(request: RpcRequest<{ cursor?: string }>): Promise<RpcResponse<{ items: SessionSummary[] }>>
+
+  /** Creates a new session (and its agent, idle and standing by). */
+  create(request: RpcRequest<{ cwd?: string }>): Promise<RpcResponse<{ sessionId: SessionId }>>
+
+  /**
+   * Reads a window of history events; page boundaries align to message boundaries: one page =
+   * all raw events owned by a whole number of messages (including their chunk / tool events),
+   * never cut mid-message. The tail page (beforeSeq absent) additionally carries the in-flight
+   * partial — chunk events already emitted for the last unfinalized message.
+   * Each entry pairs the raw SessionEvent with the host-computed view (tool events whose
+   * presenter produced one, evaluated against the registry at pagination time); the client
+   * rebuilds the surface from the events with the shared fold.
+   */
+  history(request: RpcRequest<{ sessionId: SessionId; beforeSeq?: number; maxMessages?: number }>):
+  Promise<RpcResponse<{ events: HistoryEntry[]; hasMore: boolean }>>
+
+  /** Sends a message. content is core's ContentBlock[] verbatim; mode maps 1:1 — queue→send, steer→steer. */
+  prompt(request: RpcRequest<{ sessionId: SessionId; mode: 'queue' | 'steer'; content: ContentBlock[] }>):
+  Promise<RpcResponse<{ accepted: true }>>
+
+  /** Stops: clears both FIFOs + aborts the current step (1:1 with agent.cancel). */
+  cancel(request: RpcRequest<{ sessionId: SessionId }>): Promise<RpcResponse<{ accepted: true }>>
+}

packages/host/apiproxy/src/fetch/client.ts

@@ -0,0 +1,302 @@
+/**
+ * Client side of the fetch carrier. AbstractApiClient holds every protocol invariant: rpcId minting,
+ * four-quadrant envelope wrap/unwrap, zod parsing, SSE frame decoding, and the payload-direct
+ * IApiClient domain methods (business code never mints). Platform differences ride two aspects:
+ * abstract doFetch (transport) + overridable onEnvelope (tap). ApiProxy (the impl face) is untouched.
+ */
+
+import type { z } from 'zod'
+import type { ApiProxy, HostFrame, MuxFrame } from '../api/index.ts'
+import type { RequestPayload, ResponseValue, RpcMethodMap } from '../api/rpc-map.ts'
+import type { ClientRequest, ClientResponse, RpcMessage, RpcReceipt, RpcRequest, RpcResponse, ServerRequest } from '../api/rpc.ts'
+import { RpcId } from '../api/rpc.ts'
+import type { Wire } from '../api/rpc.schema.ts'
+import { rpcReceiptSchema, serverRequestSchema, serverResponseSchema } from '../api/rpc.schema.ts'
+import { hostFrameSchema, muxFrameSchema } from '../api/events.schema.ts'
+import { hostDescribeValueSchema } from '../api/host.schema.ts'
+import {
+  sessionCancelValueSchema,
+  sessionCreateValueSchema,
+  sessionHistoryValueSchema,
+  sessionListValueSchema,
+  sessionPromptValueSchema,
+} from '../api/sessions.schema.ts'
+
+/**
+ * Client consumption face of the contract (shape a): same domain tree as ApiProxy, but unary
+ * methods take the business payload directly — the carrier mints the rpcId and wraps the
+ * envelope. Business code needing the call's rpcId reads it from the RpcResponse echo.
+ * Unary methods and respond accept an optional external AbortSignal as the last parameter
+ * (merged with the instance timeout via AbortSignal.any; same "signal rides beside the
+ * request, never on the wire" discipline as the stream signatures).
+ * Stream methods accept an optional onOpen callback: it fires once the SSE transport is
+ * readable (response headers received, before any frame) — the "stream established" signal
+ * connection controllers need for the readiness handshake. Generators are lazy, so the
+ * underlying fetch (and therefore onOpen) only happens once iteration starts.
+ * Relationship: ApiProxy is the narrow-form signature contract the impl side implements;
+ * IApiClient is the payload-direct view clients consume; AbstractApiClient bridges the two.
+ * Derived per method key from RpcMethodMap so a map row addition updates this mechanically.
+ */
+export interface IApiClient {
+  sessions: {
+    list(payload: RequestPayload<'session.list'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.list'>>>
+    create(payload: RequestPayload<'session.create'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.create'>>>
+    history(payload: RequestPayload<'session.history'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.history'>>>
+    prompt(payload: RequestPayload<'session.prompt'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.prompt'>>>
+    cancel(payload: RequestPayload<'session.cancel'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'session.cancel'>>>
+  }
+  host: {
+    describe(payload: RequestPayload<'host.describe'>, signal?: AbortSignal): Promise<RpcResponse<ResponseValue<'host.describe'>>>
+  }
+  events: {
+    mux(payload: Parameters<ApiProxy['events']['mux']>[0]['payload'], signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<MuxFrame>>
+    host(payload: Parameters<ApiProxy['events']['host']>[0]['payload'], signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<HostFrame>>
+  }
+  /** client-response passthrough (rpcId is a backfill of the server-request's id — never minted here). */
+  respond(message: ClientResponse, signal?: AbortSignal): Promise<RpcReceipt>
+}
+
+/**
+ * S→C second-level parse table: value schema by method (the response-path
+ * mirror of the handler's request table; key coverage compiler-enforced against RpcMethodMap).
+ */
+const UNARY_VALUE_SCHEMAS: { [K in keyof RpcMethodMap]: z.ZodType<Wire<ResponseValue<K>>> } = {
+  'session.list': sessionListValueSchema,
+  'session.create': sessionCreateValueSchema,
+  'session.history': sessionHistoryValueSchema,
+  'session.prompt': sessionPromptValueSchema,
+  'session.cancel': sessionCancelValueSchema,
+  'host.describe': hostDescribeValueSchema,
+}
+
+/** Default unary timeout (rpc-compare 2026-07-19: a hung host must not leave callers pending forever). */
+const DEFAULT_TIMEOUT_MS = 30_000
+
+/** URL base for in-process handler injection (fake authority, opencode precedent). */
+const INTERNAL_BASE = 'http://dsh.internal'
+
+/**
+ * Abstract fetch-carrier client. Subclasses supply the transport (doFetch) and may refine the
+ * per-message tap (onEnvelope) — platform aspects stay in subclasses, protocol invariants stay
+ * here. Envelope observation is a first-class aspect of this data middle layer: the instance
+ * owns a microtask-batched buffer (frame storms must not cost one consumer update per frame),
+ * and observers subscribe via subscribeEnvelopes. The isomorphic point survives: an in-process
+ * subclass whose doFetch is toFetchHandler(api).fetch never touches the network.
+ */
+export abstract class AbstractApiClient implements IApiClient {
+  /** Instance-owned observation buffer (module-level state would leak across instances/tests). */
+  private envelopeBatch: RpcMessage[] = []
+  private flushScheduled = false
+  private readonly envelopeListeners = new Set<(batch: readonly RpcMessage[]) => void>()
+
+  /** @param timeoutMs - unary timeout; streams never time out (long-lived by nature). */
+  constructor(protected readonly timeoutMs: number = DEFAULT_TIMEOUT_MS) {}
+
+  /** Transport aspect: browser fetch, injected handler.fetch, IPC bridge, ... */
+  protected abstract doFetch(input: URL, init?: RequestInit): Promise<Response>
+
+  /**
+   * Subscribe to batched envelope observation (diagnostics/logging consumers).
+   * Batches follow microtask boundaries; a listener throw is isolated (observation
+   * must never break the carrier).
+   * @param listener - receives each flushed batch in arrival order.
+   * @returns unsubscribe function.
+   */
+  subscribeEnvelopes(listener: (batch: readonly RpcMessage[]) => void): () => void {
+    this.envelopeListeners.add(listener)
+    return () => {
+      this.envelopeListeners.delete(listener)
+    }
+  }
+
+  /** Per-message tap: feeds the instance buffer. Subclasses may override to observe unbatched (call super to keep batching). */
+  protected onEnvelope(message: RpcMessage): void {
+    if (this.envelopeListeners.size === 0) return
+    this.envelopeBatch.push(message)
+    if (this.flushScheduled) return
+    this.flushScheduled = true
+    queueMicrotask(() => {
+      this.flushScheduled = false
+      // Never empty here: a flush is only ever scheduled by the push above,
+      // and this callback is the sole drain point.
+      const batch = this.envelopeBatch
+      this.envelopeBatch = []
+      for (const notify of this.envelopeListeners) {
+        try {
+          notify(batch)
+        } catch (error) {
+          console.error('[apiproxy] envelope listener threw:', error)
+        }
+      }
+    })
+  }
+
+  /** Browser = same-origin (a fake authority would fail DNS on real requests); no-location env (Node) = fake authority. */
+  protected resolveBase(): string {
+    const loc = (globalThis as { location?: { origin?: string } }).location
+    return loc?.origin !== undefined && loc.origin !== 'null' ? loc.origin : INTERNAL_BASE
+  }
+
+  protected mintRpcId(): RpcId {
+    // crypto.randomUUID is a Web API (browser + Node ≥19): keeps this base platform-neutral.
+    return RpcId(crypto.randomUUID())
+  }
+
+  /**
+   * Shared POST leg of both C→S carriers (callUnary/respond): JSON body,
+   * timeout merged with the caller's optional external signal, non-2xx → transport throw.
+   */
+  private async postJson(path: string, body: ClientRequest | ClientResponse, signal: AbortSignal | undefined): Promise<Response> {
+    const timeout = AbortSignal.timeout(this.timeoutMs)
+    const response = await this.doFetch(new URL(path, this.resolveBase()), {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: signal === undefined ? timeout : AbortSignal.any([timeout, signal]),
+    })
+    if (!response.ok) throw new Error(`transport failure for ${path}: HTTP ${response.status}`)
+    return response
+  }
+
+  /**
+   * Unary protocol path: mint → tap → POST full form → envelope parse → verify
+   * echo → value parse → tap → narrow. Virtual so a fake carrier (fixture) can
+   * override transport at this layer.
+   */
+  protected async callUnary<K extends keyof RpcMethodMap>(
+    method: K,
+    payload: RequestPayload<K>,
+    signal?: AbortSignal,
+  ): Promise<RpcResponse<ResponseValue<K>>> {
+    const message: ClientRequest = { type: 'client-request', rpcId: this.mintRpcId(), method, payload }
+    this.onEnvelope(message)
+    const response = await this.postJson(`/api/${method}`, message, signal)
+    const full = serverResponseSchema.parse(await response.json())
+    this.onEnvelope(full)
+    if (full.rpcId !== message.rpcId) throw new Error(`rpcId mismatch for ${method}: sent ${message.rpcId}, got ${full.rpcId}`)
+    if (!full.result.ok) return { rpcId: full.rpcId, result: full.result }
+    // Second-level S→C parse: the ok value must match the method's Value schema (mirror of the
+    // handler's request-payload parse). The cast collapses the Wire<> widening, same as the handler side.
+    const value = UNARY_VALUE_SCHEMAS[method].parse(full.result.value) as ResponseValue<K>
+    return { rpcId: full.rpcId, result: { ok: true, value } }
+  }
+
+  /** Mux stream opener; virtual for the same override reason as callUnary. */
+  protected openMux(_payload: Parameters<ApiProxy['events']['mux']>[0]['payload'], signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<MuxFrame>> {
+    return this.readSse('/api/events.mux', signal, muxFrameSchema, onOpen)
+  }
+
+  /** Host stream opener; virtual. */
+  protected openHost(_payload: Parameters<ApiProxy['events']['host']>[0]['payload'], signal: AbortSignal, onOpen?: () => void): AsyncIterable<RpcRequest<HostFrame>> {
+    return this.readSse('/api/events.host', signal, hostFrameSchema, onOpen)
+  }
+
+  /**
+   * SSE protocol path: streaming fetch (not EventSource), '\n\n' framing, ServerRequest envelope +
+   * frame-schema parse, tap, narrow yield. onOpen fires once the response headers are in and the
+   * body is readable — the stream-established signal, before any frame arrives. A frame that fails
+   * either parse level is reported and skipped (one corrupt frame must not kill the stream; the
+   * client's gap detection covers whatever the frame carried).
+   */
+  protected async *readSse<F extends MuxFrame | HostFrame>(
+    path: string,
+    signal: AbortSignal,
+    frameSchema: z.ZodType<F>,
+    onOpen?: () => void,
+  ): AsyncGenerator<RpcRequest<F>> {
+    const response = await this.doFetch(new URL(path, this.resolveBase()), { signal })
+    if (!response.ok || response.body === null) throw new Error(`transport failure for ${path}: HTTP ${response.status}`)
+    onOpen?.()
+    const reader = response.body.getReader()
+    const decoder = new TextDecoder()
+    let buffer = ''
+    try {
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) return
+        buffer += decoder.decode(value, { stream: true })
+        let boundary: number
+        while ((boundary = buffer.indexOf('\n\n')) !== -1) {
+          const chunk = buffer.slice(0, boundary)
+          buffer = buffer.slice(boundary + 2)
+          const data = chunk.split('\n').filter(line => line.startsWith('data: ')).map(line => line.slice(6)).join('')
+          if (data === '') continue
+          let full: ServerRequest
+          let frame: F
+          try {
+            full = serverRequestSchema.parse(JSON.parse(data))
+            frame = frameSchema.parse(full.payload)
+          } catch (error) {
+            console.error(`[apiproxy] dropping malformed SSE frame on ${path}:`, error)
+            continue
+          }
+          this.onEnvelope(full)
+          yield { rpcId: full.rpcId, payload: frame }
+        }
+      }
+    } finally {
+      await reader.cancel().catch(() => undefined)
+    }
+  }
+
+  // ---- IApiClient surface (arrow properties so destructured/passed references stay bound) ----
+
+  readonly sessions: IApiClient['sessions'] = {
+    list: (payload, signal) => this.callUnary('session.list', payload, signal),
+    create: (payload, signal) => this.callUnary('session.create', payload, signal),
+    history: (payload, signal) => this.callUnary('session.history', payload, signal),
+    prompt: (payload, signal) => this.callUnary('session.prompt', payload, signal),
+    cancel: (payload, signal) => this.callUnary('session.cancel', payload, signal),
+  }
+
+  readonly host: IApiClient['host'] = {
+    describe: (payload, signal) => this.callUnary('host.describe', payload, signal),
+  }
+
+  readonly events: IApiClient['events'] = {
+    mux: (payload, signal, onOpen) => this.openMux(payload, signal, onOpen),
+    host: (payload, signal, onOpen) => this.openHost(payload, signal, onOpen),
+  }
+
+  async respond(message: ClientResponse, signal?: AbortSignal): Promise<RpcReceipt> {
+    this.onEnvelope(message)
+    const response = await this.postJson('/api/respond', message, signal)
+    return rpcReceiptSchema.parse(await response.json())
+  }
+}
+
+/**
+ * In-process client over an injected fetch-shaped handler (the isomorphic point:
+ * `new InProcessApiClient(toFetchHandler(api))` never touches the network). Lives here because
+ * in-process injection is this package's own capability (handler and client are both local).
+ */
+export class InProcessApiClient extends AbstractApiClient {
+  constructor(private readonly handler: { fetch: typeof fetch }, timeoutMs?: number) {
+    super(timeoutMs)
+  }
+
+  /**
+   * Faithful to real fetch: reject on signal abort even when the in-process
+   * handler ignores the signal (a hung impl must not defeat timeout/cancel).
+   */
+  protected doFetch(input: URL, init?: RequestInit): Promise<Response> {
+    const signal = init?.signal ?? undefined
+    if (signal === undefined) return this.handler.fetch(input, init)
+    if (signal.aborted) return Promise.reject(abortError(signal))
+    return new Promise((resolve, reject) => {
+      const onAbort = (): void => { reject(abortError(signal)) }
+      signal.addEventListener('abort', onAbort, { once: true })
+      this.handler.fetch(input, init)
+        .then(resolve, reject)
+        .finally(() => { signal.removeEventListener('abort', onAbort) })
+    })
+  }
+}
+
+/** Mirror fetch's abort rejection: the signal's reason when present, else a DOMException-style AbortError. */
+function abortError(signal: AbortSignal): Error {
+  const reason: unknown = signal.reason
+  if (reason instanceof Error) return reason
+  if (typeof reason === 'string') return new Error(reason)
+  return new Error('This operation was aborted')
+}

packages/host/apiproxy/src/fetch/handler.ts

@@ -0,0 +1,197 @@
+/**
+ * Server side of the fetch carrier: maps an ApiProxy onto a pure
+ * WHATWG Request->Response function. Two-level parse: full form (type/rpcId/method +
+ * path==method) -> payload dispatched per method. HTTP status expresses only the carrier
+ * (404 unknown path / 400 non-JSON body / 500 handler crash); business errors are always
+ * 200 + ServerResponse.
+ */
+
+import { randomUUID } from 'node:crypto'
+import type { z } from 'zod'
+import type { ApiProxy, MuxFrame, HostFrame } from '../api/index.ts'
+import type { RequestPayload, ResponseValue, RpcMethodMap } from '../api/rpc-map.ts'
+import type { ClientRequest, RpcError, RpcRequest, RpcResponse, ServerRequest, ServerResponse } from '../api/rpc.ts'
+import { RpcId } from '../api/rpc.ts'
+import type { Wire } from '../api/rpc.schema.ts'
+import { clientRequestSchema, clientResponseSchema } from '../api/rpc.schema.ts'
+import {
+  sessionCancelRequestSchema,
+  sessionCreateRequestSchema,
+  sessionHistoryRequestSchema,
+  sessionListRequestSchema,
+  sessionPromptRequestSchema,
+} from '../api/sessions.schema.ts'
+import { hostDescribeRequestSchema } from '../api/host.schema.ts'
+
+/**
+ * Unary dispatch table, keyed by (and compiler-locked to) RpcMethodMap: a map row without a
+ * route row fails to compile, and each row's schema/invoke pair is checked against that row's
+ * payload type — a schema pasted onto the wrong row is a type error, not a runtime surprise.
+ * Schemas anchor to the Wire<> widening (the repo-wide exactOptionalPropertyTypes accommodation
+ * documented on Wire); the dispatch point carries the one Wire→exact cast.
+ */
+type UnaryRoutes = {
+  [K in keyof RpcMethodMap]: {
+    schema: z.ZodType<Wire<RequestPayload<K>>>
+    invoke(api: ApiProxy, request: RpcRequest<RequestPayload<K>>): Promise<RpcResponse<ResponseValue<K>>>
+  }
+}
+
+const UNARY_ROUTES: UnaryRoutes = {
+  'session.list': { schema: sessionListRequestSchema, invoke: (api, r) => api.sessions.list(r) },
+  'session.create': { schema: sessionCreateRequestSchema, invoke: (api, r) => api.sessions.create(r) },
+  'session.history': { schema: sessionHistoryRequestSchema, invoke: (api, r) => api.sessions.history(r) },
+  'session.prompt': { schema: sessionPromptRequestSchema, invoke: (api, r) => api.sessions.prompt(r) },
+  'session.cancel': { schema: sessionCancelRequestSchema, invoke: (api, r) => api.sessions.cancel(r) },
+  'host.describe': { schema: hostDescribeRequestSchema, invoke: (api, r) => api.host.describe(r) },
+}
+
+/** Route lookup that narrows an arbitrary path segment to a map key (single cast point for the string→key refinement). */
+function methodFor(path: string): keyof RpcMethodMap | undefined {
+  return Object.hasOwn(UNARY_ROUTES, path) ? path as keyof RpcMethodMap : undefined
+}
+
+/**
+ * Sentinel rpcId for error responses to envelopes whose own rpcId is unreadable: the response
+ * must still be a valid ServerResponse (a self-violating shape would turn the server's explicit
+ * bad-request report into a client-side parse failure). Fixed value, documented here as wire contract.
+ */
+const INVALID_REQUEST_RPC_ID = RpcId('invalid-request')
+
+/** Wrap a business error as a ServerResponse full form (rpcId backfilled; an unreadable rpcId uses the invalid-request sentinel). */
+function errorResponse(rpcId: RpcId, error: RpcError): Response {
+  const body: ServerResponse = { type: 'server-response', rpcId, result: { ok: false, error } }
+  return Response.json(body)
+}
+
+/** Complete the impl's narrow form into a ServerResponse full form. */
+function fullResponse(narrow: RpcResponse<unknown>): Response {
+  const body: ServerResponse = { type: 'server-response', rpcId: narrow.rpcId, result: narrow.result }
+  return Response.json(body)
+}
+
+/**
+ * Parse the payload and invoke one unary route. Generic over the map key so
+ * the row's schema/invoke pairing typechecks; the only cast collapses the
+ * Wire<> widening back to the exact payload (undefined-valued properties and
+ * absent ones are indistinguishable after JSON transport).
+ */
+// K appears once in the signature but ties the UNARY_ROUTES[K] row lookup to its own
+// schema/invoke pairing; a union parameter degrades the row to an uninvokable intersection.
+// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters
+async function handleUnary<K extends keyof RpcMethodMap>(api: ApiProxy, method: K, message: ClientRequest): Promise<Response> {
+  const route = UNARY_ROUTES[method]
+  const payload = route.schema.safeParse(message.payload)
+  if (!payload.success) {
+    return errorResponse(message.rpcId, { code: 'bad-request', message: `invalid payload for ${method}`, details: { issues: payload.error.issues } })
+  }
+  try {
+    return fullResponse(await route.invoke(api, { rpcId: message.rpcId, payload: payload.data }))
+  } catch (error: unknown) {
+    // The impl never throws business errors; reaching here means the implementation itself crashed — 500, carrier layer.
+    return new Response(`handler failure: ${String(error)}`, { status: 500 })
+  }
+}
+
+/** SSE frame: complete the narrow RpcRequest<frame> into a ServerRequest full form (method = frame type). */
+function fullFrame(narrow: RpcRequest<MuxFrame | HostFrame>): ServerRequest {
+  return { type: 'server-request', rpcId: narrow.rpcId, method: narrow.payload.type, payload: narrow.payload }
+}
+
+/**
+ * Wrap a frame stream as an SSE Response; stops when req.signal aborts. An
+ * impl throw mid-stream emits one stream/error frame and then closes.
+ */
+function sseResponse(frames: AsyncIterable<RpcRequest<MuxFrame | HostFrame>>): Response {
+  const encoder = new TextEncoder()
+  const stream = new ReadableStream<Uint8Array>({
+    async start(controller) {
+      try {
+        // Send an SSE comment line on open so clients/proxies see a live channel (the host
+        // stream has no baseline frames and would otherwise emit zero bytes while idle;
+        // a comment line is not a frame, so client frame parsing skips it naturally).
+        controller.enqueue(encoder.encode(': connected\n\n'))
+        for await (const narrow of frames) {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(fullFrame(narrow))}\n\n`))
+        }
+      } catch (error: unknown) {
+        // Mid-stream impl failure → one stream/error frame, then close: the client must see
+        // the failure instead of a silent end (which reads as a normal disconnect). A fresh
+        // rpcId is minted — this is a server-initiated push like any other frame.
+        const failure: MuxFrame | HostFrame = { type: 'stream/error', error: { code: 'internal', message: String(error), details: {} } }
+        try {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(fullFrame({ rpcId: RpcId(randomUUID()), payload: failure }))}\n\n`))
+        } catch {
+          // Consumer already cancelled the stream: enqueue-after-cancel is the
+          // only reachable error, and there is no one left to tell.
+        }
+      } finally {
+        try {
+          controller.close()
+        } catch { /* already cancelled by the consumer: a double close is the only reachable error */ }
+      }
+    },
+  })
+  return new Response(stream, {
+    headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-cache' },
+  })
+}
+
+/**
+ * Wraps an ApiProxy into a pure fetch function (isomorphic point: feed the returned fetch straight to InProcessApiClient).
+ * @param api - the host-side ApiProxy implementation.
+ * @returns an object holding `fetch(Request)`; paths outside /api/ return 404.
+ */
+export function toFetchHandler(api: ApiProxy): { fetch: typeof fetch } {
+  return {
+    // Signature matches global fetch: the isomorphic point hands this function to InProcessApiClient as its transport aspect,
+    // Clients call in (url, init) form — normalize to Request before handling.
+    async fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+      const req = input instanceof Request ? input : new Request(input, init)
+      const url = new URL(req.url)
+      const path = url.pathname
+
+      if (path === '/api/events.mux' && req.method === 'GET') {
+        return sseResponse(api.events.mux({ rpcId: RpcId(randomUUID()), payload: {} }, req.signal))
+      }
+      if (path === '/api/events.host' && req.method === 'GET') {
+        return sseResponse(api.events.host({ rpcId: RpcId(randomUUID()), payload: {} }, req.signal))
+      }
+
+      if (req.method !== 'POST' || !path.startsWith('/api/')) {
+        return new Response('not found', { status: 404 })
+      }
+
+      let body: unknown
+      try {
+        body = await req.json()
+      } catch {
+        // 400 = carrier layer (body is not even JSON); valid JSON with a bad shape goes 200 + bad-request.
+        return new Response('body is not JSON', { status: 400 })
+      }
+
+      if (path === '/api/respond') {
+        const parsed = clientResponseSchema.safeParse(body)
+        if (!parsed.success) return Response.json({ accepted: false, reason: 'bad-response' })
+        return Response.json(await api.respond(parsed.data))
+      }
+
+      const method = methodFor(path.slice('/api/'.length))
+      if (method === undefined) return new Response('not found', { status: 404 })
+
+      const envelope = clientRequestSchema.safeParse(body)
+      if (!envelope.success) {
+        // Best effort at correlation: salvage a string rpcId from the raw body;
+        // otherwise the fixed sentinel keeps the response a valid ServerResponse.
+        const rawId = (body as { rpcId?: unknown } | null)?.rpcId
+        const rpcId = typeof rawId === 'string' ? RpcId(rawId) : INVALID_REQUEST_RPC_ID
+        return errorResponse(rpcId, { code: 'bad-request', message: 'invalid client-request message', details: { issues: envelope.error.issues } })
+      }
+      const message: ClientRequest = envelope.data
+      if (message.method !== method) {
+        return errorResponse(message.rpcId, { code: 'bad-request', message: `method "${message.method}" does not match path "${method}"`, details: { issues: [] } })
+      }
+      return handleUnary(api, method, message)
+    },
+  }
+}

packages/host/apiproxy/src/index.ts

@@ -0,0 +1,13 @@
+/**
+ * @deepseek-ai/dsh-host-apiproxy — the front layer every client shape shares:
+ * the ApiProxy contract (api/: types + zod schemas, browser-safe) and the
+ * fetch carrier pair (fetch/: toFetchHandler on the host side, AbstractApiClient +
+ * platform subclasses on the client side). Host assembly (bootHost/createApiProxy/startHost)
+ * lives in @deepseek-ai/dsh-host-runtime.
+ */
+
+export type * from './api/index.ts'
+export { RpcId } from './api/rpc.ts'
+export { toFetchHandler } from './fetch/handler.ts'
+export { AbstractApiClient, InProcessApiClient } from './fetch/client.ts'
+export type { IApiClient } from './fetch/client.ts'

packages/host/apiproxy/src/invariant.ts

@@ -0,0 +1,33 @@
+/**
+ * Package-owned invariant companion for `@deepseek-ai/dsh-host-apiproxy`.
+ * @module @deepseek-ai/dsh-host-apiproxy/invariant
+ */
+
+/* jscpd:ignore-start */
+import type { Context } from 'cordis'
+import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+
+const PACKAGE_NAME = '@deepseek-ai/dsh-host-apiproxy'
+
+/** Cordis companion plugin name. */
+export const name = 'host-apiproxy-invariant'
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants']
+
+/**
+ * No runtime invariant: this package is the wire contract layer (types,
+ * schemas, fetch carrier glue) — it emits no cordis events and owns no
+ * mutable cross-plugin relation. rpcId round-trip and schema acceptance are
+ * enforced at the carrier boundary and exercised by the protocol-isomorphism
+ * suite; the live implementation relations belong to dsh-host-runtime.
+ */
+const install: InvariantInstaller = () => {}
+
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx: Context): Promise<() => void> =>
+  Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install))
+/* jscpd:ignore-end */

packages/host/apiproxy/tests/client-handler.spec.ts

@@ -0,0 +1,407 @@
+/**
+ * Wire-protocol coverage over the isomorphic point: InProcessApiClient →
+ * toFetchHandler(scripted impl) runs the real envelope wrap/unwrap, zod
+ * two-level parse, rpcId discipline, and SSE framing with no network and no
+ * browser. Each case scripts its own minimal ApiProxy.
+ */
+
+import { describe, expect, it, vi } from 'vitest'
+import type { SessionId } from '@deepseek-ai/dsh-session'
+import type { ApiProxy, HostFrame, MuxFrame, RpcMessage, RpcRequest, RpcResponse } from '@deepseek-ai/dsh-host-apiproxy'
+import { InProcessApiClient, RpcId, toFetchHandler } from '@deepseek-ai/dsh-host-apiproxy'
+
+const sid = (id: string): SessionId => id as SessionId
+
+function ok<T>(request: RpcRequest<unknown>, value: T): Promise<RpcResponse<T>> {
+  return Promise.resolve({ rpcId: request.rpcId, result: { ok: true, value } })
+}
+
+/** Scripted impl: every method resolves an empty-ish OK unless a case overrides it. */
+function scriptedApi(overrides: {
+  sessions?: Partial<ApiProxy['sessions']>
+  host?: Partial<ApiProxy['host']>
+  events?: Partial<ApiProxy['events']>
+  respond?: ApiProxy['respond']
+} = {}): ApiProxy {
+  async function *empty<F>(): AsyncGenerator<RpcRequest<F>> { /* no frames */ }
+  return {
+    sessions: {
+      list: r => ok(r, { items: [] }),
+      create: r => ok(r, { sessionId: sid('s-new') }),
+      history: r => ok(r, { events: [], hasMore: false }),
+      prompt: r => ok(r, { accepted: true as const }),
+      cancel: r => ok(r, { accepted: true as const }),
+      ...overrides.sessions,
+    },
+    host: { describe: r => ok(r, { version: '0-test', cwd: '/t', attachedSessions: 0 }), ...overrides.host },
+    events: { mux: () => empty<MuxFrame>(), host: () => empty<HostFrame>(), ...overrides.events },
+    respond: overrides.respond ?? (() => Promise.resolve({ accepted: false as const, reason: 'not-pending' as const })),
+  }
+}
+
+function client(api: ApiProxy, timeoutMs?: number): InProcessApiClient {
+  return new InProcessApiClient(toFetchHandler(api), timeoutMs)
+}
+
+describe('unary round trip', () => {
+  it('carries payload out and value back through the full wire form', async () => {
+    let seen: RpcRequest<{ cursor?: string }> | undefined
+    const api = scriptedApi({
+      sessions: {
+        list: (r) => {
+          seen = r
+          return ok(r, { items: [{ sessionId: sid('s1'), updatedAt: 7, running: false }] })
+        },
+      },
+    })
+    const response = await client(api).sessions.list({ cursor: 'c1' })
+    // Impl received the narrow form with a minted id; client returned the same id and value.
+    expect(seen?.payload).toEqual({ cursor: 'c1' })
+    expect(seen?.rpcId).toBeTruthy()
+    expect(response.rpcId).toBe(seen?.rpcId)
+    expect(response.result).toEqual({ ok: true, value: { items: [{ sessionId: 's1', updatedAt: 7, running: false }] } })
+  })
+
+  it('passes business errors through as 200 + err result, not a throw', async () => {
+    const api = scriptedApi({
+      sessions: {
+        cancel: r => Promise.resolve({ rpcId: r.rpcId, result: { ok: false, error: { code: 'session-not-found', message: 'nope', details: { sessionId: sid('sx') } } } }),
+      },
+    })
+    const response = await client(api).sessions.cancel({ sessionId: sid('sx') })
+    expect(response.result).toEqual({ ok: false, error: { code: 'session-not-found', message: 'nope', details: { sessionId: 'sx' } } })
+  })
+
+  it('throws on rpcId echo mismatch', async () => {
+    const api = scriptedApi({
+      sessions: { list: () => Promise.resolve({ rpcId: RpcId('forged'), result: { ok: true, value: { items: [] } } }) },
+    })
+    await expect(client(api).sessions.list({})).rejects.toThrow(/rpcId mismatch/)
+  })
+
+  it('rejects an invalid payload at the handler as 200 + bad-request with issues', async () => {
+    const api = scriptedApi()
+    const response = await client(api).sessions.history({ sessionId: 123 as unknown as SessionId })
+    expect(response.result.ok).toBe(false)
+    if (!response.result.ok) {
+      expect(response.result.error.code).toBe('bad-request')
+      expect((response.result.error.details as { issues: unknown[] }).issues.length).toBeGreaterThan(0)
+    }
+  })
+
+  it('rejects a method/path mismatch as bad-request', async () => {
+    const handler = toFetchHandler(scriptedApi())
+    const body = { type: 'client-request', rpcId: 'r1', method: 'session.create', payload: {} }
+    const response = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: JSON.stringify(body) })
+    expect(response.status).toBe(200)
+    const parsed = await response.json() as { result: { ok: boolean; error?: { code: string; message: string } } }
+    expect(parsed.result.ok).toBe(false)
+    expect(parsed.result.error?.code).toBe('bad-request')
+    expect(parsed.result.error?.message).toMatch(/does not match path/)
+  })
+
+  it('rejects a malformed envelope as bad-request, salvaging the rpcId or falling back to the sentinel', async () => {
+    const handler = toFetchHandler(scriptedApi())
+    // No salvageable rpcId → the fixed invalid-request sentinel keeps the response a valid ServerResponse.
+    const noId = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: JSON.stringify({ nonsense: true }) })
+    expect(noId.status).toBe(200)
+    const noIdParsed = await noId.json() as { rpcId: string; result: { ok: boolean } }
+    expect(noIdParsed.result.ok).toBe(false)
+    expect(noIdParsed.rpcId).toBe('invalid-request')
+    // A string rpcId in the otherwise-bad body is salvaged for correlation.
+    const withId = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: JSON.stringify({ rpcId: 'salvage-me', nonsense: true }) })
+    const withIdParsed = await withId.json() as { rpcId: string; result: { ok: boolean } }
+    expect(withIdParsed.result.ok).toBe(false)
+    expect(withIdParsed.rpcId).toBe('salvage-me')
+  })
+
+  it('maps carrier failures to HTTP statuses and the client throws transport failure', async () => {
+    const handler = toFetchHandler(scriptedApi())
+    // Unknown method → 404.
+    const notFound = await handler.fetch('http://dsh.internal/api/no.such', { method: 'POST', body: '{}' })
+    expect(notFound.status).toBe(404)
+    // Non-JSON body → 400.
+    const badBody = await handler.fetch('http://dsh.internal/api/session.list', { method: 'POST', body: '{oops' })
+    expect(badBody.status).toBe(400)
+    // Impl crash → 500, and through the client that is a throw, not an err result.
+    const crashing = scriptedApi({ sessions: { list: () => { throw new Error('impl exploded') } } })
+    await expect(client(crashing).sessions.list({})).rejects.toThrow(/transport failure .*500/)
+  })
+
+  it('rejects when the transport never resolves within timeoutMs', async () => {
+    // AbortSignal.timeout is immune to fake timers; a short real timeout keeps this fast.
+    const never = new InProcessApiClient({
+      fetch: (_i: RequestInfo | URL, init?: RequestInit) => new Promise<Response>((_resolve, reject) => {
+        init?.signal?.addEventListener('abort', () => { reject(new Error('aborted by timeout')) })
+      }),
+    }, 25)
+    await expect(never.sessions.list({})).rejects.toThrow()
+  })
+
+  it('aborts a unary call through the caller-supplied external signal', async () => {
+    // Real-fetch semantics: on abort the rejection is the signal's reason, and the abort
+    // works even when the transport ignores the signal entirely (hung impl).
+    const gate = new AbortController()
+    const hung = new InProcessApiClient({ fetch: () => new Promise<Response>(() => {}) }, 60_000)
+    const call = hung.sessions.list({}, gate.signal)
+    gate.abort(new Error('externally aborted'))
+    await expect(call).rejects.toThrow(/externally aborted/)
+  })
+
+  it('rejects an already-aborted signal before touching the transport, mapping a string reason to an Error', async () => {
+    let touched = false
+    const c = new InProcessApiClient({
+      fetch: () => {
+        touched = true
+        return Promise.resolve(new Response('{}'))
+      },
+    }, 60_000)
+    const gate = new AbortController()
+    gate.abort('gone before start')
+    await expect(c.sessions.list({}, gate.signal)).rejects.toThrow('gone before start')
+    expect(touched).toBe(false)
+  })
+
+  it('maps a non-Error, non-string abort reason to the default AbortError message', async () => {
+    const gate = new AbortController()
+    const hung = new InProcessApiClient({ fetch: () => new Promise<Response>(() => {}) }, 60_000)
+    const call = hung.sessions.list({}, gate.signal)
+    gate.abort(42)
+    await expect(call).rejects.toThrow('This operation was aborted')
+  })
+
+  it('passes a signal-less doFetch straight through to the handler', async () => {
+    class Probe extends InProcessApiClient {
+      direct(url: URL): Promise<Response> {
+        return this.doFetch(url)
+      }
+    }
+    const probe = new Probe({ fetch: () => Promise.resolve(new Response('raw')) })
+    const response = await probe.direct(new URL('http://dsh.internal/probe'))
+    expect(await response.text()).toBe('raw')
+  })
+
+  it('throws on an S→C ok value that fails the method value schema (second-level parse)', async () => {
+    // Impl echoes rpcId but returns a wrong-shaped value: envelope parse passes, value parse must reject.
+    const api = scriptedApi({
+      sessions: { list: r => Promise.resolve({ rpcId: r.rpcId, result: { ok: true, value: { items: 'not-an-array' } } }) as never },
+    })
+    await expect(client(api).sessions.list({})).rejects.toThrow()
+  })
+})
+
+describe('SSE stream path', () => {
+  it('yields frames in order and skips the comment preamble', async () => {
+    const frames: MuxFrame[] = [
+      { type: 'session/subscribed', sessionId: sid('s1'), lastSeq: 3 },
+      { type: 'stream/error', error: { code: 'internal', message: 'x', details: {} } },
+    ]
+    const api = scriptedApi({
+      events: {
+        async *mux(request) {
+          let n = 0
+          for (const frame of frames) yield { rpcId: RpcId(`push-${n++}-${request.rpcId}`), payload: frame }
+        },
+      },
+    })
+    const seen: MuxFrame[] = []
+    for await (const envelope of client(api).events.mux({}, new AbortController().signal)) {
+      seen.push(envelope.payload)
+    }
+    expect(seen).toEqual(frames)
+  })
+
+  it('reassembles frames across arbitrary chunk boundaries', async () => {
+    // Two SSE frames split so one frame spans chunks and one chunk carries parts of both.
+    const f1 = { type: 'server-request', rpcId: 'a', method: 'session/subscribed', payload: { type: 'session/subscribed', sessionId: 's1', lastSeq: 1 } }
+    const f2 = { type: 'server-request', rpcId: 'b', method: 'session/subscribed', payload: { type: 'session/subscribed', sessionId: 's2', lastSeq: 2 } }
+    const wire = `: connected\n\ndata: ${JSON.stringify(f1)}\n\ndata: ${JSON.stringify(f2)}\n\n`
+    const cuts = [5, 40, wire.indexOf('data: ', 40) + 3]
+    const encoder = new TextEncoder()
+    const doFetch = (): Promise<Response> => Promise.resolve(new Response(new ReadableStream<Uint8Array>({
+      start(controller) {
+        let prev = 0
+        for (const cut of [...cuts, wire.length]) {
+          controller.enqueue(encoder.encode(wire.slice(prev, cut)))
+          prev = cut
+        }
+        controller.close()
+      },
+    }), { status: 200 }))
+    const chopped = new InProcessApiClient({ fetch: doFetch })
+    const seen: string[] = []
+    for await (const envelope of chopped.events.mux({}, new AbortController().signal)) {
+      seen.push((envelope.payload as { sessionId: string }).sessionId)
+      expect(envelope.rpcId).toBe(seen.length === 1 ? 'a' : 'b')
+    }
+    expect(seen).toEqual(['s1', 's2'])
+  })
+
+  it('emits a stream/error frame then closes when the impl throws mid-stream', async () => {
+    const api = scriptedApi({
+      events: {
+        async *host(request): AsyncGenerator<RpcRequest<HostFrame>> {
+          yield { rpcId: RpcId(`p-${request.rpcId}`), payload: { type: 'host/session-added', sessionId: sid('s1') } }
+          throw new Error('impl died mid-stream')
+        },
+      },
+    })
+    const seen: HostFrame[] = []
+    for await (const envelope of client(api).events.host({}, new AbortController().signal)) {
+      seen.push(envelope.payload)
+    }
+    expect(seen.map(f => f.type)).toEqual(['host/session-added', 'stream/error'])
+    const last = seen.at(-1)
+    if (last?.type === 'stream/error') expect(last.error.message).toMatch(/impl died mid-stream/)
+  })
+
+  it('drops a malformed SSE frame and keeps the stream alive (S→C two-level parse)', async () => {
+    const good = { type: 'server-request', rpcId: 'g1', method: 'session/subscribed', payload: { type: 'session/subscribed', sessionId: 's1', lastSeq: 1 } }
+    const badEnvelope = { type: 'server-response', rpcId: 'x' } // wrong quadrant for a stream
+    const badFrame = { type: 'server-request', rpcId: 'b1', method: 'nope', payload: { type: 'no/such-frame' } }
+    const wire = [
+      'data: {oops', // not JSON
+      `data: ${JSON.stringify(badEnvelope)}`,
+      `data: ${JSON.stringify(badFrame)}`,
+      `data: ${JSON.stringify(good)}`,
+    ].map(l => `${l}\n\n`).join('')
+    const doFetch = (): Promise<Response> => Promise.resolve(new Response(new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode(wire))
+        controller.close()
+      },
+    }), { status: 200 }))
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    try {
+      const seen: MuxFrame[] = []
+      for await (const envelope of new InProcessApiClient({ fetch: doFetch }).events.mux({}, new AbortController().signal)) {
+        seen.push(envelope.payload)
+      }
+      // The three corrupt frames are reported and skipped; the good one still arrives.
+      expect(seen).toEqual([{ type: 'session/subscribed', sessionId: 's1', lastSeq: 1 }])
+      expect(errorSpy.mock.calls.length).toBe(3)
+    } finally {
+      errorSpy.mockRestore()
+    }
+  })
+
+  it('fires onOpen once headers are in, before the first frame, and not on transport failure', async () => {
+    const api = scriptedApi({
+      events: {
+        async *mux(request): AsyncGenerator<RpcRequest<MuxFrame>> {
+          yield { rpcId: RpcId(`p-${request.rpcId}`), payload: { type: 'session/subscribed', sessionId: sid('s1'), lastSeq: 0 } }
+        },
+      },
+    })
+    const order: string[] = []
+    const iterator = client(api).events.mux({}, new AbortController().signal, () => order.push('open'))
+    expect(order).toEqual([]) // lazy generator: no fetch (and no onOpen) before iteration
+    for await (const _ of iterator) order.push('frame')
+    expect(order).toEqual(['open', 'frame'])
+
+    // Transport failure path: onOpen must not fire.
+    const failing = new InProcessApiClient({ fetch: () => Promise.resolve(new Response('down', { status: 503 })) })
+    const failOrder: string[] = []
+    await expect((async () => {
+      for await (const _ of failing.events.mux({}, new AbortController().signal, () => failOrder.push('open'))) { /* unreachable */ }
+    })()).rejects.toThrow(/transport failure/)
+    expect(failOrder).toEqual([])
+  })
+
+  it('stops consuming when the caller aborts', async () => {
+    let implSawAbort = false
+    const api = scriptedApi({
+      events: {
+        async *mux(_request, signal): AsyncGenerator<RpcRequest<MuxFrame>> {
+          try {
+            let n = 0
+            while (true) {
+              yield { rpcId: RpcId(`p${n}`), payload: { type: 'session/subscribed', sessionId: sid('s1'), lastSeq: n++ } }
+              await new Promise(resolve => setTimeout(resolve, 5))
+              if (signal.aborted) return
+            }
+          } finally {
+            implSawAbort = true
+          }
+        },
+      },
+    })
+    const abort = new AbortController()
+    let count = 0
+    // In-process abort ends the stream (impl returns on signal.aborted); over a real
+    // network fetch the same abort surfaces as a rejection — both stop the loop.
+    await (async () => {
+      for await (const _ of client(api).events.mux({}, abort.signal)) {
+        if (++count === 2) abort.abort()
+      }
+    })().catch(() => undefined)
+    expect(count).toBe(2)
+    // Generator teardown may lag the abort by a microtask; poll briefly.
+    await vi.waitFor(() => { expect(implSawAbort).toBe(true) })
+  })
+})
+
+describe('respond path', () => {
+  it('round-trips a client-response to a receipt', async () => {
+    const seen: unknown[] = []
+    const api = scriptedApi({
+      respond: (message) => {
+        seen.push(message)
+        return Promise.resolve({ accepted: true as const })
+      },
+    })
+    const receipt = await client(api).respond({ type: 'client-response', rpcId: RpcId('req-1'), result: { ok: true, value: { behavior: 'allow' } } })
+    expect(receipt).toEqual({ accepted: true })
+    expect(seen).toEqual([{ type: 'client-response', rpcId: 'req-1', result: { ok: true, value: { behavior: 'allow' } } }])
+  })
+
+  it('returns bad-response for a malformed client-response without reaching the impl', async () => {
+    const respond = vi.fn()
+    const handler = toFetchHandler(scriptedApi({ respond }))
+    const response = await handler.fetch('http://dsh.internal/api/respond', { method: 'POST', body: JSON.stringify({ type: 'client-response' }) })
+    expect(await response.json()).toEqual({ accepted: false, reason: 'bad-response' })
+    expect(respond).not.toHaveBeenCalled()
+  })
+})
+
+describe('envelope tap', () => {
+  it('delivers one microtask batch of full forms per unary call', async () => {
+    const api = scriptedApi()
+    const tapped = client(api)
+    const batches: (readonly RpcMessage[])[] = []
+    tapped.subscribeEnvelopes(batch => batches.push(batch))
+    await tapped.sessions.list({})
+    await vi.waitFor(() => { expect(batches.length).toBeGreaterThan(0) })
+    const all = batches.flat()
+    expect(all.map(m => m.type)).toEqual(['client-request', 'server-response'])
+    expect(all[0]?.rpcId).toBe(all[1]?.rpcId)
+  })
+
+  it('isolates a throwing listener and keeps serving the call', async () => {
+    const api = scriptedApi()
+    const tapped = client(api)
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    try {
+      const good: string[] = []
+      tapped.subscribeEnvelopes(() => { throw new Error('listener bug') })
+      tapped.subscribeEnvelopes(batch => good.push(...batch.map(m => m.type)))
+      const response = await tapped.sessions.list({})
+      expect(response.result.ok).toBe(true)
+      await vi.waitFor(() => { expect(good).toContain('server-response') })
+    } finally {
+      errorSpy.mockRestore()
+    }
+  })
+
+  it('buffers nothing with zero subscribers and unsubscribes cleanly', async () => {
+    const api = scriptedApi()
+    const tapped = client(api)
+    await tapped.sessions.list({}) // no subscribers: must not accumulate
+    const batches: (readonly RpcMessage[])[] = []
+    const unsubscribe = tapped.subscribeEnvelopes(batch => batches.push(batch))
+    unsubscribe()
+    await tapped.sessions.list({})
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(batches).toEqual([])
+  })
+})

packages/host/apiproxy/tests/fetch-carrier.spec.ts

@@ -0,0 +1,305 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { ApiProxy, HostFrame, MuxFrame } from '../src/api/index.ts'
+import type { ClientResponse, RpcMessage, RpcReceipt, RpcRequest } from '../src/api/rpc.ts'
+import { RpcId } from '../src/api/rpc.ts'
+import { toFetchHandler } from '../src/fetch/handler.ts'
+import { AbstractApiClient, InProcessApiClient } from '../src/fetch/client.ts'
+
+/** Minimal in-memory ApiProxy: echoes rpcIds, scripts one frame per stream. */
+function fakeApi(overrides: Partial<{ muxFrames: MuxFrame[]; hostFrames: HostFrame[]; crashOn: string }> = {}): ApiProxy {
+  const muxFrames = overrides.muxFrames ?? [{ type: 'session/subscribed', sessionId: 's1' as never, lastSeq: -1 }]
+  const hostFrames = overrides.hostFrames ?? [{ type: 'host/session-removed', sessionId: 's1' as never }]
+  async function * stream<F>(frames: F[], signal: AbortSignal): AsyncGenerator<RpcRequest<F>> {
+    for (const payload of frames) {
+      if (signal.aborted) return
+      yield { rpcId: RpcId(`frame-${String(frames.indexOf(payload))}`), payload }
+    }
+  }
+  return {
+    sessions: {
+      async list(request) {
+        if (overrides.crashOn === 'session.list') throw new Error('impl crashed')
+        return { rpcId: request.rpcId, result: { ok: true, value: { items: [] } } }
+      },
+      async create(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { sessionId: 's-new' as never } } }
+      },
+      async history(request) {
+        return {
+          rpcId: request.rpcId,
+          result: { ok: false, error: { code: 'session-not-found', message: 'nope', details: { sessionId: request.payload.sessionId } } },
+        }
+      },
+      async prompt(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { accepted: true as const } } }
+      },
+      async cancel(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { accepted: true as const } } }
+      },
+    },
+    host: {
+      async describe(request) {
+        return { rpcId: request.rpcId, result: { ok: true, value: { version: 'v', cwd: '/w', attachedSessions: 0 } } }
+      },
+    },
+    events: {
+      mux: (_request, signal) => stream(muxFrames, signal),
+      host: (_request, signal) => stream(hostFrames, signal),
+    },
+    async respond(message: ClientResponse): Promise<RpcReceipt> {
+      return message.rpcId === 'known' ? { accepted: true } : { accepted: false, reason: 'not-pending' }
+    },
+  }
+}
+
+function client(api: ApiProxy = fakeApi()): InProcessApiClient {
+  return new InProcessApiClient(toFetchHandler(api))
+}
+
+async function collect<F>(stream: AsyncIterable<RpcRequest<F>>): Promise<RpcRequest<F>[]> {
+  const out: RpcRequest<F>[] = []
+  for await (const envelope of stream) out.push(envelope)
+  return out
+}
+
+describe('unary round trip (handler ⇄ client, no network)', () => {
+  it('carries a success result and echoes the minted rpcId', async () => {
+    const response = await client().sessions.list({})
+    expect(response.result).toEqual({ ok: true, value: { items: [] } })
+    expect(response.rpcId).toMatch(/[0-9a-f-]{36}/)
+  })
+
+  it('carries a business error as 200 + error result', async () => {
+    const response = await client().sessions.history({ sessionId: 'missing' as never })
+    expect(response.result.ok).toBe(false)
+    if (!response.result.ok) expect(response.result.error.code).toBe('session-not-found')
+  })
+
+  it('covers create/prompt/cancel/describe passthrough', async () => {
+    const c = client()
+    expect((await c.sessions.create({})).result.ok).toBe(true)
+    expect((await c.sessions.prompt({ sessionId: 's' as never, mode: 'queue', content: [{ type: 'text', text: 'x' }] })).result.ok).toBe(true)
+    expect((await c.sessions.cancel({ sessionId: 's' as never })).result.ok).toBe(true)
+    expect((await c.host.describe({})).result.ok).toBe(true)
+  })
+})
+
+describe('handler carrier-layer statuses', () => {
+  const handler = toFetchHandler(fakeApi())
+
+  it('404s unknown paths and non-POST non-stream methods', async () => {
+    expect((await handler.fetch(new Request('http://x/other', { method: 'POST', body: '{}' }))).status).toBe(404)
+    expect((await handler.fetch(new Request('http://x/api/session.list', { method: 'GET' }))).status).toBe(404)
+    expect((await handler.fetch(new Request('http://x/api/no.such', { method: 'POST', body: JSON.stringify({ type: 'client-request', rpcId: 'r', method: 'no.such', payload: {} }) }))).status).toBe(404)
+  })
+
+  it('400s a non-JSON body', async () => {
+    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', body: 'not json' }))
+    expect(response.status).toBe(400)
+  })
+
+  it('rejects a malformed envelope with bad-request and the invalid-request sentinel rpcId', async () => {
+    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', body: JSON.stringify({ nope: true }) }))
+    expect(response.status).toBe(200)
+    const body = await response.json() as { rpcId: string; result: { ok: boolean; error?: { code: string } } }
+    expect(body.rpcId).toBe('invalid-request')
+    expect(body.result.error?.code).toBe('bad-request')
+  })
+
+  it('rejects a method/path mismatch echoing the envelope rpcId', async () => {
+    const body = JSON.stringify({ type: 'client-request', rpcId: 'r-9', method: 'session.cancel', payload: {} })
+    const response = await handler.fetch(new Request('http://x/api/session.list', { method: 'POST', body }))
+    const parsed = await response.json() as { rpcId: string; result: { error?: { message: string } } }
+    expect(parsed.rpcId).toBe('r-9')
+    expect(parsed.result.error?.message).toContain('does not match path')
+  })
+
+  it('rejects an invalid payload with the zod issues attached', async () => {
+    const body = JSON.stringify({ type: 'client-request', rpcId: 'r-10', method: 'session.cancel', payload: {} })
+    const response = await handler.fetch(new Request('http://x/api/session.cancel', { method: 'POST', body }))
+    const parsed = await response.json() as { result: { error?: { code: string; details: { issues: unknown[] } } } }
+    expect(parsed.result.error?.code).toBe('bad-request')
+    expect(parsed.result.error?.details.issues.length).toBeGreaterThan(0)
+  })
+
+  it('500s when the impl itself throws', async () => {
+    const crashing = toFetchHandler(fakeApi({ crashOn: 'session.list' }))
+    const body = JSON.stringify({ type: 'client-request', rpcId: 'r-11', method: 'session.list', payload: {} })
+    const response = await crashing.fetch(new Request('http://x/api/session.list', { method: 'POST', body }))
+    expect(response.status).toBe(500)
+    expect(await response.text()).toContain('impl crashed')
+  })
+
+  it('routes /api/respond, rejecting malformed client-responses as a receipt', async () => {
+    const good = JSON.stringify({ type: 'client-response', rpcId: 'known', result: { ok: true, value: null } })
+    const goodReceipt: unknown = await (await handler.fetch(new Request('http://x/api/respond', { method: 'POST', body: good }))).json()
+    expect(goodReceipt).toEqual({ accepted: true })
+    const bad = JSON.stringify({ type: 'client-request', rpcId: 'r', method: 'x', payload: {} })
+    const badReceipt: unknown = await (await handler.fetch(new Request('http://x/api/respond', { method: 'POST', body: bad }))).json()
+    expect(badReceipt).toEqual({ accepted: false, reason: 'bad-response' })
+  })
+
+  it('accepts (url, init) form fetch invocation', async () => {
+    const body = JSON.stringify({ type: 'client-request', rpcId: 'r-12', method: 'session.list', payload: {} })
+    const response = await handler.fetch('http://x/api/session.list', { method: 'POST', body })
+    expect(response.status).toBe(200)
+  })
+})
+
+describe('SSE streams through the carrier', () => {
+  it('yields mux frames as ServerRequest narrow forms and completes', async () => {
+    const ac = new AbortController()
+    const frames = await collect(client().events.mux({}, ac.signal))
+    expect(frames).toHaveLength(1)
+    expect(frames[0]?.payload).toMatchObject({ type: 'session/subscribed' })
+    expect(frames[0]?.rpcId).toBe('frame-0')
+  })
+
+  it('yields host frames', async () => {
+    const ac = new AbortController()
+    const frames = await collect(client().events.host({}, ac.signal))
+    expect(frames[0]?.payload).toMatchObject({ type: 'host/session-removed' })
+  })
+
+  it('drops frames after the consumer aborts mid-stream', async () => {
+    const many = Array.from({ length: 50 }, (_, i): MuxFrame => ({ type: 'session/subscribed', sessionId: `s${String(i)}` as never, lastSeq: i }))
+    const ac = new AbortController()
+    const received: RpcRequest<MuxFrame>[] = []
+    for await (const envelope of client(fakeApi({ muxFrames: many })).events.mux({}, ac.signal)) {
+      received.push(envelope)
+      if (received.length === 2) break // generator return → reader.cancel path
+    }
+    expect(received).toHaveLength(2)
+  })
+
+  it('swallows a reader.cancel rejection on early exit', async () => {
+    const encoder = new TextEncoder()
+    const body = new ReadableStream<Uint8Array>({
+      start(controller) {
+        const frame = { type: 'server-request', rpcId: 'f0', method: 'session/subscribed', payload: { type: 'session/subscribed', sessionId: 's', lastSeq: -1 } }
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(frame)}\n\n`))
+        // stream intentionally left open: the consumer breaks first
+      },
+      cancel() {
+        throw new Error('cancel refused')
+      },
+    })
+    const c = new InProcessApiClient({ fetch: async () => new Response(body, { headers: { 'content-type': 'text/event-stream' } }) })
+    const received: RpcRequest<MuxFrame>[] = []
+    for await (const envelope of c.events.mux({}, new AbortController().signal)) {
+      received.push(envelope)
+      break
+    }
+    expect(received).toHaveLength(1)
+  })
+
+  it('surfaces a mid-stream impl failure as one stream/error frame, then the stream ends', async () => {
+    const api = fakeApi()
+    api.events.mux = (_request, _signal) => (async function * (): AsyncGenerator<RpcRequest<MuxFrame>> {
+      yield { rpcId: RpcId('f0'), payload: { type: 'session/subscribed', sessionId: 's' as never, lastSeq: -1 } }
+      throw new Error('stream source died')
+    })()
+    const frames = await collect(client(api).events.mux({}, new AbortController().signal))
+    expect(frames).toHaveLength(2)
+    expect(frames[1]?.payload).toMatchObject({ type: 'stream/error', error: { code: 'internal' } })
+  })
+})
+
+describe('client respond and transport failures', () => {
+  it('passes a client-response through and parses the receipt', async () => {
+    const receipt = await client().respond({ type: 'client-response', rpcId: RpcId('known'), result: { ok: true, value: null } })
+    expect(receipt).toEqual({ accepted: true })
+    const late = await client().respond({ type: 'client-response', rpcId: RpcId('late'), result: { ok: true, value: null } })
+    expect(late).toEqual({ accepted: false, reason: 'not-pending' })
+  })
+
+  it('throws on non-OK unary and respond and stream transport', async () => {
+    const broken = new InProcessApiClient({ fetch: async () => new Response('down', { status: 503 }) })
+    await expect(broken.sessions.list({})).rejects.toThrow('transport failure for /api/session.list: HTTP 503')
+    await expect(broken.respond({ type: 'client-response', rpcId: RpcId('r'), result: { ok: true, value: null } }))
+      .rejects.toThrow('transport failure for /api/respond')
+    await expect(collect(broken.events.mux({}, new AbortController().signal))).rejects.toThrow('transport failure for /api/events.mux')
+  })
+
+  it('throws on an rpcId echo mismatch', async () => {
+    const lying = new InProcessApiClient({
+      fetch: async () => Response.json({ type: 'server-response', rpcId: 'someone-else', result: { ok: true, value: { items: [] } } }),
+    })
+    await expect(lying.sessions.list({})).rejects.toThrow('rpcId mismatch')
+  })
+})
+
+describe('envelope observation', () => {
+  it('batches envelopes per microtask and isolates a throwing listener', async () => {
+    const c = client()
+    const batches: (readonly RpcMessage[])[] = []
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    const unsubscribeThrowing = c.subscribeEnvelopes(() => { throw new Error('observer bug') })
+    const unsubscribe = c.subscribeEnvelopes((batch) => { batches.push(batch) })
+    await c.sessions.list({})
+    await new Promise((resolve) => { setTimeout(resolve, 0) })
+    // request and response tap in separate microtask windows (the await between
+    // them yields), so both arrive but batch count is timing-defined
+    expect(batches.flatMap(batch => batch.map(message => message.type))).toEqual(['client-request', 'server-response'])
+    expect(errorSpy).toHaveBeenCalled()
+    unsubscribe()
+    unsubscribeThrowing()
+    errorSpy.mockRestore()
+  })
+
+  it('skips buffering entirely with no listeners and after unsubscribe', async () => {
+    const c = client()
+    const seen: RpcMessage[] = []
+    const unsubscribe = c.subscribeEnvelopes((batch) => { seen.push(...batch) })
+    unsubscribe()
+    await c.sessions.list({})
+    await new Promise((resolve) => { setTimeout(resolve, 0) })
+    expect(seen).toHaveLength(0)
+  })
+
+  it('coalesces multiple calls in one microtask window into one flush', async () => {
+    const c = client()
+    const batches: (readonly RpcMessage[])[] = []
+    c.subscribeEnvelopes((batch) => { batches.push(batch) })
+    await Promise.all([c.sessions.list({}), c.host.describe({})])
+    await new Promise((resolve) => { setTimeout(resolve, 0) })
+    const total = batches.reduce((n, batch) => n + batch.length, 0)
+    expect(total).toBe(4)
+  })
+})
+
+describe('resolveBase', () => {
+  it('prefers a real location.origin and falls back to the internal authority', async () => {
+    class Probe extends AbstractApiClient {
+      urls: string[] = []
+      protected async doFetch(input: URL): Promise<Response> {
+        this.urls.push(input.href)
+        return Response.json({ type: 'server-response', rpcId: this.lastMinted, result: { ok: true, value: { items: [] } } })
+      }
+
+      lastMinted = ''
+      protected override mintRpcId(): ReturnType<AbstractApiClient['mintRpcId']> {
+        const id = super.mintRpcId()
+        this.lastMinted = id
+        return id
+      }
+    }
+    const probe = new Probe()
+    await probe.sessions.list({})
+    expect(probe.urls[0]).toMatch(/^http:\/\/dsh\.internal\//)
+
+    const globalWithLocation = globalThis as { location?: { origin?: string } }
+    globalWithLocation.location = { origin: 'http://host.example' }
+    try {
+      const probe2 = new Probe()
+      await probe2.sessions.list({})
+      expect(probe2.urls[0]).toMatch(/^http:\/\/host\.example\//)
+      globalWithLocation.location = { origin: 'null' } // sandboxed iframe shape
+      const probe3 = new Probe()
+      await probe3.sessions.list({})
+      expect(probe3.urls[0]).toMatch(/^http:\/\/dsh\.internal\//)
+    } finally {
+      delete globalWithLocation.location
+    }
+  })
+})

packages/host/apiproxy/tests/rpc-schemas.spec.ts

@@ -0,0 +1,161 @@
+import { describe, expect, it } from 'vitest'
+import { RpcId } from '../src/api/rpc.ts'
+import {
+  clientRequestSchema, clientResponseSchema, rpcErrorSchema, rpcIdSchema, rpcMessageSchema,
+  rpcReceiptSchema, rpcResultSchema, serverRequestSchema, serverResponseSchema,
+} from '../src/api/rpc.schema.ts'
+import { z } from 'zod'
+import {
+  contentBlockSchema, sessionCancelRequestSchema, sessionCancelValueSchema, sessionCreateRequestSchema,
+  sessionCreateValueSchema, sessionEventSchema, sessionHistoryRequestSchema, sessionHistoryValueSchema,
+  sessionIdSchema, sessionListRequestSchema, sessionListValueSchema, sessionPromptRequestSchema,
+  sessionPromptValueSchema, sessionSummarySchema,
+} from '../src/api/sessions.schema.ts'
+import { hostDescribeRequestSchema, hostDescribeValueSchema } from '../src/api/host.schema.ts'
+import { hostFrameSchema, muxFrameSchema, askUserQuestionItemSchema } from '../src/api/events.schema.ts'
+import { approvalRequestIdSchema, approvalResponsePayloadSchema } from '../src/api/approvals.schema.ts'
+import { askUserQuestionAnswerSchema, questionResponsePayloadSchema } from '../src/api/questions.schema.ts'
+
+describe('RpcId', () => {
+  it('brands a raw string at zero runtime cost', () => {
+    expect(RpcId('abc')).toBe('abc')
+    expect(rpcIdSchema.parse('abc')).toBe('abc')
+    // No min-length: the id is an opaque echo token (see rpcIdSchema's contract).
+    expect(rpcIdSchema.parse('')).toBe('')
+    expect(() => rpcIdSchema.parse(42)).toThrow()
+  })
+})
+
+describe('rpcErrorSchema', () => {
+  it('accepts every code branch with its required details', () => {
+    expect(rpcErrorSchema.parse({ code: 'bad-request', message: 'm', details: { issues: [] } }).code).toBe('bad-request')
+    expect(rpcErrorSchema.parse({ code: 'session-not-found', message: 'm', details: { sessionId: 's' } }).code).toBe('session-not-found')
+    expect(rpcErrorSchema.parse({ code: 'agent-busy', message: 'm', details: { reason: 'r' } }).code).toBe('agent-busy')
+    expect(rpcErrorSchema.parse({ code: 'internal', message: 'm', details: {} }).code).toBe('internal')
+  })
+
+  it('rejects a known code with missing details', () => {
+    expect(() => rpcErrorSchema.parse({ code: 'agent-busy', message: 'm', details: {} })).toThrow()
+    expect(() => rpcErrorSchema.parse({ code: 'nope', message: 'm', details: {} })).toThrow()
+  })
+})
+
+describe('rpcResultSchema', () => {
+  it('accepts both result branches and rejects hybrids', () => {
+    const schema = rpcResultSchema(z.object({ n: z.number() }))
+    expect(schema.parse({ ok: true, value: { n: 1 } })).toEqual({ ok: true, value: { n: 1 } })
+    const err = schema.parse({ ok: false, error: { code: 'internal', message: 'x', details: {} } })
+    expect(err).toMatchObject({ ok: false })
+    expect(() => schema.parse({ ok: true, error: {} })).toThrow()
+  })
+})
+
+describe('wire full-form schemas', () => {
+  it('parses the four quadrants and the union discriminates on type', () => {
+    const cq = { type: 'client-request', rpcId: 'r1', method: 'session.list', payload: {} }
+    const sr = { type: 'server-response', rpcId: 'r1', result: { ok: true, value: 1 } }
+    const rq = { type: 'server-request', rpcId: 'r2', method: 'session/event', payload: { a: 1 } }
+    const cr = { type: 'client-response', rpcId: 'r2', result: { ok: true, value: null } }
+    expect(clientRequestSchema.parse(cq).method).toBe('session.list')
+    expect(serverResponseSchema.parse(sr).rpcId).toBe('r1')
+    expect(serverRequestSchema.parse(rq).method).toBe('session/event')
+    expect(clientResponseSchema.parse(cr).rpcId).toBe('r2')
+    for (const message of [cq, sr, rq, cr]) expect(rpcMessageSchema.parse(message)).toBeTruthy()
+    expect(() => rpcMessageSchema.parse({ type: 'other', rpcId: 'x' })).toThrow()
+  })
+
+  it('rejects a quadrant missing its members', () => {
+    expect(() => clientRequestSchema.parse({ type: 'client-request', rpcId: 'r1' })).toThrow()
+    expect(() => serverResponseSchema.parse({ type: 'server-response', rpcId: 'r1', result: { ok: true } })).toThrow()
+  })
+})
+
+describe('rpcReceiptSchema', () => {
+  it('accepts both receipt branches with the closed reason set', () => {
+    expect(rpcReceiptSchema.parse({ accepted: true })).toEqual({ accepted: true })
+    expect(rpcReceiptSchema.parse({ accepted: false, reason: 'not-pending' })).toEqual({ accepted: false, reason: 'not-pending' })
+    expect(rpcReceiptSchema.parse({ accepted: false, reason: 'bad-response' })).toEqual({ accepted: false, reason: 'bad-response' })
+    expect(() => rpcReceiptSchema.parse({ accepted: false, reason: 'other' })).toThrow()
+  })
+})
+
+describe('sessions domain schemas', () => {
+  it('validates ids, summaries, and the event passthrough envelope', () => {
+    expect(sessionIdSchema.parse('s1')).toBe('s1')
+    expect(() => sessionIdSchema.parse('')).toThrow()
+    expect(sessionSummarySchema.parse({ sessionId: 's1', updatedAt: 1, running: false })).toMatchObject({ sessionId: 's1' })
+    expect(sessionSummarySchema.parse({ sessionId: 's1', updatedAt: 1, running: true, parentSessionId: 'p', cwd: '/x' }).cwd).toBe('/x')
+    const event = sessionEventSchema.parse({ type: 'user/message', seq: 0, time: 1, data: { any: true } })
+    expect(event).toMatchObject({ type: 'user/message' })
+    expect(() => sessionEventSchema.parse({ type: 'user/message', seq: -1, time: 1, data: {} })).toThrow()
+  })
+
+  it('validates the per-method request/value pairs', () => {
+    expect(sessionListRequestSchema.parse({})).toEqual({})
+    expect(sessionListRequestSchema.parse({ cursor: 'c' }).cursor).toBe('c')
+    expect(sessionListValueSchema.parse({ items: [] }).items).toEqual([])
+    expect(sessionCreateRequestSchema.parse({ cwd: '/w' }).cwd).toBe('/w')
+    expect(sessionCreateValueSchema.parse({ sessionId: 's1' }).sessionId).toBe('s1')
+    expect(sessionHistoryRequestSchema.parse({ sessionId: 's1', beforeSeq: 3, maxMessages: 5 }).beforeSeq).toBe(3)
+    expect(() => sessionHistoryRequestSchema.parse({ sessionId: 's1', maxMessages: 0 })).toThrow()
+    expect(sessionHistoryValueSchema.parse({ events: [], hasMore: false }).hasMore).toBe(false)
+    const prompt = sessionPromptRequestSchema.parse({ sessionId: 's1', mode: 'queue', content: [{ type: 'text', text: 'hi' }] })
+    expect(prompt.mode).toBe('queue')
+    expect(() => sessionPromptRequestSchema.parse({ sessionId: 's1', mode: 'inject', content: [] })).toThrow()
+    expect(sessionPromptValueSchema.parse({ accepted: true }).accepted).toBe(true)
+    expect(sessionCancelRequestSchema.parse({ sessionId: 's1' }).sessionId).toBe('s1')
+    expect(sessionCancelValueSchema.parse({ accepted: true }).accepted).toBe(true)
+    expect(contentBlockSchema.parse({ type: 'text', text: 'x', extra: 1 })).toMatchObject({ extra: 1 })
+  })
+})
+
+describe('host domain schemas', () => {
+  it('validates describe request/value', () => {
+    expect(hostDescribeRequestSchema.parse({})).toEqual({})
+    const value = hostDescribeValueSchema.parse({ version: '1', cwd: '/x', provider: 'p', model: 'm', attachedSessions: 2 })
+    expect(value.attachedSessions).toBe(2)
+    expect(hostDescribeValueSchema.parse({ version: '1', cwd: '/x', attachedSessions: 0 }).provider).toBeUndefined()
+  })
+})
+
+describe('events frame schemas', () => {
+  it('accepts every mux frame branch', () => {
+    const frames = [
+      { type: 'session/event', sessionId: 's', event: { type: 't', seq: 0, time: 1, data: null } },
+      { type: 'session/subscribed', sessionId: 's', lastSeq: -1 },
+      { type: 'approval/requested', sessionId: 's', approvalId: 'a', toolName: 'bash', callId: 'c', reason: 'r' },
+      { type: 'approval/resolved', sessionId: 's', approvalId: 'a', outcome: 'allowed-once' },
+      { type: 'question/requested', sessionId: 's', questions: [{ id: 'q', question: 'Q?', options: [{ label: 'L' }], multiSelect: true }] },
+      { type: 'question/resolved', sessionId: 's', questionRpcId: 'r', outcome: 'answered' },
+      { type: 'stream/error', error: { code: 'internal', message: 'm', details: {} } },
+    ]
+    for (const frame of frames) expect(muxFrameSchema.parse(frame)).toMatchObject({ type: frame.type })
+    expect(() => muxFrameSchema.parse({ type: 'unknown/frame' })).toThrow()
+    expect(askUserQuestionItemSchema.parse({ id: 'q', question: 'Q?' }).id).toBe('q')
+  })
+
+  it('accepts every host frame branch', () => {
+    const frames = [
+      { type: 'host/session-added', sessionId: 's', parentSessionId: 'p' },
+      { type: 'host/session-added', sessionId: 's' },
+      { type: 'host/session-removed', sessionId: 's' },
+      { type: 'host/session-status', sessionId: 's', running: true },
+      { type: 'host/agent-error', sessionId: 's', message: 'boom' },
+      { type: 'stream/error', error: { code: 'internal', message: 'm', details: {} } },
+    ]
+    for (const frame of frames) expect(hostFrameSchema.parse(frame)).toMatchObject({ type: frame.type })
+  })
+})
+
+describe('respond payload schemas', () => {
+  it('validates approval and question answer payloads', () => {
+    expect(approvalRequestIdSchema.parse('a1')).toBe('a1')
+    const approval = approvalResponsePayloadSchema.parse({ sessionId: 's', approvalId: 'a', outcome: 'rejected' })
+    expect(approval.outcome).toBe('rejected')
+    expect(() => approvalResponsePayloadSchema.parse({ sessionId: 's', approvalId: 'a', outcome: 'cancelled' })).toThrow()
+    const answer = askUserQuestionAnswerSchema.parse({ answers: [{ id: 'q', selected: ['x'], custom: 'c' }] })
+    expect(answer.answers[0]?.selected).toEqual(['x'])
+    const payload = questionResponsePayloadSchema.parse({ sessionId: 's', answer: { answers: [] } })
+    expect(payload.sessionId).toBe('s')
+  })
+})

packages/host/apiproxy/tsconfig.json

@@ -0,0 +1,33 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types"
+  },
+  "include": [
+    "src"
+  ],
+  "references": [
+    {
+      "path": "../../util/brand"
+    },
+    {
+      "path": "../../llm/llm"
+    },
+    {
+      "path": "../../core/session"
+    },
+    {
+      "path": "../../core/tools"
+    },
+    {
+      "path": "../../ui/user-approval"
+    },
+    {
+      "path": "../../ui/user-interaction"
+    },
+    {
+      "path": "../../support/invariants"
+    }
+  ]
+}