@deepseek-ai/dsh-web-app 0.1.0-rc.7 → 0.1.1-rc.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/web-app/README.md
-README.md: 90d1566b5a7a25f6a827079c4a8ab776e05cc7a3
-README.zh.md: b7156bcab66b53964bb2f0e1c87d9e9a806e3f75
+README.md: c8a6874bc01696fc7c9ca65faf772da81ac1e964
+README.zh.md: cb58177daa9eb166e29e4169409bbc6a558437e0

package/README.md

@@ -2,7 +2,11 @@
 
 English | [中文](README.zh.md)
 
-The dsh browser-surface bundle. [`cordis.patch.yml`](cordis.patch.yml) rides over [`dsh-base`](../base/README.md): it sets the coding persona, inserts the Web host rows (webserver, API gateway, workspace, projection cache, storage) and the browser plugin roster, the always-on client-plugin reload chain ([`dsh-client-hmr`](../../client/hmr/README.md), idle until a rebuild watcher rewrites client bundles), and mounts this package's `web-runtime` glue plugin (config `{printUrl, surfaceContext, trustedHosts}`). That plugin resolves the built frontend dist through `@deepseek-ai/dsh-web-frontend`'s exports, samples bind-dependent LAN trust once, provides it as `webRuntime` to the browser-trust fence and client roster, mounts the [`frontend-static`](../../host/frontend-static/README.md) fallback owner, registers the harness-source and web-surface prompt sections plus the bash-visible `DSH_WEB_URL` runtime variable when `surfaceContext` is true, and prints the `dsh web:` URL line when `printUrl` is true, after its Loader tree settles so a sibling failure cannot announce a dead app. This bundle also owns the app command line: the ordinary `web-startup` provider ([`src/startup.ts`](src/startup.ts)) injects `ctx.cmdlineArgs` ([`dsh-cmdline`](../../boot/cmdline/README.md)), parses `--host`, `--port`, repeatable `--trusted-host`, and the app's `--help`, then provides `webStartup`. It rejects `--host 0.0.0.0` before publishing that service because the CLI intentionally does not support all-interfaces binding yet. Flag-configured rows inject the service and read it directly from lazy config, so nothing binds a port before argument resolution and `dsh --profile web --help` starts no server. [`dsh-headless`](../headless/README.md) is a sibling surface over the same base and does not mount this bundle.
+The dsh browser-surface bundle. [`cordis.patch.yml`](cordis.patch.yml) rides over [`dsh-base`](../base/README.md): it sets the coding persona, inserts the Web host rows (webserver, API gateway, workspace, projection cache, storage) and the browser plugin roster, the always-on client-plugin reload chain ([`dsh-client-hmr`](../../client/hmr/README.md), idle until a rebuild watcher rewrites client bundles), and mounts this package's `web-runtime` glue plugin (config `{openBrowser, printUrl, surfaceContext, trustedHosts}`). That plugin resolves the built frontend dist through `@deepseek-ai/dsh-web-frontend`'s exports, samples bind-dependent LAN trust once, provides it as `webRuntime` to the browser-trust fence and client roster, mounts the [`frontend-static`](../../host/frontend-static/README.md) fallback owner, and registers the harness-source and web-surface prompt sections plus the bash-visible `DSH_WEB_URL` runtime variable when `surfaceContext` is true. After its Loader tree settles, it prints the `dsh web:` URL line when `printUrl` is true and opens the canonical host URL in the default browser when `openBrowser` is true and the inherited `SSH_CONNECTION` and `SSH_TTY` are blank or absent. An SSH launch keeps the URL line but suppresses browser handoff because the SSH client or editor owns the local forwarded address. Immediately before a handoff, the runtime prints `dsh web: opening the default browser; pass --no-open to disable`. A short-lived Node helper runs the maintained platform opener with the canonical scrubbed child environment. On Windows it stays alive until the short-lived PowerShell launcher exits, because `open` reports spawn before that launcher has handed the URL to the shell; elsewhere the helper stops after the opener accepts spawn. A helper failure writes a diagnostic with its reason and the manual URL to stderr without stopping the server, and no path waits for the browser to exit. This bundle also owns the app command line: the ordinary `web-startup` provider ([`src/startup.ts`](src/startup.ts)) injects `ctx.cmdlineArgs` ([`dsh-cmdline`](../../boot/cmdline/README.md)), parses `--host`, `--port`, repeatable `--trusted-host`, `--no-open`, and the app's `--help`, then provides `webStartup`; browser opening defaults on for local launches, and `--no-open` turns it off for this invocation. It rejects `--host 0.0.0.0` before publishing that service because the CLI intentionally does not support all-interfaces binding yet. Flag-configured rows inject the service and read it directly from lazy config, so nothing binds a port before argument resolution and `dsh --profile web --help` starts no server. [`dsh-headless`](../headless/README.md) is a sibling surface over the same base and does not mount this bundle.
+
+## Model retry defaults
+
+Web uses the shared bounded normal default of five eligible retries after the initial request. The `deepseek-official` route and settings-added pi-ai routes use that default when they omit `retryPolicy`; explicit provider policies still win. Web adds no retry-specific composition override, so the same omission behavior applies to non-Web profiles.
 
 ## Model Experience
 
@@ -24,3 +28,6 @@ The prompt section sits near the system prompt's head and is stable for the life
 
 - **The frontend dist must be built** — `require.resolve` of the dist fails loud at activation with a build hint; there is no source-serving fallback.
 - **`lanAddresses` is a boot-time snapshot** — interface changes after boot are not re-advertised; the printed LAN URL always matches the configured trust fence.
+- **Only handoff startup is observable** — observation ends when the platform opener accepts spawn, except that Windows waits for its short-lived PowerShell launcher to exit; a later browser exit is not reported, and the printed URL remains the manual fallback.
+- **SSH forwarding owns the browser URL** — the printed canonical URL names the remote host's loopback endpoint; automatic handoff is suppressed, and the SSH client or editor must expose and open its local forwarded address.
+- **Browser command overrides are launch-only** — a discovered `.env` may not set `BROWSER`; only an inherited value may reach an opener path that honors the variable, so a checkout cannot choose an executable for automatic handoff.

package/README.zh.md

@@ -2,7 +2,11 @@
 
 [English](README.md) | 中文
 
-dsh 浏览器表层组合包。[`cordis.patch.yml`](cordis.patch.yml) 叠加在 [`dsh-base`](../base/README.md) 之上：设置 coding persona，插入 Web 宿主行（webserver、API 网关、workspace、投影缓存、存储）、浏览器插件名录与始终挂载的客户端插件重载链（[`dsh-client-hmr`](../../client/hmr/README.md)，在重建 watcher 改写客户端 bundle 之前保持空闲），并挂载本包的 `web-runtime` 粘合插件（配置为 `{printUrl, surfaceContext, trustedHosts}`）。该插件通过 `@deepseek-ai/dsh-web-frontend` 的 exports 解析已构建的前端 dist，只采样一次依赖 bind 的 LAN 信任信息并将其作为 `webRuntime` 提供给浏览器信任栅栏和客户端名录，挂载 [`frontend-static`](../../host/frontend-static/README.md) 回退席位所有者，在 `surfaceContext` 为 true 时注册 Harness 源码与 Web 表层提示词段落，以及 bash 可见的 `DSH_WEB_URL` 运行时变量，并在 `printUrl` 为 true 时等自身的 Loader 配置树结算后再打印 `dsh web:` URL 行，避免兄弟行失败时公告一个已失效的应用。本组合包还持有应用命令行：普通 `web-startup` 提供方（[`src/startup.ts`](src/startup.ts)）注入 `ctx.cmdlineArgs`（[`dsh-cmdline`](../../boot/cmdline/README.md)），解析 `--host`、`--port`、可重复的 `--trusted-host` 以及应用自己的 `--help`，再提供 `webStartup`。它会在发布该服务前拒绝 `--host 0.0.0.0`，因为 CLI 目前有意不支持绑定所有网络接口。由 flag 配置的行会注入该服务，并在惰性配置中直接读取它，因此参数解析完成前不会有任何东西绑定端口，`dsh --profile web --help` 也不会启动服务器。[`dsh-headless`](../headless/README.md) 是同一 base 之上的同级表层，不挂载本组合包。
+dsh 浏览器表层组合包。[`cordis.patch.yml`](cordis.patch.yml) 叠加在 [`dsh-base`](../base/README.zh.md) 之上：设置 coding persona，插入 Web 宿主行（webserver、API 网关、workspace、投影缓存、存储）、浏览器插件名录与始终挂载的客户端插件重载链（[`dsh-client-hmr`](../../client/hmr/README.zh.md)，在重建 watcher 改写客户端 bundle 之前保持空闲），并挂载本包的 `web-runtime` 粘合插件（配置为 `{openBrowser, printUrl, surfaceContext, trustedHosts}`）。该插件通过 `@deepseek-ai/dsh-web-frontend` 的 exports 解析已构建的前端 dist，只采样一次依赖 bind 的 LAN 信任信息并将其作为 `webRuntime` 提供给浏览器信任栅栏和客户端名录，挂载 [`frontend-static`](../../host/frontend-static/README.zh.md) 回退席位所有者，并在 `surfaceContext` 为 true 时注册 Harness 源码与 Web 表层提示词段落，以及 bash 可见的 `DSH_WEB_URL` 运行时变量。自身 Loader 配置树结算后，它在 `printUrl` 为 true 时打印 `dsh web:` URL 行；`openBrowser` 为 true 且继承的 `SSH_CONNECTION` 与 `SSH_TTY` 均为空或不存在时，才会用默认浏览器打开规范宿主机 URL。SSH 启动仍保留 URL 行，但会跳过浏览器交接，因为本地转发地址由 SSH 客户端或编辑器持有。交接前，运行时会打印英文提示 `dsh web: opening the default browser; pass --no-open to disable`。短生命周期 Node helper 使用规范的脱敏子进程环境运行受维护的平台 opener。在 Windows 上，helper 会保持存活，直至短生命周期的 PowerShell launcher 退出，因为 `open` 会在 launcher 把 URL 交给 shell 之前、仅在 spawn 时返回；其他平台则在 opener 接受 spawn 后结束。helper 失败时会向 stderr 写入包含原因和手动访问 URL 的诊断，不会停止服务器，且任何路径都不会等待浏览器退出。本组合包还持有应用命令行：普通 `web-startup` 提供方（[`src/startup.ts`](src/startup.ts)）注入 `ctx.cmdlineArgs`（[`dsh-cmdline`](../../boot/cmdline/README.zh.md)），解析 `--host`、`--port`、可重复的 `--trusted-host`、`--no-open` 以及应用自己的 `--help`，再提供 `webStartup`；本机启动默认会打开浏览器，`--no-open` 则只对本次调用关闭该行为。它会在发布该服务前拒绝 `--host 0.0.0.0`，因为 CLI 目前有意不支持绑定所有网络接口。由 flag 配置的行会注入该服务，并在惰性配置中直接读取它，因此参数解析完成前不会有任何东西绑定端口，`dsh --profile web --help` 也不会启动服务器。[`dsh-headless`](../headless/README.zh.md) 是同一 base 之上的同级表层，不挂载本组合包。
+
+## 模型重试默认值
+
+Web 使用共享的有界 normal 默认值，在首次请求后最多再重试五次符合条件的失败。`deepseek-official` 与由 settings 新增的 pi-ai 路由在省略 `retryPolicy` 时使用该默认值；显式提供方策略仍然优先。Web 不再增加重试专用的组合覆盖，因此非 Web profile 的省略行为与之相同。
 
 ## 模型体验
 
@@ -24,3 +28,6 @@ dsh 浏览器表层组合包。[`cordis.patch.yml`](cordis.patch.yml) 叠加在
 
 - **前端 dist 必须已构建**：对 dist 的 `require.resolve` 在激活时明确报错并给出构建提示；没有从源码直接服务的回退路径。
 - **`lanAddresses` 是启动期快照**：启动后的网卡变化不会重新公告；打印的 LAN URL 始终与配置的信任栅栏一致。
+- **只观测交接启动**：平台 opener 接受 spawn 后即结束观察，但 Windows 会等待其短生命周期 PowerShell launcher 退出；之后的浏览器退出不会上报，已打印 URL 仍是手动访问的回退路径。
+- **SSH 转发持有浏览器 URL**：打印出的规范 URL 指向远端宿主机 loopback 端点；自动交接会被跳过，SSH 客户端或编辑器必须暴露并打开其本地转发地址。
+- **浏览器命令覆盖只能来自启动环境**：被发现的 `.env` 不得设置 `BROWSER`；只有继承值可以抵达会读取该变量的 opener 路径，避免 checkout 为自动交接选择可执行文件。

package/cordis.patch.yml

@@ -79,6 +79,12 @@
         writeEveryEvents: 200
         writeIntervalMs: 5000
 
+    - id: session-reference
+      name: '@deepseek-ai/dsh-session-reference'
+
+    - id: file-reference-local
+      name: '@deepseek-ai/dsh-file-reference-local'
+
     # Whole-log turn/step counts for the chat stats strip (the sessionStats
     # projection key); the projection registry itself is a base-layer row.
     - id: session-stats
@@ -122,15 +128,17 @@
     # Web glue owned by this bundle: resolves the built frontend dist (an
     # assembly fact of dsh-web-app, never user config), mounts the
     # frontend-static fallback owner, registers the web-surface prompt
-    # section and the bash runtime variable, and prints the URL line. The
-    # webStartup provider supplies invocation-only values; after the server
-    # binds, this row samples LAN trust once and provides `webRuntime`. A
-    # complete agent-preset persona suppresses the prompt section for that
-    # agent while retaining the host-owned shell variable.
+    # section and the bash runtime variable, prints the URL line, and opens the
+    # canonical local URL after the full tree settles. The webStartup provider
+    # supplies invocation-only values; after the server binds, this row samples
+    # LAN trust once and provides `webRuntime`. A complete agent-preset persona
+    # suppresses the prompt section for that agent while retaining the host-owned
+    # shell variable.
     - id: web-runtime
       name: '@deepseek-ai/dsh-web-app'
       inject: [webStartup]
       config:
+        openBrowser: !!js ctx.webStartup.openBrowser
         printUrl: true
         surfaceContext: true
         trustedHosts: !!js ctx.webStartup.trustedHosts
@@ -180,6 +188,9 @@
     - id: ui-layout
       name: '@deepseek-ai/dsh-client-ui-layout'
 
+    - id: ui-renderer
+      name: '@deepseek-ai/dsh-client-ui-renderer'
+
     - id: ui-sidebar
       name: '@deepseek-ai/dsh-client-ui-sidebar'
 
@@ -198,6 +209,13 @@
     - id: ui-conversation
       name: '@deepseek-ai/dsh-client-ui-conversation'
 
+    # Official occupants for the generic sidebar and conversation brand slots.
+    - id: ui-brand-official
+      name: '@deepseek-ai/dsh-client-ui-brand-official'
+
+    - id: ui-attachment
+      name: '@deepseek-ai/dsh-client-ui-attachment'
+
     # Tool call tree, generic fallback, and keyed business Tool views.
     - id: ui-tool
       name: '@deepseek-ai/dsh-client-ui-tool'
@@ -220,7 +238,7 @@
       name: '@deepseek-ai/dsh-client-ui-workspace'
 
     # Input triggers: the '/' | '@' pipeline (ui-input-trigger), the command surface over
-    # it (ui-commands), and the two reference sources (ui-skill / ui-subagent).
+    # it (ui-commands), and the reference sources (ui-skill / ui-reference).
     - id: ui-input-trigger
       name: '@deepseek-ai/dsh-client-ui-input-trigger'
 
@@ -233,6 +251,9 @@
     - id: ui-subagent
       name: '@deepseek-ai/dsh-client-ui-subagent'
 
+    - id: ui-reference
+      name: '@deepseek-ai/dsh-client-ui-reference'
+
     # Background jobs: the session-header list over the jobsBySession mirror.
     - id: ui-jobs
       name: '@deepseek-ai/dsh-client-ui-jobs'

package/lib/index.js

@@ -1,9 +1,12 @@
 import { createRequire } from "node:module";
+import { spawn } from "node:child_process";
 import { networkInterfaces } from "node:os";
 import { fileURLToPath } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { addHarnessSourceSection } from "@deepseek-ai/dsh-app-boot";
 import * as FrontendStatic from "@deepseek-ai/dsh-host-frontend-static";
+import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
+import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
 //#region lib/types/index.js
 /**
 * @deepseek-ai/dsh-web-app — the browser-surface bundle's runtime glue plugin
@@ -12,8 +15,9 @@ import * as FrontendStatic from "@deepseek-ai/dsh-host-frontend-static";
 * the built frontend dist (workspace knowledge of this bundle, never user
 * config), mounts the `frontend-static` fallback owner over it, registers the
 * harness-source and web-surface prompt sections, the bash-visible web runtime
-* variable, and the URL line. App command-line values arrive through the
-* `webStartup` service expressions in the bundle patch.
+* variable, the URL line, and the default-browser handoff. App command-line
+* values arrive through the `webStartup` service expressions in the bundle
+* patch.
 * @module @deepseek-ai/dsh-web-app
 */
 /** Stable Cordis plugin name. */
@@ -25,6 +29,7 @@ const WEB_RUNTIME_SERVICE = "webRuntime";
 /** Services required before the web runtime can mount. */
 const inject = ["webServer"];
 const Config = z.object({
+	openBrowser: z.boolean().default(true),
 	printUrl: z.boolean().default(true),
 	surfaceContext: z.boolean().default(true),
 	trustedHosts: z.array(String).default([])
@@ -34,6 +39,43 @@ const DSH_WEB_URL = "DSH_WEB_URL";
 const LOOPBACK_HOST = "127.0.0.1";
 /** The webserver schema's all-interfaces bind literal. */
 const ALL_INTERFACES_HOST = "0.0.0.0";
+/** Whether this process was launched through SSH, including a forwarded-port session. */
+function launchedThroughSsh(ctx) {
+	const environment = launchEnvironmentOf(ctx);
+	return ["SSH_CONNECTION", "SSH_TTY"].some((name) => {
+		const value = environment.getFrom(name, ["process"])?.value;
+		return value !== void 0 && value !== "";
+	});
+}
+const BROWSER_OPENER_MODULE = import.meta.resolve("open");
+const BROWSER_OPENER_PROGRAM = `
+try {
+  const { default: open } = await import(${JSON.stringify(BROWSER_OPENER_MODULE)})
+  const launcher = await open(process.argv[1])
+  if (process.platform === 'win32') {
+    // open resolves at PowerShell spawn; keep it referenced until that launcher hands the URL to Windows.
+    const code = launcher.exitCode ?? await new Promise((resolve, reject) => {
+      function onError(error) {
+        launcher.off('close', onClose)
+        reject(error)
+      }
+      function onClose(code) {
+        launcher.off('error', onError)
+        resolve(code)
+      }
+      launcher.ref()
+      launcher.once('error', onError)
+      launcher.once('close', onClose)
+    })
+    if (code !== 0) throw new Error('browser operating-system launcher exited with code ' + String(code))
+  }
+  process.exitCode = 0
+} catch (error) {
+  // The parent turns this exit into the manual-URL warning.
+  console.error(error)
+  process.exitCode = 1
+}
+`;
 /**
 * Resolve one LAN-trust snapshot from the active server bind.
 *
@@ -71,16 +113,65 @@ function resolveDistIndex() {
 		throw new Error("web-app: frontend dist not built; run pnpm run build from the repository root first");
 	}
 }
-/** Test hook: hosts with no built frontend dist substitute the resolver; production never touches this. */
-const internals = { resolveDistIndex };
+/** Start the maintained platform opener without forwarding Harness credentials. */
+function spawnBrowserLauncher(url) {
+	return spawn(process.execPath, [
+		"--input-type=module",
+		"--eval",
+		BROWSER_OPENER_PROGRAM,
+		"--",
+		url
+	], {
+		env: scrubbedParentEnv(),
+		stdio: [
+			"ignore",
+			"inherit",
+			"pipe"
+		]
+	});
+}
+/** Hand one URL to the operating system's default browser. */
+async function openBrowser(url) {
+	const launcher = spawnBrowserLauncher(url);
+	let launcherStderr = "";
+	launcher.stderr?.setEncoding("utf8");
+	launcher.stderr?.on("data", (chunk) => {
+		launcherStderr += chunk;
+	});
+	await new Promise((resolve, reject) => {
+		function onError(error) {
+			launcher.off("close", onClose);
+			reject(error);
+		}
+		function onClose(code) {
+			launcher.off("error", onError);
+			if (code !== 0) {
+				const firstLine = launcherStderr.trim().split(/\r?\n/u)[0];
+				const reason = firstLine === void 0 || firstLine === "" ? `browser launcher exited with code ${String(code)}` : firstLine.replace(/^(?:[A-Za-z]*Error):\s*/u, "");
+				reject(new Error(reason));
+				return;
+			}
+			if (launcherStderr !== "") process.stderr.write(launcherStderr);
+			resolve();
+		}
+		launcher.once("error", onError);
+		launcher.once("close", onClose);
+	});
+}
+/** Test hooks for the built dist and native browser handoff; production never mutates them. */
+const internals = {
+	resolveDistIndex,
+	openBrowser
+};
 /**
 * Mount the Web runtime: dist serving, surface prompt, the bash runtime
-* variable, and the URL line.
+* variable, the URL line, and the default-browser handoff.
 * @param ctx - plugin context carrying the webServer service.
 * @param config - validated {@link Config}.
 */
 function apply(ctx, config) {
 	const runtime = resolveLanTrust(ctx.webServer.host, config.trustedHosts);
+	const handoffBrowser = config.openBrowser && !launchedThroughSsh(ctx);
 	ctx.provide(WEB_RUNTIME_SERVICE, runtime);
 	ctx.plugin(FrontendStatic, { distIndex: internals.resolveDistIndex() });
 	if (config.surfaceContext) {
@@ -100,16 +191,24 @@ function apply(ctx, config) {
 			});
 		});
 	}
-	if (config.printUrl) {
-		const printUrl = () => {
+	if (config.printUrl || handoffBrowser) {
+		const announceReady = () => {
+			const webUrl = localWebUrl(ctx);
 			const lanCandidate = runtime.lanAddresses[0];
 			const port = ctx.webServer.port;
-			console.log(`dsh web: ${localWebUrl(ctx)}${lanCandidate === void 0 ? "" : ` (LAN: http://${lanCandidate}:${String(port)})`}`);
+			if (config.printUrl) console.log(`dsh web: ${webUrl}${lanCandidate === void 0 ? "" : ` (LAN: http://${lanCandidate}:${String(port)})`}`);
+			if (handoffBrowser) {
+				console.log("dsh web: opening the default browser; pass --no-open to disable");
+				internals.openBrowser(webUrl).catch((error) => {
+					const reason = error instanceof Error ? error.message : String(error);
+					console.error(`web-app: could not open the default browser because ${reason}; visit ${webUrl} manually`);
+				});
+			}
 		};
 		const settled = ctx.get("loader")?.await();
-		if (settled === void 0) printUrl();
+		if (settled === void 0) announceReady();
 		else settled.then(() => {
-			if (ctx.get("webServer") !== void 0) printUrl();
+			if (ctx.get("webServer") !== void 0) announceReady();
 		}, () => {});
 	}
 }

package/lib/startup.js

@@ -3,7 +3,7 @@ import { parseCmdline } from "@deepseek-ai/dsh-cmdline";
 //#region lib/types/startup.js
 /**
 * The web app's command-line provider: it parses the `dsh --profile web` flag
-* family (`--host`, `--port`, `--trusted-host`) and its `--help`
+* family (`--host`, `--port`, `--trusted-host`, `--no-open`) and its `--help`
 * text, then provides the immutable values as {@link WEB_STARTUP_SERVICE}.
 * Ordinary rows inject that service before reading it from lazy config.
 * @module @deepseek-ai/dsh-web-app/startup
@@ -19,9 +19,10 @@ const WEB_STARTUP_SERVICE = "webStartup";
 * @returns a fresh program, so one process can parse more than once (tests).
 */
 function webCommand() {
-	return new Command().name("dsh --profile web").description("Serve the DeepSeek Harness browser UI.").helpOption("-h, --help", "show this help").option("--host <host>", "bind host").option("--port <port>", "listen port; pass 0 to let the OS pick a free one").option("--trusted-host <authority...>", "extra authority the /api browser-trust fence accepts (host or host:port; repeatable)").addHelpText("after", `
+	return new Command().name("dsh --profile web").description("Serve the DeepSeek Harness browser UI.").helpOption("-h, --help", "show this help").option("--host <host>", "bind host").option("--no-open", "do not open the Web UI in the default browser").option("--port <port>", "listen port; pass 0 to let the OS pick a free one").option("--trusted-host <authority...>", "extra authority the /api browser-trust fence accepts (host or host:port; repeatable)").addHelpText("after", `
 Examples:
   dsh --profile web                          serve on the composed host and port
+  dsh --profile web --no-open                serve without opening a browser
   dsh --profile web --port 8080              serve on another port
 `);
 }
@@ -39,6 +40,7 @@ function apply(ctx) {
 		if (options.host === "0.0.0.0") program.error("error: --host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead");
 		if (options.port !== void 0 && !/^\d+$/.test(options.port)) program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`);
 		ctx.provide(WEB_STARTUP_SERVICE, {
+			openBrowser: options.open,
 			...options.host !== void 0 && { host: options.host },
 			...options.port !== void 0 && { port: Number(options.port) },
 			trustedHosts: options.trustedHost ?? []

package/lib/types/index.d.ts

@@ -5,8 +5,9 @@
  * the built frontend dist (workspace knowledge of this bundle, never user
  * config), mounts the `frontend-static` fallback owner over it, registers the
  * harness-source and web-surface prompt sections, the bash-visible web runtime
- * variable, and the URL line. App command-line values arrive through the
- * `webStartup` service expressions in the bundle patch.
+ * variable, the URL line, and the default-browser handoff. App command-line
+ * values arrive through the `webStartup` service expressions in the bundle
+ * patch.
  * @module @deepseek-ai/dsh-web-app
  */
 import type { Context } from '@deepseek-ai/cordis';
@@ -17,6 +18,8 @@ export declare const name = "web-app";
 export declare const inject: string[];
 /** Plugin config: composed deployment settings plus per-invocation command-line values. */
 export interface Config {
+    /** Permit default-browser handoff after the Loader tree settles; an SSH launch suppresses it. */
+    openBrowser: boolean;
     /** Print the URL line on activation; a non-interactive layer can turn it off. */
     printUrl: boolean;
     /**
@@ -48,13 +51,14 @@ export interface WebRuntimeValues {
  * @returns the LAN display addresses and invocation-derived fence authorities.
  */
 export declare function resolveLanTrust(bindHost: string, extra: readonly string[]): WebRuntimeValues;
-/** Test hook: hosts with no built frontend dist substitute the resolver; production never touches this. */
+/** Test hooks for the built dist and native browser handoff; production never mutates them. */
 export declare const internals: {
     resolveDistIndex: () => string;
+    openBrowser: (url: string) => Promise<void>;
 };
 /**
  * Mount the Web runtime: dist serving, surface prompt, the bash runtime
- * variable, and the URL line.
+ * variable, the URL line, and the default-browser handoff.
  * @param ctx - plugin context carrying the webServer service.
  * @param config - validated {@link Config}.
  */

package/lib/types/startup.d.ts

@@ -1,6 +1,6 @@
 /**
  * The web app's command-line provider: it parses the `dsh --profile web` flag
- * family (`--host`, `--port`, `--trusted-host`) and its `--help`
+ * family (`--host`, `--port`, `--trusted-host`, `--no-open`) and its `--help`
  * text, then provides the immutable values as {@link WEB_STARTUP_SERVICE}.
  * Ordinary rows inject that service before reading it from lazy config.
  * @module @deepseek-ai/dsh-web-app/startup
@@ -14,6 +14,8 @@ export declare const inject: string[];
 export declare const WEB_STARTUP_SERVICE = "webStartup";
 /** What the web rows read from {@link WEB_STARTUP_SERVICE}. */
 export interface WebStartupValues {
+    /** Whether this invocation opens the default browser after startup. */
+    openBrowser: boolean;
     /** `--host`, absent when the invocation did not name one. */
     host?: string;
     /** `--port`, absent when the invocation did not name one. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-web-app",
   "description": "The dsh browser-surface bundle: the web patch layer over dsh-base plus the runtime glue plugin (frontend dist serving, web-surface prompt, bash runtime variables, URL line)",
-  "version": "0.1.0-rc.7",
+  "version": "0.1.1-rc.1",
   "publishConfig": {
     "access": "public"
   },
@@ -45,77 +45,87 @@
   },
   "dependencies": {
     "commander": "^15.0.0",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-hmr": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-app-boot": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-commands": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-agent-preset": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-modules": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-cordis": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-deliverables": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-directory-picker-browse": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-message-feedback": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-goal": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-directory-picker-native": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-settings-models": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-settings-plugin-inventory": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-permission-presets": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-plan": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-user-questions": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-settings-general": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-skill": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-subagent": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-jobs": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-model-selection": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-layout": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-theme": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-tool": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-workflow-run": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-trajectory": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-code-runtime-worker-thread": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-cordis-client-runner": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-cordis-host-runner": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-workspace": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-cmdline": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-directory-picker-auto": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-directory-picker-browse": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-directory-picker-native": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-plugin-inventory": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-message-feedback": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-projection-cache": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-log-export": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-stats": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-storage": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-storage-json": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-workspace": "^0.1.0-rc.7",
+    "open": "^11.0.0",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-app-boot": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-hmr": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-modules": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-attachment": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-brand-official": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-commands": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-cordis": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-deliverables": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-directory-picker-browse": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-directory-picker-native": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-message-feedback": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-goal": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-model-selection": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugin-inventory": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-permission-presets": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-agent-preset": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-user-questions": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-plan": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-general": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-skill": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-reference": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-subagent": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-jobs": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-theme": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-workflow-run": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-trajectory": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-workspace": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-cmdline": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-code-runtime-worker-thread": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-cordis-client-runner": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-cordis-host-runner": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-frontend-static": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-directory-picker-auto": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-directory-picker-browse": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-web-frontend": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-directory-picker-native": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-plugin-inventory": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-file-reference": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-file-reference-local": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-message-feedback": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-reference": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-log-export": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-storage": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-session-stats": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-subprocess": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-workspace": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-storage-json": "^0.1.1-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@deepseek-ai/dsh-web-frontend": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-frontend-static": "^0.1.0-rc.7"
+    "@deepseek-ai/dsh-storage-domain": "^0.1.1-rc.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
-    "@deepseek-ai/dsh-shell-env": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-shell-env": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
     "@deepseek-ai/cordis": "^4.0.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.7",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.7",
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-shell-env": "^0.1.0-rc.7",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.2"
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
+    "@deepseek-ai/dsh-shell-env": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.1"
   }
 }