@deepseek-ai/dsh-experimental-webworker-runtime 0.1.6-alpha.1 → 0.1.7-alpha.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/experimental/webworker-runtime/README.md
-README.md: ab54ec689664adc1c0e01cc3387777c77f36bc66
-README.zh.md: d6593eeff22e642e2423fa9348f64d751d5de62f
+README.md: 3a5d702c2163c19daa3230ffd14270b4f236f2d9
+README.zh.md: a987fed1db5f607aee4e95e2faf96575c1d0c904

package/README.md

@@ -27,12 +27,12 @@ The public npm package exposes the runtime library at its root, the self-contain
 
 Three build artifacts and one source-owned process layer:
 
-- **`lib/index.js` (assembly library)** — `createWorkerHost`/`startWorkerHost` mount the base image and any ordered data overlays (`storage/`), install the module loader (`module-system/`) and the `process` shim, boot the tree through the image's own `dsh-app-boot`, and hand the tunnel its serving seams. Overlays may replace files only under `home/` and `workspace/`; they cannot replace the base manifest, configuration, or modules. The image layout contract (`image-layout.ts`: virtual root, config/manifest paths, empty directories, the `lowered` wrapper-contract gate) is shared with the packer. Boot patches force the deployment-shaped rows: frontend serving off, JSONL session logs on the plaintext path, preset roots onto the image's `config/agent-presets`.
-- **`lib/worker.js` (worker bundle)** — the assembly plus this package's Node-compatibility layer as one self-contained ES module. The module proxy table (`module-proxies.ts`) is the only platform fork: `node:*` builtins over VFS/tunnel/browser primitives, structural stubs that fail loud on the console for what a browser cannot do, and native/binary package replacements. `node:module` supplies `createRequire().resolve` and `.resolve.paths()` over the image package root, so unchanged packages can discover manifests without evaluating their modules. The global `process` shim carries Node detection fields including `title`, preventing Worker execution from entering DOM-only branches. The pack-time parser reports statically named module requests, including module-scope direct calls of the form `createRequire(import.meta.url)('pkg')` through a named `node:module` or `module` import, to the packer's reachability walk. Stored, CommonJS-obtained, and rebased `createRequire` calls require image entry seeds. VFS mutations drive `node:fs` callback, polling, and promise watchers; open descriptors retain file identity and access mode across rename, replacement, and unlink, `FileHandle.stat({ bigint: true })` reports the same device and inode identity as a path stat while the name still refers to that file, and `FileHandle.chmod()` updates the opened file identity; `readable-stream` supplies the stream state machine used by file streams and unchanged image packages such as Chokidar and readdirp. AsyncLocalStorage carries sync-stack causality across `await` through the snapshot/restore faces the pack-time lowering injects. The worker holds no compiler: an image the packer did not lower is refused at mount. The callback `fs.realpath.native` alias resolves within the mounted VFS and supports `util.promisify`.
+- **`lib/index.js` (assembly library)** — `createWorkerHost`/`startWorkerHost` mount the base image and any ordered data overlays (`storage/`), install the module loader (`module-system/`) and the `process` shim, boot the tree through the image's own `dsh-app-boot`, and hand the tunnel its serving seams. Overlays may replace files only under `home/` and `workspace/`; they cannot replace the base manifest, configuration, or modules. The image layout contract (`image-layout.ts`: virtual root, config/manifest paths, empty directories, the `lowered` wrapper-contract gate) is shared with the packer. The Worker supplies `profileContext` for an editable profile at `home/profiles/preview/`: the packed rows seed its insertion patch, and ConfigEditor persists overrides in that VFS patch. ConfigEditor reconciles each write and Loader commits live values; package management and Node module HMR stay disabled. Deployment overlays keep JSONL session logs plaintext and preset roots at the image's `config/agent-presets`. Configuration edits last for the current Worker lifetime.
+- **`lib/worker.js` (worker bundle)** — the assembly plus this package's Node-compatibility layer as one self-contained ES module. The module proxy table (`module-proxies.ts`) is the only platform fork: `node:*` builtins over VFS/tunnel/browser primitives, structural stubs that fail loud on the console for what a browser cannot do, and native/binary package replacements. `node:module` supplies `createRequire().resolve` and `.resolve.paths()` over the image package root, so unchanged packages can discover manifests without evaluating their modules. The `node:util` JSON-data comparator compares own enumerable properties, preserving Node admission decisions for recorded fields such as `__proto__`. The global `process` shim carries Node detection fields including `title`, preventing Worker execution from entering DOM-only branches. The pack-time parser reports statically named module requests, including module-scope direct calls of the form `createRequire(import.meta.url)('pkg')` through a named `node:module` or `module` import, to the packer's reachability walk. Stored, CommonJS-obtained, and rebased `createRequire` calls require image entry seeds. VFS mutations drive `node:fs` callback, polling, and promise watchers; open descriptors retain file identity and access mode across rename, replacement, and unlink, `FileHandle.stat({ bigint: true })` reports the same device and inode identity as a path stat while the name still refers to that file, and `FileHandle.chmod()` updates the opened file identity; `readable-stream` supplies `node:stream/promises` completion and pipeline helpers and the stream state machine used by file streams and unchanged image packages such as Chokidar and readdirp. AsyncLocalStorage carries sync-stack causality across `await` through the snapshot/restore faces the pack-time lowering injects. The worker holds no compiler: an image the packer did not lower is refused at mount. The callback `fs.realpath.native` alias resolves within the mounted VFS and supports `util.promisify`.
 - **`src/shell/` (the worker's own process layer)** — a browser worker cannot fork, so `node:child_process` is not a stub but an implementation: `spawn` starts the command in its own Web Worker — this same bundle, told by its first frame to be a shell process — and reports it through the `ChildProcess` surface the subprocess service consumes. The command runs off the host's thread, `SIGKILL` terminates it whatever it is doing, and it reaches the VFS only by message (the host serves those frames). Worker platform executables preserve native-package protocols such as Landlock without replacing their JavaScript packages or coupling their implementations to `node:child_process`; ordinary commands use the package's evaluator and coreutils command table. The grammar is `@yarnpkg/parsers`' `parseShell`, while `execSync`/`fork` still refuse because they need a real process.
-- **`lib/client.js` (page half)** — startup has two independent stages. `chooseWorkerHostSource({ image?, fixtureManifest? })` optionally owns the boot barrier and fixture manifest: without `preview-fixture` it waits at the source chooser, while a valid query selects directly; either path returns ordered overlays. `connectWorkerHost(worker, { image?, overlays? })` remains the public base-runtime connector; callers that skip the chooser get an empty overlay list. `apps/web` invokes both and supplies its statically bundled Worker. The opening `init` frame carries the base and ordered overlay URLs, the boot payload delivers the structured index-injection table, and `applyIndexInjections` executes it before the shell entry runs. Script preload rows are advisory and skipped because `/plugins` resources resolve only through the tunnel; `loadBundle` fetches each combo on first demand, embeds its tunnel-only source map as a Base64 data URL, and executes the script as a Blob. The tunnel also exposes fetch-shaped transport, the independent file-upload carrier, and the API client. Request frames preserve Blob bodies through structured clone and transfer `ReadableStream<Uint8Array>` ownership. The Host Worker streams both forms into the route, so neither browser thread creates a complete byte array for a generic-file upload.
+- **`lib/client.js` (page half)** — startup has two independent stages. `chooseWorkerHostSource({ image?, fixtureManifest? })` optionally owns the boot barrier and fixture manifest: without `preview-fixture` it waits at the source chooser, while a valid query selects directly; either path returns ordered overlays. `connectWorkerHost(worker, { image?, overlays? })` remains the public base-runtime connector; callers that skip the chooser get an empty overlay list. `apps/web` invokes both and supplies its statically bundled Worker. The opening `init` frame carries the base and ordered overlay URLs, the boot payload delivers the structured index-injection table, and `applyIndexInjections` executes it before the shell entry runs. Script preload rows are advisory and skipped because `/plugins` resources resolve only through the tunnel; `loadBundle` fetches each combo on first demand, embeds its tunnel-only source map as a Base64 data URL, and executes the script as a Blob. The tunnel also exposes fetch-shaped transport, the independent file-upload carrier, and the API client. Request frames preserve Blob bodies through structured clone and transfer `ReadableStream<Uint8Array>` ownership. The Host Worker streams both forms into the route, so neither browser thread creates a complete byte array for a generic-file upload. A Remote stream's uplink crosses as `stream-uplink-item` / `stream-uplink-end` frames into an unbounded `TunnelUplink` that drops items arriving after `end`: the page and its worker are one trusted same-origin boundary, so the Host inbox cap does not apply.
 
-Acceptance lives in `apps/web/tests/preview-boot.e2e.ts`, which serves the real built pages and drives the pre-boot chooser plus Worker activation in headless Chromium. The empty selection exercises first-run startup. The `vfs-example` overlay supplies ordinary workspace files and plaintext persistence artifacts for cold Workspace/Session discovery, tool presentation, subagent navigation, and history paging without a model request. The fixture generator owns current-generation logs and the projection cache; committed predecessor logs remain byte-identical alongside them. The chooser reserves WebFS as a separate user-authorized source; that provider does not read the built-in fixture.
+Acceptance lives in `apps/web/tests/preview-boot.e2e.ts`, which serves the real built pages and drives the pre-boot chooser plus Worker activation in headless Chromium. The empty selection exercises first-run startup. The `vfs-example` overlay supplies ordinary workspace files and plaintext persistence artifacts for cold Workspace/Session discovery, tool presentation, subagent navigation, and history paging without a model request. The [packer](../webworker-packer/README.md) prepares current-generation successors from committed historical logs in Node; those source logs remain byte-identical in the overlay. The fixture generator owns the acceptance test's current projection cache. The chooser reserves WebFS as a separate user-authorized source; that provider does not read the built-in fixture.
 
 The [built-bundle import sweep](tests/compile/transform-corpus-check.ts) checks bare Node imports after the library build. Its Dockkit exception accepts Node’s unknown-`.css`-extension refusal for any stylesheet rather than one pinned path; another extension, error code, or message, and an unexpectedly successful exempt import, remain errors. See the [stylesheet exemption decision](../../../.agents/notes/implemented/bug-fix/2026-09-10-built-bundle-css-exemption.md).
 
@@ -53,7 +53,9 @@ None; this package neither assembles nor sends a provider request.
 
 - **The worker composition writes plaintext session logs** (`compression: 'none'` boot patch): it carries no Zstandard codec, so exported logs are `.jsonl`, never `.jsonl.zstd`.
 - **`node:dns/promises`, `node:vm`, `node:net`, `node:sqlite`, `node:worker_threads` are structural stubs**: every call reports its refusal on the console and throws. Rows needing native DNS, a real process, or realm isolation cannot run here.
+- **Host package commands are unavailable**: `execa` reports an explicit worker-host refusal; the preview cannot run pnpm or install native dependencies.
 - **PTC Node programs are unavailable**: the process shim exposes `/dsh/bin/node` as its executable identity so the provider can activate, but the Worker has neither a Node executable nor `stripTypeScriptTypes`. Program execution fails before launching a child.
+- **Office conversion requires a Node Host**: the LibreOffice kit replacement rejects converter creation with `unavailable`. The browser image excludes the kit and its engine dependencies; the Office preview reports that conversion is unavailable.
 - **Filesystem watchers observe only the mounted VFS**: image seeding is silent and the VFS has no symlinks or external writers. `persistent`, `ref()`, and `unref()` preserve the Node API but cannot control a dedicated Worker's lifetime because browsers expose no ref-counted event loop.
 - **Worker confinement is a VFS boundary, not kernel Landlock**: `read-only` and `workspace-write` run the unchanged `@deepseek-ai/node-addon-system/landlock-run` JavaScript and launcher argv, but the process layer implements the logical `landlock-run` executable and enforces its grants on every shell filesystem request. `full` therefore covers the Worker command table and mounted VFS only; it does not claim arbitrary native-process execution or Linux kernel isolation.
 - **The worker bundle pins a path inside `@yarnpkg/parsers`** — the build resolves the package's own `lib/shell.js` instead of its root, whose barrel also re-exports the Syml parser and so drags js-yaml into a bundle that never parses that format (around 175 kB, plus its module body at worker start). The path is derived from the package manifest, so a layout change fails the build rather than reinstating the barrel; upgrading the dependency means re-checking that the shell parser still lives there.

package/README.zh.md

@@ -27,12 +27,12 @@ kind: "package-library"
 
 一条 tsdown 管线产出三个构建产物；另有一层由源码维护的进程实现：
 
-- **`lib/index.js`（装配库）**——`createWorkerHost`/`startWorkerHost` 挂载基础镜像和按序排列的数据 overlays（`storage/`）、安装模块加载器（`module-system/`）与 `process` shim、经镜像自带的 `dsh-app-boot` 启动插件树，并把服务 seam 交给隧道。Overlay 只能替换 `home/` 与 `workspace/` 下的文件，不能替换基础 manifest、配置或模块。镜像布局契约（`image-layout.ts`：虚拟根、config/manifest 路径、空目录、`lowered` 包装契约门）与 packer 共享。boot patch 强制部署形态行：关前端静态服务、JSONL 会话日志走明文、preset 根指向镜像内 `config/agent-presets`。
-- **`lib/worker.js`（worker 束）**——装配库加本包的 Node 兼容层，合成一个自含 ES module。模块代理表（`module-proxies.ts`）是唯一平台叉口：`node:*` 内建走 VFS、隧道和浏览器原语，浏览器做不到的走结构化 stub（调用即在 console 报错并抛出），native/binary 包则替换执行后端。`node:module` 在镜像 package 根之上提供 `createRequire().resolve` 与 `.resolve.paths()`，使未修改的包无需执行目标模块即可发现 manifest。全局 `process` shim 带有包括 `title` 在内的 Node 环境识别字段，避免 Worker 执行误入仅适用于 DOM 的分支。pack 期解析器会把名称静态可知的模块请求报告给 packer 的可达性遍历，其中包括通过 `node:module` 或 `module` 具名导入在模块作用域直接发起的 `createRequire(import.meta.url)('pkg')` 调用。保存、经 CommonJS 获取或另设基准的 `createRequire` 调用需要镜像入口种子。VFS mutation 驱动 `node:fs` 的 callback、polling 和 promise watcher；打开的 descriptor 在 rename、replacement 和 unlink 后仍保留文件身份与访问模式，只要文件名仍指向该文件，`FileHandle.stat({ bigint: true })` 报告的 device 与 inode 身份就与路径 stat 相同，`FileHandle.chmod()` 则更新打开文件身份的权限；`readable-stream` 提供文件流以及 Chokidar、readdirp 等未修改镜像包所用的流状态机。AsyncLocalStorage 经 pack 时降低注入的 snapshot/restore 面在 `await` 间携带同步栈因果。worker 不带编译器：packer 未降低的镜像在挂载时被拒。回调式 `fs.realpath.native` 别名在已挂载的 VFS 内解析路径，并支持 `util.promisify`。
+- **`lib/index.js`（装配库）**——`createWorkerHost`/`startWorkerHost` 挂载基础镜像和按序排列的数据 overlays（`storage/`）、安装模块加载器（`module-system/`）与 `process` shim、经镜像自带的 `dsh-app-boot` 启动插件树，并把服务 seam 交给隧道。Overlay 只能替换 `home/` 与 `workspace/` 下的文件，不能替换基础 manifest、配置或模块。镜像布局契约（`image-layout.ts`：虚拟根、config/manifest 路径、空目录、`lowered` 包装契约门）与 packer 共享。Worker 为 `home/profiles/preview/` 下可编辑的 profile 提供 `profileContext`：打包行初始化其插入 patch，ConfigEditor 将覆盖值持久化到该 VFS patch。ConfigEditor 协调每次写入，Loader 提交实时值；包管理和 Node 模块 HMR 保持禁用。部署 overlay 保持 JSONL 会话日志为明文，preset 根指向镜像内 `config/agent-presets`。配置修改在当前 Worker 生命周期内有效。预设声明包含在组合后的配置中。
+- **`lib/worker.js`（worker 束）**——装配库加本包的 Node 兼容层，合成一个自含 ES module。模块代理表（`module-proxies.ts`）是唯一平台叉口：`node:*` 内建走 VFS、隧道和浏览器原语，浏览器做不到的走结构化 stub（调用即在 console 报错并抛出），native/binary 包则替换执行后端。`node:module` 在镜像 package 根之上提供 `createRequire().resolve` 与 `.resolve.paths()`，使未修改的包无需执行目标模块即可发现 manifest。`node:util` 的 JSON 数据比较器检查可枚举的自有属性，使 `__proto__` 等记录字段的准入判定与 Node 一致。全局 `process` shim 带有包括 `title` 在内的 Node 环境识别字段，避免 Worker 执行误入仅适用于 DOM 的分支。pack 期解析器会把名称静态可知的模块请求报告给 packer 的可达性遍历，其中包括通过 `node:module` 或 `module` 具名导入在模块作用域直接发起的 `createRequire(import.meta.url)('pkg')` 调用。保存、经 CommonJS 获取或另设基准的 `createRequire` 调用需要镜像入口种子。VFS mutation 驱动 `node:fs` 的 callback、polling 和 promise watcher；打开的 descriptor 在 rename、replacement 和 unlink 后仍保留文件身份与访问模式，只要文件名仍指向该文件，`FileHandle.stat({ bigint: true })` 报告的 device 与 inode 身份就与路径 stat 相同，`FileHandle.chmod()` 则更新打开文件身份的权限；`readable-stream` 提供 `node:stream/promises` 的完成等待与管道方法，以及文件流以及 Chokidar、readdirp 等未修改镜像包所用的流状态机。AsyncLocalStorage 经 pack 时降低注入的 snapshot/restore 面在 `await` 间携带同步栈因果。worker 不带编译器：packer 未降低的镜像在挂载时被拒。回调式 `fs.realpath.native` 别名在已挂载的 VFS 内解析路径，并支持 `util.promisify`。
 - **`src/shell/`（worker 自己的进程层）**——浏览器 worker 无法 fork，所以 `node:child_process` 不是 stub 而是实现：`spawn` 把命令放进它自己的 Web Worker——就是这同一个束，由首帧告诉它「你是 shell 进程」——并以 subprocess 服务消费的 `ChildProcess` 面报告结果。命令不占宿主线程，`SIGKILL` 不管它在干什么都能终止它，而它只能靠消息触达 VFS（由宿主应答这些帧）。Worker 平台 executable 在不替换 JavaScript 包、也不把具体实现耦合进 `node:child_process` 的情况下保持 Landlock 等 native 包协议；普通命令使用本包的求值器与 coreutils 命令表。语法来自 `@yarnpkg/parsers` 的 `parseShell`，而 `execSync`/`fork` 依然拒绝，因为它们需要真进程。
-- **`lib/client.js`（页面半）**——启动分为相互独立的两段。`chooseWorkerHostSource({ image?, fixtureManifest? })` 可选地拥有 boot barrier 与 fixture manifest：没有 `preview-fixture` 时停在来源选择面板，合法 query 则直接选择；两条路径都返回按序排列的 overlays。`connectWorkerHost(worker, { image?, overlays? })` 仍是公开的基础运行态连接器；调用方跳过选择器时 overlay 列表为空。`apps/web` 调用这两段并提供静态打包的 Worker。开局 `init` 帧携带基础镜像与按序排列的 overlay URL，boot 载荷送达结构化 index 注入表，`applyIndexInjections` 在壳入口运行前逐行执行。脚本 preload 行只是提示，因此会被跳过：`/plugins` 资源只能经 tunnel 解析，`loadBundle` 会在首次需要时获取 combo、把仅 tunnel 可达的 sourcemap 内嵌为 Base64 data URL，再以 Blob 执行脚本。Tunnel 还暴露 fetch 形式的传输、独立文件上传载体和 API 客户端。请求帧通过结构化克隆保留 Blob 请求体，并转移 `ReadableStream<Uint8Array>` 的所有权。Host Worker 将两种请求体都逐块送入路由，因此通用文件上传不会在任何浏览器线程创建完整字节数组。
+- **`lib/client.js`（页面半）**——启动分为相互独立的两段。`chooseWorkerHostSource({ image?, fixtureManifest? })` 可选地拥有 boot barrier 与 fixture manifest：没有 `preview-fixture` 时停在来源选择面板，合法 query 则直接选择；两条路径都返回按序排列的 overlays。`connectWorkerHost(worker, { image?, overlays? })` 仍是公开的基础运行态连接器；调用方跳过选择器时 overlay 列表为空。`apps/web` 调用这两段并提供静态打包的 Worker。开局 `init` 帧携带基础镜像与按序排列的 overlay URL，boot 载荷送达结构化 index 注入表，`applyIndexInjections` 在壳入口运行前逐行执行。脚本 preload 行只是提示，因此会被跳过：`/plugins` 资源只能经 tunnel 解析，`loadBundle` 会在首次需要时获取 combo、把仅 tunnel 可达的 sourcemap 内嵌为 Base64 data URL，再以 Blob 执行脚本。Tunnel 还暴露 fetch 形式的传输、独立文件上传载体和 API 客户端。请求帧通过结构化克隆保留 Blob 请求体，并转移 `ReadableStream<Uint8Array>` 的所有权。Host Worker 将两种请求体都逐块送入路由，因此通用文件上传不会在任何浏览器线程创建完整字节数组。Remote 流的上行以 `stream-uplink-item` / `stream-uplink-end` 帧进入没有上限的 `TunnelUplink`，`end` 之后到达的项被丢弃：页面与其 worker 是同一个可信的同源边界，Host 的 inbox 上限在此不适用。
 
-验收在 `apps/web/tests/preview-boot.e2e.ts`：静态服务真实构建页面，在 headless Chromium 里驱动 pre-boot 选择面板与 Worker 激活。空白选择验证首次启动；`vfs-example` overlay 提供普通 workspace 文件与明文 persistence 产物，无需模型请求即可验证 Workspace/Session 冷发现、工具呈现、subagent 导航和历史分页。fixture 生成器负责当前代日志与投影缓存；已提交的前代日志逐字节保持不变，与它们并存。选择面板为 WebFS 保留独立的用户授权来源；该 provider 不读取内置 fixture。
+验收在 `apps/web/tests/preview-boot.e2e.ts`：静态服务真实构建页面，在 headless Chromium 里驱动 pre-boot 选择面板与 Worker 激活。空白选择验证首次启动；`vfs-example` overlay 提供普通 workspace 文件与明文 persistence 产物，无需模型请求即可验证 Workspace/Session 冷发现、工具呈现、subagent 导航和历史分页。[打包器](../webworker-packer/README.zh.md)在 Node 中根据已提交的历史日志准备当前代后继文件；这些源日志在 overlay 中逐字节保持不变。fixture 生成器负责验收测试的当前投影缓存。选择面板为 WebFS 保留独立的用户授权来源；该 provider 不读取内置 fixture。
 
 [已构建 bundle 导入检查](tests/compile/transform-corpus-check.ts)在库构建后检查裸 Node 导入。Dockkit 例外接受 Node 针对任意样式表报告的未知 `.css` 扩展名错误，而不限定某一固定路径；其他扩展名、错误码或消息，以及意外成功的豁免导入，仍然报错。参见 [样式表豁免决策](../../../.agents/notes/implemented/bug-fix/2026-09-10-built-bundle-css-exemption.zh.md)。
 
@@ -53,7 +53,9 @@ kind: "package-library"
 
 - **worker 组合写明文会话日志**（`compression: 'none'` boot patch）：不带 Zstandard 编解码器，导出日志是 `.jsonl`，不会是 `.jsonl.zstd`。
 - **`node:dns/promises`、`node:vm`、`node:net`、`node:sqlite`、`node:worker_threads` 是结构化 stub**：每次调用在 console 报告拒绝并抛出。需要原生 DNS、真进程或真 realm 隔离的行在此无法运行。
+- **宿主包管理命令不可用**：`execa` 明确报告 worker host 不支持该调用；预览无法运行 pnpm 或安装原生依赖。
 - **PTC Node 程序不可用**：process shim 用 `/dsh/bin/node` 表示可执行文件身份，使 provider 能够激活，但 Worker 既没有 Node 可执行文件，也没有 `stripTypeScriptTypes`。程序执行会在启动子进程前失败。
+- **Office 转换需要 Node Host**：LibreOffice kit 的替代模块以 `unavailable` 拒绝创建转换器。浏览器镜像排除 kit 及其引擎依赖；Office 预览提示转换不可用。
 - **文件 watcher 只能观察已挂载的 VFS**：镜像 seed 不产生事件，VFS 也没有符号链接或外部写入方。`persistent`、`ref()` 和 `unref()` 保留 Node API，但浏览器没有引用计数事件循环，因此这些接口不能控制 dedicated Worker 的生存期。
 - **Worker confinement 是 VFS 边界，不是内核 Landlock**：`read-only` 和 `workspace-write` 运行未经修改的 `@deepseek-ai/node-addon-system/landlock-run` JavaScript 与 launcher argv，进程层则实现逻辑 `landlock-run` 可执行文件，并在 shell 的每次文件系统请求上执行其授权。`full` 仅覆盖 Worker 命令表和已挂载 VFS，不表示能够执行任意 native 进程，也不表示 Linux 内核隔离。
 - **worker 束钉住了 `@yarnpkg/parsers` 的包内路径**——构建解析到该包自己的 `lib/shell.js` 而非包根，因为包根 barrel 还 re-export 了 Syml 解析器，会把 js-yaml 拖进一个从不解析该格式的束（约 175 kB，外加 worker 启动时的模块体求值）。该路径由包 manifest 派生，包内布局一变即构建期失败、不会静默退回 barrel；升级这个依赖时须复核 shell 解析器是否仍在那里。

package/lib/client.js

@@ -1,3 +1,4 @@
+import { applyIndexInjections } from "@deepseek-ai/dsh-client-web/injections";
 //#region src/image-layout.ts
 /**
 * Leaf name of the packed base image: one gzip member holding the ustar archive.
@@ -178,7 +179,7 @@ var WorkerTunnel = class {
 				kind: "carrier",
 				message: `web-preview tunnel: worker failed: ${event.message}`
 			}, { cause: reason });
-			for (const inbox of this.logicalStreams.values()) inbox.fail(failure);
+			for (const { inbox } of this.logicalStreams.values()) inbox.fail(failure);
 			this.logicalStreams.clear();
 			for (const release of this.releases.values()) release();
 			this.releases.clear();
@@ -234,19 +235,24 @@ var WorkerTunnel = class {
 	* @param endpoint - canonical Gateway Remote endpoint.
 	* @param payload - decoded endpoint payload.
 	* @param signal - logical-stream cancellation.
+	* @param uplink - the stream's uplink, posted as `stream-uplink-item` frames and closed with `stream-uplink-end`.
 	* @returns decoded stream values from the worker Host.
 	*/
-	async *open(endpoint, payload, signal) {
+	async *open(endpoint, payload, signal, uplink) {
 		signal.throwIfAborted();
 		const id = this.nextId++;
 		const inbox = new LogicalStreamInbox();
+		const stream = {
+			inbox,
+			pump: void 0
+		};
 		let opened = false;
 		let terminal = false;
 		const onAbort = () => {
 			inbox.fail(signal.reason);
 		};
 		signal.addEventListener("abort", onAbort, { once: true });
-		this.logicalStreams.set(id, inbox);
+		this.logicalStreams.set(id, stream);
 		this.inFlight.set(id, `STREAM ${endpoint}`);
 		try {
 			const frame = {
@@ -264,6 +270,7 @@ var WorkerTunnel = class {
 					message: `web-preview tunnel: failed to open Remote stream ${endpoint}`
 				}, { cause });
 			}
+			if (uplink !== void 0) stream.pump = this.pumpUplink(id, uplink, signal, inbox);
 			while (true) {
 				const response = await inbox.next();
 				signal.throwIfAborted();
@@ -279,8 +286,67 @@ var WorkerTunnel = class {
 			signal.removeEventListener("abort", onAbort);
 			this.logicalStreams.delete(id);
 			this.inFlight.delete(id);
+			stream.pump?.stop();
 			if (opened && !terminal) this.abortWorkerOperation(id);
+			if (stream.pump !== void 0) await stream.pump.done;
+		}
+	}
+	/**
+	* Post the caller's uplink items for one logical stream. A failing uplink
+	* fails the downlink, and the enclosing `open` then aborts the worker side.
+	* `stop()` interrupts a pump blocked on `uplink.next()` and returns the
+	* caller's iterator at once, so a handle's queue closes and `send()` throws
+	* from then on; a generator blocked in `next()` completes that return only
+	* once it yields, so it is not awaited.
+	*/
+	pumpUplink(id, uplink, signal, inbox) {
+		const interrupt = Promise.withResolvers();
+		const iterator = uplink[Symbol.asyncIterator]();
+		const state = {
+			active: true,
+			released: false
+		};
+		const release = () => {
+			if (state.released) return;
+			state.released = true;
+			Promise.resolve(iterator.return?.()).catch(() => void 0);
+		};
+		return {
+			done: this.forwardUplink(id, iterator, interrupt.promise, () => state.active && !signal.aborted).then((exhausted) => {
+				state.released ||= exhausted;
+			}, (error) => {
+				inbox.fail(error);
+			}).then(release),
+			stop: () => {
+				state.active = false;
+				interrupt.resolve({
+					value: void 0,
+					done: true
+				});
+				release();
+			}
+		};
+	}
+	/**
+	* Post items until the caller's iterator ends, the pump is stopped, or the page aborts the stream.
+	* @returns whether the caller's iterator was exhausted and the uplink end posted.
+	*/
+	async forwardUplink(id, iterator, interrupt, isActive) {
+		for (;;) {
+			const next = await Promise.race([iterator.next(), interrupt]);
+			if (!isActive()) return false;
+			if (next.done === true) break;
+			this.worker.postMessage({
+				t: "stream-uplink-item",
+				id,
+				value: next.value
+			});
 		}
+		this.worker.postMessage({
+			t: "stream-uplink-end",
+			id
+		});
+		return true;
 	}
 	/**
 	* Read the pre-cordis boot payload (the injection table).
@@ -297,7 +363,8 @@ var WorkerTunnel = class {
 	* The image packs each bundle with a trailing `sourceURL` naming its image
 	* path, so the blob shows under that name in the debugger instead of as an
 	* anonymous blob entry.
-	* @param url - Graph combo URL (`/plugins/??<id>/client.js&rev=...`).
+	* @param url - Graph combo reference (`plugins/??<id>/client.js&rev=...`), which
+	* this tunnel resolves against the page origin it maps from.
 	*/
 	async loadBundle(url) {
 		const response = await this.fetch(url);
@@ -473,52 +540,18 @@ var WorkerTunnel = class {
 			}
 			case "stream-item":
 			case "stream-end":
-			case "stream-error":
-				this.logicalStreams.get(frame.id)?.push(frame);
+			case "stream-error": {
+				const stream = this.logicalStreams.get(frame.id);
+				if (stream === void 0) return;
+				stream.inbox.push(frame);
+				if (frame.t !== "stream-item") stream.pump?.stop();
 				return;
+			}
 			default: throw new Error(`web-preview tunnel: unknown frame ${JSON.stringify(frame)}`);
 		}
 	}
 };
 //#endregion
-//#region src/client/apply-injections.ts
-function assertNever(row) {
-	throw new Error(`webworker-runtime: unknown index injection row ${JSON.stringify(row)}`);
-}
-/**
-* Execute every row in table order.
-* @param rows - Injection table from the boot payload.
-* @param loadScript - Executes one script-src row; the tunnel's `loadBundle`,
-* because the row URLs (`/plugins/...`) resolve only through the worker.
-*/
-async function applyIndexInjections(rows, loadScript) {
-	for (const row of rows) switch (row.kind) {
-		case "global":
-			globalThis[row.name] = row.value;
-			break;
-		case "script": {
-			const el = document.createElement("script");
-			el.textContent = row.text;
-			(row.placement === "head" ? document.head : document.body).append(el);
-			break;
-		}
-		case "script-src":
-			await loadScript(row.src);
-			break;
-		case "script-preload": break;
-		case "style": {
-			const el = document.createElement("style");
-			el.textContent = row.text;
-			document.head.append(el);
-			break;
-		}
-		case "html":
-			(row.placement === "head" ? document.head : document.body).insertAdjacentHTML("beforeend", row.html);
-			break;
-		default: assertNever(row);
-	}
-}
-//#endregion
 //#region src/client/source-chooser.ts
 /** Pre-boot filesystem-source chooser for static WebWorker previews. */
 const EMPTY_SOURCE = "none";
@@ -833,7 +866,7 @@ async function connectWorkerHost(worker, options) {
 		const payload = await tunnel.bootPayload();
 		globalThis.__DSH_TRANSPORT__ = {
 			fetch: (input, init) => tunnel.fetch(input, init),
-			openStream: (endpoint, payload, signal) => tunnel.open(endpoint, payload, signal),
+			openStream: (endpoint, payload, signal, uplink) => tunnel.open(endpoint, payload, signal, uplink),
 			loadBundle: (url) => tunnel.loadBundle(url),
 			ownsHost: true
 		};

package/lib/index.js

@@ -107,6 +107,15 @@ function parseInboundFrame(data) {
 		t: "abort",
 		id
 	};
+	if (frame.t === "stream-uplink-end") return {
+		t: "stream-uplink-end",
+		id
+	};
+	if (frame.t === "stream-uplink-item") return {
+		t: "stream-uplink-item",
+		id,
+		value: frame.value
+	};
 	if (frame.t === "stream-open") {
 		if (typeof frame.endpoint !== "string" || frame.endpoint.length === 0) throw new Error(`webworker tunnel: stream ${String(id)} needs a non-empty endpoint`);
 		return {
@@ -725,13 +734,17 @@ const MODULE_PROXIES = {
 	"dns/promises": "./node/builtin_modules/mock/dns/promises.ts",
 	"node:net": "./node/builtin_modules/mock/net.ts",
 	"node:stream": "./node/builtin_modules/implemented/stream.ts",
+	"node:stream/promises": "./node/builtin_modules/implemented/stream/promises.ts",
+	"stream/promises": "./node/builtin_modules/implemented/stream/promises.ts",
 	"node:vm": "./node/builtin_modules/mock/vm.ts",
 	"node:worker_threads": "./node/builtin_modules/mock/worker_threads.ts",
 	"node:sqlite": "./node/builtin_modules/mock/sqlite.ts",
+	"@deepseek-ai/libreoffice-kit": "./node/external_packages/libreoffice-kit.ts",
 	"@deepseek-ai/node-addon-system/flock": "./node/external_packages/node-addon-system-flock.ts",
 	"koffi": "./node/external_packages/koffi.ts",
 	"sharp": "./node/external_packages/sharp.ts",
 	"node-pty": "./node/external_packages/node-pty.ts",
+	"execa": "./node/external_packages/execa.ts",
 	"@vscode/ripgrep": "./node/external_packages/ripgrep.ts",
 	"@earendil-works/pi-ai": "./node/external_packages/pi-ai.ts",
 	"ws": "./node/external_packages/ws.ts"
@@ -750,9 +763,11 @@ const MODULE_PROXY_PREFIXES = { "@earendil-works/pi-ai/": "./node/external_packa
 const REPLACED_EXTERNAL_PACKAGES = [
 	"@earendil-works/pi-ai",
 	"@vscode/ripgrep",
+	"@deepseek-ai/libreoffice-kit",
 	"@deepseek-ai/node-addon-system/flock",
 	"koffi",
 	"node-pty",
+	"execa",
 	"sharp",
 	"ws"
 ];
@@ -1515,6 +1530,61 @@ var BufferedSink = class {
 		for (const call of this.calls.splice(0)) call();
 	}
 };
+/** Uplink items of one worker-local logical stream, read once by the Host method as its `uplink`. */
+var TunnelUplink = class {
+	items = [];
+	ended = false;
+	closed = false;
+	wake;
+	push(value) {
+		if (this.ended || this.closed) return;
+		this.items.push(value);
+		this.signal();
+	}
+	/** Page half-close or stream end; buffered items still drain. */
+	end() {
+		this.ended = true;
+		this.signal();
+	}
+	[Symbol.asyncIterator]() {
+		return this;
+	}
+	async next() {
+		while (true) {
+			if (this.closed) return {
+				value: void 0,
+				done: true
+			};
+			if (this.items.length > 0) return {
+				value: this.items.shift(),
+				done: false
+			};
+			if (this.ended) return {
+				value: void 0,
+				done: true
+			};
+			if (this.wake !== void 0) throw new Error("webworker tunnel: stream uplink has one pending read");
+			await new Promise((resolve) => {
+				this.wake = resolve;
+			});
+		}
+	}
+	/** The Host stopped reading: buffered and later items are dropped. */
+	return() {
+		this.closed = true;
+		this.items.length = 0;
+		this.signal();
+		return Promise.resolve({
+			value: void 0,
+			done: true
+		});
+	}
+	signal() {
+		const wake = this.wake;
+		this.wake = void 0;
+		wake?.();
+	}
+};
 /** One tunnel per worker; wire {@link TunnelServer.handleMessage} to `onmessage` first. */
 var TunnelServer = class {
 	port;
@@ -1523,6 +1593,8 @@ var TunnelServer = class {
 	unaryApiLane;
 	queue = [];
 	inFlight = /* @__PURE__ */ new Map();
+	/** Uplinks of accepted `stream-open` frames, buffering items that arrive before or while the stream serves. */
+	uplinks = /* @__PURE__ */ new Map();
 	seams;
 	failure;
 	listener;
@@ -1539,9 +1611,18 @@ var TunnelServer = class {
 	handleMessage(data) {
 		const frame = parseInboundFrame(data);
 		if (frame.t === "init") throw new Error("webworker tunnel: duplicate init frame; the tunnel is already open");
+		if (frame.t === "stream-uplink-item") {
+			this.uplinks.get(frame.id)?.push(frame.value);
+			return;
+		}
+		if (frame.t === "stream-uplink-end") {
+			this.uplinks.get(frame.id)?.end();
+			return;
+		}
 		if (frame.t === "abort") {
 			this.inFlight.get(frame.id)?.abort();
 			this.inFlight.delete(frame.id);
+			this.dropUplink(frame.id);
 			const queued = this.queue.findIndex((request) => request.id === frame.id);
 			if (queued !== -1) this.queue.splice(queued, 1);
 			return;
@@ -1550,6 +1631,7 @@ var TunnelServer = class {
 			this.refuse(frame, this.failure);
 			return;
 		}
+		if (frame.t === "stream-open") this.uplinks.set(frame.id, new TunnelUplink());
 		if (this.seams === void 0) {
 			this.queue.push(frame);
 			return;
@@ -1580,6 +1662,7 @@ var TunnelServer = class {
 	}
 	refuse(frame, message) {
 		if (frame.t === "stream-open") {
+			this.dropUplink(frame.id);
 			this.send({
 				t: "stream-error",
 				id: frame.id,
@@ -1610,12 +1693,13 @@ var TunnelServer = class {
 			return;
 		}
 		const seams = this.seams;
+		const uplink = this.uplinks.get(frame.id) ?? new TunnelUplink();
 		const controller = new AbortController();
 		this.inFlight.set(frame.id, { abort: () => {
 			controller.abort();
 		} });
 		try {
-			const source = await seams.openStream(frame.endpoint, frame.payload, controller.signal);
+			const source = await seams.openStream(frame.endpoint, frame.payload, uplink, controller.signal);
 			for await (const value of source) {
 				if (controller.signal.aborted) return;
 				this.send({
@@ -1642,8 +1726,15 @@ var TunnelServer = class {
 			}
 		} finally {
 			this.inFlight.delete(frame.id);
+			this.dropUplink(frame.id);
 		}
 	}
+	/** The stream is over: settle any Host read still waiting on its uplink and stop buffering. */
+	dropUplink(id) {
+		const uplink = this.uplinks.get(id);
+		this.uplinks.delete(id);
+		uplink?.end();
+	}
 	sinkFor(id) {
 		const send = this.send.bind(this);
 		const inFlight = this.inFlight;
@@ -3282,8 +3373,10 @@ function createWorkerHost(options) {
 			const require = loader.requireFrom(dirname(configPath));
 			const appBoot = require("@deepseek-ai/dsh-app-boot");
 			const cmdline = require("@deepseek-ai/dsh-cmdline");
-			const { patches, presetOverlay } = bootPatches(loader, mounted, configPath, root);
-			const ctx = await appBoot.boot("dsh-webworker", configPath, patches, (hostCtx) => {
+			const { patches, profile } = bootPatches(loader, mounted, configPath, root);
+			const profileConfig = join(profile.dir, "cordis.yml");
+			const ctx = await appBoot.boot("dsh-webworker", profileConfig, patches, (hostCtx) => {
+				hostCtx.provide("profileContext", profile);
 				hostCtx.loader.internal = loader.internal;
 				installLogSink(hostCtx, require);
 				cmdline.provideCmdline(hostCtx, {
@@ -3306,11 +3399,11 @@ function createWorkerHost(options) {
 			if (typertGateway === void 0) throw new Error("webworker host: the tree activated without a typertGateway service");
 			const handler = connection.createSharedFetchHandler("/api");
 			const usage = loader.usage();
-			console.info(`webworker host: tree active (modules=${String(usage.modules)}, data overlays=${String(overlays.length)}, preset root overlay=${presetOverlay ? "applied" : "already in roster"}, direct lane=connection.createSharedFetchHandler, als causality=${options.alsCausality === void 0 ? "inert" : "snapshot/restore"}, image lowering=${LOWERING_VERSION})`);
+			console.info(`webworker host: tree active (modules=${String(usage.modules)}, data overlays=${String(overlays.length)}, direct lane=connection.createSharedFetchHandler, als causality=${options.alsCausality === void 0 ? "inert" : "snapshot/restore"}, image lowering=${LOWERING_VERSION})`);
 			tunnel.serve({
 				directFetch: (request) => handler.fetch(request),
 				bootPayload: () => readBootPayload(ctx),
-				openStream: typertGateway.wireStream.open,
+				openStream: (endpoint, payload, uplink, signal) => typertGateway.wireStream.open(endpoint, payload, uplink, void 0, signal),
 				streamFailure: typertGateway.wireStream.failure
 			});
 		} catch (reason) {
@@ -3382,30 +3475,22 @@ function requireLoweredImage(vfs, path) {
 	if (lowered !== "dsh-worker-transform/1") throw new Error(`webworker host: image was lowered by ${String(lowered)}, this build runs ${LOWERING_VERSION}; rebuild the image`);
 }
 /**
-* The shipped preset root, as the application layer that owns the composition
-* supplies it.
-*
-* A launcher appends this root itself rather than writing it into the roster —
-* `apps/cli` does it in `composeProfile` (`profile-boot.ts:159-166`) because only
-* the application knows where its own presets sit. The worker's presets travel
-* in the image, so the same overlay names their virtual path. Patching replaces
-* a row's whole `config`, so the current one is read and spread, and a roster
-* that already names roots keeps them.
+* Prepare an editable VFS profile from the packed rows and deployment overlays.
+* ConfigEditor writes overrides beside the insertion rows; reconciliation starts
+* at the empty profile root and retains the Worker deployment overlays.
 * @param loader - Module loader, for the image's YAML reader.
 * @param vfs - Filesystem holding the composed configuration.
 * @param configPath - Composed configuration path.
 * @param root - Virtual root.
-* @returns Boot patches (preset root overlay, frontend serving off) and
-* whether the preset overlay was applied.
+* @returns Profile locations and effective boot patches.
 */
 function bootPatches(loader, vfs, configPath, root) {
 	const text = vfs.readFileSync(configPath, "utf8");
+	const include = loader.load(loader.resolve("@deepseek-ai/cordis-plugin-include", root));
+	const yaml = loader.load(loader.resolve("js-yaml", root));
 	let rows;
 	if (configPath.endsWith(".json")) rows = JSON.parse(text);
-	else {
-		const include = loader.load(loader.resolve("@deepseek-ai/cordis-plugin-include", root));
-		rows = loader.load(loader.resolve("js-yaml", root)).load(text, { schema: include.entryListSchema });
-	}
+	else rows = yaml.load(text, { schema: include.entryListSchema });
 	const find = (entries, id) => {
 		if (!Array.isArray(entries)) return void 0;
 		for (const entry of entries) {
@@ -3416,21 +3501,10 @@ function bootPatches(loader, vfs, configPath, root) {
 	};
 	const configOf = (row) => typeof row.config === "object" && row.config !== null && !Array.isArray(row.config) ? row.config : {};
 	const patches = [];
-	let presetOverlay = false;
-	const presets = find(rows, "agent-presets");
-	if (presets !== void 0 && configOf(presets).roots === void 0) {
-		presetOverlay = true;
-		patches.push({
-			id: "agent-presets",
-			config: {
-				...configOf(presets),
-				roots: [{
-					path: join(root, "config/agent-presets"),
-					trust: "system"
-				}]
-			}
-		});
-	}
+	for (const id of ["hmr", "plugin-manager"]) if (find(rows, id) !== void 0) patches.push({
+		id,
+		disabled: true
+	});
 	const jsonl = find(rows, "session-persistence-jsonl");
 	if (jsonl !== void 0) patches.push({
 		id: "session-persistence-jsonl",
@@ -3439,9 +3513,24 @@ function bootPatches(loader, vfs, configPath, root) {
 			compression: "none"
 		}
 	});
+	const dir = join(root, IMAGE_HOME_DIRECTORY, "profiles/preview");
+	const profile = {
+		name: "preview",
+		dir,
+		patchPath: join(dir, "cordis.patch.yml"),
+		installAnchor: join(dir, "package.json"),
+		cwd: root,
+		home: join(root, IMAGE_HOME_DIRECTORY),
+		startedBundles: [],
+		overlays: patches,
+		telemetryDisabledEnv: void 0
+	};
+	vfs.seed(join(dir, "package.json"), "{\"private\":true,\"dsh\":{\"profile\":{\"bundles\":[]}}}\n");
+	vfs.seed(join(dir, "cordis.yml"), "[]\n");
+	if (!vfs.existsSync(profile.patchPath)) vfs.seed(profile.patchPath, yaml.dump([{ insert: rows }], { schema: include.entryListSchema }));
 	return {
-		patches,
-		presetOverlay
+		patches: loader.load(loader.resolve("@deepseek-ai/dsh-app-boot", root)).readProfilePatches("dsh-webworker", profile),
+		profile
 	};
 }
 /**

package/lib/types/client/apply-injections.d.ts

@@ -1,15 +1,3 @@
-/**
- * Page-side interpreter for the structured index injection table. The served
- * form renders the same rows into index.html text; a static worker page has
- * no served HTML, so it executes the table directly. Rows execute strictly in
- * table order, so a global row lands before the scripts that read it.
- */
-import type { IndexInjection } from '@deepseek-ai/dsh-host-webserver';
-/**
- * Execute every row in table order.
- * @param rows - Injection table from the boot payload.
- * @param loadScript - Executes one script-src row; the tunnel's `loadBundle`,
- * because the row URLs (`/plugins/...`) resolve only through the worker.
- */
-export declare function applyIndexInjections(rows: readonly IndexInjection[], loadScript: (src: string) => Promise<void>): Promise<void>;
+/** Shared page-side interpreter for asynchronous Host startup. */
+export { applyIndexInjections } from '@deepseek-ai/dsh-client-web/injections';
 //# sourceMappingURL=apply-injections.d.ts.map

package/lib/types/client/client.d.ts

@@ -48,9 +48,24 @@ export declare class WorkerTunnel {
      * @param endpoint - canonical Gateway Remote endpoint.
      * @param payload - decoded endpoint payload.
      * @param signal - logical-stream cancellation.
+     * @param uplink - the stream's uplink, posted as `stream-uplink-item` frames and closed with `stream-uplink-end`.
      * @returns decoded stream values from the worker Host.
      */
-    open(endpoint: string, payload: unknown, signal: AbortSignal): AsyncGenerator;
+    open(endpoint: string, payload: unknown, signal: AbortSignal, uplink?: AsyncIterable<unknown>): AsyncGenerator;
+    /**
+     * Post the caller's uplink items for one logical stream. A failing uplink
+     * fails the downlink, and the enclosing `open` then aborts the worker side.
+     * `stop()` interrupts a pump blocked on `uplink.next()` and returns the
+     * caller's iterator at once, so a handle's queue closes and `send()` throws
+     * from then on; a generator blocked in `next()` completes that return only
+     * once it yields, so it is not awaited.
+     */
+    private pumpUplink;
+    /**
+     * Post items until the caller's iterator ends, the pump is stopped, or the page aborts the stream.
+     * @returns whether the caller's iterator was exhausted and the uplink end posted.
+     */
+    private forwardUplink;
     /**
      * Read the pre-cordis boot payload (the injection table).
      * @returns The payload the page applies before the client tree loads.
@@ -62,7 +77,8 @@ export declare class WorkerTunnel {
      * The image packs each bundle with a trailing `sourceURL` naming its image
      * path, so the blob shows under that name in the debugger instead of as an
      * anonymous blob entry.
-     * @param url - Graph combo URL (`/plugins/??<id>/client.js&rev=...`).
+     * @param url - Graph combo reference (`plugins/??<id>/client.js&rev=...`), which
+     * this tunnel resolves against the page origin it maps from.
      */
     loadBundle(url: string): Promise<void>;
     private rejectOnAbort;