@fonlan/dsh-quick-commands 0.1.6 → 0.1.8

package/lib/index.js

@@ -1,7 +1,141 @@
 import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
 import z from "@deepseek-ai/schemastery";
+//#region src/server/shell-path.ts
+/**
+* Login-shell PATH resolution for the local quick-command backend.
+*
+* `dsh web` started from a terminal inherits the user's full PATH, so a
+* configured command such as `npm run typecheck` or `docker compose up -d`
+* finds its toolchain. **DSH Desktop does not**: the Electron host is launched
+* by launchd and runs with the minimal system PATH
+* (`/usr/bin:/bin:/usr/sbin:/sbin`), which hides homebrew, `/usr/local/bin`,
+* nvm, corepack and Docker Desktop. Every command that leans on the user's
+* toolchain then fails with "command not found" in Desktop while the very same
+* profile keeps working in a browser-launched host.
+*
+* This module asks the user's interactive login shell for its PATH once
+* (cached for the process lifetime) and prepends it to the inherited PATH for
+* local runs. Resolution is best effort by design: a missing `$SHELL`, a
+* timeout, a non-zero exit or unparseable output all leave the inherited PATH
+* untouched, so a terminal-launched host behaves exactly as before.
+*/
+/** Delimiters wrapping the shell's own PATH in the probe's stdout. */
+const PATH_START = "__DSH_QC_PATH_START__";
+const PATH_END = "__DSH_QC_PATH_END__";
+const defaultRunner = (file, args, options) => new Promise((resolve, reject) => {
+	execFile(file, args, options, (error, stdout) => {
+		if (error) reject(error);
+		else resolve({ stdout });
+	});
+});
+/**
+* Extract the PATH a shell printed between the markers.
+*
+* Login profiles are free to print their own noise (nvm notices, version
+* managers, MOTDs), so only the marked span counts — never the whole stdout.
+* @param stdout - raw probe stdout.
+* @returns the marked PATH, or '' when the markers are missing.
+*/
+function extractShellPath(stdout) {
+	if (typeof stdout !== "string" && !(stdout instanceof Buffer)) return "";
+	const text = String(stdout);
+	const start = text.indexOf(PATH_START);
+	const end = text.lastIndexOf(PATH_END);
+	if (start < 0 || end < 0 || end < start) return "";
+	return text.slice(start + 21, end);
+}
+/**
+* Put the login-shell PATH in front of the inherited one.
+*
+* The login PATH wins (that is where the user's toolchain lives); entries from
+* the inherited PATH stay behind it as a fallback. Empty entries are dropped
+* and duplicates keep their first position.
+* @param loginPath - PATH reported by the login shell ('' when unavailable).
+* @param inheritedPath - the host process's own PATH.
+* @returns the merged PATH (the inherited value when there is no login one).
+*/
+function mergePaths(loginPath, inheritedPath) {
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	for (const part of `${loginPath}:${inheritedPath ?? ""}`.split(":")) {
+		const entry = part.trim();
+		if (entry === "" || seen.has(entry)) continue;
+		seen.add(entry);
+		entries.push(entry);
+	}
+	return entries.join(":");
+}
+/** The shell program whose login PATH describes this user's environment. */
+function loginShell(env = process.env) {
+	const shell = env.SHELL?.trim();
+	return shell !== void 0 && shell !== "" ? shell : void 0;
+}
+/**
+* Ask `shell` (interactive login) for its PATH.
+*
+* Both flags matter: `-l` sources the profile files that own the system PATH
+* (on macOS `/etc/zprofile` → `path_helper`), `-i` additionally sources the
+* interactive config where nvm/fnm/volta and other version managers install
+* their shims (this user's node lives in `~/.zshrc`). A hung or noisy
+* interactive profile cannot block a run: the probe carries a deadline, and
+* only the marked span of stdout is read.
+* @param options.shell - shell program; defaults to `$SHELL`.
+* @param options.timeoutMs - probe deadline.
+* @param options.run - probe runner, injectable for tests.
+* @param options.env - environment the probe itself runs with.
+* @returns the login PATH, or '' when it cannot be determined.
+*/
+async function resolveLoginShellPath(options = {}) {
+	if (process.platform === "win32") return "";
+	const env = options.env ?? process.env;
+	const shell = options.shell ?? loginShell(env);
+	if (shell === void 0) return "";
+	const run = options.run ?? defaultRunner;
+	const command = `printf '%s' "${PATH_START}\${PATH}${PATH_END}"`;
+	try {
+		const { stdout } = await run(shell, [
+			"-i",
+			"-l",
+			"-c",
+			command
+		], {
+			timeout: options.timeoutMs ?? 3e3,
+			windowsHide: true,
+			env
+		});
+		const path = extractShellPath(stdout).trim();
+		return /[\s]/.test(path) ? "" : path;
+	} catch {
+		return "";
+	}
+}
+let cached;
+/** Cached, process-wide login-shell PATH (one probe per host lifetime). */
+function loginShellPath() {
+	cached ??= resolveLoginShellPath();
+	return cached;
+}
+/**
+* Environment for one local quick command.
+*
+* A copy of the host environment with the login-shell PATH merged in front, so
+* Desktop-launched hosts see the same toolchain a terminal-launched host does.
+* @param overrides - plugin-owned variables (DSH_WORKSPACE*) merged last.
+* @returns the spawn environment.
+*/
+async function localCommandEnv(overrides = {}) {
+	const env = { ...process.env };
+	const loginPath = await loginShellPath();
+	if (loginPath !== "") env.PATH = mergePaths(loginPath, process.env.PATH);
+	return {
+		...env,
+		...overrides
+	};
+}
+//#endregion
 //#region src/server/remote.ts
 /**
 * Remote (SSH) execution support: detect that a workspace path is a dsh-ssh
@@ -312,12 +446,11 @@ var QuickCommandRunner = class {
 				stdout: { maxBytes: TAIL_MAX_BYTES },
 				stderr: { maxBytes: TAIL_MAX_BYTES }
 			},
-			env: {
-				...process.env,
+			env: await localCommandEnv({
 				DSH_WORKSPACE: input.workspacePath,
 				DSH_WORKSPACE_ID: input.workspaceId,
 				DSH_WORKSPACE_TITLE: input.workspaceTitle
-			}
+			})
 		});
 		const live = {
 			runId,
@@ -556,43 +689,67 @@ const WorkspaceCommandsSchema = z.object({
 	commands: z.array(CommandSchema).max(200)
 });
 const QuickCommandsSettingsSchema = z.object({
-	workspaces: z.array(WorkspaceCommandsSchema).max(500),
-	popupAnchor: z.union([z.const("corner"), z.const("button")]).default("corner"),
+	workspaces: z.array(WorkspaceCommandsSchema).max(500).volatile(),
+	popupAnchor: z.union([z.const("corner"), z.const("button")]).default("corner").volatile(),
 	popupSize: z.object({
 		width: z.number().min(320).max(8192),
 		height: z.number().min(200).max(8192)
-	})
+	}).volatile()
 });
-const DEFAULT_SETTINGS = {
-	workspaces: [],
-	popupAnchor: "corner"
-};
-function registerSettings(ctx) {
-	let current = {
-		...DEFAULT_SETTINGS,
-		workspaces: []
+/**
+* Read one config field. A volatile field arrives as a handle (dsh >= 0.1.7)
+* and is read through `.get()` on EVERY access, so edits made through the
+* settings plane are visible immediately; hosts that hand the plain value keep
+* working unchanged.
+*/
+function readField(field, fallback) {
+	if (field === void 0 || field === null) return fallback;
+	const handle = field;
+	const value = typeof handle.get === "function" ? handle.get() : field;
+	return value === void 0 || value === null ? fallback : value;
+}
+function registerSettings(ctx, config) {
+	const readWorkspaces = () => {
+		const value = readField(config?.workspaces, []);
+		return Array.isArray(value) ? value : [];
+	};
+	const readAnchor = () => readField(config?.popupAnchor, "corner") === "button" ? "button" : "corner";
+	const readPopupSize = () => {
+		const value = readField(config?.popupSize, void 0);
+		if (typeof value !== "object" || value === null) return void 0;
+		const { width, height } = value;
+		if (typeof width !== "number" || typeof height !== "number") return void 0;
+		if (!Number.isFinite(width) || !Number.isFinite(height)) return void 0;
+		return {
+			width: Math.round(width),
+			height: Math.round(height)
+		};
+	};
+	/** Current document, rebuilt from the live config fields on every read. */
+	const readDocument = () => {
+		const size = readPopupSize();
+		return {
+			workspaces: readWorkspaces(),
+			popupAnchor: readAnchor(),
+			...size === void 0 ? {} : { popupSize: size }
+		};
 	};
 	let service;
 	ctx.inject(["settings"], (sctx) => {
 		service = sctx.settings;
-		const scope = service.register(QUICK_COMMANDS_NS, QuickCommandsSettingsSchema);
-		current = scope.get();
-		scope.watch((next) => {
-			current = next;
-		});
 	});
 	async function persist(patch) {
 		if (service === void 0) throw new Error("@fonlan/dsh-quick-commands: settings service is not available in this profile");
 		await service.update(QUICK_COMMANDS_NS, patch);
 	}
 	return {
-		get: () => current,
+		get: readDocument,
 		commandsOf: (workspaceId) => {
-			const set = current.workspaces.find((w) => w.workspaceId === workspaceId);
+			const set = readWorkspaces().find((w) => w.workspaceId === workspaceId);
 			return set === void 0 ? [] : set.commands;
 		},
 		setCommands: async (workspaceId, commands) => {
-			const next = current.workspaces.filter((w) => w.workspaceId !== workspaceId);
+			const next = readWorkspaces().filter((w) => w.workspaceId !== workspaceId);
 			if (commands.length > 0) next.push({
 				workspaceId,
 				commands
@@ -837,10 +994,8 @@ function registerApiRoutes(ctx, runner, settings) {
 			};
 		}
 	}
-	const webServer = ctx.get("webServer");
-	if (webServer === void 0) return () => void 0;
 	return ctx.effect(() => {
-		return webServer.register({
+		return ctx.webServer.register({
 			kind: "prefix",
 			path: API_PREFIX,
 			handler: async (req, res) => {
@@ -871,33 +1026,32 @@ function registerApiRoutes(ctx, runner, settings) {
 //#region src/index.ts
 const name = "@fonlan/dsh-quick-commands";
 const inject = ["settings"];
-/** No plugin-level config; all configuration lives in the settings namespace. */
-function apply(ctx) {
-	const settings = registerSettings(ctx);
-	const subprocess = ctx.get("subprocess");
-	if (subprocess === void 0) {
-		ctx.logger?.warn?.("@fonlan/dsh-quick-commands: subprocess service unavailable; commands cannot run");
-		return;
-	}
-	const resolveRemote = () => {
-		const sshPool = ctx.get("sshPool");
-		if (sshPool === void 0 || typeof sshPool.acquire !== "function" || typeof sshPool.release !== "function") return;
-		return {
-			pool: sshPool,
-			resolveHost: (hostId) => readHostConfig((ns) => {
-				try {
-					return ctx.get("settings")?.get(ns);
-				} catch {
-					return;
-				}
-			}, hostId)
+const Config = QuickCommandsSettingsSchema;
+/** Configuration rides the entry config; edits persist through the settings service. */
+function apply(ctx, config) {
+	const settings = registerSettings(ctx, config);
+	ctx.inject(["subprocess", "webServer"], (sctx) => {
+		const subprocess = sctx.get("subprocess");
+		const resolveRemote = () => {
+			const sshPool = sctx.get("sshPool");
+			if (sshPool === void 0 || typeof sshPool.acquire !== "function" || typeof sshPool.release !== "function") return;
+			return {
+				pool: sshPool,
+				resolveHost: (hostId) => readHostConfig((ns) => {
+					try {
+						return sctx.get("settings")?.get(ns);
+					} catch {
+						return;
+					}
+				}, hostId)
+			};
 		};
-	};
-	const runner = new QuickCommandRunner(subprocess, () => resolveRemote());
-	ctx.effect(() => registerApiRoutes(ctx, runner, settings), "quick-commands: api routes");
-	ctx.effect(() => () => {
-		for (const id of runner.listAll()) runner.kill(id);
-	}, "quick-commands: process cleanup");
+		const runner = new QuickCommandRunner(subprocess, () => resolveRemote());
+		sctx.effect(() => registerApiRoutes(sctx, runner, settings), "quick-commands: api routes");
+		sctx.effect(() => () => {
+			for (const id of runner.listAll()) runner.kill(id);
+		}, "quick-commands: process cleanup");
+	});
 }
 //#endregion
-export { apply, inject, name };
+export { Config, apply, inject, name };

package/lib/types/index.d.ts

@@ -13,7 +13,9 @@
  * absence of dsh-ssh degrades cleanly to local-only behaviour.
  */
 import type { Context } from '@deepseek-ai/cordis';
+import type { QuickCommandsSettings } from './shared/contract.js';
 export declare const name = "@fonlan/dsh-quick-commands";
 export declare const inject: string[];
-/** No plugin-level config; all configuration lives in the settings namespace. */
-export declare function apply(ctx: Context): void;
+export declare const Config: import("@deepseek-ai/schemastery").default<QuickCommandsSettings>;
+/** Configuration rides the entry config; edits persist through the settings service. */
+export declare function apply(ctx: Context, config: QuickCommandsSettings): void;

package/lib/types/server/settings.d.ts

@@ -1,8 +1,18 @@
 /**
  * User-facing plugin settings (per-workspace command sets + popup anchor),
- * persisted through the settings service namespace `quick-commands`.
- * The DSH settings service requires a lowercase kebab-case namespace
- * (/^[a-z][a-z0-9-]*$/), so the scoped package name cannot be used here.
+ * carried by this bundle's entry config: dsh >= 0.1.7 owns plugin settings as
+ * entry config (the plugin's `Config` schema) and persists edits through
+ * `settings.update`.
+ *
+ * All three fields are declared `volatile()` — that is what makes them
+ * writable by the settings plane — and schemastery hands a volatile field to
+ * `apply()` as a LIVE HANDLE (`{ get() }`), not as the value. Reading the raw
+ * field therefore yields the handle object, which silently destroys the whole
+ * document: `Array.isArray(handle)` is false, JSON renders `{}`, and a
+ * `.default('corner')` union arrives as the handle rather than a literal.
+ * Every read goes through {@link readField} instead, which unwraps handles and
+ * still accepts plain values (hosts that resolve the config without the
+ * volatile wrapper).
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
@@ -21,4 +31,4 @@ export interface QuickCommandsSettingsFace {
     /** Persist the output popup size (drag-resize). */
     setPopupSize(size: QuickPopupSize): Promise<void>;
 }
-export declare function registerSettings(ctx: Context): QuickCommandsSettingsFace;
+export declare function registerSettings(ctx: Context, config: QuickCommandsSettings): QuickCommandsSettingsFace;

package/lib/types/server/shell-path.d.ts

@@ -0,0 +1,69 @@
+/** Delimiters wrapping the shell's own PATH in the probe's stdout. */
+export declare const PATH_START = "__DSH_QC_PATH_START__";
+export declare const PATH_END = "__DSH_QC_PATH_END__";
+/** Default deadline for the login-shell probe (ms). */
+export declare const PROBE_TIMEOUT_MS = 3000;
+/** Minimal probe runner shape: `child_process.execFile`, or a test double. */
+export type ProbeRunner = (file: string, args: string[], options: {
+    timeout: number;
+    windowsHide: boolean;
+    env: NodeJS.ProcessEnv;
+}) => Promise<{
+    stdout?: string | Buffer;
+}>;
+/**
+ * Extract the PATH a shell printed between the markers.
+ *
+ * Login profiles are free to print their own noise (nvm notices, version
+ * managers, MOTDs), so only the marked span counts — never the whole stdout.
+ * @param stdout - raw probe stdout.
+ * @returns the marked PATH, or '' when the markers are missing.
+ */
+export declare function extractShellPath(stdout: unknown): string;
+/**
+ * Put the login-shell PATH in front of the inherited one.
+ *
+ * The login PATH wins (that is where the user's toolchain lives); entries from
+ * the inherited PATH stay behind it as a fallback. Empty entries are dropped
+ * and duplicates keep their first position.
+ * @param loginPath - PATH reported by the login shell ('' when unavailable).
+ * @param inheritedPath - the host process's own PATH.
+ * @returns the merged PATH (the inherited value when there is no login one).
+ */
+export declare function mergePaths(loginPath: string, inheritedPath: string | undefined): string;
+/** The shell program whose login PATH describes this user's environment. */
+export declare function loginShell(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Ask `shell` (interactive login) for its PATH.
+ *
+ * Both flags matter: `-l` sources the profile files that own the system PATH
+ * (on macOS `/etc/zprofile` → `path_helper`), `-i` additionally sources the
+ * interactive config where nvm/fnm/volta and other version managers install
+ * their shims (this user's node lives in `~/.zshrc`). A hung or noisy
+ * interactive profile cannot block a run: the probe carries a deadline, and
+ * only the marked span of stdout is read.
+ * @param options.shell - shell program; defaults to `$SHELL`.
+ * @param options.timeoutMs - probe deadline.
+ * @param options.run - probe runner, injectable for tests.
+ * @param options.env - environment the probe itself runs with.
+ * @returns the login PATH, or '' when it cannot be determined.
+ */
+export declare function resolveLoginShellPath(options?: {
+    shell?: string | undefined;
+    timeoutMs?: number;
+    run?: ProbeRunner;
+    env?: NodeJS.ProcessEnv;
+}): Promise<string>;
+/** Cached, process-wide login-shell PATH (one probe per host lifetime). */
+export declare function loginShellPath(): Promise<string>;
+/** Drop the cache (tests, and settings reloads that may have changed `$SHELL`). */
+export declare function resetLoginShellPathCache(): void;
+/**
+ * Environment for one local quick command.
+ *
+ * A copy of the host environment with the login-shell PATH merged in front, so
+ * Desktop-launched hosts see the same toolchain a terminal-launched host does.
+ * @param overrides - plugin-owned variables (DSH_WORKSPACE*) merged last.
+ * @returns the spawn environment.
+ */
+export declare function localCommandEnv(overrides?: Record<string, string>): Promise<NodeJS.ProcessEnv>;

package/lib/types/shared/contract.d.ts

@@ -33,6 +33,13 @@ export interface QuickCommandsSettings {
     /** Output popup size; absent until the user drags the resize handle (then per-anchor defaults apply). */
     popupSize?: QuickPopupSize;
 }
+/**
+ * The document's anchor as a usable literal. Wire data is defensive by
+ * contract: an older host can still answer with schemastery's empty-object
+ * resolution (`{}`) for this field, which must never reach a CSS class name or
+ * a radio `checked` comparison.
+ */
+export declare function anchorOf(value: unknown): 'corner' | 'button';
 /** Placeholder substitution values resolved for one execution. */
 export interface QuickRunPlaceholders {
     /** Workspace root path (also the execution cwd). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fonlan/dsh-quick-commands",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "DSH web plugin: per-workspace quick commands. Configure named shell commands per DSH workspace, run one from the session header with live stdout/stderr in a floating popup.",
   "license": "MIT",
   "repository": {
@@ -44,6 +44,18 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "rm -rf lib && tsc -p tsconfig.build.json && tsdown",
+    "build:client": "tsdown",
+    "prepare": "npm run build",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.client.json",
+    "test": "node --experimental-transform-types --test test/remote.test.ts test/settings-config.test.ts test/host-apply.test.ts test/shell-path.test.ts && node test/header-icons.test.mjs",
+    "bundle": "tsdown",
+    "watch": "tsdown --watch",
+    "release:patch": "npm version patch && git push && git push --tags",
+    "release:minor": "npm version minor && git push && git push --tags",
+    "release:major": "npm version major && git push && git push --tags"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -63,42 +75,33 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.2-alpha.2",
     "@deepseek-ai/dsh-settings": "^0.1.2-alpha.2",
     "@deepseek-ai/dsh-subprocess": "^0.1.2-alpha.2",
     "@deepseek-ai/dsh-workspace": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.2-alpha.2",
     "@deepseek-ai/schemastery": "^3.18.2",
-    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-alpha.2",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "devDependencies": {
+    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-workspace": "^0.1.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.3",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.1",
     "@types/react-dom": "~18.3.0",
     "tsdown": "^0.22.14",
-    "typescript": "^5.9.0",
-    "@deepseek-ai/dsh-settings": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-subprocess": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-workspace": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.2-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
-    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.2-alpha.2"
+    "typescript": "^5.9.0"
   },
-  "scripts": {
-    "build": "rm -rf lib && tsc -p tsconfig.build.json && tsdown",
-    "build:client": "tsdown",
-    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.client.json",
-    "bundle": "tsdown",
-    "watch": "tsdown --watch",
-    "release:patch": "npm version patch && git push && git push --tags",
-    "release:minor": "npm version minor && git push && git push --tags",
-    "release:major": "npm version major && git push && git push --tags"
-  }
-}
+  "packageManager": "pnpm@11.21.0"
+}

package/src/client/header.tsx

@@ -8,20 +8,18 @@
  */
 import { useEffect, useLayoutEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
-import {
-  IconPlayOutline16,
-  IconCloseOutline16,
-  IconStopFill16,
-} from '@deepseek-ai/dsh-client-ui-primitives'
+import { PlayIcon, CloseIcon, StopIcon } from './icons'
 import { quickApi } from './api'
 import { useRunPopover, openMenu, closeMenu, openRun, closeRun } from './run-state'
-import type { QuickPopupSize } from '../shared/contract'
+import { anchorOf, type QuickPopupSize } from '../shared/contract'
 
 /** Workspace row shape the standard useWorkspaces hook exposes. */
 interface WorkspaceRow {
   workspaceId: string
   path: string
   title: string
+  /** Session membership; the canonical link DSH itself resolves Workspaces by. */
+  sessionIds?: string[]
 }
 
 /** Session list state subset we read (cwd + id). */
@@ -91,7 +89,12 @@ function useCurrentWorkspace(
 ): { workspace: WorkspaceRow | undefined; cwd: string | undefined } {
   const row = useSessions?.((s) => s.byId[sessionId]) as SessionRow | undefined
   const workspaces = useWorkspaces?.((s) => s.items) as WorkspaceRow[] | undefined
-  return { workspace: matchWorkspace(row?.cwd, workspaces ?? []), cwd: row?.cwd }
+  const items = workspaces ?? []
+  // Membership first (how DSH core resolves a session's Workspace, and the only
+  // link that survives when a session runs outside the Workspace root), then
+  // the longest cwd prefix as the fallback for hosts without membership data.
+  const byMembership = items.find((ws) => ws.sessionIds?.includes(sessionId) === true)
+  return { workspace: byMembership ?? matchWorkspace(row?.cwd, items), cwd: row?.cwd }
 }
 
 /** Header icon button + command menu + live output popup. */
@@ -159,7 +162,7 @@ export function QuickCommandsHeaderAction(props: HeaderProps): JSX.Element {
         const own = entries.find((e) => e.workspaceId === workspace?.workspaceId)
         setCommands(own === undefined ? [] : own.commands)
         setMenuRemoteHost(own?.remoteHost ?? null)
-        setAnchor(settings.popupAnchor)
+        setAnchor(anchorOf(settings.popupAnchor))
         setPopupSize(settings.popupSize)
         setMenuLoadError(null)
       } catch (e) {
@@ -201,7 +204,7 @@ export function QuickCommandsHeaderAction(props: HeaderProps): JSX.Element {
         disabled={workspace === undefined}
         onClick={() => { popover.menuOpen ? closeMenu() : openMenu() }}
       >
-        <IconPlayOutline16 size={15} />
+        <PlayIcon size={15} />
       </button>
 
       {popover.menuOpen && workspace !== undefined && menuPosition !== null && createPortal(
@@ -216,7 +219,7 @@ export function QuickCommandsHeaderAction(props: HeaderProps): JSX.Element {
             {menuRemoteHost !== null && <span className="qc-menu-remote" title={`SSH · ${menuRemoteHost}`}>SSH</span>}
             <span className="qc-menu-ws">{workspace.title}</span>
             <button type="button" className="qc-menu-close" aria-label={t('runClose')} onClick={closeMenu}>
-              <IconCloseOutline16 size={12} />
+              <CloseIcon size={12} />
             </button>
           </div>
           {commands.length === 0 && (
@@ -495,7 +498,7 @@ function RunPopup(props: {
           aria-label={t('runKill')}
           onClick={() => void kill()}
         >
-          <IconStopFill16 size={14} />
+          <StopIcon size={14} />
         </button>
         <button
           type="button"
@@ -505,7 +508,7 @@ function RunPopup(props: {
           onPointerUp={onClosePointerUp}
           onClick={closeOutput}
         >
-          <IconCloseOutline16 size={14} />
+          <CloseIcon size={14} />
         </button>
       </header>