session-event-gate

@omdsh-dev/dsh-session-event-gate is a standalone Cordis plugin that uses @oh-my-dsh/stent to control whether DSH session event payloads are exposed to the frontend and whether their original payloads enter the persistence queue. It does not import or modify a DSH source checkout.

Current implementation

The first implementation is deliberately conservative:

• present: full sends the original event;
• present: hidden sends a seq-preserving session-event-gate/hidden placeholder instead of the original payload and removes any parallel tool view so hidden tool arguments cannot leak through the frame envelope;
• persist: full queues the original event;
• persist: redacted queues a seq-preserving session-event-gate/redacted tombstone with an empty payload.

A redacted tombstone is not the same as physically removing a row: it keeps the canonical persistence cursor contiguous. Dropping an already-appended event from SessionWriteBehind.enqueue() would create a seq gap and is intentionally not supported. A future producer-specific transient path can be added for plugin-owned events that never enter the canonical session.

Unlisted event types are full/full. Replay-critical event types are rejected when a rule tries to redact them; this prevents a generic consumer hook from breaking restore, projections, or tool pairing.

Configuration example

config:
  rules:
    - type: 'debug/*'
      present: hidden
      persist: redacted
    - type: 'trace/*'
      present: hidden
      persist: redacted
    - type: 'assistant/chunk'
      present: hidden
      persist: full
  stent:
    patches: [] # the profile supplies the static descriptors from cordis.patch.yml

Rules use exact matches or a trailing * prefix match. Exact event types and session-specific rules take precedence over broad rules.

Stent contract

The plugin declares a hard Cordis dependency:

export const inject = ['stent']

The profile must run through stent-dsh, carry the descriptors in config.stent.patches, and install them before the target modules are loaded. The runtime registers fiber-owned trusted handlers for:

Patch	Target	Purpose
session-event-gate/session-append	Session.append	Scope synchronous publication and associate live event objects with session ids.
session-event-gate/frame-queue-push	FrameQueue.push	Rewrite hidden live mux events.
session-event-gate/history-page	historyPage	Rewrite hidden history entries one-for-one.
session-event-gate/persistence-enqueue	SessionWriteBehind.enqueue	Replace redacted events before persistence-owned cloning.

All descriptors are required: true and pinned to the DSH 0.1.1-rc.1 package line. A target drift must fail the Stent binding gate rather than silently turning the plugin into a no-op.

Development

pnpm install
pnpm run typecheck
pnpm test
pnpm run build

The package is private until a real DSH profile and release verification are added. The package manifest keeps Stent as a peer dependency so a second Stent copy is never bundled.