@deepseek-insight/dsi 0.10.0 → 0.10.1

package/.agents/skills/glass-dsi/scripts/_connect.mjs

@@ -26,7 +26,52 @@
  */
 import { chromium } from 'playwright-core';
 
-const DSI = 'http://127.0.0.1:5175';
+// ── The Floor Seam (ADR "The Floor Seam" 2026-11-05, D1-D3) ────────────────
+// DSI_UI env verbatim when set; else parallel probe of both known floor
+// bases (5175 dev, 5174 build) with the D7 identity tiebreak. Tab identity
+// is an origin compare against the RESOLVED base — never a port literal.
+
+const DEFAULT_FLOOR_BASES = ['http://127.0.0.1:5175', 'http://127.0.0.1:5174'];
+
+/** Candidate bases: env seam wins; else dev first, build second. */
+export function floorCandidates(env = process.env) {
+  const ui = env.DSI_UI;
+  if (ui && /^http:\/\//.test(ui)) return [ui.replace(/\/$/, '')];
+  return [...DEFAULT_FLOOR_BASES];
+}
+
+/** Resolve the live floor — one answer wins; both → pickSession per floor,
+ *  my-glass floor wins, double-claim dies loud; none → die naming both. */
+export async function resolveDsiBase({ env = process.env, fetchImpl = fetch, identity = undefined, pickSessionFn = pickSession, dieFn = die, timeoutMs = 3000 } = {}) {
+  const candidates = floorCandidates(env);
+  const probes = await Promise.all(candidates.map(async (base) => {
+    try {
+      const res = await fetchImpl(base + '/api/browser', { signal: AbortSignal.timeout(timeoutMs) });
+      if (!res.ok) return { base, reg: null };
+      return { base, reg: await res.json() };
+    } catch { return { base, reg: null }; }
+  }));
+  const answered = probes.filter((p) => p.reg?.sessions);
+  if (answered.length === 0) {
+    dieFn('no DSI floor answers — probed ' + candidates.join(', ') +
+      ' (dev: dsi dsh --sync --dev --playwright-mcp · build: dsi dsh --sync · or set DSI_UI=<floor url>)');
+  }
+  if (answered.length === 1) return answered[0];
+  const claims = answered.map((p) => ({ ...p, verdict: pickSessionFn(p.reg.sessions, identity) }));
+  const mine = claims.filter((c) => c.verdict.session);
+  if (mine.length === 1) return mine[0];
+  if (mine.length > 1) {
+    dieFn('a glass owned by you lives on BOTH floors (' + mine.map((m) => m.base).join(', ') +
+      ') — set DSI_UI=<floor url> to name the floor; refusing to guess (D7)');
+  }
+  dieFn('both floors answer but neither holds YOUR glass (' + answered.map((m) => m.base).join(', ') +
+    ') — click the Browser chip in THIS conversation');
+}
+
+/** True when a tab url's ORIGIN is the resolved floor's origin (D2). */
+export function isFloorTab(url, base) {
+  try { return new URL(url).origin === new URL(base).origin; } catch { return false; }
+}
 
 export function die(msg) {
   console.error(JSON.stringify({ error: msg, fallback: 'SKILL.md Step 1 — ask the OPERATOR to click the Browser chip IN THE RIGHT CONVERSATION, then catch the session via GET /api/browser. If DSH_SESSION_ID is absent from env, pass --owner-session <id> (the session id you already know from context).' }));
@@ -62,20 +107,15 @@ export function pickSession(sessions, envId) {
 }
 
 export async function connect() {
-  let reg;
-  try {
-    reg = await (await fetch(DSI + '/api/browser')).json();
-  } catch {
-    die('DSI dev server not reachable on 5175 — floor not up (dsi dsh --sync --dev --playwright-mcp)');
-  }
+  const { base, reg } = await resolveDsiBase({ env: process.env, identity: identityFrom(process.argv) });
   const { session, degraded, note, error } = pickSession(reg.sessions, identityFrom(process.argv));
   if (!session) die(error ?? 'no glass session resolved — operator must click the Browser chip');
   if (degraded || note) console.error(JSON.stringify({ warn: note ?? 'degraded', sessionId: session.id }));
   const browser = await chromium.connectOverCDP('http://127.0.0.1:' + session.port).catch(() => null);
   if (!browser) die('CDP connect failed on port ' + session.port);
-  return { session, browser, ctx: browser.contexts()[0] };
+  return { session, browser, ctx: browser.contexts()[0], base };
 }
 
 export function pick(ctx, substr) {
   return ctx.pages().find((p) => p.url().includes(substr));
-}
+}

package/.agents/skills/glass-dsi/scripts/glass.mjs

@@ -20,18 +20,19 @@
  * On any failure it prints the manual fallback hint (SKILL.md Step 1 —
  * the operator clicks the Browser chip; agents never open sessions).
  */
-import { connect, die } from './_connect.mjs';
+import { connect, die, isFloorTab } from './_connect.mjs';
 
-const DSI = 'http://127.0.0.1:5175';
 const [cmd, ...args] = process.argv.slice(2);
 
-const { session, browser, ctx } = await connect();
+// The Floor Seam (ADR 2026-11-05): connect resolves the live floor (DSI_UI
+// env or probe); the DSI tab is its own ORIGIN — never a port literal.
+const { session, browser, ctx, base } = await connect();
 
-let page = ctx.pages().find((p) => p.url().includes('5175'));
+let page = ctx.pages().find((p) => isFloorTab(p.url(), base));
 if (cmd === 'open') {
   if (!page) {
     page = await ctx.newPage();
-    await page.goto(args[0] ?? DSI, { waitUntil: 'domcontentloaded' }).catch(() => {});
+    await page.goto(args[0] ?? base, { waitUntil: 'domcontentloaded' }).catch(() => {});
   } else if (args[0] && args[0] !== page.url()) {
     await page.goto(args[0], { waitUntil: 'domcontentloaded' }).catch(() => {});
   }

package/.agents/skills/glass-url/scripts/_connect.mjs

@@ -39,7 +39,59 @@ import { chromium } from 'playwright-core';
  * @property {string} [error]
  */
 
-const DSI = 'http://127.0.0.1:5175';
+// ── The Floor Seam (ADR "The Floor Seam" 2026-11-05, D1-D3) ────────────────
+// The drivers dial the floor they SEE: DSI_UI env verbatim when set, else a
+// parallel probe of the two known floor bases (5175 dev, 5174 build) with the
+// D7 identity resolver as tiebreak. No port literal may survive in tab
+// filtering — isFloorTab compares origins against the RESOLVED base (D2).
+
+const DEFAULT_FLOOR_BASES = ['http://127.0.0.1:5175', 'http://127.0.0.1:5174'];
+
+/** Candidate bases: the env seam wins verbatim (validated http), else both
+ *  known floor bases — dev first so a dev-only machine keeps today's shape. */
+export function floorCandidates(env = process.env) {
+  const ui = env.DSI_UI;
+  if (ui && /^http:\/\//.test(ui)) return [ui.replace(/\/$/, '')];
+  return [...DEFAULT_FLOOR_BASES];
+}
+
+/** Resolve the live floor: fetch /api/browser on every candidate in
+ *  PARALLEL (3 s timeout each), then — one answer wins; both answer →
+ *  pickSession per floor with the caller's identity, the floor holding the
+ *  caller's OWN glass wins, a double-claim dies loud (D7 stands); none
+ *  answer → die naming BOTH ports and BOTH launch commands. */
+export async function resolveDsiBase({ env = process.env, fetchImpl = fetch, identity = undefined, pickSessionFn = pickSession, dieFn = die, timeoutMs = 3000 } = {}) {
+  const candidates = floorCandidates(env);
+  const probes = await Promise.all(candidates.map(async (base) => {
+    try {
+      const res = await fetchImpl(base + '/api/browser', { signal: AbortSignal.timeout(timeoutMs) });
+      if (!res.ok) return { base, reg: null };
+      return { base, reg: await res.json() };
+    } catch { return { base, reg: null }; }
+  }));
+  const answered = probes.filter((p) => p.reg?.sessions);
+  if (answered.length === 0) {
+    dieFn('no DSI floor answers — probed ' + candidates.join(', ') +
+      ' (dev: dsi dsh --sync --dev --playwright-mcp · build: dsi dsh --sync · or set DSI_UI=<floor url>)');
+  }
+  if (answered.length === 1) return answered[0];
+  // Both floors live — the caller's own glass picks the floor (D7 tiebreak).
+  const claims = answered.map((p) => ({ ...p, verdict: pickSessionFn(p.reg.sessions, identity) }));
+  const mine = claims.filter((c) => c.verdict.session);
+  if (mine.length === 1) return mine[0];
+  if (mine.length > 1) {
+    dieFn('a glass owned by you lives on BOTH floors (' + mine.map((m) => m.base).join(', ') +
+      ') — set DSI_UI=<floor url> to name the floor; refusing to guess (D7)');
+  }
+  dieFn('both floors answer but neither holds YOUR glass (' + answered.map((m) => m.base).join(', ') +
+    ') — click the Browser chip in THIS conversation');
+}
+
+/** True when a tab url's ORIGIN is the resolved floor's origin (D2): the
+ *  DSI tab is the floor's own page, whatever port it landed on. */
+export function isFloorTab(url, base) {
+  try { return new URL(url).origin === new URL(base).origin; } catch { return false; }
+}
 
 /** @param {string} msg @returns {never} */
 export function die(msg) {
@@ -79,21 +131,16 @@ export function pickSession(sessions, envId) {
 
 /** @returns {Promise<{ session: GlassSession, browser: import('playwright-core').Browser, ctx: import('playwright-core').BrowserContext }>} */
 export async function connect() {
-  let reg;
-  try {
-    reg = await (await fetch(DSI + '/api/browser')).json();
-  } catch {
-    die('DSI dev server not reachable on 5175 — floor not up (dsi dsh --sync --dev --playwright-mcp)');
-  }
+  const { base, reg } = await resolveDsiBase({ env: process.env, identity: identityFrom(process.argv) });
   const { session, degraded, note, error } = pickSession(reg.sessions, identityFrom(process.argv));
   if (!session) die(error ?? 'no glass session resolved — operator must click the Browser chip');
   if (degraded || note) console.error(JSON.stringify({ warn: note ?? 'degraded', sessionId: session.id }));
   const browser = await chromium.connectOverCDP('http://127.0.0.1:' + session.port).catch(() => null);
   if (!browser) die('CDP connect failed on port ' + session.port);
-  return { session, browser, ctx: browser.contexts()[0] };
+  return { session, browser, ctx: browser.contexts()[0], base };
 }
 
 /** @param {import('playwright-core').BrowserContext} ctx @param {string} substr @returns {import('playwright-core').Page|undefined} */
 export function pick(ctx, substr) {
   return ctx.pages().find((p) => p.url().includes(substr));
-}
+}

package/.agents/skills/glass-url/scripts/glass-url.mjs

@@ -23,22 +23,23 @@
  * EXIT DISCIPLINE: this script always process.exit()s — a driver that
  * played media once hung its caller for a full timeout (RCA trap 5).
  */
-import { connect, die, pick } from './_connect.mjs';
+import { connect, die, pick, isFloorTab } from './_connect.mjs';
 import { norm, parseEvalArgs, matchAllTerms } from './_args.mjs';
 
 const argv = process.argv.slice(2);
-const { session, browser, ctx } = await connect();
+const { session, browser, ctx, base } = await connect();
 const out = (v) => { console.log(JSON.stringify(v, null, 1)); return process.exit(0); };
 
 // target tab: url-substring when given; else last http(s) page that is
-// neither the glass placeholder nor :5175 (contract, not position — D2).
+// neither the glass placeholder nor the FLOOR's own page — origin compare
+// against the resolved base (The Floor Seam ADR D2; never a port literal).
 const target = (substr) => {
   if (substr) {
     const p = pick(ctx, substr);
     if (!p) die('no tab matching "' + substr + '" — run: pages');
     return p;
   }
-  const pages = ctx.pages().filter((p) => p.url().startsWith('http') && !p.url().includes(':5175'));
+  const pages = ctx.pages().filter((p) => p.url().startsWith('http') && !isFloorTab(p.url(), base));
   if (!pages.length) die('no non-DSI tab to drive — run: glass-url.mjs open <url>');
   return pages[pages.length - 1];
 };

package/README.md

@@ -65,6 +65,27 @@ npx @deepseek-insight/dsi@latest dsh --sync --zai
 
 When it is up, your browser opens the page by itself (default `http://127.0.0.1:5174`).
 
+### Ports & the browser brain, in plain words
+
+One "floor" is a pair: **DSH** (the harness host) and **DSI** (the page you watch). Each sits on its own port, and each port can be moved — handy when you want a second floor beside one that is already running.
+
+| What | Default | How to move it | Plain meaning |
+|---|---|---|---|
+| DSH host | `3080` | `--port <n>` | the harness brain of the floor |
+| DSI page | `5174` | `PORT=<n>` env var | the page you open in the browser |
+| Browser brain | `9515` | `DSI_MCP_PORT=<n>` env var | the MCP endpoint agents use to drive the glass browser |
+
+**The browser brain.** By default the glass browser's assistant (the MCP brain that lets an agent click and type in the browser) runs as its **own separate helper process** — if it fails, you lose only the glass panel. Adding `--playwright-mcp` moves that brain **inside the DSI page server**: one less background process and a faster start, but a brain failure can now touch the page server itself. DSI prints a banner saying so whenever you use the flag — drop the flag to go back to the helper process.
+
+**Example — a second, self-contained floor beside a live one** (nothing on the running floor is touched):
+
+```bash
+PORT=5176 DSI_MCP_PORT=19515 npx @deepseek-insight/dsi@latest dsh --sync --playwright-mcp --port 3081
+# Page: http://localhost:5176 · host: 3081 · brain: http://127.0.0.1:19515/sse
+```
+
+**Second floors are fully drivable.** At boot, a floor stamps its own addresses (`DSI_UI`, `DSI_MCP_URL`) into everything it starts — so agents in *that* floor's conversations drive *that* floor's glass automatically, and the preset brain entry follows the stamped port. Nothing on the primary floor changes: without a stamp (a bare `dsh web` boot), the brain falls back to `9515` and the drivers probe `5175` → `5174` exactly as before. One conversation = one glass owner; the driver refuses to touch another conversation's glass, and a session busy in the live floor shows `writer-held` if you try to prompt it from the second window (watch it there, prompt it on its own floor).
+
 ## License
 
 [Apache-2.0](LICENSE) — Copyright © 2026 [Widi Harsojo](https://www.linkedin.com/in/wharsojo/)

package/bin/dsi.mjs

@@ -33,7 +33,9 @@ import { parse, stringify } from 'yaml';
 import { mirrorSkills } from './lib/mirror-skills.mjs';
 import { dshLauncherCmd, parsePluginArgs, takeoverFloorPorts, hostBounceDecision, floorUiPort, parseDevFloorPids, launchUrl, tokenFromSettings } from './lib/plugin-chain.mjs';
 import { parseDevArg, devModeEnv, modeFromBoolean, resolveBounceMode, extractInspectArgs, parseInspectArgsFromEnv } from './lib/dev-mode.mjs';
+import { brainBannerLines } from './lib/mcp-banner.mjs';
 import { addZaiProvider as addZaiPatch, zaiPatchPath } from './lib/zai-patch.mjs';
+import { ensureGlassBrowser } from './lib/glass-browser-bootstrap.mjs';
 
 // Layman-facing help: wrapped near 76 columns, continuation lines indented,
 // the recommended one-liner first. --zai is optional on purpose — no GLM
@@ -177,15 +179,32 @@ if (command === 'dsh') {
 		const rest = process.argv.slice(4);
 		const withZai = rest.includes('--zai');
 		const withOv = rest.includes('--ov');
-		// The Glass Browser (ADR-0029 D7): --playwright-mcp opts the DEV floor
-		// into the in-process MCP brain — a dsi-side flag, stripped before the
-		// host spawn (dsh web would refuse it) and carried to vite as an env
-		// marker, the exact idiom of DSI_DEV_IN_PROCESS.
+		// The Glass Browser (ADR-0029 D7, amendment A6 D7c): --playwright-mcp
+		// opts ANY floor into the in-process MCP brain — a dsi-side flag,
+		// stripped before the host spawn (dsh web would refuse it) and carried
+		// to the server as an env marker (DSI_MCP_IN_PROCESS, dev-mode.mjs).
 		const withPlaywrightMcp = rest.includes('--playwright-mcp');
 		const restNoMcp = withPlaywrightMcp ? rest.filter((a) => a !== '--playwright-mcp') : rest;
+		// A6 D7d: say out loud what the flag chose, in plain language, BEFORE
+		// any child spawns — an unannounced behavior change is a silent trap.
+		if (withPlaywrightMcp) {
+			const { mode: bannerMode } = parseDevArg(restNoMcp);
+			for (const line of brainBannerLines(bannerMode !== 'build')) console.log(line);
+		}
 		if (withZai) addZaiProvider();
 		if (withOv) runOvPlugin();
 		runSkillsMirror();
+		// The Glass Bootstrap (ADR 2026-11-05, D1): probe the glass browser
+		// BEFORE the pair spawns — system Chrome first, cached chromium second,
+		// a one-time pinned fetch last (soft failure; DSI_SKIP_BROWSER_INSTALL=1
+		// skips). The bounce chain never fetches — only this first-run branch.
+		const glass = ensureGlassBrowser({
+			packageRoot,
+			spawnSync,
+			env: process.env,
+			log: (line) => console.log(line)
+		});
+		if (glass.action === 'fetched') console.log(`dsi dsh: chromium ${glass.reason} — the glass browser is ready`);
 		// --dev parse (D4): 'in-process' | 'pair' consumed as a value; bare
 		// --dev stays 'pair'. dsi-side flags stripped before the host spawn.
 		const { mode, rest: hostArgs0 } = parseDevArg(restNoMcp);
@@ -365,6 +384,18 @@ function setDshAuthToken(token) {
  *  falls back to the registry's latest tag). An exact pin, not a range: a
  *  range drifts to whatever the registry resolves, and the pin exists
  *  precisely because latest can change the API contract under DSI. */
+/** The Stamped Floor (ADR 2026-11-05, D1): every floor announces its own
+ *  addresses into the env it gives its children — the UI base (the Floor
+ *  Seam D1a seam, finally with a writer) and the brain URL (the preset's
+ *  !!js expression reads DSI_MCP_URL with a 9515 bare-boot fallback). The
+ *  launcher is the only party that knows both ports at spawn time. */
+function stampedFloorEnv(uiPort) {
+	return {
+		DSI_UI: 'http://127.0.0.1:' + uiPort,
+		DSI_MCP_URL: 'http://127.0.0.1:' + (process.env.DSI_MCP_PORT ?? 9515) + '/sse'
+	};
+}
+
 function dshWebVersion() {
 	const doc = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf-8'));
 	const version = doc?.dsh?.webVersion;
@@ -487,9 +518,9 @@ async function runSyncedPair(extraArgs, dev = 'build', execArgv = [], opts = {})
 	// host lifecycle (vite close hook stops it; one Ctrl-C, no orphan).
 	const host = inProcess ? null : spawn('/bin/sh', [script, ...extraArgs], {
 		stdio: 'inherit',
-		env: { ...process.env, DSH_WEB_VERSION: dshWebVersion() }
+		env: { ...process.env, DSH_WEB_VERSION: dshWebVersion(), ...stampedFloorEnv(uiPort) }
 	});
-	const ui = mode === 'build' ? startDsiServer(uiPort, dshBase) : startDsiDevServer(uiPort, dshBase, mode, execArgv, opts);
+	const ui = mode === 'build' ? startDsiServer(uiPort, dshBase, opts) : startDsiDevServer(uiPort, dshBase, mode, execArgv, opts);
 	// The browser follows the UI: the built page (5174) — or, in --dev mode,
 	// the dev server (5175). Gated on the HOST actually listening (bug
 	// 2026-10-17): the fixed 2s timer lost every race the host booted slower
@@ -754,6 +785,7 @@ function startDsiDevServer(defaultPort = '5175', dshBase = undefined, mode = 'pa
 			DSI_DEV: '1',
 			// D4/D6: the mode rides as env, never past the CLI to the host.
 			...devModeEnv(mode, { playwrightMcp: opts.playwrightMcp === true }),
+			...stampedFloorEnv(process.env.PORT ?? defaultPort),
 			// The Faithful Bounce (ADR 2026-10-13, D1): the inspector flags are
 			// part of the launch record — stamped so every restorer (the bounce
 			// boot via ps -E, the delayed re-serve via inherited env) can put
@@ -764,7 +796,7 @@ function startDsiDevServer(defaultPort = '5175', dshBase = undefined, mode = 'pa
 	});
 }
 
-function startDsiServer(defaultPort = '5174', dshBase = undefined) {
+function startDsiServer(defaultPort = '5174', dshBase = undefined, opts = {}) {
 	const serverEntry = path.join(packageRoot, 'build', 'index.js');
 	if (!existsSync(serverEntry)) {
 		console.error(`dsi: no build found at ${serverEntry} — run \`pnpm run build\` first`);
@@ -779,6 +811,11 @@ function startDsiServer(defaultPort = '5174', dshBase = undefined) {
 			// First-start bootstrap seam: the server clones template/.dsi to ~/.dsi
 			// when the operator home is absent (src/lib/server/settings-document.ts).
 			DSI_TEMPLATE_PATH: process.env.DSI_TEMPLATE_PATH ?? path.join(packageRoot, 'template', '.dsi'),
+			// A6 D7c: the brain marker rides EVERY floor, build included — the
+			// vite child got it via startDsiDevServer's devModeEnv spread; the
+			// built server was silently dropping it (caught by the live gate).
+			...devModeEnv('build', { playwrightMcp: opts.playwrightMcp === true }),
+			...stampedFloorEnv(process.env.PORT ?? defaultPort),
 			...(dshBase !== undefined ? { DSH_BASE_URL: dshBase } : {})
 		}
 	});

package/bin/lib/dev-mode.mjs

@@ -54,9 +54,15 @@ export function parseDevArg(rest) {
  * @returns {Record<string, string>}
  */
 export function devModeEnv(mode, opts = {}) {
-	if (mode === 'build') return {};
 	/** @type {Record<string, string>} */
-	const env = { DSI_DEV: '1', DSI_DEV_MODE: mode };
+	const env = {};
+	// ADR-0029 amendment A6 D7c: the glass brain's placement is the operator's
+	// choice on EVERY floor — build included. DSI_DEV/DSI_DEV_MODE stay
+	// strictly dev-only (the bounce chain probes them as dev-floor markers).
+	if (opts.playwrightMcp) env.DSI_MCP_IN_PROCESS = '1';
+	if (mode === 'build') return env;
+	env.DSI_DEV = '1';
+	env.DSI_DEV_MODE = mode;
 	if (mode === 'in-process') {
 		env.DSI_DEV_IN_PROCESS = '1';
 		// ADR-0025 Wave 3 (real-floor gate finding, 2026-10-14): the bounce
@@ -67,9 +73,6 @@ export function devModeEnv(mode, opts = {}) {
 		// that carries the handle, so in-process floors default to it.
 		env.DSH_HOST_INTROSPECT = '1';
 	}
-	// ADR-0029 D7: the glass browser's MCP brain runs in-process (opt-in,
-	// dev floor only — the tandem/production floors keep the stdio child)
-	if (opts.playwrightMcp) env.DSI_MCP_IN_PROCESS = '1';
 	return env;
 }
 

package/bin/lib/glass-browser-bootstrap.mjs

@@ -0,0 +1,115 @@
+/**
+ * Glass browser bootstrap (ADR "The Glass Bootstrap" 2026-11-05, D1-D4):
+ * decide whether the floor's glass browser has a binary it can launch, and
+ * fetch the pinned chromium once when it does not. Pure decision logic —
+ * every effect (spawnSync, env, log, platform) is injected, so the unit
+ * pins exercise the full decision tree without a network or a real cache.
+ *
+ * Probe order IS the launch order (D2): registry.ts tries system Google
+ * Chrome (channel: 'chrome') FIRST and falls back to the bundled chromium,
+ * so a machine with Chrome must never pay for a chromium download.
+ *
+ * Soft failure is the contract (D4): a failed or skipped fetch warns and
+ * returns — the floor boots; only the glass is affected, and the launch
+ * site's honest error (D5) names the cure.
+ */
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+
+/** Chrome candidates probed on PATH (Linux shape). macOS has no google-chrome
+ *  on PATH — the .app bundle is the truth (checked separately). */
+const CHROME_PATH_CANDIDATES = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'];
+
+/** The pinned playwright family, derived from this package's own
+ *  playwright-core dependency (D3: no second hardcoded pin may exist).
+ *  Returns null when the pin cannot be read — the caller then warns and
+ *  skips the fetch; a null pin never spawns npx. */
+export function pinnedPlaywrightVersion(packageRoot) {
+	try {
+		const doc = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf-8'));
+		const version = doc?.dependencies?.['playwright-core'];
+		return typeof version === 'string' && /^\d+\.\d+\.\d+/.test(version) ? version : null;
+	} catch {
+		return null;
+	}
+}
+
+/** True when a system Google/Chromium browser is resolvable: PATH probes on
+ *  Linux, the .app bundle on macOS (where PATH probing is always blind). */
+export function findSystemChrome(spawnSync, platform = process.platform, exists = existsSync) {
+	if (platform === 'darwin') {
+		return exists('/Applications/Google Chrome.app');
+	}
+	for (const name of CHROME_PATH_CANDIDATES) {
+		try {
+			if (spawnSync('which', [name], { stdio: 'pipe' }).status === 0) return true;
+		} catch {
+			// no which (or no sh) — the next candidate still probes
+		}
+	}
+	return false;
+}
+
+/** True when ANY chromium-family build sits in the playwright cache (either
+ *  platform root). The npx fetch is the revision authority — this probe is
+ *  the cheap hint that avoids re-downloading what is already present. */
+export function playwrightCacheHasChromium(env = process.env, readdir = readdirSync) {
+	const home = env.HOME ?? homedir();
+	const roots = [
+		path.join(home, 'Library', 'Caches', 'ms-playwright'),
+		path.join(home, '.cache', 'ms-playwright')
+	];
+	for (const root of roots) {
+		try {
+			if (readdir(root).some((entry) => entry.startsWith('chromium'))) return true;
+		} catch {
+			// unreadable/absent root — the next root still probes
+		}
+	}
+	return false;
+}
+
+/**
+ * The D2 decision tree. Sync by construction: every step is a stat, a
+ * readdir, or one spawnSync child. Returns a verdict the launcher logs:
+ *   { action: 'skip',    reason } — a browser exists (or the hatch fired)
+ *   { action: 'fetched', reason } — the pinned chromium landed in the cache
+ *   { action: 'warned',  reason } — no browser and the fetch failed/skipped;
+ *                                   the floor still boots (D4)
+ */
+export function ensureGlassBrowser({ packageRoot, spawnSync, env = process.env, log = () => {}, platform = process.platform }) {
+	if (env.DSI_SKIP_BROWSER_INSTALL === '1') {
+		log('dsi dsh: glass browser check skipped (DSI_SKIP_BROWSER_INSTALL=1)');
+		return { action: 'skip', reason: 'env-escape-hatch' };
+	}
+	if (findSystemChrome(spawnSync, platform)) {
+		return { action: 'skip', reason: 'system-chrome' };
+	}
+	if (playwrightCacheHasChromium(env)) {
+		return { action: 'skip', reason: 'cached-chromium' };
+	}
+	const pin = pinnedPlaywrightVersion(packageRoot);
+	if (pin === null) {
+		log('dsi dsh: glass browser — no playwright-core pin readable in package.json, skipping the chromium fetch');
+		return { action: 'warned', reason: 'no-pin' };
+	}
+	// The loud line comes BEFORE the fetch child (D1): the silent-minutes
+	// bug (2026-11-06) must never repeat on this stage.
+	log(`dsi dsh: glass browser missing — downloading chromium (~150 MB, one-time, playwright@${pin})…`);
+	let result;
+	try {
+		result = spawnSync('npx', ['--yes', `playwright@${pin}`, 'install', 'chromium'], {
+			stdio: 'inherit',
+			timeout: 300000
+		});
+	} catch (error) {
+		log(`dsi dsh: chromium fetch failed (${error?.message ?? error}) — the floor still boots; the glass needs: npx playwright@${pin} install chromium`);
+		return { action: 'warned', reason: 'fetch-error' };
+	}
+	if ((result?.status ?? 1) === 0) {
+		return { action: 'fetched', reason: `playwright@${pin}` };
+	}
+	log(`dsi dsh: chromium fetch failed (exit ${result?.status}) — the floor still boots; the glass needs: npx playwright@${pin} install chromium`);
+	return { action: 'warned', reason: 'fetch-failed' };
+}

package/bin/lib/mcp-banner.mjs

@@ -0,0 +1,26 @@
+// mcp-banner — A6 D7d: when --playwright-mcp is present, say out loud what
+// the operator just chose, in plain language, BEFORE any child spawns.
+// Extracted as a module so the exact text is unit-pinned (T3-T).
+
+/** @param {boolean} devFloor - true when a --dev mode was chosen
+ * @returns {string[]} banner lines (never empty; the caller prints each) */
+export function brainBannerLines(devFloor) {
+	const blast = devFloor
+		? 'a brain failure can now touch this dev floor server.'
+		: 'a brain failure can now touch this page server — not just the glass.';
+	return [
+		'',
+		'────────── playwright-mcp: in-process browser brain ──────────',
+		'You asked for the browser-assist brain to run INSIDE the DSI page',
+		'server instead of as its own separate background helper.',
+		'',
+		'What that means:',
+		'  + one less background process on your machine, faster start',
+		'  - ' + blast,
+		'    Before, it could only lose the glass panel, never the server.',
+		'',
+		'Drop the --playwright-mcp flag to go back to the old helper process.',
+		'───────────────────────────────────────────────────────────────',
+		''
+	];
+}