fix(dsh): complete automatic-path diagnostics and recall presentation

[knqiufan]

Which issue or RFC does this PR close?

Closes #1457. Refs #1450 (B). Builds on the merged fixes #1452 (A) and #1464 (Windows Server cursor-key fix).

This PR is rebased on upstream master 8550f9f9, which contains #1398, #1452, #1453, and #1464. It contains B's implementation and acceptance records plus the independently reviewable macOS LaunchAgent start fix from #1480. That fix is included here so the same native CI path that exposed the failure can validate it; once #1480 merges, rebasing will drop the equivalent commit.
PR comparison.
Live-model acceptance is pending: the configured official DeepSeek endpoint returned HTTP 401.

Rationale for this change

An ordinary DSH conversation can silently lose automatic Scope diagnostics or discard valid prepared context when capture or a diagnostic writer fails. Successfully injected context also lacks the host's snapshot metadata. The new registered-entry regressions reproduce these defects on A: 20 failures out of 28 initial tests.

B reuses A's error classification, endpoint semantics and Scope cancellation support, and completes their automatic pre-step integration. This fixes existing host contracts and requires no RFC.

What changes are included in this PR?

• Report Scope/prepare/capture/flush/injection failures at their own boundaries. Logger exceptions and rejected promises are best effort; existing safe fields and outcome-based 60-second cooldown remain.
• Stop automatic work after Scope failure or overall cancellation. Preserve prepare/capture independence, accepted Source results, and the complete downstream decision, including startsRequestSeries.
• Attach one native snapshot with a PowerContext section whose text exactly matches the injected message. Preserve the Server content, citations, byte validation and untrusted-history framing through normal host persistence.
• Fix two compatibility defects exposed by actual host acceptance: omit absent request_id fields so tool output is lossless JSON, and declare command input so Web routes /pc doctor and /pc capabilities as commands.
• Add registered-entry regressions and a pinned real-DSH runtime test package. CI now runs make dsh-runtime-test after make js-test, loading the built distributable with real host services and a real PowerContext Server.
• Rebuild lib, document behavior in English/Chinese, and add reproducible runtime instructions plus an acceptance record. Fix Windows e2e Server teardown to stop its owned child process tree.
• Include fix(service): kickstart newly bootstrapped LaunchAgents #1480's explicit LaunchAgent kickstart so a successful macOS bootstrap reliably starts the Server and surfaces launchd errors directly.

Are there any user-facing changes?

Background failures leave normal conversation handling with DSH while reporting a safe stage-specific diagnostic. Prepared context remains usable when capture or flush fails, and appears in the native snapshot view. Scope failures stop subsequent automatic requests without fallback.

In the tested Web versions, expand the turn's context-injection row to view PowerContext. Terminal diagnostics require a native logger exporter with warning level enabled. Source acceptance and successful Memory generation remain separate outcomes. HTTP contracts, Scope policy, capture policy, and retry/request budgets are unchanged.

How was this change tested?

Acceptance record, sanitized observations, build identities and Web screenshot.

Validation	Result
Current head 0436943a	17/17 checks passed, including the real macOS LaunchAgent lifecycle, Linux/Windows native services, Python 3.11–3.14, DSH package/runtime, quality, website, and SQLite/OceanBase acceptance.
Previous B head 279baf8c	DSH and all other checks passed; a later native-service run exposed the macOS LaunchAgent start race now tracked by #1479 and fixed in #1480.
Plugin unit suite	148 passed, including 30 automatic-path regressions and existing A coverage
Real PowerContext Server e2e	9 passed, including default Scope without cwd
Real DSH SDK runtime, published 0.1.2-rc.1	4 passed: Source → Memory → fresh-session context, persistence/model input, native diagnostics, actual tool results, stage faults, restart, Scope isolation
Integration manifest	26 passed
Build, quality, documentation	Passed Makefile-equivalent commands in PowerShell; GNU make is unavailable locally. Final website export verified 78 HTTP and 378 Python API pages.
Actual Web 0.1.2-rc.1	Snapshot display/history, independent stage faults, native console diagnostics, recovery/restart, Stop during held Scope, doctor/capabilities and bare /pc
Actual Web 0.1.0-rc.6	Capture/processing/new-session recall, rendered/persisted snapshot, Scope failure, doctor/capabilities and named-tool failure
Live-model + associated Web matrix	Pending: HTTP 401 authentication error; unrelated to this CI failure.

Executed the commands in make js-test, make check, and make docs-test, plus:

pnpm --dir integrations/dsh/plugins/powercontext/tests/runtime install --frozen-lockfile
pnpm --dir integrations/dsh/plugins/powercontext test:e2e:runtime

For the LaunchAgent fix, uv run pytest -q tests/test_service.py -k launchd passed 23 tests with 1 platform skip, and the complete real macOS lifecycle passed on both #1459 and #1480.

Local environment: Windows, Node 24.14.1, Python 3.12.13. CI uses the repository's Node 22.19.0. SDK/runtime dependencies are locked. Passing runtime and Web scenarios use a deterministic loopback model and real Server processing/storage; they do not establish live-model behavior. The opt-in test:real command fails for a missing key and verifies actual Memory generation plus fresh-session recall with configured live inference.

AI usage statement

OpenAI Codex assisted with implementation, regression tests, fixtures, documentation, and browser-driven validation. Results above come from executed commands, real DSH/Server processes, persisted events, request observations and actual Web interactions. The unresolved live-model authentication gate is recorded explicitly; AI-generated code and model fixture replies are not treated as proof of live-model acceptance.

[knqiufan]

Validation for head e3ad78d7f1b0dec456b94dab52480a5852bb536d is complete for the available environment:

• 16 of 17 CI checks passed, including the DSH package and real runtime tests, Python 3.11–3.14, quality, website, both SQLite/OceanBase acceptance jobs, and Linux/macOS native service checks.
• The Windows native-service job failed at tests/native/test_personal_service_lifecycle.py:86: restarted.ok was false because the restarted service was not reachable. The failing check remains unresolved. A rerun attempt was refused with HTTP 403, Must have admin rights to Repository.
• Local final-build checks passed: 148 plugin unit tests, 9 real Server e2e tests, 4 real DSH runtime tests, quality/documentation gates, and actual Web checks on 0.1.2-rc.1 and 0.1.0-rc.6. The acceptance record contains the build hash, evidence, screenshot and reproduction details.
• Live-model acceptance remains blocked by authentication (HTTP 401). The passing runtime/Web checks used deterministic model responses. A (fix(dsh): handle Scope failures at tool and command boundaries #1452) is still open, and its original branch/head was left unchanged.

The PR remains Draft. B is not marked complete; remaining gates are live-model/Web acceptance, resolution of the Windows CI failure, and integration after A merges.

[knqiufan]

The Windows native-service failure has been traced to a reproducible Server defect, tracked in #1463 and fixed independently in #1464. The same fix is included in this PR as d2b3ee25.

The uploaded service log shows that the second Server process exited with cursor signing key must contain 32 bytes. The key writer used a Windows text-mode descriptor, so LF bytes in a random 32-byte key expanded to CRLF on disk. A fixed test input reproduces a 33-byte file and the failed restart. This was not an unexplained runner failure or a DSH diagnostic regression.

The fix uses binary writes and makes the persistence/restart tests deterministic. Windows CI now runs them against the installed wheel and continues to exercise the real Task Scheduler lifecycle. Native failure output also includes the Server log tail, so the underlying exception is visible without downloading an artifact first.

Correction to the earlier permissions note: GitHub rejected my attempt to rerun the old job with HTTP 403 and the message Must have admin rights to Repository. That was a restriction on initiating a rerun, not a prerequisite for making the test pass. GitHub documents repository write permission for reruns; reruns do not acquire the privileges of the person requesting them. The new substantive fix triggered normal PR validation without changing repository permissions or test requirements.

Validation is now complete for this CI fix:

• fix(server): preserve binary cursor keys on Windows #1464 at 2fb02a2e: 17/17 checks passed.
• fix(dsh): complete automatic-path diagnostics and recall presentation #1459 at d2b3ee25: 17/17 checks passed.
• The B-branch Windows job passed the four deterministic cursor checks and all four applicable real service lifecycle tests. The one native skip is macOS-only.
• Local source validation: 51 passed for cursor persistence and Server tests; the fresh installed wheel passed the four targeted persistence/restart tests.

The live-model HTTP 401 acceptance gate and dependency on A remain separate from this CI fix; the DSH PR remains Draft.

[knqiufan]

Rebased this PR onto upstream 8550f9f9 and force-updated the contributor branch with an exact --force-with-lease guard.

• fix(dsh): handle Scope failures at tool and command boundaries #1452 (A) and fix(server): preserve binary cursor keys on Windows #1464 (the Windows cursor-key fix) are now merged upstream. Git identified and skipped the branch's two equivalent commits, so this PR no longer duplicates those changes.
• git range-diff reports the original three B commits as patch-identical after the rebase. A fourth documentation commit records the post-rebase build identity and validation without relabelling the earlier Web screenshot as current-build evidence.
• Rebuilding the distributable produced no working-tree change. The current lib/index.js SHA-256 is 3aefa1ab1288ce68f030b4fb0701f1a21d09c2e31accd2472a8333fac7da76e7.
• Local validation passed: 148 plugin unit tests, 9 real Server e2e tests, 4 pinned real DSH runtime scenarios, lock validation, all pre-commit hooks, and the Python type check.
• Upstream CI at 279baf8c: 17/17 checks passed, including Python 3.11–3.14, DSH runtime, native Linux/macOS/Windows services, website, SQLite, and OceanBase acceptance.

GitHub now reports the PR as mergeable with no content conflicts. It remains Draft because the separately recorded live-model attempt still returns HTTP 401; that acceptance result was not inferred from deterministic fixture tests.

[Teingi]

LGTM