Refactor DSHX to profile-owned Codex TUI surface

.gitattributes

@@ -0,0 +1,3 @@
+# Release provenance hashes the reviewed lockfile bytes. Keep that identity
+# stable across Windows, macOS, and Linux checkouts.
+package-lock.json text eol=lf

.github/workflows/ci.yml

@@ -45,18 +45,20 @@ jobs:
         run: npm test
       - name: Verify DSH ownership boundary
         run: node scripts/verify-ownership-boundary.mjs
+      - name: Enable pnpm for the surface profile bootstrap
+        run: corepack enable pnpm
       - name: Boot and dispose official DeepSeek Harness composition
         run: node scripts/runtime-smoke.mjs
-      - name: Syntax check shipped JavaScript
+      - name: Syntax check shipped and development JavaScript
         shell: bash
         run: |
           set -euo pipefail
-          while IFS= read -r file; do node --check "$file"; done < <(find src bin scripts -type f -name '*.mjs' -print | sort)
+          while IFS= read -r file; do node --check "$file"; done < <(find src bin scripts devtools test -type f \( -name '*.mjs' -o -name '*.js' \) -print | sort)
       - name: Syntax check PTY smoke
         run: python3 -m py_compile test/tui_smoke.py
 
   linux-tui:
-    name: Linux TUI / pinned Codex / local IPC
+    name: Linux TUI / pinned Codex / DSH stdio
     needs: core
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -83,16 +85,17 @@ jobs:
         run: npm ci
       - name: Verify exact DeepSeek Harness release closure
         run: node scripts/verify-dsh-closure.mjs
-      - name: Build pinned Codex TUI + local IPC bridge
+      - name: Build pinned Codex TUI
         shell: bash
         env:
           DSHX_VERSION: 1.0.0-ci
         run: bash scripts/build-codex-tui.sh
-      - name: Verify thin-fork and transport invariants
+      - name: Verify thin-fork and stdio transport invariants
         run: node scripts/verify-tui-invariants.mjs
-      - name: Verify local IPC data plane
-        shell: bash
-        run: dist/bin/dshx-ipc-bridge --check
+      - name: Enable pnpm for the official plugin machinery
+        run: corepack enable pnpm
+      - name: Verify bundle install and stdio activation end to end
+        run: node scripts/verify-bundle-install.mjs
       - name: Exercise real TUI through Linux PTY + CJK + resize
         shell: bash
         run: |

.github/workflows/rc-platform.yml

@@ -15,7 +15,7 @@ concurrency:
 jobs:
   windows:
     if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release/')
-    name: Windows ConPTY / CJK / local IPC
+    name: Windows ConPTY / CJK / DSH stdio
     runs-on: windows-latest
     timeout-minutes: 150
     steps:
@@ -28,37 +28,34 @@ jobs:
           EXPECTED_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
         run: |
           $actual = (git rev-parse HEAD).Trim()
-          if ($actual -ne $env:EXPECTED_SHA) {
-            throw "wrong source checkout: expected=$env:EXPECTED_SHA actual=$actual"
-          }
+          if ($actual -ne $env:EXPECTED_SHA) { throw "wrong source checkout: expected=$env:EXPECTED_SHA actual=$actual" }
           Write-Host "exact source checkout: $actual"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       - name: Install frozen dependency graph
         run: npm ci --include=optional --ignore-scripts=false
-      - name: Verify exact DeepSeek Harness release closure
+      - name: Verify DSH release closure
         run: node scripts/verify-dsh-closure.mjs
-      - name: Boot and dispose official DeepSeek Harness composition
+      - name: Enable pnpm for official profile machinery
+        run: corepack enable pnpm
+      - name: Verify official DSH stdio lifecycle
         run: node scripts/runtime-smoke.mjs
-      - name: Build pinned Codex TUI + local IPC bridge
+      - name: Build pinned Codex TUI
         shell: pwsh
         env:
           DSHX_VERSION: 1.0.0-ci
         run: ./scripts/build-codex-tui.ps1
-      - name: Verify thin-fork and transport invariants
+      - name: Verify thin-fork and stdio invariants
         run: node scripts/verify-tui-invariants.mjs
-      - name: Verify Windows local IPC data plane
-        shell: pwsh
-        run: |
-          & .\dist\bin\dshx-ipc-bridge.exe --check
-          if ($LASTEXITCODE -ne 0) { throw 'local IPC data-plane self-check failed' }
+      - name: Verify bundle install and stdio activation
+        run: node scripts/verify-bundle-install.mjs
       - name: Exercise real TUI through Windows ConPTY + CJK text
         run: node test/tui_smoke_windows.mjs
 
   macos:
     if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release/')
-    name: macOS PTY / CJK / resize / local IPC
+    name: macOS PTY / CJK / resize / DSH stdio
     runs-on: macos-26
     timeout-minutes: 120
     steps:
@@ -72,30 +69,28 @@ jobs:
         run: |
           set -euo pipefail
           actual="$(git rev-parse HEAD)"
-          if [[ "$actual" != "$EXPECTED_SHA" ]]; then
-            echo "wrong source checkout: expected=$EXPECTED_SHA actual=$actual" >&2
-            exit 1
-          fi
+          if [[ "$actual" != "$EXPECTED_SHA" ]]; then echo "wrong source checkout: expected=$EXPECTED_SHA actual=$actual" >&2; exit 1; fi
           echo "exact source checkout: $actual"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       - name: Install frozen dependency graph
         run: npm ci --include=optional --ignore-scripts=false
-      - name: Verify exact DeepSeek Harness release closure
+      - name: Verify DSH release closure
         run: node scripts/verify-dsh-closure.mjs
-      - name: Boot and dispose official DeepSeek Harness composition
+      - name: Enable pnpm for official profile machinery
+        run: corepack enable pnpm
+      - name: Verify official DSH stdio lifecycle
         run: node scripts/runtime-smoke.mjs
-      - name: Build pinned Codex TUI + local IPC bridge
+      - name: Build pinned Codex TUI
         shell: bash
         env:
           DSHX_VERSION: 1.0.0-ci
         run: bash scripts/build-codex-tui.sh
-      - name: Verify thin-fork and transport invariants
+      - name: Verify thin-fork and stdio invariants
         run: node scripts/verify-tui-invariants.mjs
-      - name: Verify macOS local IPC data plane
-        shell: bash
-        run: dist/bin/dshx-ipc-bridge --check
+      - name: Verify bundle install and stdio activation
+        run: node scripts/verify-bundle-install.mjs
       - name: Exercise real TUI through macOS PTY + CJK + resize
         shell: bash
         run: |
@@ -104,3 +99,20 @@ jobs:
           python3 -m venv "$VENV"
           "$VENV/bin/python" -m pip install --disable-pip-version-check pexpect
           "$VENV/bin/python" test/tui_smoke.py
+
+  summary:
+    if: always() && (github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release/'))
+    name: RC platform summary
+    needs: [windows, macos]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all platform gates
+        env:
+          WINDOWS_RESULT: ${{ needs.windows.result }}
+          MACOS_RESULT: ${{ needs.macos.result }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$WINDOWS_RESULT" == success ]] || { echo "Windows RC gate: $WINDOWS_RESULT" >&2; exit 1; }
+          [[ "$MACOS_RESULT" == success ]] || { echo "macOS RC gate: $MACOS_RESULT" >&2; exit 1; }
+          echo 'Windows and macOS RC platform gates passed.'

.github/workflows/release.yml

@@ -55,21 +55,13 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          if [[ "$GITHUB_REF_NAME" != "v1.0.0" ]]; then
-            exit 0
-          fi
+          if [[ "$GITHUB_REF_NAME" != "v1.0.0" ]]; then exit 0; fi
           for issue in 12 13 14 15; do
             state="$(gh issue view "$issue" --repo "$GITHUB_REPOSITORY" --json state --jq .state)"
-            if [[ "$state" != "CLOSED" ]]; then
-              echo "stable 1.0 is blocked: release-gate issue #$issue is $state" >&2
-              exit 1
-            fi
+            if [[ "$state" != "CLOSED" ]]; then echo "stable 1.0 is blocked: release-gate issue #$issue is $state" >&2; exit 1; fi
           done
           merged="$(gh pr view 11 --repo "$GITHUB_REPOSITORY" --json mergedAt --jq '.mergedAt != null')"
-          if [[ "$merged" != "true" ]]; then
-            echo 'stable 1.0 is blocked: PR #11 has not been merged' >&2
-            exit 1
-          fi
+          if [[ "$merged" != "true" ]]; then echo 'stable 1.0 is blocked: PR #11 has not been merged' >&2; exit 1; fi
       - name: Resolve release version (Unix)
         if: runner.os != 'Windows'
         shell: bash
@@ -78,32 +70,27 @@ jobs:
         if: runner.os == 'Windows'
         shell: pwsh
         run: Add-Content -Path $env:GITHUB_ENV -Value "DSHX_VERSION=$($env:GITHUB_REF_NAME.TrimStart('v'))"
-      - name: Test presentation adapter from frozen graph
+      - name: Test standard DSH presentation bundle from frozen graph
         run: |
           npm ci --include=optional --ignore-scripts=false
           node scripts/verify-dsh-closure.mjs
           npm test
-      - name: Boot official DSH runtime
+          node scripts/verify-ownership-boundary.mjs
+      - name: Enable pnpm for official plugin machinery
+        run: corepack enable pnpm
+      - name: Verify official DSH profile lifecycle
         run: node scripts/runtime-smoke.mjs
-      - name: Build pinned TUI and local IPC bridge (Unix)
+      - name: Build pinned TUI (Unix)
         if: runner.os != 'Windows'
         shell: bash
         run: bash scripts/build-codex-tui.sh
-      - name: Build pinned TUI and local IPC bridge (Windows)
+      - name: Build pinned TUI (Windows)
         if: runner.os == 'Windows'
         shell: pwsh
         run: ./scripts/build-codex-tui.ps1
-      - name: Verify local IPC data plane (Unix)
-        if: runner.os != 'Windows'
-        shell: bash
-        run: dist/bin/dshx-ipc-bridge --check
-      - name: Verify local IPC data plane (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          & .\dist\bin\dshx-ipc-bridge.exe --check
-          if ($LASTEXITCODE -ne 0) { throw 'local IPC data-plane self-check failed' }
-      - name: Real pinned TUI local-IPC PTY + CJK + resize smoke
+      - name: Verify profile-owned directional-pipe thin-fork invariants
+        run: node scripts/verify-tui-invariants.mjs
+      - name: Real pinned TUI PTY + CJK + resize smoke
         if: runner.os != 'Windows'
         shell: bash
         run: |
@@ -112,17 +99,15 @@ jobs:
           python3 -m venv "$VENV"
           "$VENV/bin/python" -m pip install --disable-pip-version-check pexpect
           "$VENV/bin/python" test/tui_smoke.py
-      - name: Real pinned TUI Windows ConPTY + CJK local-IPC smoke
+      - name: Real pinned TUI Windows ConPTY + CJK smoke
         if: runner.os == 'Windows'
         run: node test/tui_smoke_windows.mjs
-      - name: Build installable platform tarball (Unix)
-        if: runner.os != 'Windows'
-        shell: bash
-        run: node scripts/package-platform.mjs
-      - name: Build installable platform tarball (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
+      - name: Build installable platform tarball
         run: node scripts/package-platform.mjs
+      - name: Verify release bundle install and profile activation
+        env:
+          DSHX_REQUIRE_RELEASE: '1'
+        run: node scripts/verify-bundle-install.mjs
       - name: Clean install smoke (Unix)
         if: runner.os != 'Windows'
         shell: bash
@@ -131,8 +116,12 @@ jobs:
           TGZ="$(find dist/release -maxdepth 1 -name 'dshx-*.tgz' -print -quit)"
           PREFIX="$RUNNER_TEMP/dshx-release-smoke"
           npm install --global --prefix "$PREFIX" --include=optional --ignore-scripts=false "$TGZ"
+          if npm ls --global --prefix "$PREFIX" @deepseek-ai/dsh --depth=0 >/dev/null 2>&1; then
+            echo 'clean DSHX install unexpectedly materialized a second @deepseek-ai/dsh runtime' >&2
+            exit 1
+          fi
+          export DSHX_DSH_BIN="$PWD/node_modules/@deepseek-ai/dsh/lib/bin.js"
           "$PREFIX/bin/dshx" --version | grep -F "$DSHX_VERSION"
-          "$PREFIX/bin/dshx" doctor
       - name: Clean install smoke (Windows)
         if: runner.os == 'Windows'
         shell: pwsh
@@ -141,9 +130,11 @@ jobs:
           if (-not $tgz) { throw 'platform tarball missing' }
           $prefix = Join-Path $env:RUNNER_TEMP 'dshx-release-smoke'
           npm install --global --prefix $prefix --include=optional --ignore-scripts=false $tgz.FullName
+          & npm ls --global --prefix $prefix '@deepseek-ai/dsh' --depth=0 *> $null
+          if ($LASTEXITCODE -eq 0) { throw 'clean DSHX install unexpectedly materialized a second @deepseek-ai/dsh runtime' }
+          $env:DSHX_DSH_BIN = (Resolve-Path 'node_modules\@deepseek-ai\dsh\lib\bin.js').Path
           $version = & (Join-Path $prefix 'dshx.cmd') --version
           if (-not ($version -match [regex]::Escape($env:DSHX_VERSION))) { throw "wrong dshx version: $version" }
-          & (Join-Path $prefix 'dshx.cmd') doctor
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dshx-${{ matrix.label }}
@@ -178,10 +169,12 @@ jobs:
               with open(filename, encoding='utf-8') as handle:
                   records.append((filename, json.load(handle)))
           expected_version = os.environ['GITHUB_REF_NAME'].removeprefix('v')
-          keys = ('version', 'dshVersion', 'codexCommit', 'dshCommit', 'transport', 'dependencyGraph', 'sourceLockSha256')
+          keys = ('version', 'dshVersion', 'dshHostRange', 'codexCommit', 'dshCommit', 'transport', 'dependencyGraph', 'sourceLockSha256')
           baseline = {key: records[0][1].get(key) for key in keys}
           if baseline['version'] != expected_version:
               raise SystemExit(f"artifact version mismatch: expected {expected_version}, got {baseline['version']}")
+          if baseline['transport'] != 'profile-directional-pipes':
+              raise SystemExit(f"unexpected transport provenance: {baseline['transport']}")
           if baseline['dependencyGraph'] != 'source-package-lock':
               raise SystemExit(f"unexpected dependency graph provenance: {baseline['dependencyGraph']}")
           lock_hash = baseline['sourceLockSha256']

.gitignore

@@ -9,3 +9,6 @@ coverage/
 !.env.example
 .vscode/
 .idea/
+.build/
+.upstream/
+.release/