@itsyuyi/dsh-session-manager 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 itsyuyi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,85 @@
+# @itsyuyi/dsh-session-manager
+
+DeepSeek Harness (DSH) plugin for **workspace session management** — currently: a durable **“Delete session”** action, right in the sidebar session row menu, with a host-styled confirmation dialog.
+
+为 DeepSeek Harness 提供**工作区会话管理**能力——当前版本：在侧栏会话行菜单中增加可**彻底删除会话**的操作，配宿主风格确认弹窗。
+
+## Features / 功能
+
+- **“Delete session” menu row** appended to each session's `…` menu (after the shipped pin / rename / fork / archive rows), styled exactly like the host's destructive menu rows (theme tokens only, light & dark).
+  每个会话“…”菜单末尾追加红色“删除会话”项，样式与宿主内置菜单行一致（仅用主题 token，自动适配明暗主题）。
+- **Host-styled confirmation dialog** rendered in the `shell.overlay` slot: Escape / mask click dismiss, Cancel focused on open, in-flight and error states live inside the dialog.
+  宿主同款确认弹窗：Esc/点遮罩关闭、打开即聚焦“取消”、删除中与错误状态都在弹窗内展示。
+- **Durable deletion** — removes the session log artifact and detaches it from every workspace account (archive/pin sets included). The sidebar refreshes automatically; the search index reconciles itself on the next search.
+  彻底删除——移除会话日志工件并从所有工作区登记（含归档/置顶集合）中摘除。侧栏自动刷新，搜索索引下次搜索时自动同步。
+- **Safety guard** — refuses to delete a session with actual running work (a turn in flight, owned jobs, live subagents, active schedules), using the exact same `workspace/session-activity` admission the host's own archive flow uses. Idle sessions — even currently open ones — are deletable.
+  安全保护——复用宿主归档同款的活跃判定：只拒绝**真正在运行**的会话（回合/任务/子代理/日程），空闲会话（即使打开着）可删。
+- **Localized** — UI copy follows the host language (中文 / English), live-switching.
+  界面文案跟随宿主语言，实时切换。
+- **Verification tool** — `verify-session.mjs` checks on disk whether a session is truly gone (artifact directory + workspace registry), by session id **or title**.
+  附带核对脚本：按 id 或标题确认会话是否已从系统目录真正删除。
+
+## Requirements / 环境要求
+
+- DeepSeek Harness (web surface), DSH `0.1.7` generation (`@deepseek-ai/cordis` 4.x)
+- Node `^22.19.0 || >=24.0.0`
+
+## Install / 安装
+
+In any DSH agent session, ask the agent (or use the plugin manager) to install from npm:
+在任意 DSH 会话里让 Agent 执行（或通过插件管理器）从 npm 安装：
+
+```
+plugin_manager install_bundle  target: @itsyuyi/dsh-session-manager
+```
+
+Or install from a local clone / 或从本地克隆安装：
+
+```bash
+git clone https://github.com/itsyuyi/dsh-session-manager.git
+# then: plugin_manager install_bundle  target: /absolute/path/to/dsh-session-manager
+```
+
+Then **refresh the browser page** once to load the client module.
+安装后**刷新一次页面**以加载客户端模块。
+
+Uninstall / 卸载：`plugin_manager remove_bundle @itsyuyi/dsh-session-manager`
+
+## Usage / 使用
+
+1. Hover a session row in the sidebar → click `…` → **Delete session / 删除会话**.
+2. Confirm in the dialog. Done — the row disappears immediately.
+   弹窗确认后即删除，侧栏行立即消失。
+
+If the session is actually running, the dialog tells you to stop it first (this includes the session you are chatting in while it is mid-turn).
+若会话正在运行，弹窗会提示先停止（包括你正在对话中的会话）。
+
+### Verify deletion / 核对删除结果
+
+```bash
+node verify-session.mjs              # list every known session with on-disk status
+node verify-session.mjs "Some title" # check one session by title or id
+```
+
+“Deleted” means: artifact directory under `~/.dsh/sessions/` gone **and** no reference left in `workspace.json`. Projection-cache leftovers are derived data and never read again (harmless).
+“已删除”判定：`~/.dsh/sessions/` 下工件目录消失 **且** `workspace.json` 无引用。投影缓存残留属派生数据，不会再被读取（无害）。
+
+## How it works / 工作原理
+
+| Half | Mechanism |
+|---|---|
+| Host (`index.js`) | Registers `POST /plugins/dsh-session-manager/delete-session` on the host web server. Deletion = activity check (`workspace/session-activity` waterfall) → unarchive/unpin → `detachSession` from every workspace → `rm -rf` the session's JSONL artifact directory (traversal-proof: only ever removes existing directory names under the persistence root). |
+| Client (`client.js`) | Registers a menu row in `sidebar.workspaces.session.menu.item` and a confirmation dialog in `shell.overlay`, sharing one request store. Styling copied from the host Modal/Menu/Button rules under a `dsm-` prefix using only `--dsw-*` theme tokens. |
+
+The SQLite session-search index needs no write: it reconciles against the persistence listing on the next search and drops vanished sessions automatically.
+
+## Notes / 说明
+
+- Replacing the plugin's **host** code requires restarting `dsh web` (Node ESM module cache); client code reloads on page refresh.
+  修改插件 Host 端代码需重启 `dsh web` 才能重载；Client 端刷新页面即可。
+- Deleting a session is **irreversible** — prefer the built-in *Archive* when you may come back.
+  删除**不可恢复**——想留后路请用内置“归档”。
+
+## License
+
+MIT © 2026 itsyuyi

package/client.js

@@ -0,0 +1,402 @@
+/**
+ * Client half of @itsyuyi/dsh-session-manager.
+ *
+ * Two cooperating slot entries share one module-scoped request store:
+ *
+ *   1. `sidebar.workspaces.session.menu.item` — a destructive "Delete session"
+ *      row (after the shipped pin/rename/fork/archive rows). Clicking it closes
+ *      the menu and raises a delete request; it never deletes inline.
+ *   2. `shell.overlay` — a centered confirmation dialog rendered only while a
+ *      request is pending. It mirrors the host's archive-confirm dialog: Escape
+ *      and mask click dismiss, the Cancel button is focused on open, the
+ *      in-flight and error states live and die with the request, and a refused
+ *      live session shows the localized reason inside the dialog.
+ *
+ * Localization reads `document.documentElement.lang`, which the host locale
+ * plugin keeps in sync with the active locale ("zh-CN" for Chinese, "en"
+ * otherwise); a MutationObserver re-renders on a live language switch. This
+ * avoids depending on `ctx.locale` being injected into this module.
+ *
+ * Styling copies the host Modal / Button / dialog-status rules under the
+ * `dsm-` prefix and references only `--dsw-*` theme tokens, so light and dark
+ * themes and the macOS title-bar clearance all follow the host. The stylesheet
+ * is inserted once in `apply` and removed on unload.
+ */
+window.__ModuleLoader__.load({
+  id: '@itsyuyi/dsh-session-manager',
+  factory(require) {
+    const React = require('react');
+    const h = React.createElement;
+
+    const ROUTE = '/plugins/dsh-session-manager/delete-session';
+
+    /* ---------------------------------------------------------------- */
+    /* Localization                                                      */
+    /* ---------------------------------------------------------------- */
+
+    const DICTS = {
+      zh: {
+        menuLabel: '删除会话',
+        title: '删除会话',
+        desc: '确定要删除会话“{title}”吗？会话记录将被永久移除，此操作不可恢复。',
+        close: '关闭',
+        cancel: '取消',
+        confirm: '删除',
+        pending: '正在删除…',
+        live: '会话正在运行（有进行中的回合或任务），请等待结束或先停止，再删除。',
+        failed: '删除失败，请稍后重试。',
+      },
+      en: {
+        menuLabel: 'Delete session',
+        title: 'Delete session',
+        desc: 'Delete session “{title}”? Its history will be permanently removed. This cannot be undone.',
+        close: 'Close',
+        cancel: 'Cancel',
+        confirm: 'Delete',
+        pending: 'Deleting…',
+        live: 'Session is running (a turn or task is in progress); wait for it to finish or stop it first.',
+        failed: 'Delete failed, please retry.',
+      },
+    };
+
+    function activeLang(ctx) {
+      if (typeof document !== 'undefined' && document.documentElement && document.documentElement.lang)
+        return document.documentElement.lang;
+      try {
+        const a = ctx && ctx.locale && ctx.locale.getLocale && ctx.locale.getLocale().active;
+        if (a) return String(a);
+      } catch {
+        /* no locale service — fall through */
+      }
+      return 'en';
+    }
+
+    function dictForLang(lang) {
+      return String(lang || '').toLowerCase().startsWith('zh') ? DICTS.zh : DICTS.en;
+    }
+
+    /** Reactive dictionary: follows `document.documentElement.lang` live. */
+    function useDict(ctx) {
+      const [lang, setLang] = React.useState(() => activeLang(ctx));
+      React.useEffect(() => {
+        if (typeof document === 'undefined' || !document.documentElement) return undefined;
+        const el = document.documentElement;
+        const sync = () => setLang(activeLang(ctx));
+        sync();
+        let observer;
+        try {
+          observer = new MutationObserver(sync);
+          observer.observe(el, { attributes: true, attributeFilter: ['lang'] });
+        } catch {
+          observer = undefined;
+        }
+        let unsubLocale;
+        try {
+          unsubLocale = ctx && ctx.locale && ctx.locale.subscribe ? ctx.locale.subscribe(sync) : undefined;
+        } catch {
+          unsubLocale = undefined;
+        }
+        return () => {
+          if (observer) observer.disconnect();
+          if (typeof unsubLocale === 'function') unsubLocale();
+        };
+      }, [ctx]);
+      return dictForLang(lang);
+    }
+
+    /* ---------------------------------------------------------------- */
+    /* Shared request store (module-scoped, plain pub/sub)              */
+    /* ---------------------------------------------------------------- */
+
+    function createDeleteStore() {
+      let pending = null; // { sessionId, displayTitle } | null
+      const listeners = new Set();
+      const emit = () => {
+        for (const fn of listeners) fn();
+      };
+      return {
+        getSnapshot: () => pending,
+        subscribe(fn) {
+          listeners.add(fn);
+          return () => {
+            listeners.delete(fn);
+          };
+        },
+        request(p) {
+          pending = p;
+          emit();
+        },
+        clear() {
+          if (pending === null) return;
+          pending = null;
+          emit();
+        },
+      };
+    }
+
+    function usePending(store) {
+      const [pending, setPending] = React.useState(store.getSnapshot);
+      React.useEffect(() => store.subscribe(() => setPending(store.getSnapshot())), [store]);
+      return pending;
+    }
+
+    /* ---------------------------------------------------------------- */
+    /* Stylesheet (host Modal + Button + dialog-status rules, dsm-)      */
+    /* ---------------------------------------------------------------- */
+
+    const CSS = [
+      /* Menu row (host Menu.module.css .item + .danger) */
+      '.dsm-separator{height:.5px;margin:3px 2px;background:var(--dsw-alias-border-l2);flex:none;}',
+      '.dsm-item{display:flex;align-items:center;gap:6px;width:100%;min-height:34px;padding:6px 8px;border:none;border-radius:8px;background:transparent;cursor:pointer;font-size:13px;line-height:20px;font-family:inherit;color:var(--dsw-alias-state-error-primary);text-align:left;}',
+      '.dsm-item:hover:not(:disabled),.dsm-item:focus-visible:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger);outline:none;}',
+      '.dsm-item:disabled{opacity:.4;cursor:not-allowed;}',
+      '.dsm-icon{display:inline-flex;flex:none;width:14px;height:14px;align-items:center;justify-content:center;color:var(--dsw-alias-state-error-primary);}',
+      '.dsm-icon svg{width:14px;height:14px;}',
+      '.dsm-label{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;}',
+      /* Modal (host Modal.module.css) */
+      '.dsm-modalRoot{position:fixed;inset:0;z-index:1000;display:flex;align-items:center;justify-content:center;padding:max(24px,var(--dsh-frame-top-clearance,24px)) 24px;}',
+      '.dsm-mask{position:absolute;inset:0;background:var(--dsw-alias-bg-mask-1);backdrop-filter:var(--dsw-mask-blur);}',
+      '.dsm-dialog{position:relative;z-index:1;display:flex;flex-direction:column;gap:20px;width:min(380px,100%);padding:0 0 24px;overflow:hidden;border:0;border-radius:24px;background:var(--dsw-alias-bg-layer-2);box-shadow:var(--dsw-elevation-prominent);}',
+      '.dsm-content{display:flex;flex-direction:column;width:100%;}',
+      '.dsm-header{display:flex;align-items:center;justify-content:space-between;gap:8px;padding:22px 14px 12px 24px;}',
+      '.dsm-title{margin:0;font-size:16px;line-height:24px;font-weight:500;color:var(--dsw-alias-label-primary);}',
+      '.dsm-close{flex:none;display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;border:none;border-radius:8px;background:transparent;cursor:pointer;color:var(--dsw-alias-label-secondary);}',
+      '.dsm-close:hover{background:var(--dsw-alias-interactive-bg-hover);}',
+      '.dsm-close svg{width:14px;height:14px;}',
+      '.dsm-description{margin:0;padding:0 24px;font-size:14px;line-height:22px;font-weight:400;color:var(--dsw-alias-label-primary);overflow-wrap:anywhere;}',
+      '.dsm-body{display:flex;flex-direction:column;min-width:0;margin-top:20px;padding:0 24px;gap:8px;}',
+      '.dsm-body:empty{display:none;}',
+      '.dsm-footer{display:flex;align-items:center;justify-content:flex-end;gap:8px;padding:0 24px;}',
+      /* Buttons (host Button.module.css: outline + geometry) */
+      '.dsm-btn{display:inline-flex;align-items:center;justify-content:center;gap:4px;border:none;border-radius:18px;cursor:pointer;font-size:14px;line-height:22px;height:36px;padding:0 14px;font-family:inherit;color:var(--dsw-alias-label-primary);background:transparent;}',
+      '.dsm-btn:disabled{cursor:not-allowed;opacity:.4;}',
+      '.dsm-outline{border:.5px solid var(--dsw-alias-border-l3);background:transparent;}',
+      '.dsm-outline:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover);}',
+      '.dsm-deleteAction:not(:disabled){color:var(--dsw-alias-state-error-primary);}',
+      /* Dialog status + error (host workspace dialog) */
+      '.dsm-status{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px;}',
+      '.dsm-error{color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px;}',
+    ].join('\n');
+
+    /* ---------------------------------------------------------------- */
+    /* Icons                                                             */
+    /* ---------------------------------------------------------------- */
+
+    function TrashIcon() {
+      return h(
+        'svg',
+        { viewBox: '0 0 16 16', fill: 'none', 'aria-hidden': 'true', focusable: 'false' },
+        h('path', {
+          d: 'M2.75 4.25h10.5M6.25 4.25V3.4a1.15 1.15 0 0 1 1.15-1.15h1.2a1.15 1.15 0 0 1 1.15 1.15v.85M4.5 4.25l.42 7.98c.03.6.53 1.07 1.13 1.07h3.9c.6 0 1.1-.47 1.13-1.07l.42-7.98M6.6 6.75v4.25M9.4 6.75v4.25',
+          stroke: 'currentColor',
+          strokeWidth: 1.2,
+          strokeLinecap: 'round',
+          strokeLinejoin: 'round',
+        }),
+      );
+    }
+
+    function CloseIcon() {
+      return h(
+        'svg',
+        { viewBox: '0 0 14 14', fill: 'none', 'aria-hidden': 'true', focusable: 'false' },
+        h('path', {
+          d: 'M3 3l8 8M11 3l-8 8',
+          stroke: 'currentColor',
+          strokeWidth: 1.3,
+          strokeLinecap: 'round',
+        }),
+      );
+    }
+
+    /* ---------------------------------------------------------------- */
+    /* Menu item                                                         */
+    /* ---------------------------------------------------------------- */
+
+    function createMenuItem(ctx, store) {
+      return function DeleteSessionMenuItem(props) {
+        const { sessionId, displayTitle, useMenuOpenState } = props;
+        const [, setMenuOpen] = useMenuOpenState();
+        const t = useDict(ctx);
+        return h(
+          React.Fragment,
+          null,
+          h('div', { className: 'dsm-separator', 'aria-hidden': 'true' }),
+          h(
+            'button',
+            {
+              type: 'button',
+              role: 'menuitem',
+              className: 'dsm-item',
+              title: t.menuLabel,
+              onClick: () => {
+                setMenuOpen(false);
+                store.request({ sessionId, displayTitle: displayTitle || sessionId });
+              },
+            },
+            h('span', { className: 'dsm-icon' }, h(TrashIcon)),
+            h('span', { className: 'dsm-label' }, t.menuLabel),
+          ),
+        );
+      };
+    }
+
+    /* ---------------------------------------------------------------- */
+    /* Confirmation dialog (shell.overlay)                              */
+    /* ---------------------------------------------------------------- */
+
+    function createDialog(ctx, store) {
+      return function DeleteSessionDialog() {
+        const pending = usePending(store);
+        const t = useDict(ctx);
+        if (!pending) return null;
+        // Keyed by session so in-flight/error state dies with its request.
+        return h(DeleteDialogForm, { key: pending.sessionId, request: pending, store, t });
+      };
+    }
+
+    function DeleteDialogForm({ request, store, t }) {
+      const [busy, setBusy] = React.useState(false);
+      const [error, setError] = React.useState(null);
+      const cancelRef = React.useRef(null);
+
+      // Dismiss the dialog; ignored while a delete is in flight.
+      const requestClose = React.useCallback(() => {
+        if (busy) return;
+        store.clear();
+      }, [busy, store]);
+
+      const confirm = React.useCallback(() => {
+        setBusy(true);
+        setError(null);
+        (async () => {
+          try {
+            const res = await fetch(ROUTE, {
+              method: 'POST',
+              credentials: 'same-origin',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ sessionId: request.sessionId }),
+            });
+            const body = await res.json().catch(() => ({}));
+            if (res.ok && body && body.ok === true) {
+              store.clear();
+              return;
+            }
+            const code = body && body.error;
+            setError(code === 'session-live' ? t.live : body && body.message ? String(body.message) : t.failed);
+          } catch {
+            setError(t.failed);
+          } finally {
+            setBusy(false);
+          }
+        })();
+      }, [request.sessionId, store, t]);
+
+      // Escape dismisses (unless busy).
+      React.useEffect(() => {
+        const onKey = (e) => {
+          if (e.key !== 'Escape') return;
+          if (busy) return;
+          e.stopPropagation();
+          store.clear();
+        };
+        document.addEventListener('keydown', onKey);
+        return () => document.removeEventListener('keydown', onKey);
+      }, [busy, store]);
+
+      // Focus the Cancel button on open.
+      React.useEffect(() => {
+        if (cancelRef.current) cancelRef.current.focus();
+      }, []);
+
+      const description = t.desc.replace('{title}', request.displayTitle || request.sessionId);
+
+      return h(
+        'div',
+        { className: 'dsm-modalRoot', role: 'presentation' },
+        h('div', { className: 'dsm-mask', 'aria-hidden': 'true', onClick: requestClose }),
+        h(
+          'div',
+          { className: 'dsm-dialog', role: 'dialog', 'aria-modal': 'true', 'aria-label': t.title },
+          h(
+            'div',
+            { className: 'dsm-content' },
+            h(
+              'div',
+              { className: 'dsm-header' },
+              h('h2', { className: 'dsm-title' }, t.title),
+              h(
+                'button',
+                { type: 'button', className: 'dsm-close', 'aria-label': t.close, onClick: requestClose, disabled: busy },
+                h(CloseIcon),
+              ),
+            ),
+            h('p', { className: 'dsm-description' }, description),
+            h(
+              'div',
+              { className: 'dsm-body' },
+              busy ? h('div', { className: 'dsm-status', role: 'status' }, t.pending) : null,
+              error ? h('div', { className: 'dsm-error', role: 'alert' }, error) : null,
+            ),
+          ),
+          h(
+            'div',
+            { className: 'dsm-footer' },
+            h(
+              'button',
+              { type: 'button', className: 'dsm-btn dsm-outline', ref: cancelRef, disabled: busy, onClick: requestClose },
+              t.cancel,
+            ),
+            h(
+              'button',
+              {
+                type: 'button',
+                className: 'dsm-btn dsm-outline dsm-deleteAction',
+                disabled: busy,
+                onClick: confirm,
+              },
+              t.confirm,
+            ),
+          ),
+        ),
+      );
+    }
+
+    /* ---------------------------------------------------------------- */
+    /* Module face                                                       */
+    /* ---------------------------------------------------------------- */
+
+    return {
+      inject: ['slots'],
+      apply(ctx) {
+        // One stylesheet for both entries, removed on unload.
+        ctx.effect(() => {
+          if (typeof document === 'undefined' || !document.head) return () => {};
+          const el = document.createElement('style');
+          el.setAttribute('data-dsh-session-manager', '');
+          el.textContent = CSS;
+          document.head.appendChild(el);
+          return () => {
+            el.remove();
+          };
+        }, 'dsh-session-manager: styles');
+
+        const store = createDeleteStore();
+
+        ctx.slots.inject('sidebar.workspaces.session.menu.item', () =>
+          ctx.slots.register(
+            { name: 'sidebar.workspaces.session.menu.item', id: 'dsh-session-manager.delete', order: 900 },
+            createMenuItem(ctx, store),
+          ),
+        );
+
+        ctx.slots.inject('shell.overlay', () =>
+          ctx.slots.register(
+            { name: 'shell.overlay', id: 'dsh-session-manager.delete-confirm', order: 100 },
+            createDialog(ctx, store),
+          ),
+        );
+      },
+    };
+  },
+});

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-session-manager
+      name: '@itsyuyi/dsh-session-manager'

package/icon.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <defs>
+    <linearGradient id="g" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#5B7CFA"/>
+      <stop offset="1" stop-color="#3A56C4"/>
+    </linearGradient>
+  </defs>
+  <rect x="2" y="2" width="60" height="60" rx="14" fill="url(#g)"/>
+  <g fill="none" stroke="#FFFFFF" stroke-width="3.2" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M18 24h28"/>
+    <path d="M26.5 24v-4.2a2.3 2.3 0 0 1 2.3-2.3h6.4a2.3 2.3 0 0 1 2.3 2.3V24"/>
+    <path d="M21.5 24l1.4 20.4A4 4 0 0 0 26.9 48h10.2a4 4 0 0 0 4-3.6L42.5 24"/>
+    <path d="M28 31v10"/>
+    <path d="M36 31v10"/>
+  </g>
+</svg>

package/index.js

@@ -0,0 +1,194 @@
+/**
+ * Host half of @itsyuyi/dsh-session-manager.
+ *
+ * Durable session deletion for workspace session management:
+ *   1. refuse while the session is live in this host (an open Session or Agent),
+ *   2. clean the workspace registry (unarchive, unpin, detach from every
+ *      workspace account),
+ *   3. remove the session's JSONL artifact directory from the persistence root.
+ *
+ * The SQLite search index reconciles itself: once `sessionPersistence.list()`
+ * no longer observes the artifact, the next search drops the stale row, so no
+ * index write is needed here. The projection cache is a derived, id-keyed
+ * cache; an orphaned entry is never read again after the log is gone.
+ */
+import { readdir, rm, stat as fsStat } from 'node:fs/promises';
+import { join, resolve, sep } from 'node:path';
+
+const ROUTE = '/plugins/dsh-session-manager/delete-session';
+const MAX_BODY_BYTES = 64 * 1024;
+/**
+ * Accepted session ids: the runtime's `session-<uuid>` / `session-<n>` shape.
+ * The hex-and-dash body rejects path separators and dots outright; artifact
+ * removal is additionally traversal-proof because it only ever matches names
+ * that already exist as directories under the persistence root.
+ */
+const SESSION_ID_PATTERN = /^session-[0-9a-fA-F-]{1,128}$/;
+
+export const inject = ['webServer', 'workspaceRegistry', 'sessionPersistence'];
+
+export function apply(ctx) {
+  ctx.effect(
+    () =>
+      ctx.webServer.register({
+        kind: 'exact',
+        path: ROUTE,
+        handler: (req, res) => serveDeleteSession(ctx, req, res),
+      }),
+    'dsh-session-manager: delete-session route',
+  );
+}
+
+/* ------------------------------------------------------------------ */
+/* HTTP plumbing (same shape the shipped plugin routes use)            */
+/* ------------------------------------------------------------------ */
+
+async function serveDeleteSession(ctx, req, res) {
+  if (req.method !== 'POST') return jsonError(res, 405, 'method-not-allowed');
+  if (!String(req.headers['content-type'] ?? '').toLowerCase().startsWith('application/json'))
+    return jsonError(res, 415, 'json-required');
+  if (!sameOrigin(req)) return jsonError(res, 403, 'origin-rejected');
+
+  let body;
+  try {
+    body = JSON.parse(await readBody(req));
+  } catch {
+    return jsonError(res, 400, 'invalid-request');
+  }
+  const sessionId = typeof body?.sessionId === 'string' ? body.sessionId.trim() : '';
+  if (!SESSION_ID_PATTERN.test(sessionId)) return jsonError(res, 400, 'invalid-session-id');
+
+  try {
+    const result = await deleteSession(ctx, sessionId);
+    res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(result));
+  } catch (error) {
+    jsonError(res, 500, 'delete-failed', error instanceof Error ? error.message : String(error));
+  }
+}
+
+function sameOrigin(req) {
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  if (origin !== undefined && host !== undefined && origin !== `http://${host}` && origin !== `https://${host}`)
+    return false;
+  return true;
+}
+
+async function readBody(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.byteLength;
+    if (bytes > MAX_BODY_BYTES) throw new Error('request too large');
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+function jsonError(res, status, code, message) {
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify(message === undefined ? { ok: false, error: code } : { ok: false, error: code, message }));
+}
+
+/* ------------------------------------------------------------------ */
+/* Deletion                                                            */
+/* ------------------------------------------------------------------ */
+
+async function deleteSession(ctx, sessionId) {
+  // 1. Refuse only sessions with ACTUAL running work — a turn in flight, an
+  //    owned job, a live subagent, or an active schedule. This is exactly the
+  //    host's archive-admission criterion (`workspace/session-activity`
+  //    waterfall): an idle session that merely happens to be open/loaded stays
+  //    deletable. The event bus is global, so dispatching from this plugin's
+  //    context reaches the same turn/job/subagent/schedule listeners the
+  //    registry asks; a non-empty result means "stop it first".
+  const activity = await ctx.waterfall('workspace/session-activity', { sessionId }, () => Promise.resolve([]));
+  const families = Array.isArray(activity) ? activity.map((a) => (a && a.kind) || 'unknown') : [];
+  if (families.length > 0) return { ok: false, error: 'session-live', activity: families, guard: 'activity-v2' };
+
+  // 2. Registry cleanup: clear the registry-global archive/pin sets, then
+  //    detach from every workspace account that lists the session. All three
+  //    are idempotent for unknown ids.
+  let detached = 0;
+  const registry = ctx.workspaceRegistry;
+  if (registry) {
+    try {
+      await registry.unarchiveSession(sessionId);
+    } catch {
+      /* not archived / unknown — nothing to clear */
+    }
+    try {
+      await registry.unpinSession(sessionId);
+    } catch {
+      /* not pinned / unknown — nothing to clear */
+    }
+    for (const workspace of registry.list()) {
+      if (!workspace.sessionIds?.includes(sessionId)) continue;
+      await workspace.detachSession(sessionId);
+      detached += 1;
+    }
+  }
+
+  // 3. Artifact removal under the persistence root.
+  const removed = await removeArtifacts(ctx, sessionId);
+
+  return { ok: true, detached, removedArtifact: removed > 0, removedDirs: removed, guard: 'activity-v2' };
+}
+
+/**
+ * Remove the session's artifact directory. The directory name under each
+ * project directory is `encodeSegment(sessionId)`, which is the identity for
+ * the runtime's `session-<hex>` ids; scanning the root's project directories
+ * for that exact name keeps this independent of the header cwd encoding.
+ * @returns the number of removed directories (0 or 1 in practice).
+ */
+async function removeArtifacts(ctx, sessionId) {
+  const root = ctx.sessionPersistence?.config?.root;
+  if (typeof root !== 'string' || root.length === 0) return 0;
+
+  const names = new Set([sessionId, encodeSegment(sessionId)]);
+  let projects;
+  try {
+    projects = await readdir(root, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+
+  let removed = 0;
+  for (const project of projects) {
+    if (!project.isDirectory()) continue;
+    const projectPath = join(root, project.name);
+    let entries;
+    try {
+      entries = await readdir(projectPath, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || !names.has(entry.name)) continue;
+      const target = resolve(join(projectPath, entry.name));
+      // Containment guard: never escape the persistence root.
+      if (!target.startsWith(resolve(root) + sep)) continue;
+      await rm(target, { recursive: true, force: true });
+      removed += 1;
+    }
+  }
+  return removed;
+}
+
+/** Exact copy of the JSONL backend's segment encoder (safe chars pass through). */
+function encodeSegment(raw) {
+  if (raw.length === 0) throw new Error('cannot encode an empty path segment');
+  if (raw === '.') return '~002E';
+  if (raw === '..') return '~002E~002E';
+  let out = '';
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i);
+    const ch = String.fromCharCode(code);
+    if (ch !== '~' && /^[A-Za-z0-9._-]$/.test(ch)) out += ch;
+    else out += '~' + code.toString(16).toUpperCase().padStart(4, '0');
+  }
+  return out;
+}

package/locale/en.json

@@ -0,0 +1,4 @@
+{
+  "title": "Session Manager",
+  "description": "Adds a durable “Delete session” action to the workspace session row menu."
+}

package/locale/zh.json

@@ -0,0 +1,4 @@
+{
+  "title": "会话管理",
+  "description": "为 DeepSeek Harness 侧栏会话菜单添加“删除会话”：弹窗确认、彻底清除日志与工作区登记。"
+}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@itsyuyi/dsh-session-manager",
+  "version": "1.0.0",
+  "description": "DeepSeek Harness plugin: workspace session management — a durable “Delete session” action with a host-styled confirmation dialog, right in the sidebar session menu.",
+  "license": "MIT",
+  "author": "itsyuyi <itsyuyi@126.com>",
+  "type": "module",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "verify-session.mjs",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "README.md",
+    "LICENSE"
+  ],
+  "icon": "./icon.svg",
+  "meta": {
+    "title": "Session Manager",
+    "description": "Adds a durable “Delete session” action to the workspace session row menu."
+  },
+  "keywords": [
+    "deepseek",
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "session-management",
+    "session-delete",
+    "workspace",
+    "sidebar"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.0 <5",
+    "react": ">=18.2.0 <19"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/itsyuyi/dsh-session-manager.git"
+  },
+  "homepage": "https://github.com/itsyuyi/dsh-session-manager#readme",
+  "bugs": {
+    "url": "https://github.com/itsyuyi/dsh-session-manager/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-workspace"
+      ]
+    }
+  }
+}

package/verify-session.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+/**
+ * verify-session.mjs — 核对某个会话是否已从系统目录中真正删除。
+ *
+ * 用法：
+ *   node verify-session.mjs                 # 列出所有已知会话及各自在磁盘上的存在情况
+ *   node verify-session.mjs <id或标题片段>   # 核对匹配的会话，给出"是否已删除"的结论
+ *
+ * 检查的位置（删除会话时，插件会清理 1 和 2）：
+ *   1) 会话工件目录   ~/.dsh/sessions/<项目>/session-<id>/     ← 主数据（rm -rf）
+ *   2) 工作区登记     ~/.dsh/storages/workspace.json           ← 从 sessionIds/归档/置顶摘除
+ *   3) 投影缓存       session_projcache.json + session_projcache/sessions/<id>.json
+ *                     ← 派生缓存，删除后可能残留孤儿（无害，不会再被读取）
+ *   （搜索索引 SQLite 会在下次搜索时自动 reconcile，无需手动核对）
+ *
+ * 判定"已删除"只看 1 和 2（权威来源）；投影缓存仅供参考。
+ * 重要：当 <参数> 既不是任何已知 id、也匹配不到任何标题时，脚本报"未找到"，
+ * 绝不据此推断"已删除"（避免假阴性）。
+ */
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+const DSH_HOME = process.env.DSH_HOME || join(homedir(), '.dsh');
+const SESSIONS_ROOT = process.env.DSH_SESSIONS_ROOT || join(DSH_HOME, 'sessions');
+const WORKSPACE_JSON = join(DSH_HOME, 'storages', 'workspace.json');
+const PROJCACHE_JSON = join(DSH_HOME, 'storages', 'session_projcache.json');
+const PROJCACHE_DIR = join(DSH_HOME, 'storages', 'session_projcache', 'sessions');
+
+/** 与 JSONL 后端一致的段编码（对 UUID 形态的 id 是恒等）。 */
+function encodeSegment(raw) {
+  if (raw === '.') return '~002E';
+  if (raw === '..') return '~002E~002E';
+  let out = '';
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i);
+    const ch = String.fromCharCode(code);
+    if (ch !== '~' && /^[A-Za-z0-9._-]$/.test(ch)) out += ch;
+    else out += '~' + code.toString(16).toUpperCase().padStart(4, '0');
+  }
+  return out;
+}
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** 扫描会话工件根目录，返回该 id 对应的现存目录（通常 0 或 1 个）。 */
+function findArtifactDirs(id) {
+  const names = new Set([id, encodeSegment(id)]);
+  const found = [];
+  if (!existsSync(SESSIONS_ROOT)) return found;
+  for (const proj of readdirSync(SESSIONS_ROOT, { withFileTypes: true })) {
+    if (!proj.isDirectory()) continue;
+    const pdir = join(SESSIONS_ROOT, proj.name);
+    let entries;
+    try {
+      entries = readdirSync(pdir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && names.has(e.name)) found.push(join(pdir, e.name));
+    }
+  }
+  return found;
+}
+
+/** 逐会话投影缓存文件的 id 列表（session-*.json）。 */
+function perSessionCacheIds() {
+  if (!existsSync(PROJCACHE_DIR)) return [];
+  return readdirSync(PROJCACHE_DIR)
+    .filter((f) => f.startsWith('session-') && f.endsWith('.json'))
+    .map((f) => f.slice(0, -'.json'.length));
+}
+
+/**
+ * 标题 → id 映射。合并两处来源：
+ *   - 聚合缓存 session_projcache.json:  tables.sessions.<id>.rows.title.val
+ *   - 逐会话缓存 sessions/<id>.json:     record.rows.title.val（通常更新、覆盖新会话）
+ */
+function loadTitles() {
+  const map = new Map();
+  const agg = readJson(PROJCACHE_JSON);
+  for (const [id, entry] of Object.entries(agg?.tables?.sessions || {})) {
+    const t = entry?.rows?.title?.val;
+    if (typeof t === 'string' && t) map.set(id, t);
+  }
+  if (existsSync(PROJCACHE_DIR)) {
+    for (const f of readdirSync(PROJCACHE_DIR)) {
+      if (!f.startsWith('session-') || !f.endsWith('.json')) continue;
+      const id = f.slice(0, -'.json'.length);
+      const e = readJson(join(PROJCACHE_DIR, f));
+      const t = e?.record?.rows?.title?.val;
+      if (typeof t === 'string' && t) map.set(id, t); // 逐会话较新，覆盖聚合值
+    }
+  }
+  return map;
+}
+
+/** 该 id 在 workspace.json 里还被哪些地方引用。 */
+function workspaceRefs(id) {
+  const w = readJson(WORKSPACE_JSON);
+  if (!w) return [];
+  const g = w.global || {};
+  const refs = [];
+  if ((g.archivedSessionIds || []).includes(id)) refs.push('归档集');
+  if ((g.pinnedSessionIds || []).includes(id)) refs.push('置顶集');
+  for (const [wid, ws] of Object.entries(w.tables?.workspaces || {})) {
+    if ((ws.sessionIds || []).includes(id)) refs.push(`工作区「${ws.title || wid}」`);
+  }
+  return refs;
+}
+
+/** 投影缓存中是否仍有该 id（聚合表 或 逐会话文件），仅供参照。 */
+function inProjcache(id) {
+  const agg = readJson(PROJCACHE_JSON);
+  if ((agg?.tables?.sessions || {})[id]) return true;
+  return existsSync(join(PROJCACHE_DIR, `${id}.json`));
+}
+
+/** 收集所有出现过的会话 id（工件目录 ∪ workspace.json ∪ 两处投影缓存）。 */
+function allSessionIds() {
+  const ids = new Set();
+  if (existsSync(SESSIONS_ROOT)) {
+    for (const proj of readdirSync(SESSIONS_ROOT, { withFileTypes: true })) {
+      if (!proj.isDirectory()) continue;
+      let entries;
+      try {
+        entries = readdirSync(join(SESSIONS_ROOT, proj.name), { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const e of entries) if (e.isDirectory() && e.name.startsWith('session-')) ids.add(e.name);
+    }
+  }
+  const w = readJson(WORKSPACE_JSON);
+  for (const id of w?.global?.archivedSessionIds || []) ids.add(id);
+  for (const id of w?.global?.pinnedSessionIds || []) ids.add(id);
+  for (const ws of Object.values(w?.tables?.workspaces || {}))
+    for (const id of ws.sessionIds || []) ids.add(id);
+  for (const id of Object.keys(readJson(PROJCACHE_JSON)?.tables?.sessions || {})) ids.add(id);
+  for (const id of perSessionCacheIds()) ids.add(id);
+  return [...ids];
+}
+
+function statusOf(id) {
+  const dirs = findArtifactDirs(id);
+  const wrefs = workspaceRefs(id);
+  const proj = inProjcache(id);
+  // "已删除" = 工件目录不存在 且 workspace.json 无任何引用（投影缓存孤儿不算数）
+  const deleted = dirs.length === 0 && wrefs.length === 0;
+  return { dirs, wrefs, proj, deleted };
+}
+
+function reportOne(id, titles) {
+  const s = statusOf(id);
+  console.log(`\n会话：${id}`);
+  if (titles.get(id)) console.log(`标题：${titles.get(id)}`);
+  console.log(`  1) 工件目录  ~/.dsh/sessions/…/${id}/ : ${s.dirs.length ? '❌ 仍存在 → ' + s.dirs.join(', ') : '✅ 不存在'}`);
+  console.log(`  2) 工作区登记 workspace.json          : ${s.wrefs.length ? '❌ 仍被引用 → ' + s.wrefs.join('、') : '✅ 无引用'}`);
+  console.log(`  3) 投影缓存   session_projcache(.json|/sessions/) : ${s.proj ? '⚠️ 仍有缓存条目（派生数据，无害，不影响删除结论）' : '✅ 无'}`);
+  console.log(`  结论：${s.deleted ? '✅ 已从系统目录中删除（主数据与登记均已清除）' : '⛔ 仍然存在，尚未删除（见上）'}`);
+}
+
+const arg = process.argv[2];
+const titles = loadTitles();
+
+if (!arg) {
+  const ids = allSessionIds().sort();
+  console.log(`共 ${ids.length} 个会话（标题取自投影缓存，新会话可能暂缺）：\n`);
+  console.log('状态  会话id                                      工件  登记  缓存  标题');
+  for (const id of ids) {
+    const s = statusOf(id);
+    const flag = s.deleted ? '已删' : '存在';
+    console.log(
+      `${flag}  ${id.padEnd(44)}  ${s.dirs.length ? '有' : '— '}    ${s.wrefs.length ? '有' : '— '}    ${s.proj ? '有' : '— '}   ${titles.get(id) || ''}`,
+    );
+  }
+  console.log('\n提示：node verify-session.mjs <id或标题片段> 可核对单个会话。');
+} else {
+  const ids = allSessionIds();
+  // 1) 先按 id 精确/子串匹配
+  let matches = ids.filter((id) => id === arg || id.includes(arg));
+  // 2) 再按标题片段匹配（合并两处缓存的标题）
+  if (matches.length === 0) {
+    matches = [...titles.entries()].filter(([, t]) => t.includes(arg)).map(([id]) => id);
+  }
+  matches = [...new Set(matches)];
+
+  if (matches.length === 0) {
+    // 关键：匹配不到 ≠ 已删除。明确报"未找到"，绝不给出删除结论。
+    console.log(`\n⚠️ 未找到与「${arg}」匹配的会话。`);
+    console.log('   它既不是任何已知会话 id，也没有任何会话的标题包含这段文字。');
+    console.log('   可能原因：会话名不完全一致、标题投影尚未落盘，或该会话本就不存在。');
+    console.log('   ⛔ 这不代表"已删除"。请改用：');
+    console.log('      · node verify-session.mjs            # 看完整列表与标题，找到确切 id');
+    console.log('      · node verify-session.mjs <完整id>    # 用 id 精确核对');
+    process.exit(0);
+  }
+
+  for (const id of matches) reportOne(id, titles);
+  if (matches.length > 1) console.log(`\n（匹配到 ${matches.length} 个会话）`);
+}