@deepseek-insight/dsi 0.11.0 → 0.11.2

package/build/server/chunks/entries/pages/{_page.svelte.js-DlLAziUY.js → _page.svelte.js-tSeYvTqX.js}

@@ -9,7 +9,7 @@ import { D as DEFAULT_IMAGE_LIMITS } from '../../chunks/image-limits.js-CUdJ0f7r
 import { s as sanitizeWorkspaceProfile, d as dsiKey, t as themePrefs } from '../../chunks/theme-prefs.svelte.js-8CaWz46g.js';
 import { a as appConfig, p as previewSegments, b as parseTagWords, i as isValidTagWord, s as shouldRecordPrompt, g as getTrigger, t as triggerMode, c as searchKey, d as textPreviewOf } from '../../chunks/app-config.svelte.js-BXjvTmJu.js';
 import { c as getLocale } from '../../chunks/runtime.js-CCJi3XaY.js';
-import { p as page, a as afterNavigate, t, c as currentLocale, e as replaceState, u as unexpectederror1, s as sessionnotfound2, r as reapednote1, d as dshunreachable1, b as backtoworkspace2 } from '../../chunks/state.js-CRPhnJJH.js';
+import { p as page, a as afterNavigate, t, c as currentLocale, e as replaceState, u as unexpectederror1, s as sessionnotfound2, r as reapednote1, d as dshunreachable1, b as backtoworkspace2 } from '../../chunks/state.js-BIGPexgb.js';
 import 'yaml';
 import 'html-to-image';
 import hljs from 'highlight.js/lib/core';
@@ -21,7 +21,7 @@ import xml from 'highlight.js/lib/languages/xml';
 import css from 'highlight.js/lib/languages/css';
 import '../../chunks/uneval.js-BJ9Qq2SF.js';
 import '../../chunks/shared.js-HQ0rfhm4.js';
-import '../../chunks/internal2.js-Cu5N8_4R.js';
+import '../../chunks/internal2.js-D_dNqBcA.js';
 import '../../chunks/utils.js-CAdNO8Tu.js';
 
 //#region src/lib/paraglide/messages/abort.js
@@ -19220,7 +19220,7 @@ function ThemeToggle($$renderer, $$props) {
 }
 //#endregion
 //#region package.json
-var version = "0.11.0";
+var version = "0.11.2";
 var dsh = { "webVersion": "0.2.2-rc.1" };
 //#endregion
 //#region src/lib/version.ts
@@ -28495,6 +28495,100 @@ function autolinkBareUrls(text) {
 function emphasis(text) {
 	return text.replace(/\*\*\*(.+?)\*\*\*/g, "<strong><em>$1</em></strong>").replace(/\*\*(.+?)\*\*/g, "<strong>$1</strong>").replace(/\*(.+?)\*/g, "<em>$1</em>").replace(/(?<![\w])_(.+?)_(?![\w])/g, "<em>$1</em>").replace(/~~(.+?)~~/g, "<del>$1</del>");
 }
+/** The tags the FILE PREVIEW path may revive from source (ADR-0055 D2;
+* strong/em added 2026-11-09 amendment — real READMEs carry them INSIDE
+* revived <p> blocks, and they take no attributes): centered banners
+* (p/div/center + img), collapsibles (details/summary), br for README line
+* breaks, bold/italic for HTML-paragraph prose. Everything else stays
+* escaped text. */
+var PREVIEW_TAGS = [
+	"p",
+	"div",
+	"img",
+	"br",
+	"details",
+	"summary",
+	"center",
+	"strong",
+	"em"
+];
+/** Attributes a revived tag may carry (ADR-0055 D2). `src` is the only URL
+* attribute and is additionally scheme-gated to http(s) below. */
+var PREVIEW_ATTRS = [
+	"align",
+	"src",
+	"alt",
+	"width",
+	"height"
+];
+var PREVIEW_TAG_RE = PREVIEW_TAGS.join("|");
+/** One raw HTML token shape the preview path may consider: an open or
+* closing tag of an allow-listed name with no `>` inside. Malformed
+* constructs (unterminated, stray `>` in attrs) never match and ride the
+* strict path as plain text. */
+var PREVIEW_TOKEN_RE = new RegExp(`</?(?:${PREVIEW_TAG_RE})(?:\\s[^>]*)?>`, "gi");
+/**
+* Validate and rebuild ONE raw source token (ADR-0055 weakest-point rule):
+* revival happens only when the tag name is allow-listed AND every
+* attribute parses as name or name="value" AND is allow-listed AND the src
+* value (the sole URL attribute) is http(s). ONE hostile attribute leaves
+* the WHOLE token escaped — no partial revival. Uppercase normalizes to
+* lowercase; attr values are re-escaped before emission.
+*/
+function revivePreviewToken(token) {
+	const m = /^<(\/?)([A-Za-z]+)((?:\s[^>]*)?)(\/?)>$/.exec(token);
+	if (!m) return escapeHtml(token);
+	const closing = m[1] === "/";
+	const tag = m[2].toLowerCase();
+	const attrRegion = m[3].replace(/\/$/, "").trim();
+	const selfClose = m[4] === "/";
+	if (closing) return attrRegion === "" ? `</${tag}>` : escapeHtml(token);
+	const attrs = [];
+	if (attrRegion !== "") {
+		const attrRe = /(^|\s+)([A-Za-z][A-Za-z0-9-]*)(?:=("[^"]*"|[^\s"'>]+))?(?=\s|$)/g;
+		let cursor = 0;
+		for (const a of attrRegion.matchAll(attrRe)) {
+			const starts = a.index;
+			if (starts !== cursor) return escapeHtml(token);
+			const name = a[2].toLowerCase();
+			if (!PREVIEW_ATTRS.includes(name)) return escapeHtml(token);
+			let value = "";
+			if (a[3] !== void 0) {
+				value = a[3];
+				value = value.startsWith("\"") && value.endsWith("\"") && value.length >= 2 ? value.slice(1, -1) : value;
+				if (name === "src" && !/^https?:\/\/[^\s"']+$/i.test(value)) return escapeHtml(token);
+			} else if (name === "src") return escapeHtml(token);
+			attrs.push(`${name}="${escapeHtml(value)}"`);
+			cursor = starts + a[0].length;
+		}
+		if (cursor !== attrRegion.length) return escapeHtml(token);
+	}
+	const slash = tag === "img" || tag === "br" || selfClose ? " /" : "";
+	return `<${tag}${attrs.length > 0 ? " " + attrs.join(" ") : ""}${slash}>`;
+}
+/**
+* Render markdown for the FILE PREVIEW surface (ADR-0055 D1, opt-in second
+* path). Candidate allow-listed HTML tokens are VAULTED out of the raw
+* source first (fence bodies stay in place — D3: fenced HTML is data,
+* never markup), the strict escape-first pipeline then renders the
+* remainder unchanged, and the vault is spliced back ONLY after
+* whole-token validation above. Chat surfaces must keep calling
+* renderMarkdown — they never touch this path.
+*/
+function renderPreviewMarkdown(text) {
+	if (text === "") return "";
+	const vault = [];
+	let body = "";
+	let last = 0;
+	for (const f of text.matchAll(/```[\s\S]*?(```|$)/g)) {
+		const head = text.slice(last, f.index);
+		body += head.replace(PREVIEW_TOKEN_RE, (t) => `\u0001${vault.push(t) - 1}\u0001`);
+		body += f[0];
+		last = f.index + f[0].length;
+	}
+	body += text.slice(last).replace(PREVIEW_TOKEN_RE, (t) => `\u0001${vault.push(t) - 1}\u0001`);
+	return renderMarkdown(body).replace(/\u0001(\d+)\u0001/g, (_m, i) => revivePreviewToken(vault[Number(i)] ?? ""));
+}
 /**
 * [label](href) — http(s) hrefs become hardened external anchors; SCHEME-FREE
 * relative hrefs (assistant file links like [card](src/lib/…)) become same-
@@ -29166,11 +29260,11 @@ function RawPreviewToggle($$renderer, $$props) {
 //#region src/lib/components/common/viewers/MarkdownContent.svelte
 function MarkdownContent($$renderer, $$props) {
 	$$renderer.component(($$renderer) => {
-		let { content, small = false, hideToggle = false, searchTerm = "", onFileLink = void 0 } = $$props;
+		let { content, small = false, hideToggle = false, searchTerm = "", allowHtml = false, onFileLink = void 0 } = $$props;
 		let showRaw = false;
 		let containerEl = null;
 		/** Sanitized HTML — BC-12: allow-listed tags only (never raw input). */
-		let renderedHtml = derived(() => renderMarkdown(content));
+		let renderedHtml = derived(() => allowHtml ? renderPreviewMarkdown(content) : renderMarkdown(content));
 		/** Highlight search term in rendered HTML — AFTER markdown rendering. */
 		let highlightedHtml = derived(() => {
 			if (!searchTerm.trim()) return renderedHtml();
@@ -30244,7 +30338,8 @@ function FileContentViewer($$renderer, $$props) {
 			$$renderer.push(`<div class="[padding:0_10px]" data-testid="file-viewer-markdown">`);
 			MarkdownContent($$renderer, {
 				content: body(),
-				small: true
+				small: true,
+				allowHtml: true
 			});
 			$$renderer.push(`<!----></div>`);
 		} else if (view.lang !== void 0 && isKnownCodeLang(view.lang)) {
@@ -37329,9 +37424,12 @@ function MarkdownPanel($$renderer, $$props) {
 	* byte-exact surface stays the transcript's chips; here prose may
 	* reflow, the accepted give-up).
 	*/
-	let { content } = $$props;
+	let { content, allowHtml = false } = $$props;
 	$$renderer.push(`<div data-svelte="MarkdownPanel" class="markdown-panel svelte-db6jsb" data-testid="markdown-panel">`);
-	MarkdownContent($$renderer, { content });
+	MarkdownContent($$renderer, {
+		content,
+		allowHtml
+	});
 	$$renderer.push(`<!----></div>`);
 }
 //#endregion
@@ -37999,7 +38097,10 @@ function WorkspaceFile($$renderer, $$props) {
 			} else if (isMarkdown && tab === "preview") {
 				$$renderer.push("<!--[5-->");
 				$$renderer.push(`<div class="file-scroll svelte-tsr372">`);
-				MarkdownPanel($$renderer, { content: text ?? "" });
+				MarkdownPanel($$renderer, {
+					content: text ?? "",
+					allowHtml: true
+				});
 				$$renderer.push(`<!----></div>`);
 			} else {
 				$$renderer.push("<!--[-1-->");
@@ -39394,4 +39495,4 @@ function _page($$renderer, $$props) {
 }
 
 export { _page as default };
-//# sourceMappingURL=_page.svelte.js-DlLAziUY.js.map
+//# sourceMappingURL=_page.svelte.js-tSeYvTqX.js.map

package/build/server/chunks/{handler-BRlzTcii.js → handler-CdfDULha.js}

@@ -9,8 +9,8 @@ import * as qs from 'node:querystring';
 import { Readable } from 'node:stream';
 import { S as SvelteKitError } from './chunks/shared.js-HQ0rfhm4.js';
 import './chunks/utils.js-CAdNO8Tu.js';
-import { S as Server } from './index.js-D2umW-Cg.js';
-import { m as manifest } from './manifest.js-CaT4HRXz.js';
+import { S as Server } from './index.js-CAZuEVlJ.js';
+import { m as manifest } from './manifest.js-Bq-QTetg.js';
 import { env, dir, env_prefix } from '../../env.js';
 import { format } from 'node:url';
 
@@ -1732,4 +1732,4 @@ const handler = sequence(
 );
 
 export { format_listening_address as f, handler as h, polka as p };
-//# sourceMappingURL=handler-BRlzTcii.js.map
+//# sourceMappingURL=handler-CdfDULha.js.map

package/build/server/chunks/{index.js-D2umW-Cg.js → index.js-CAZuEVlJ.js}

@@ -3,7 +3,7 @@ import { n as noop, T as TRAILING_SLASH_PARAM, I as INVALIDATED_PARAM, R as Redi
 import { b as base, o as override, a as assets, r as reset, c as app_dir } from './chunks/internal.js-BcS47nI-.js';
 import { f as format_server_error, j as json, i as is_form_content_type, t as text, h as has_prerendered_path, a as handle_fatal_error, r as redirect_response, g as get_set_cookies, n as negotiate, w as with_request_store, p as parseString, m as merge_tracing, b as method_not_allowed, s as static_error_page, c as handle_error_and_jsonify, d as get_global_name, e as create_replacer, k as serialize_uses, l as clarify_devalue_error, E as ENDPOINT_METHODS, P as PAGE_METHODS, o as get_node_type, q as isRedirect, u as escape_html, v as error, x as deserialize_binary_form } from './chunks/utils.js-CAdNO8Tu.js';
 import { u as uneval } from './chunks/uneval.js-BJ9Qq2SF.js';
-import { o as options, s as set_private_env, a as set_public_env, g as get_hooks, p as public_env, r as read_implementation, b as set_read_implementation } from './chunks/internal2.js-Cu5N8_4R.js';
+import { o as options, s as set_private_env, a as set_public_env, g as get_hooks, p as public_env, r as read_implementation, b as set_read_implementation } from './chunks/internal2.js-D_dNqBcA.js';
 import { h as has_resolution_suffix, a as has_data_suffix, s as strip_resolution_suffix, b as strip_data_suffix, d as decode_pathname, c as add_data_suffix, e as add_resolution_suffix, f as find_route, n as normalize_path, g as disable_search, v as validate_layout_server_exports, i as validate_layout_exports, j as validate_page_server_exports, k as validate_page_exports, r as resolve, l as hash, m as make_trackable } from './chunks/exports.js-D5zA1U7A.js';
 import { S as readable, T as writable } from './chunks/server.js-Dijo7DtV.js';
 
@@ -3821,4 +3821,4 @@ var Server = class {
 };
 
 export { Server as S };
-//# sourceMappingURL=index.js-D2umW-Cg.js.map
+//# sourceMappingURL=index.js-CAZuEVlJ.js.map

package/build/server/chunks/{manifest.js-CaT4HRXz.js → manifest.js-Bq-QTetg.js}

@@ -10,11 +10,11 @@ return {
 	assets: new Set(["favicon.svg"]),
 	mimeTypes: {".svg":"image/svg+xml"},
 	_: {
-		client: {start:"_app/immutable/entry/start.DdPLwPDt.js",app:"_app/immutable/entry/app.ezxtVZch.js",imports:["_app/immutable/entry/start.DdPLwPDt.js","_app/immutable/chunks/UPlr67N1.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/entry/app.ezxtVZch.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/chunks/HclGiUj8.js","_app/immutable/chunks/xihTtKlq.js"],stylesheets:[],fonts:[],uses_env_dynamic_public:false},
+		client: {start:"_app/immutable/entry/start.Bo2gqLX-.js",app:"_app/immutable/entry/app.wTcqn7d3.js",imports:["_app/immutable/entry/start.Bo2gqLX-.js","_app/immutable/chunks/CLf6wcwo.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/entry/app.wTcqn7d3.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/chunks/HclGiUj8.js","_app/immutable/chunks/xihTtKlq.js"],stylesheets:[],fonts:[],uses_env_dynamic_public:false},
 		nodes: [
 			__memo(() => import('./nodes/0.js-B8ciwPSu.js')),
-			__memo(() => import('./nodes/1.js-cXTCbvze.js')),
-			__memo(() => import('./nodes/2.js-CF_m1q-z.js'))
+			__memo(() => import('./nodes/1.js-CKR9qKW9.js')),
+			__memo(() => import('./nodes/2.js-BuwXpGsh.js'))
 		],
 		remotes: {
 			
@@ -53,105 +53,105 @@ return {
 				pattern: /^\/api\/browser\/?$/,
 				params: [],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_server.ts.js-0Gye8oLN.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_server.ts.js-pQmJm_Io.js'))
 			},
 			{
 				id: "/api/browser/[id]/activate",
 				pattern: /^\/api\/browser\/([^/]+?)\/activate\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/activate/_server.ts.js-BxfB-QXT.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/activate/_server.ts.js-DlbbO3RF.js'))
 			},
 			{
 				id: "/api/browser/[id]/closetab",
 				pattern: /^\/api\/browser\/([^/]+?)\/closetab\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/closetab/_server.ts.js-Cwu4C98Y.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/closetab/_server.ts.js-Dt5Bxv2-.js'))
 			},
 			{
 				id: "/api/browser/[id]/close",
 				pattern: /^\/api\/browser\/([^/]+?)\/close\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/close/_server.ts.js-DT6rU-EU.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/close/_server.ts.js-B85bLw4w.js'))
 			},
 			{
 				id: "/api/browser/[id]/element",
 				pattern: /^\/api\/browser\/([^/]+?)\/element\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/element/_server.ts.js-B55tx3-S.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/element/_server.ts.js-uJ5BnGUA.js'))
 			},
 			{
 				id: "/api/browser/[id]/history",
 				pattern: /^\/api\/browser\/([^/]+?)\/history\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/history/_server.ts.js-D2ft7u0s.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/history/_server.ts.js-CVCoWk2n.js'))
 			},
 			{
 				id: "/api/browser/[id]/input",
 				pattern: /^\/api\/browser\/([^/]+?)\/input\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/input/_server.ts.js-BO1uO6i3.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/input/_server.ts.js-CmhQ7zGO.js'))
 			},
 			{
 				id: "/api/browser/[id]/mcp",
 				pattern: /^\/api\/browser\/([^/]+?)\/mcp\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/mcp/_server.ts.js-zOccgfJZ.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/mcp/_server.ts.js-CFtpmSCd.js'))
 			},
 			{
 				id: "/api/browser/[id]/navigate",
 				pattern: /^\/api\/browser\/([^/]+?)\/navigate\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/navigate/_server.ts.js-DgyR0sLf.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/navigate/_server.ts.js-BH8MNt9W.js'))
 			},
 			{
 				id: "/api/browser/[id]/opentab",
 				pattern: /^\/api\/browser\/([^/]+?)\/opentab\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/opentab/_server.ts.js-CPCIL2MG.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/opentab/_server.ts.js-uIrK0T8h.js'))
 			},
 			{
 				id: "/api/browser/[id]/page",
 				pattern: /^\/api\/browser\/([^/]+?)\/page\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/page/_server.ts.js-Cjvr5nEt.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/page/_server.ts.js-Bg5yHS9F.js'))
 			},
 			{
 				id: "/api/browser/[id]/stream",
 				pattern: /^\/api\/browser\/([^/]+?)\/stream\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/stream/_server.ts.js-Bb3DkB-H.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/stream/_server.ts.js-DG6xvUsm.js'))
 			},
 			{
 				id: "/api/browser/[id]/tabs",
 				pattern: /^\/api\/browser\/([^/]+?)\/tabs\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/tabs/_server.ts.js-DVcq1pYf.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/tabs/_server.ts.js-RiXP45mV.js'))
 			},
 			{
 				id: "/api/browser/[id]/viewport",
 				pattern: /^\/api\/browser\/([^/]+?)\/viewport\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/viewport/_server.ts.js-D1xgkwTO.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/viewport/_server.ts.js-w9MNQddQ.js'))
 			},
 			{
 				id: "/api/browser/[id]/zoom",
 				pattern: /^\/api\/browser\/([^/]+?)\/zoom\/?$/,
 				params: [{"name":"id","optional":false,"rest":false,"chained":false}],
 				page: null,
-				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/zoom/_server.ts.js-DFo94fTq.js'))
+				endpoint: __memo(() => import('./entries/endpoints/api/browser/_id_/zoom/_server.ts.js-BoXDoshV.js'))
 			},
 			{
 				id: "/api/config",
@@ -606,4 +606,4 @@ return {
 })();
 
 export { manifest as m };
-//# sourceMappingURL=manifest.js-CaT4HRXz.js.map
+//# sourceMappingURL=manifest.js-Bq-QTetg.js.map

package/build/server/chunks/nodes/1.js-CKR9qKW9.js

@@ -0,0 +1,9 @@
+const index = 1;
+let component_cache;
+const component = async () => component_cache ??= (await import('../entries/pages/_error.svelte.js-MpJVAPPn.js')).default;
+const imports = ["_app/immutable/nodes/1.5Yu0dCHp.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/chunks/xihTtKlq.js","_app/immutable/chunks/BXbGQv0I.js","_app/immutable/chunks/CLf6wcwo.js","_app/immutable/chunks/D9jhmf3I.js"];
+const stylesheets = [];
+const fonts = [];
+
+export { component, fonts, imports, index, stylesheets };
+//# sourceMappingURL=1.js-CKR9qKW9.js.map

package/build/server/chunks/nodes/{2.js-CF_m1q-z.js → 2.js-BuwXpGsh.js}

@@ -19,11 +19,11 @@ import '../chunks/uneval.js-BJ9Qq2SF.js';
 
 const index = 2;
 let component_cache;
-const component = async () => component_cache ??= (await import('../entries/pages/_page.svelte.js-DlLAziUY.js')).default;
+const component = async () => component_cache ??= (await import('../entries/pages/_page.svelte.js-tSeYvTqX.js')).default;
 const server_id = "src/routes/+page.server.ts";
-const imports = ["_app/immutable/nodes/2.9BE7-E5x.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/chunks/UPlr67N1.js","_app/immutable/chunks/HclGiUj8.js","_app/immutable/chunks/xihTtKlq.js","_app/immutable/chunks/D9jhmf3I.js","_app/immutable/chunks/CTWtsoJD.js","_app/immutable/chunks/e-3PBXxJ.js"];
+const imports = ["_app/immutable/nodes/2.DAzLHFNq.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/chunks/CLf6wcwo.js","_app/immutable/chunks/HclGiUj8.js","_app/immutable/chunks/xihTtKlq.js","_app/immutable/chunks/D9jhmf3I.js","_app/immutable/chunks/CTWtsoJD.js","_app/immutable/chunks/BXbGQv0I.js"];
 const stylesheets = ["_app/immutable/assets/2.glyfXGzi.css"];
 const fonts = [];
 
 export { component, fonts, imports, index, server_id, stylesheets };
-//# sourceMappingURL=2.js-CF_m1q-z.js.map
+//# sourceMappingURL=2.js-BuwXpGsh.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@deepseek-insight/dsi",
-	"version": "0.11.0",
+	"version": "0.11.2",
 	"description": "See your multiple agents run on the floor (agent, sub-agent, etc), each conversation on the floor are updated instantly.",
 	"keywords": [
 		"Deepseek",

package/skills/dsi-host-drive/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: "dsi-host-drive"
+description: "Drive the HOST floor's Terminal Desk from inside a VM floor over the OrbStack bridge (host.orb.internal + Host-header pass) — reach a Mac that has no ssh, run install/build/launch anything on the operator's physical machine, same baton law. Reserved keyword"
+---
+
+# Drive Host Terminal (VM → Host over the bridge)
+
+One goal → run commands on the HOST machine (the operator's Mac) while
+working from a VM floor, by driving the HOST floor's own Terminal Desk over
+its HTTP wire. Same baton law as `dsi-drive-terminal` — load that skill
+first for the etiquette core (heal-on-refusal, echo+marker gates, silent
+eaters, dead sessions); THIS skill carries only what is special about
+crossing the VM→host boundary.
+
+## Why this exists (earned 2026-11-08, the Glass Chassis drive)
+
+The Mac has no ssh (port 22 refused), its LAN IP drifts on every reboot
+(192.168.1.9 → .1.3 within one day), and its services bind loopback —
+so the ONLY stable path from a VM to the Mac's shell is the Mac's own
+DSI floor, reached through OrbStack's host alias.
+
+## The access recipe (all four rules are load-bearing)
+
+1. **Alias, not IP.** The Mac's LAN IP (`192.168.1.x`) refuses every port
+   from the VM (000). Use `http://host.orb.internal:<port>` — OrbStack
+   forwards it to the Mac's loopback.
+2. **Host header pass.** The floor's guard blocks the alias name
+   ("Blocked request. This host is not allowed"). Send the request with
+   `Host: localhost:<port>`:
+   ```sh
+   H=http://host.orb.internal:5175
+   HH="Host: localhost:5175"
+   curl -s -m5 -H "$HH" "$H/api/terminal"
+   ```
+3. **curl, never node fetch.** Node's `fetch`/`urllib` silently DROP the
+   spoofed Host header and every write comes back 403 blocked — the
+   entire drive must run on curl (or curl via subprocess).
+4. **Same shell quirks as home.** The host floor's terminal API is the
+   same code — open (`POST /api/terminal`), reattach for the baton,
+   paced per-char writes, `?fromByte=` ring reads, exit markers — exactly
+   per `dsi-drive-terminal` Steps 1–4.
+
+## Host-specific traps (each one bit the 2026-11-08 drive)
+
+- **A dead session still answers `written:true`** — after opening a fresh
+  desk tab, CHECK `GET /api/terminal`'s `exited` flag and the ECHO before
+  trusting receipts. Two full command sequences vanished into an exited
+  `t-3` this way.
+- **The operator's focused tab steals the baton** — its watcher
+  auto-reattaches, so long paced sequences die mid-way with
+  `FOREIGN_SESSION`. Prefer driving the tab the operator just activated
+  FOR you, in short healed bursts; or accept the heal loop and retry the
+  SAME keystroke after each reattach.
+- **macOS `git` pages on the host** (`(END)` from a plain `git log`) —
+  export `GIT_PAGER=cat PAGER=cat` in the first command you send; escape
+  a live pager with `q` (and RETURN for less's sub-prompts).
+- **The host shell may carry a proxy env** — in-band
+  `curl http://127.0.0.1:<port>/status` on the Mac can fail with exit 6
+  (proxy can't resolve) while the companion is perfectly up. Verify
+  host-local services from the VM over the alias, or add `--noproxy '*'`.
+- **The host checkout drifts** — always `GIT_PAGER=cat git pull --rebase`
+  before running repo code there; the operator commits on the Mac too
+  (its local docs commit once refused a `--ff-only` pull).
+
+## Companion-grade longevity (things that must outlive the tab)
+
+Anything the HOST should keep running (a chassis companion, a dev server)
+must NOT be a background job of the desk session: the session's idle
+teardown kills the process tree, `nohup` notwithstanding — this killed the
+glass chassis three times in one evening. Detach with launchd:
+
+```sh
+launchctl remove dsi-chassis 2>/dev/null
+launchctl submit -l dsi-chassis -- <abs-node-path> <abs-repo>/bin/dsi-chassis.mjs --bind 127.0.0.1 --port 9525
+launchctl list | grep dsi-chassis   # pid + last exit status
+```
+
+- `launchctl submit` runs with cwd `/` — absolute paths REQUIRED.
+- Check health from the VM over the alias, never in-band (proxy trap).
+
+## Checklist
+
+```
+📋 host-drive: {goal} — host floor :<port>
+
+   [ ]  1.1  Host floor found via host.orb.internal (never the LAN IP)
+   [ ]  1.2  Host-header pass on EVERY request (curl only)
+   [ ]  1.3  Session id from GET /api/terminal + exited flag (badge law)
+   [ ]  2.1  Baton via reattach; FOREIGN_SESSION → heal, retry same write
+   [ ]  2.2  GIT_PAGER=cat exported before any git command
+   [ ]  2.3  Exit markers gate completion; echoes checked (dead-session law)
+   [ ]  3.1  Ring reads from the reattach offset (stale bytes fake markers)
+   [ ]  4.1  Long-lived processes detached via launchctl (absolute paths)
+   [ ]  4.2  Health verified from the VM over the alias
+   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```

package/build/client/_app/immutable/chunks/Dj8AK3pr.js

@@ -1 +0,0 @@
-import{U as e}from"../nodes/2.9BE7-E5x.js";export{e as startPanelResize};

package/build/client/_app/immutable/chunks/WySTHi46.js

@@ -1 +0,0 @@
-import{r as e}from"../nodes/2.9BE7-E5x.js";export{e as stringify};

package/build/client/_app/immutable/entry/start.DdPLwPDt.js

@@ -1 +0,0 @@
-import{o as e,r as t}from"../chunks/UPlr67N1.js";export{e as load_css,t as start};

package/build/server/chunks/nodes/1.js-cXTCbvze.js

@@ -1,9 +0,0 @@
-const index = 1;
-let component_cache;
-const component = async () => component_cache ??= (await import('../entries/pages/_error.svelte.js-CJ9RHd_3.js')).default;
-const imports = ["_app/immutable/nodes/1.CGppLUrN.js","_app/immutable/chunks/0Tfhif1V.js","_app/immutable/chunks/xihTtKlq.js","_app/immutable/chunks/e-3PBXxJ.js","_app/immutable/chunks/UPlr67N1.js","_app/immutable/chunks/D9jhmf3I.js"];
-const stylesheets = [];
-const fonts = [];
-
-export { component, fonts, imports, index, stylesheets };
-//# sourceMappingURL=1.js-cXTCbvze.js.map