@deepseek-ai/dsh-client-connection 0.1.0-rc.7 → 0.1.1-rc.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
-README.md: f0a707cc5f3a962c7852f7323c727d0a39a57b10
-README.zh.md: b529eebf9af93e36b6b92c19964678b7f5a04ea1
+README.md: a7562b9dac57930b1abc0b76b9079a6865a38b35
+README.zh.md: 24c56e598ebd4b5ca39e433c5782399909f528b8

package/README.md

@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared api client + current-page loopback state + observable generation-scoped `hostDescription` + single-consumer stream-loop starter); the export face carries the wire contract types, the `AbstractApiClient` abstraction, and the loop's sink/config types. Each successful readiness handshake publishes the exact `host.describe` value before `onConnected`; generation loss and explicit stop clear it, so native-capability consumers never retain a disconnected answer. The browser carrier uses HTTP POST for unary and respond operations and opens one downlink-only WebSocket each for `events.mux` and `events.host`; the in-process carrier satisfies the same two-stream abstraction. The Host half owns the single `/api` route and its Fetch bridge; a registered Typert interceptor claims its Remote endpoints before the API Proxy fallback. Loopback hostname classification stays package-internal: the `/api` Host fence and WebSocket upgrades use it directly, while other client plugins consume the derived `ctx.connection.isLoopback` state. The node half's `/api` route pins the privileged method set (`host.pickDirectory`, `host.openPath`, and the whole configuration plane — `settings.describe`/`openDocument`/`update`/`replace`/`mutate` and `credentials.describe`/`set`/`unset`; reads and native actions included, since describing returns the exposed configuration, opening acts on the Host desktop, and probing an arbitrary reference reports where a credential comes from — and the agent-preset authoring plane, `agentPreset.read`/`copy`/`openDocument`/`remove`, since a composition names the plugins a session runs, so reading one is reconnaissance, and copy/remove/openDocument manage the roster and drive the host desktop (authoring is copy-only, so none of them accepts composition text or a path); `agentPreset.list` and `agentPreset.select` stay out — the roster carries only ids and trust, and choosing a preset grants nothing `session.create`'s own `agentPreset` did not, over a default that already carries bash) to loopback by passing the trust fence with an empty trust list — a declared `trustedHosts` authority reaches every other method, while these stay loopback-local until a real authentication layer exists. The platform carriers and ConnectionController loop are package-internal; apply selects and drives them. The downlink boundary is documented in the [WebSocket downlink carrier Agent Note](../../../.agents/notes/implemented/architecture/2026-08-04-websocket-downlink-carrier.md).
+Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared api client + current-page loopback state + observable generation-scoped `hostDescription` + single-consumer stream-loop starter); the export face carries the wire contract types, the `AbstractApiClient` abstraction, and the loop's sink/config types. Each successful readiness handshake publishes the exact `host.describe` value before `onConnected`; generation loss and explicit stop clear it, so native-capability consumers never retain a disconnected answer. The browser carrier uses HTTP POST for unary and respond operations and opens one downlink-only WebSocket each for `events.mux` and `events.host`; the in-process carrier satisfies the same two-stream abstraction. The exported `ClientTransportHooks` names the page global `__DSH_TRANSPORT__` that replaces the browser carrier wholesale: the served web app leaves it unset and gets HTTP + WebSocket, while a shell owning a different physical transport (the worker preview's postMessage tunnel) provides `createApiClient` and `fetch` — plus `loadBundle` when it also owns bundle bytes — instead of forking the plugin. The Host half owns the single `/api` route and its Fetch bridge; a registered Typert interceptor claims its Remote endpoints before the API Proxy fallback. Loopback hostname classification stays package-internal: the `/api` Host fence and WebSocket upgrades use it directly, while other client plugins consume the derived `ctx.connection.isLoopback` state. The node half's `/api` route pins the privileged method set (`host.pickDirectory`, `host.openPath`, and the whole configuration plane — `settings.describe`/`openDocument`/`update`/`replace`/`mutate` and `credentials.describe`/`set`/`unset`; reads and native actions included, since describing returns the exposed configuration, opening acts on the Host desktop, and probing an arbitrary reference reports where a credential comes from — and the agent-preset authoring plane, `agentPreset.read`/`copy`/`openDocument`/`remove`, since a composition names the plugins a session runs, so reading one is reconnaissance, and copy/remove/openDocument manage the roster and drive the host desktop (authoring is copy-only, so none of them accepts composition text or a path); `agentPreset.list` and `agentPreset.select` stay out — the roster carries only ids and trust, and choosing a preset grants nothing `session.create`'s own `agentPreset` did not, over a default that already carries bash) to loopback by passing the trust fence with an empty trust list — a declared `trustedHosts` authority reaches every other method, while these stay loopback-local until a real authentication layer exists. The platform carriers and ConnectionController loop are package-internal; apply selects and drives them. The downlink boundary is documented in the [WebSocket downlink carrier Agent Note](../../../.agents/notes/implemented/architecture/2026-08-04-websocket-downlink-carrier.md).
 
 ## /api browser-trust fence
 

package/README.zh.md

@@ -2,11 +2,11 @@
 
 [English](README.md) | 中文
 
-协议消费层：客户端插件的 apply 会挂载 `ctx.connection`（共享 API 客户端 + 当前页面的 loopback 状态 + 可观察且按 generation 生效的 `hostDescription` + 单消费方流循环启动器）；导出表层携带协议约定类型、`AbstractApiClient` 抽象，以及循环的 sink／配置类型。每次就绪握手成功后，都会在 `onConnected` 之前发布完整的 `host.describe` 值；generation 失效或显式 stop 会清空它，因此原生能力消费者不会保留已经断线的判断。浏览器载体以 HTTP POST 发送 unary／respond，并为 `events.mux` 与 `events.host` 各开一条只下行的 WebSocket；进程内载体满足同一双流抽象。Host half 持有唯一 `/api` route 及其 Fetch bridge；已注册的 Typert interceptor 会先认领自己的 Remote endpoint，未认领请求再回退 API Proxy。Loopback hostname 判定逻辑留在包内部：`/api` Host fence 与 WebSocket upgrade 会直接使用它，其他客户端插件则消费派生的 `ctx.connection.isLoopback` 状态。node 半侧的 `/api` 路由让特权方法集（`host.pickDirectory`、`host.openPath`，以及整个配置面——`settings.describe`/`openDocument`/`update`/`replace`/`mutate` 与 `credentials.describe`/`set`/`unset`；读取与原生操作也在内，因为 describe 会返回已暴露的配置、打开操作会作用于 Host 桌面，而探测任意引用会报出某条凭据来自何处——以及 agent（智能体） preset 的创作面 `agentPreset.read`/`copy`/`openDocument`/`remove`，因为组装指明了一个会话所运行的插件，读取它是侦察，而 copy/remove/openDocument 管理名单并驱动宿主桌面（创作只有复制一种写入，因此这些方法都不接收组装文本或路径）；`agentPreset.list` 与 `agentPreset.select` 不在其中——名单只携带 id 与信任级别，而选择一个 preset 并不比 `session.create` 自带的 `agentPreset` 多给任何能力，何况默认 preset 本就带着 bash）以空信任表过信任 fence，从而钉在回环——已声明的 `trustedHosts` 授权可达其余全部方法，而这些方法在真正的认证层出现之前仍只限回环本机。平台载体与 ConnectionController 循环属于包内部；apply 负责选择并驱动它们。下行边界见 [WebSocket 下行载体 Agent Note](../../../.agents/notes/implemented/architecture/2026-08-04-websocket-downlink-carrier.md)。
+协议消费层：客户端插件的 apply 会挂载 `ctx.connection`（共享 API 客户端 + 当前页面的 loopback 状态 + 可观察且按 generation 生效的 `hostDescription` + 单消费方流循环启动器）；导出表层携带协议约定类型、`AbstractApiClient` 抽象，以及循环的 sink／配置类型。每次就绪握手成功后，都会在 `onConnected` 之前发布完整的 `host.describe` 值；generation 失效或显式 stop 会清空它，因此原生能力消费者不会保留已经断线的判断。浏览器载体以 HTTP POST 发送 unary／respond，并为 `events.mux` 与 `events.host` 各开一条只下行的 WebSocket；进程内载体满足同一双流抽象。导出的 `ClientTransportHooks` 命名了整体替换浏览器载体的页面全局量 `__DSH_TRANSPORT__`：served web app 不设置它、走 HTTP + WebSocket；拥有另一种物理传输的壳（worker 预览的 postMessage 隧道）则在此提供 `createApiClient` 与 `fetch`——当它同时持有 bundle 字节时再加 `loadBundle`——而不必 fork 本插件。Host half 持有唯一 `/api` route 及其 Fetch bridge；已注册的 Typert interceptor 会先认领自己的 Remote endpoint，未认领请求再回退 API Proxy。Loopback hostname 判定逻辑留在包内部：`/api` Host fence 与 WebSocket upgrade 会直接使用它，其他客户端插件则消费派生的 `ctx.connection.isLoopback` 状态。node 半侧的 `/api` 路由让特权方法集（`host.pickDirectory`、`host.openPath`，以及整个配置面——`settings.describe`/`openDocument`/`update`/`replace`/`mutate` 与 `credentials.describe`/`set`/`unset`；读取与原生操作也在内，因为 describe 会返回已暴露的配置、打开操作会作用于 Host 桌面，而探测任意引用会报出某条凭据来自何处——以及 agent（智能体） preset 的创作面 `agentPreset.read`/`copy`/`openDocument`/`remove`，因为组装指明了一个会话所运行的插件，读取它是侦察，而 copy/remove/openDocument 管理名单并驱动宿主桌面（创作只有复制一种写入，因此这些方法都不接收组装文本或路径）；`agentPreset.list` 与 `agentPreset.select` 不在其中——名单只携带 id 与信任级别，而选择一个 preset 并不比 `session.create` 自带的 `agentPreset` 多给任何能力，何况默认 preset 本就带着 bash）以空信任表过信任 fence，从而钉在回环——已声明的 `trustedHosts` 授权可达其余全部方法，而这些方法在真正的认证层出现之前仍只限回环本机。平台载体与 ConnectionController 循环属于包内部；apply 负责选择并驱动它们。下行边界见 [WebSocket 下行载体 Agent Note](../../../.agents/notes/implemented/architecture/2026-08-04-websocket-downlink-carrier.zh.md)。
 
 ## /api 浏览器信任栅栏
 
-node 半侧在桥接或 upgrade 前守卫 `/api` 下的每个入口（`src/api-request-trust.ts`）。每个请求——无论是否带浏览器标记——`Host` 都必须是回环地址权威，或与某个 `trustedHosts` 条目匹配：带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）。刻意不为无浏览器标记的 HTTP 请求开捷径：明文 HTTP 下浏览器的图片与导航读取既不带 `Origin` 也不带 Fetch-Metadata，因此无标记请求仍可能是被重绑页面发起的、响应可被读走的读取，而 Host 是重绑唯一伪造不了的请求头；WebSocket 浏览器握手会带 `Origin` 并通过同一道比较。非浏览器客户端经由回环地址、部署推导的 LAN IP 字面量或已声明的权威通过同一道栅栏。当标记存在时，如附带 `Origin`，则它必须与 Host 权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载明确报错：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。HTTP 失败在任何 RPC 分发之前以纯 403 应答，upgrade 失败在启动任何事件流前拒绝握手。非回环组合必须显式信任其服务权威：Web 运行时从全接口服务器配置推导 LAN IP 字面量，cordis.yml 中的 `trustedHosts` 与 CLI（命令行界面）的 `--trusted-host` flag 则声明具名权威。`dsh web --host 0.0.0.0` 在远程访问具备认证层之前有意不受支持。这道栅栏是可达性策略，而不是认证；Web 载体不提供认证层。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+node 半侧在桥接或 upgrade 前守卫 `/api` 下的每个入口（`src/api-request-trust.ts`）。每个请求——无论是否带浏览器标记——`Host` 都必须是回环地址权威，或与某个 `trustedHosts` 条目匹配：带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）。刻意不为无浏览器标记的 HTTP 请求开捷径：明文 HTTP 下浏览器的图片与导航读取既不带 `Origin` 也不带 Fetch-Metadata，因此无标记请求仍可能是被重绑页面发起的、响应可被读走的读取，而 Host 是重绑唯一伪造不了的请求头；WebSocket 浏览器握手会带 `Origin` 并通过同一道比较。非浏览器客户端经由回环地址、部署推导的 LAN IP 字面量或已声明的权威通过同一道栅栏。当标记存在时，如附带 `Origin`，则它必须与 Host 权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载明确报错：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。HTTP 失败在任何 RPC 分发之前以纯 403 应答，upgrade 失败在启动任何事件流前拒绝握手。非回环组合必须显式信任其服务权威：Web 运行时从全接口服务器配置推导 LAN IP 字面量，cordis.yml 中的 `trustedHosts` 与 CLI（命令行界面）的 `--trusted-host` flag 则声明具名权威。`dsh web --host 0.0.0.0` 在远程访问具备认证层之前有意不受支持。这道栅栏是可达性策略，而不是认证；Web 载体不提供认证层。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md)。
 
 ## `/api` WebSocket 下行
 

package/lib/client.js

@@ -5263,8 +5263,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			workspaceId: workspaceIdSchema.optional(),
 			cwd: string().optional(),
 			sessionId: sessionIdSchema.optional(),
-			agentPreset: string().optional()
-		}).refine((payload) => payload.workspaceId === void 0 || payload.cwd === void 0, { message: "session.create accepts workspaceId or cwd, not both" });
+			agentPreset: string().optional(),
+			reuseWorkspaceBlank: literal(true).optional()
+		}).refine((payload) => payload.workspaceId === void 0 || payload.cwd === void 0, { message: "session.create accepts workspaceId or cwd, not both" }).refine((payload) => payload.reuseWorkspaceBlank !== true || payload.workspaceId !== void 0 && payload.sessionId !== void 0, { message: "session.create reuseWorkspaceBlank requires workspaceId and sessionId" });
 		/** session.create response value. */
 		const sessionCreateValueSchema = object({
 			sessionId: sessionIdSchema,
@@ -5360,6 +5361,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			maxImagesPerMessage: number().int().positive(),
 			maxMessageImageBytes: number().int().positive(),
 			maxImagePixels: number().int().positive(),
+			maxImageDimension: number().int().positive(),
 			mediaTypes: array(string())
 		});
 		/** session.history response value (projections rides the tail page only). */
@@ -5707,6 +5709,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			provider: string().optional(),
 			model: string().optional(),
 			attachedSessions: number().int().nonnegative(),
+			home: string(),
 			canOpenPath: boolean()
 		});
 		object({});
@@ -7084,7 +7087,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			toolTurn(67, "grep", "{\"pattern\":\"SEARCH_MAX_LINES\",\"path\":\"packages/client\"}", SEARCH_MATCHES_TEXT);
 			toolTurn(68, "glob", "{\"pattern\":\"**/SearchBlock*\",\"path\":\"packages/client\"}", SEARCH_PATHS_TEXT);
 			toolTurn(69, "read", `{"file_path":${JSON.stringify(READ_SAMPLE_PATH)},"offset":${READ_SAMPLE_FIRST_LINE}}`, READ_SAMPLE_TEXT);
-			toolTurn(70, "web_search", "{\"query\":\"deepseek harness architecture\"}", "Search results for deepseek harness architecture.");
+			toolTurn(70, "web_search", "{\"queries\":[\"deepseek harness architecture\"]}", "Search results for deepseek harness architecture.");
 			toolTurn(71, "web_fetch", "{\"url\":\"https://www.deepseek.com/blog/harness-architecture\"}", "# Harness architecture\n\nEverything is a plugin.");
 			push({
 				type: "turn/start",
@@ -7264,7 +7267,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				};
 				case "web_search": return {
 					card: "generic",
-					title: `Search ${str(args.query)}`,
+					title: `Search ${(Array.isArray(args.queries) ? args.queries.filter((query) => typeof query === "string" && query !== "") : []).join(", ")}`,
 					kind: "search",
 					rawInput: args
 				};
@@ -7357,29 +7360,37 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			}
 		}
 		/**
-		* Fixture parallel of the plan unit's double-event fold: `command/run`
-		* records named `plan` with recorded input set the wanted target (`off` →
-		* false, else true); `plan/mode` commits and clears it. `wanted` is exposed
-		* for the prompt boundary (the fixture's step/start parallel).
+		* Fixture parallel of the plan unit's lifecycle fold. The paired
+		* `command/done` retains successful plan selections and drops failures;
+		* `plan/mode` commits one. `wanted` is exposed for the prompt boundary (the
+		* fixture's step/start parallel).
 		*/
 		function foldPlan(log) {
 			let active = false;
 			let wanted = null;
+			let running = null;
 			for (const event of log) {
 				const item = event;
 				if (item.type === "command/run" && item.data?.["name"] === "plan") {
 					const args = item.data["args"];
 					if (typeof args !== "string") continue;
-					wanted = args.trim() !== "off";
+					running = {
+						commandId: item.data["commandId"],
+						wanted: args.trim() !== "off"
+					};
+				} else if (item.type === "command/done" && item.data !== void 0 && running !== null && item.data["commandId"] === running.commandId) {
+					wanted = item.data["kind"] === "success" && running.wanted !== active ? running.wanted : null;
+					running = null;
 				} else if (item.type === "plan/mode") {
 					active = item.data?.["active"] === true;
 					wanted = null;
 				}
 			}
+			const selected = running?.wanted ?? wanted;
 			return {
 				active,
-				pending: wanted !== null && wanted !== active,
-				wanted
+				pending: selected !== null && selected !== active,
+				wanted: selected
 			};
 		}
 		/** The plan projection's wire view over the full log. */
@@ -7619,6 +7630,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				maxImagesPerMessage: 20,
 				maxMessageImageBytes: 100 * 1024 * 1024,
 				maxImagePixels: 4e7,
+				maxImageDimension: 2e3,
 				mediaTypes: [
 					"image/png",
 					"image/jpeg",
@@ -7985,6 +7997,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			let attachedSessions = options.empty ? 0 : 1;
 			const wid = (raw) => raw;
 			const fixtureEpoch = (/* @__PURE__ */ new Date(Date.now() - 3e5)).toISOString();
+			const FIXTURE_HOME = "/home/fixture";
 			const workspaces = options.empty ? [] : [{
 				workspaceId: wid("fx-ws-fixture"),
 				path: "/tmp/fixture",
@@ -7996,10 +8009,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				],
 				createdAt: fixtureEpoch,
 				updatedAt: fixtureEpoch
+			}, {
+				workspaceId: wid("fx-ws-home"),
+				path: `${FIXTURE_HOME}/Documents/project`,
+				title: "project",
+				sessionIds: [],
+				createdAt: fixtureEpoch,
+				updatedAt: fixtureEpoch
 			}];
 			let nextWorkspace = 1;
 			const archivedSessionIds = [];
-			const FIXTURE_HOME = "/home/fixture";
 			const directoryTree = new Map([
 				["/", ["home"]],
 				["/home", ["fixture"]],
@@ -8227,7 +8246,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 							{
 								name: "goal",
 								description: "set or view the goal for a long-running task",
-								input: { hint: "<objective>" }
+								input: {
+									hint: "<objective>",
+									images: true
+								}
 							},
 							{
 								name: "permission",
@@ -8237,17 +8259,59 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 							{
 								name: "plan",
 								description: "Enter or leave plan mode",
-								input: { hint: "[off|message]" }
+								input: {
+									hint: "[off|message]",
+									images: true
+								}
 							}
 						]
 					};
 				},
-				execute(id, line) {
+				execute(id, line, images = []) {
 					const missing = requireGoalSession(id);
 					if (missing !== void 0) return missing;
 					const match = /^\/(\S+)((?:\s.*)?)$/.exec(line.trim());
 					const name = match?.[1];
 					const args = match?.[2] ?? "";
+					if (images.length > 0 && name !== void 0 && [
+						"permission",
+						"goal",
+						"compact",
+						"echo",
+						"plan"
+					].includes(name)) {
+						const rejection = name !== "goal" && name !== "plan" ? `/${name} does not accept image attachments` : name === "goal" && args.trim() === "" ? "Image attachments only accompany a goal objective: /goal <objective> or /goal edit <objective>." : name === "plan" && args.trim() === "off" ? "Image attachments cannot accompany /plan off." : void 0;
+						if (rejection !== void 0) {
+							const commandId = `fx-cmd-${logOf(id).length}`;
+							append(id, {
+								type: "command/run",
+								data: {
+									commandId,
+									name,
+									args,
+									source: { kind: "user" }
+								}
+							});
+							const result = {
+								kind: "error",
+								text: rejection
+							};
+							append(id, {
+								type: "command/done",
+								data: {
+									commandId,
+									...result
+								}
+							});
+							return {
+								ok: true,
+								value: {
+									commandId,
+									result
+								}
+							};
+						}
+					}
 					if (name === "permission") {
 						const preset = args.trim();
 						const commandId = `fx-cmd-${logOf(id).length}`;
@@ -8409,6 +8473,50 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				activation: projection.goal.phase === "active" ? "armed" : "disarmed"
 			});
 			/** Canonical fixture implementation of the generated Goal Remote contract. */
+			/** Canonical fixture implementation of the generated reference-discovery Remote contracts. */
+			const referenceRemotes = {
+				files(id, query) {
+					const missing = requireGoalSession(id);
+					if (missing !== void 0) return missing;
+					const needle = query.toLocaleLowerCase();
+					return {
+						ok: true,
+						value: [
+							{
+								path: "notes",
+								kind: "directory"
+							},
+							{
+								path: "README.md",
+								kind: "file"
+							},
+							{
+								path: "notes/demo.txt",
+								kind: "file"
+							}
+						].filter((item) => item.path.toLocaleLowerCase().includes(needle))
+					};
+				},
+				sessions(id, query) {
+					const missing = requireGoalSession(id);
+					if (missing !== void 0) return missing;
+					const needle = query.toLocaleLowerCase();
+					return {
+						ok: true,
+						value: sessions.filter((item) => item.sessionId !== id).filter((item) => String(item.sessionId).toLocaleLowerCase().includes(needle) || item.cwd?.toLocaleLowerCase().includes(needle) === true).map((item) => {
+							const label = item.sessionId === sid("fx-beta") ? "Fixture child session" : String(item.sessionId);
+							const encoded = btoa(JSON.stringify(item.sessionId)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+							return {
+								sessionId: item.sessionId,
+								label,
+								...item.cwd === void 0 ? {} : { cwd: item.cwd },
+								createdAt: item.updatedAt,
+								mention: `@[${label}](dsh-session:${encoded})`
+							};
+						})
+					};
+				}
+			};
 			const goalRemotes = {
 				create(id, request) {
 					const missing = requireGoalSession(id);
@@ -9204,11 +9312,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 								message: `no session ${id}`,
 								details: { sessionId: id }
 							});
-							if (options.rejectPrompt) return err(request, {
-								code: "agent-busy",
-								message: "fixture: prompt rejected before acceptance",
-								details: { reason: "fixture-prompt-rejection" }
-							});
+							if (options.rejectPrompt) {
+								if (content.some((block) => block.type === "image")) return err(request, {
+									code: "attachment-error",
+									message: "fixture: image side exceeds the deployment limit",
+									details: { reason: "IMAGE_DIMENSION_TOO_LARGE" }
+								});
+								return err(request, {
+									code: "agent-busy",
+									message: "fixture: prompt rejected before acceptance",
+									details: { reason: "fixture-prompt-rejection" }
+								});
+							}
 							summary.updatedAt = Date.now();
 							summary.blank = false;
 							const userText = content.map((b) => b.type === "text" ? b.text : "").join("");
@@ -9319,6 +9434,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 							version: "0.0.0-fixture",
 							cwd: "/tmp/fixture",
 							attachedSessions,
+							home: FIXTURE_HOME,
 							canOpenPath: true
 						}),
 						pickDirectory: (request) => ok(request, { path: `${FIXTURE_HOME}/Documents/project` }),
@@ -9831,7 +9947,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					const sessionId = args.agentId;
 					switch (endpoint) {
 						case "commands/list": return Promise.resolve(commandRemotes.list(sessionId));
-						case "commands/execute": return Promise.resolve(commandRemotes.execute(sessionId, args.line));
+						case "commands/execute": return Promise.resolve(commandRemotes.execute(sessionId, args.line, args.images ?? []));
+						case "fileReferences/list": return Promise.resolve(referenceRemotes.files(sessionId, args.query ?? ""));
+						case "sessionReferenceResolver/candidates": return Promise.resolve(referenceRemotes.sessions(sessionId, args.query ?? ""));
 						case "goals/create": return Promise.resolve(goalRemotes.create(sessionId, {
 							objective: args.request?.objective,
 							...args.request?.maxGoalRounds === void 0 ? {} : { maxGoalRounds: args.request.maxGoalRounds }
@@ -10083,9 +10201,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		const ENDPOINT_SEGMENT_PATTERN = /^[A-Za-z0-9_$.-]+$/;
 		/**
 		* Create the browser-backed generic RPC caller.
+		* @param doFetch - transport override; defaults to the page's global fetch.
 		* @returns caller that owns request correlation and response-envelope validation.
 		*/
-		function createWebConnectionRpc() {
+		function createWebConnectionRpc(doFetch) {
+			const send = doFetch ?? ((input, init) => globalThis.fetch(input, init));
 			return { async call(channel, endpoint, payload, signal) {
 				assertTarget(channel, endpoint);
 				const rpcId = RpcId(randomUuid());
@@ -10095,7 +10215,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					method: endpoint,
 					payload
 				};
-				const response = await globalThis.fetch(new URL(`${channel}/${endpoint}`, resolveBase()), {
+				const response = await send(new URL(`${channel}/${endpoint}`, resolveBase()), {
 					method: "POST",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify(message),
@@ -10143,8 +10263,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		function apply(ctx) {
 			const pageLocation = typeof location === "undefined" ? void 0 : location;
 			const fixtureClient = pageLocation !== void 0 && new URLSearchParams(pageLocation.search).has("fixture") ? new FixtureApiClient() : void 0;
-			const api = fixtureClient ?? new WebApiClient();
-			const rpc = fixtureClient?.rpc ?? createWebConnectionRpc();
+			const transport = globalThis.__DSH_TRANSPORT__;
+			const api = fixtureClient ?? transport?.createApiClient() ?? new WebApiClient();
+			const rpc = fixtureClient?.rpc ?? createWebConnectionRpc(transport?.fetch);
 			let started = false;
 			let description;
 			const descriptionListeners = /* @__PURE__ */ new Set();

package/lib/types/client/index.d.ts

@@ -6,11 +6,13 @@
 import type { Context } from '@deepseek-ai/cordis';
 import type { HostDescription, IApiClient } from './api.ts';
 import { type ConnectionConfig, type ConnectionSinks, type ConnectionState } from './connection.ts';
+import { type RpcFetch } from './rpc.ts';
 import type { ClientConnectionRpc } from '../rpc.ts';
 export type { ApiProxy, SessionsApi, SessionSearchItem, SessionSummary, PromptContentPart, HostApi, EventsApi, MuxFrame, HostFrame, ApprovalResponsePayload, QuestionResponsePayload, HistoryEntry, ToolEventView, DirectoryEntry, DirectoryListing, ToolCallView, ToolResultView, WorkspaceApi, WorkspaceId, WorkspaceView, SkillsApi, SkillEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning, MessageId, ModelReasoningEffort, ModelSelection, QueueAction, QueuedInboxItem, SessionModels, SubagentsApi, SubagentAddress, SubagentCatalog, SubagentListEntry, SubagentPromptReceipt, JobView, RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode, ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt, HostDescription, IApiClient, SessionId, SessionEvent, ContentBlock, StreamChunk, GoalsApi, GoalRef, SettingsApi, SettingsNamespaceView, SettingsPathOpView, SettingsSecretView, CredentialsApi, CredentialView, ConfigurableProviderView, DiscoveredModelView, LlmApi, } from './api.ts';
 export { RpcId, AbstractApiClient, transportError, } from './api.ts';
 export type { ConnectionConfig, ConnectionSinks, ConnectionState };
 export type { ClientConnectionRpc } from '../rpc.ts';
+export type { RpcFetch } from './rpc.ts';
 /** Observable Host description published by each completed connection handshake. */
 export interface HostDescriptionSource {
     /** Latest connected-generation description; absent before connect and while reconnecting. */
@@ -20,6 +22,24 @@ export interface HostDescriptionSource {
 }
 /** Required services (none — this is the wire root). */
 export declare const inject: string[];
+/**
+ * Carrier override installed on the page global before plugin boot. The served
+ * web app leaves it unset and gets HTTP + WebSocket; a shell that owns a
+ * different physical transport (the worker preview's postMessage tunnel)
+ * provides both halves here instead of forking this plugin.
+ */
+export interface ClientTransportHooks {
+    /** Build the API carrier: unary calls plus the two downstream event streams. */
+    createApiClient(): IApiClient;
+    /** Transport for generic unary RPC channels (the Typert gateway). */
+    fetch: RpcFetch;
+    /**
+     * Bundle transport for the module system, present when the carrier also owns
+     * bundle bytes (the worker tunnel). Absent in the served web app, whose
+     * bundles load over HTTP.
+     */
+    loadBundle?(url: string): Promise<void>;
+}
 /**
  * The ctx.connection service API: the API client plus a one-shot
  * controller starter (the runtime plugin supplies sinks when its object layer
@@ -30,7 +50,7 @@ export interface ConnectionHandle {
     readonly api: IApiClient;
     /** Whether the current page authority is loopback; non-browser contexts default to true. */
     readonly isLoopback: boolean;
-    /** Generation-scoped Host facts, including native path-open capability. */
+    /** Generation-scoped Host facts, including the account home and native path-open capability. */
     readonly hostDescription: HostDescriptionSource;
     /** Generic logical RPC channels over the same Connection transport. */
     readonly rpc: ClientConnectionRpc;

package/lib/types/client/rpc.d.ts

@@ -1,8 +1,11 @@
 /** Browser caller for generic Connection unary RPC channels. */
 import type { ClientConnectionRpc } from '../rpc.ts';
+/** Transport this caller posts through; same signature as the global `fetch`. */
+export type RpcFetch = (input: URL, init: RequestInit) => Promise<Response>;
 /**
  * Create the browser-backed generic RPC caller.
+ * @param doFetch - transport override; defaults to the page's global fetch.
  * @returns caller that owns request correlation and response-envelope validation.
  */
-export declare function createWebConnectionRpc(): ClientConnectionRpc;
+export declare function createWebConnectionRpc(doFetch?: RpcFetch): ClientConnectionRpc;
 //# sourceMappingURL=rpc.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-connection",
   "description": "Wire consumer layer: HTTP-up/WebSocket-down client, ConnectionController dual streams with reconnect, and fixture api",
-  "version": "0.1.0-rc.7",
+  "version": "0.1.1-rc.1",
   "publishConfig": {
     "access": "public"
   },
@@ -39,13 +39,7 @@
   "license": "MIT",
   "dependencies": {
     "ws": "^8.21.0",
-    "@deepseek-ai/dsh-attachment": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-commands": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.7",
-    "@deepseek-ai/schemastery": "^3.18.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7"
+    "@deepseek-ai/schemastery": "^3.18.1"
   },
   "files": [
     "lib/index.js",
@@ -54,14 +48,26 @@
     "lib/types/**/*.d.ts"
   ],
   "peerDependencies": {
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7",
-    "@deepseek-ai/cordis": "^4.0.1"
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.1-rc.1"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7"
+    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.1.1-rc.1"
   }
 }