@jaychang1989/dsh-webchat 0.4.1 → 0.5.0

package/NOTICE

@@ -1,25 +1,26 @@
 dsh-webchat
 Copyright 2026 jaychang1989
 
-This product is a fork of dsh-web-chat
+This package is a fork of dsh-web-chat
 (https://github.com/xmuwenxiang/dsh-web-chat), Copyright the dsh-web-chat
-authors, licensed under the Apache License, Version 2.0.
+authors, licensed under the Apache License, Version 2.0. A copy of that license
+is in LICENSE.
 
-0.3.0 retargeted the plugin at the DeepSeek Harness 0.2.x plugin APIs:
+Reused from that project, and the reason this notice exists:
 
-  * the settings section is no longer registered by the plugin
-    (`installSettingsSection` / `settingsNamespace` were removed from
-    `@deepseek-ai/dsh-settings` in 0.1.7; forms are now derived from the
-    profile entry and its exported `Config`);
-  * session persistence is addressed through per-session handles
-    (`sessionPersistence.open` / `create` + handle `read` / `append` / `flush`)
-    instead of the retired service-level `load` / `append` pair.
+  * the plugin scaffolding — the dual-half packaging (a host half plus a
+    `dsh.client` browser half), the `cordis.patch.yml` bundle row, and the
+    `window.__ModuleLoader__.load` form of the emitted client bundle;
+  * the approach to injecting a sidebar entry row at the DOM level, with its
+    self-healing MutationObservers, and the base styling that came with it.
 
-0.4.0 reduced the package to a launcher: it opens the official
-chat.deepseek.com web app in a window instead of driving the page and
-re-rendering the conversation. The custom chat panel, the local transcript
-store, the five `webchat_*` agent tools, the transfer/distillation code and
-thirteen of the fifteen HTTP routes were removed, along with the
-`playwright-core` runtime dependency and the React-based client build.
+Written here:
 
-See MAINTAINING.md for the current structure and the constraints behind it.
+  * the launcher behaviour — opening the official chat.deepseek.com page in a
+    window, the three window strategies and their ordering;
+  * the entry-as-action interaction (the entry itself opens the page, with the
+    busy state and the result toast);
+  * the host routes, the tests and this documentation.
+
+The package no longer drives the page, stores transcripts, exposes agent tools
+or reimplements a chat interface.

package/README.en.md

@@ -0,0 +1,80 @@
+# dsh-webchat
+
+[简体中文](./README.md) | **English**
+
+Opens the official [chat.deepseek.com](https://chat.deepseek.com) web app inside [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — **click the sidebar entry and the page renders in the DSH window itself**, filling the center column like the Automation Tasks page does.
+
+No chat UI is reimplemented: model picker, deep think, smart search, history and attachments are all the official ones.
+
+## How it can render inside the window
+
+The obvious routes really are closed:
+
+| Route | Result |
+| --- | --- |
+| `<iframe>` | the site answers `Content-Security-Policy: frame-ancestors 'none'`, so the browser refuses |
+| A plain `<webview>` | the desktop build disables the tag and blocks `will-attach-webview` |
+
+But the desktop shell keeps a door open for **approved browser guests**: the renderer asks `globalThis.dshDesktop.browser` for a lease, and the shell approves exactly the `<webview>` whose `src` is `about:blank#<lease>` and whose `partition` matches — everything else stays blocked. This is the mechanism the built-in side-card browser uses; this plugin takes the same channel.
+
+So the page is **not an iframe** — it is a native guest owned by the host, which is why `frame-ancestors` does not apply to it. It also means the desktop app is what makes it possible.
+
+Where that bridge is absent (a plain `dsh web` profile) the plugin **falls back** to opening a window, so the entry always does something.
+
+## Install
+
+```bash
+dsh plugin --profile desktop add @jaychang1989/dsh-webchat
+```
+
+Or straight from this repository:
+
+```bash
+dsh plugin --profile desktop add github:jaychang1989/dsh-webchat
+```
+
+> The npm package is scoped because the unscoped `dsh-webchat` name is taken. The scope does not change the plugin's identity: the entry id stays `webchat`.
+
+**Restart the desktop app after installing.**
+
+## Use
+
+1. Click the "DeepSeek 网页 / DeepSeek Web" entry — the page loads in the center column; there is no second click.
+2. Sign in to DeepSeek once; that holds for the rest of the run.
+
+Click again to collapse the panel. The guest stays mounted while the panel is closed, so reopening neither reloads the page nor drops the session. Clicking a session or workspace row in the sidebar hands the center column back to the conversation.
+
+## Requirements
+
+- DeepSeek Harness **0.2.0-rc.1 or a newer 0.2.x**
+- Node.js >= 22
+- The desktop app: only it provides the native guest bridge; plain `dsh web` uses the window fallback
+
+## Known limitations
+
+- **Restarting the desktop app means signing in to DeepSeek again.** The host hands out a **process-lifetime** guest partition (a fresh random name per run, with no `persist:` prefix), so the session is not written to disk. That is the host's mechanism, not a choice this plugin makes.
+- The DeepSeek web front end has its own rate limiting and sign-in flow; the plugin only hosts it and does not mediate its requests.
+- Links the page opens are handled inside the guest; the plugin adds no navigation policy of its own.
+
+## Troubleshooting
+
+| Symptom | Cause / fix |
+| --- | --- |
+| The entry is missing | Check that `@jaychang1989/dsh-webchat` is in the profile's `dsh.profile.bundles`, then restart the desktop app |
+| The center column says "载入失败：…" | The host refused the guest (the bridge threw). The text carries the host's reason |
+| Clicking the entry opened a browser window instead | This renderer had no `dshDesktop.browser` (a plain web profile, for instance), so the fallback ran |
+| It asks for a login again after a restart | See the limitations above — it is the host's partition behaviour |
+
+## Development and tests
+
+```bash
+node --test
+```
+
+Fourteen cases, and the browser half really executes against a DOM stand-in: in a desktop environment it checks that the entry mounts, that clicking reserves a lease, that the webview is built the way the host requires (`about:blank#<lease>`), that navigation happens on `dom-ready`, and that closing and reopening reuses the same guest; without a bridge it checks the window fallback and its reporting.
+
+There is no build step — `lib/index.js` and `lib/client.js` are the hand-written runtime, and the package has **zero runtime dependencies**. The guest mechanism is written up in [MAINTAINING.md](./MAINTAINING.md) (Chinese).
+
+## Origin and license
+
+[Apache-2.0](./LICENSE). This package started as a fork of [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat): it reuses that project's plugin scaffolding (the dual-half packaging, the `cordis.patch.yml` row, the `window.__ModuleLoader__.load` bundle form) and its approach to injecting a sidebar entry, while the current behaviour — the in-window guest panel, the window fallback chain, the entry-as-action — was written here. See [NOTICE](./NOTICE) for the copyright and license statements.

package/README.md

@@ -1,83 +1,80 @@
 # dsh-webchat
 
-Opens the official [chat.deepseek.com](https://chat.deepseek.com) web app from inside [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness): one sidebar entry, and **clicking it opens the official page directly**.
+**简体中文** | [English](./README.en.md)
 
-**It no longer reimplements the chat UI.** The official web app is the client — model picker, deep think, smart search, history and attachments all live there. This plugin opens it and nothing else.
+在 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 里打开 [chat.deepseek.com](https://chat.deepseek.com) 官方网页版——**点侧边栏入口，页面就直接显示在 DSH 窗口里**，占满中栏，和「自动化任务」那些页面一样。
 
-## Why a window, and not a pane
+不重新实现聊天界面：模型选择、深度思考、智能搜索、历史记录、附件上传，全都还是官方那一套。
 
-Both embedding routes are closed, and that is a measurement rather than a choice:
+## 它凭什么能显示在窗口内
 
-- `chat.deepseek.com` answers with **`Content-Security-Policy: frame-ancestors 'none'`**, so no iframe can host it;
-- the desktop build runs both windows with **`webviewTag: false`** and blocks `will-attach-webview`, so `<webview>` is unavailable too.
+iframe 和 `<webview>` 常规路径确实都被封死了：
 
-A real window is therefore the only faithful way to show the official page.
-
-## What opens, in order
+| 方式 | 结果 |
+| --- | --- |
+| `<iframe>` | 站点返回 `Content-Security-Policy: frame-ancestors 'none'`，浏览器拒绝渲染 |
+| 直接写 `<webview>` | 桌面端默认关闭该标签，且 `will-attach-webview` 一律拦截 |
 
-Clicking the entry tries these in order and reports which one worked in a short toast:
+但桌面端为**受信任的浏览器访客**留了通道：渲染进程向 `globalThis.dshDesktop.browser` 申请一个租约，宿主只放行 `src="about:blank#<lease>"` 且 `partition` 匹配的那一个 `<webview>`，其余照旧拦截。DSH 自带的侧栏浏览器用的就是这套机制，本插件走同一条通道。
 
-1. **`app-window`** — a window created by the DSH desktop process itself (the desktop app is Electron). An already-open one is focused instead of duplicated.
-2. **`app-window-shell`** — a chromeless Edge/Chrome window (`--app=`) with its own `--user-data-dir` (`~/.dsh/dsh-webchat/app-window`), so its login stays separate from your everyday browser. Used when the host refuses (1).
-3. **`system-browser`** — handed to the OS default browser, so the button always does something.
+所以这个页面**不是嵌在 iframe 里**，而是宿主的原生访客——`frame-ancestors` 管不到它。这也解释了为什么它必须由 DSH 桌面端承载。
 
-Sign in once; the window's own profile keeps the session.
+在没有该桥接的环境（纯 `dsh web`，非桌面端）会**自动降级**为打开一个窗口，保证入口永远有反应。
 
-## Install
+## 安装
 
 ```bash
 dsh plugin --profile desktop add @jaychang1989/dsh-webchat
 ```
 
-Or straight from this repository:
+或直接从仓库安装：
 
 ```bash
 dsh plugin --profile desktop add github:jaychang1989/dsh-webchat
 ```
 
-> The npm package is scoped because the unscoped `dsh-webchat` name belongs to the unmaintained upstream project. The scope does not change the plugin's identity: the entry id stays `webchat`.
+> npm 包名带 scope，因为不带 scope 的 `dsh-webchat` 已被占用。scope 不影响插件身份：entry id 仍是 `webchat`。
 
-**Switching from upstream, or from this plugin's 0.3.x:** all of them insert the same `id: webchat` row, and one profile cannot hold the same entry id twice — boot fails on the duplicate. Remove the old package first, then add this one, then restart the desktop app.
+安装后**重启桌面端**。
 
-## Use
+## 使用
 
-1. Click the "DeepSeek 网页 / DeepSeek Web" entry in the sidebar — the page opens directly, there is no second click.
-2. Sign in once in the window it opens; afterwards just use the official web app.
+1. 点侧边栏的「DeepSeek 网页」入口 —— 页面直接在中栏载入，不需要第二次点击；
+2. 在里面登录一次 DeepSeek，当前这次运行内一直有效。
 
-A toast in the corner reports the outcome: `已打开 DeepSeek 网页` / `已交给系统默认浏览器打开` / a failure reason (an `HTTP 404` usually means the host half is still an older version — restart the desktop app).
+再点一次入口收起面板；面板关闭后访客保持挂载，重新打开不会重新加载、也不会掉登录。点侧边栏的会话/工作区行会自动把中栏还给对话。
 
-## Difference from 0.3.x — this release deletes most of the plugin
+## 环境要求
 
-| 0.3.x | 0.4.0 |
-| --- | --- |
-| Drove the page with Playwright and re-rendered messages in a custom panel | Does not drive the page; opens it. Custom panel removed |
-| Five agent tools (`webchat_status/send/recover/import/transfer`) | All removed |
-| "Transfer to Harness", "recover from web", "import", "export" | All removed |
-| Local transcript store at `~/.dsh/dsh-webchat/transcripts.json` | Removed (only the window profile directory remains) |
-| Fifteen `/api/dsh-webchat/*` routes | Two: `state` and `open` |
-| Depended on `playwright-core`; the client half needed React and a bundler | **No runtime dependencies**; plain-DOM client, no build step |
-| ~3800 lines of build output | ~700 lines of hand-written JS |
+- DeepSeek Harness **0.2.0-rc.1 或更新的 0.2.x**
+- Node.js >= 22
+- 桌面端（DSH Desktop）：只有它提供原生访客桥接；纯 `dsh web` 会走窗口降级
 
-## Requirements
+## 已知限制
 
-- DeepSeek Harness **0.2.0-rc.1 or a newer 0.2.x**
-- Node.js >= 22
-- Strategy 2 needs Edge or Chrome installed; strategy 1 does not
+- **重启桌面端后需要重新登录 DeepSeek。** 宿主给访客分配的是**进程内**分区（每次运行随机命名、不带 `persist:`），登录态不落盘。这是宿主的机制，插件无法改变。
+- 官方网页端有自己的风控与登录流程，插件只负责把它承载起来，不介入其请求。
+- 页面里指向外部的链接在访客内处理；插件不追加自己的导航策略。
 
-## Limitations
+## 排查
 
-- The DeepSeek web front end applies its own rate limiting; the plugin hands the page over and does not mediate its login or requests.
-- A strategy-1 window is owned by the DSH process: if you close the DSH main window while it is still open, DSH will not quit (Electron's `window-all-closed`). Close that window too.
-- Reloading the plugin does not close a window that is already open, so a settings change cannot close the conversation you are reading.
+| 现象 | 原因 / 处理 |
+| --- | --- |
+| 入口没出现 | 确认 profile 的 `dsh.profile.bundles` 里有 `@jaychang1989/dsh-webchat`，然后重启桌面端 |
+| 中栏提示「载入失败：…」 | 宿主拒绝了访客（桥接返回异常）。文本里带着宿主给的原因 |
+| 点了入口却弹出一个浏览器窗口 | 说明当前渲染进程拿不到 `dshDesktop.browser`（例如在纯 web 环境），插件走了降级路径 |
+| 重启后要求重新登录 | 见上面的「已知限制」，属于宿主分区机制 |
 
-## Development and tests
+## 开发与测试
 
 ```bash
-node --test        # 11 cases: host routes, window-strategy selection, and the browser half mounted into a DOM stand-in
+node --test
 ```
 
-There is no build step: `lib/index.js` and `lib/client.js` are the hand-written runtime. See [MAINTAINING.md](./MAINTAINING.md).
+14 个用例，其中浏览器半区在 DOM 桩里**真实执行**：桌面端环境下验证入口挂载、点击后申请租约、按宿主约定生成 `about:blank#<lease>` 的 webview、`dom-ready` 后导航到目标地址、关闭重开复用同一个访客；无桥接环境下验证降级为请求宿主开窗并如实提示结果。
+
+没有构建步骤——`lib/index.js` 与 `lib/client.js` 就是手写的运行时代码，包内**零运行时依赖**。访客机制的来龙去脉见 [MAINTAINING.md](./MAINTAINING.md)。
 
-## License
+## 来源与许可
 
-[Apache-2.0](./LICENSE). Original copyright belongs to the authors of [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat); see [NOTICE](./NOTICE).
+[Apache-2.0](./LICENSE)。本包最初由 [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat) 分叉而来：沿用其插件骨架（双半区打包、`cordis.patch.yml` 行、浏览器 bundle 的 `window.__ModuleLoader__.load` 形式）与侧边栏入口的 DOM 注入思路；当前功能——中栏访客面板、窗口降级链、入口即动作——都是在这里写的。版权与许可声明见 [NOTICE](./NOTICE)。

package/cordis.patch.yml

@@ -13,11 +13,9 @@
 # manifest name verbatim (scoped names included) — dsh-client-modules keys every
 # browser row by it, and lib/client.js registers its factory under the same id.
 # `id` is the profile entry id; dsh >= 0.1.7 also uses it as the settings form
-# namespace, so keep it stable.
-#
-# Note: the upstream package xmuwenxiang/dsh-web-chat inserts the same
-# `id: webchat`. Do not keep both installed in one profile — a duplicate entry
-# id is rejected at boot.
+# namespace, so keep it stable. It must be unique per profile: a second package
+# inserting the same `webchat` id cannot be installed alongside this one — the
+# duplicate is rejected at boot.
 - insert:
     - id: webchat
       name: '@jaychang1989/dsh-webchat'

package/lib/client.js

@@ -1,15 +1,22 @@
 /**
  * dsh-webchat — browser half.
  *
- * One sidebar entry. Clicking it opens the official DeepSeek web app in a
- * window (see lib/index.js) and reports the outcome in a short toast. There is
- * no panel and no in-GUI chat: chat.deepseek.com cannot be framed
- * (`frame-ancestors 'none'`) and this build has `webviewTag: false`, so the
- * official page can only live in a window of its own.
+ * One sidebar entry that opens the official chat.deepseek.com web app **inside
+ * the DSH window**, in the center column, exactly like the other full-page
+ * views (Automation Tasks and friends).
  *
- * Everything here is plain DOM — no React, no build step. The shell exposes no
- * slot an external plugin can register into, so the entry row is injected at
- * the DOM level and self-heals against React re-renders.
+ * It can do that because the desktop shell lends out native browser guests: the
+ * renderer asks `globalThis.dshDesktop.browser` for a reservation and then
+ * attaches a `<webview>` whose `src` is `about:blank#<lease>` and whose
+ * `partition` matches — the shell approves exactly that element and assigns the
+ * real web preferences, so the page is not subject to `frame-ancestors` the way
+ * an iframe would be. This is the same mechanism the built-in side-card browser
+ * uses; see MAINTAINING.md.
+ *
+ * Where that bridge is absent (a plain `dsh web` profile, not the desktop app)
+ * the entry falls back to asking the host half to open the page in a window.
+ *
+ * Everything here is plain DOM — no React, no build step.
  */
 window.__ModuleLoader__.load({
 	id: "@jaychang1989/dsh-webchat",
@@ -17,11 +24,26 @@ window.__ModuleLoader__.load({
 		var module = { exports: {} }
 		var exports = module.exports
 
-		/** Routes served by lib/index.js. */
-		var API = { open: '/api/dsh-webchat/open' }
+		/** Host route used only by the window fallback. */
+		var OPEN_ROUTE = '/api/dsh-webchat/open'
+		/** The page the panel shows. */
+		var PAGE_URL = 'https://chat.deepseek.com/'
+		/**
+		 * Storage identity for the guest partition. The shell keys one
+		 * process-lifetime partition per identity, so this string is what makes
+		 * the DeepSeek login survive panel close/reopen within one run.
+		 */
+		var STORAGE_IDENTITY = 'dsh-webchat'
+
 		var ENTRY_ATTR = 'data-dsh-webchat-entry'
+		var VIEW_ATTR = 'data-dsh-webchat-view'
+		var ACTIVE_ATTR = 'data-dsh-webchat-active'
+		var OTHER_ACTIVE_ATTRS = ['data-dsh-taskboard-active', 'data-dsh-ssh-active']
+		var ACTIVATE_EVENT = 'dsh-panel-activate'
+		var PANEL_NAME = 'webchat'
 		var STYLE_ID = 'dsh-webchat-style'
 		var TOAST_ATTR = 'data-dsh-webchat-toast'
+		var FRAME_CLASS = 'dsh-wc-frame'
 
 		var ZH = typeof navigator === 'object' && typeof navigator.language === 'string'
 			&& navigator.language.toLowerCase().indexOf('zh') === 0
@@ -30,25 +52,33 @@ window.__ModuleLoader__.load({
 		var T = ZH
 			? {
 				label: 'DeepSeek 网页',
-				tooltip: '打开 chat.deepseek.com',
-				busy: '正在打开…',
-				opened: '已打开 DeepSeek 网页',
-				handed: '已交给系统默认浏览器打开',
-				failed: '打开失败',
+				tooltip: '在 Harness 内打开 chat.deepseek.com',
+				failed: '载入失败',
+				fallbackOpened: '已打开 DeepSeek 网页',
+				fallbackHanded: '已交给系统默认浏览器打开',
+				fallbackFailed: '打开失败',
 			}
 			: {
 				label: 'DeepSeek Web',
-				tooltip: 'Open chat.deepseek.com',
-				busy: 'Opening…',
-				opened: 'DeepSeek Web is open',
-				handed: 'Handed to the system default browser',
-				failed: 'Could not open',
+				tooltip: 'Open chat.deepseek.com inside Harness',
+				failed: 'Could not load it',
+				fallbackOpened: 'DeepSeek Web is open',
+				fallbackHanded: 'Handed to the system default browser',
+				fallbackFailed: 'Could not open',
 			}
 
-		/** Entry and toast styling, scoped to this plugin's own attribute. */
+		/** Entry, center-column takeover and guest styling. */
 		var CSS = [
+			"[data-pane='conversation'],[class*='centerCol']{position:relative}",
+			'[' + VIEW_ATTR + ']{position:absolute;inset:0;display:none;z-index:60;background:var(--dsw-alias-bg-base)}',
+			'html[' + ACTIVE_ATTR + ']:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [' + VIEW_ATTR + ']{display:flex}',
+			"html[" + ACTIVE_ATTR + "]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [data-pane='conversation'] > :not([" + VIEW_ATTR + ']),',
+			'html[' + ACTIVE_ATTR + "]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [class*='centerCol'] > :not([" + VIEW_ATTR + ']){display:none !important}',
+			'.' + FRAME_CLASS + '{-webkit-app-region:no-drag;border:0;flex:auto;width:100%;min-width:0;height:100%;min-height:0;display:flex}',
+			'.dsh-wc-message{margin:auto;max-width:460px;padding:22px;text-align:center;font-size:13px;line-height:1.65;color:var(--dsw-alias-label-secondary);font-family:var(--dsw-font-family)}',
 			'[' + ENTRY_ATTR + ']{display:flex;align-items:center;gap:8px;width:100%;height:32px;padding:0 12px;background:transparent;border:none;border-radius:8px;color:var(--dsw-alias-label-secondary);cursor:pointer;font-size:13px;white-space:nowrap}',
 			'[' + ENTRY_ATTR + ']:hover{background:var(--dsw-specific-sidebar-nav-item-hover);color:var(--dsw-alias-label-primary)}',
+			'[' + ENTRY_ATTR + '][data-active]{background:var(--dsw-specific-sidebar-nav-item-active);color:var(--dsw-alias-label-primary);font-weight:600}',
 			'[' + ENTRY_ATTR + '][disabled]{opacity:.55;cursor:progress}',
 			'[' + ENTRY_ATTR + '] [data-part=icon]{display:inline-flex;align-items:center;justify-content:center;flex:none}',
 			'[' + ENTRY_ATTR + '] [data-part=label]{overflow:hidden;text-overflow:ellipsis}',
@@ -58,6 +88,16 @@ window.__ModuleLoader__.load({
 			'[' + TOAST_ATTR + '][data-state=bad]{border-color:var(--dsw-alias-state-danger,#ef4444);color:var(--dsw-alias-state-danger,#ef4444)}',
 		].join('\n')
 
+		/**
+		 * The desktop shell's browser bridge, when this renderer is the desktop
+		 * app's primary frame. A plain web profile exposes only a protocol
+		 * version, so the window fallback takes over.
+		 */
+		const carrier = globalThis.dshDesktop
+		const guests = carrier !== null && typeof carrier === 'object' && carrier.protocolVersion === 1
+			? carrier.browser
+			: undefined
+
 		/** Inject the stylesheet once. */
 		function ensureStyle() {
 			if (document.getElementById(STYLE_ID) !== null) return
@@ -67,7 +107,7 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag)
 		}
 
-		/** Show one transient message next to the panel corner. */
+		/** Show one transient message in the corner. */
 		function toast(text, state) {
 			var previous = document.querySelector('[' + TOAST_ATTR + ']')
 			if (previous !== null) previous.remove()
@@ -81,15 +121,39 @@ window.__ModuleLoader__.load({
 			}, state === 'bad' ? 8000 : 3000)
 		}
 
-		/** Call the host route; a non-JSON or non-2xx answer becomes an error field. */
-		async function openPage() {
-			const response = await fetch(API.open, { method: 'POST', headers: { accept: 'application/json' } })
+		/** Ask the host half to open the page in a window (the non-desktop path). */
+		async function openInWindow() {
+			const response = await fetch(OPEN_ROUTE, { method: 'POST', headers: { accept: 'application/json' } })
 			let payload = {}
 			try { payload = await response.json() } catch (error) { payload = {} }
 			if (!response.ok && payload.error === undefined) payload.error = 'HTTP ' + response.status
 			return payload
 		}
 
+		/** Tiny observable for the panel's open state. */
+		function createController() {
+			var open = false
+			var listeners = new Set()
+			var notify = function () {
+				listeners.forEach(function (listener) {
+					try {
+						listener()
+					} catch (error) {
+						console.warn('[dsh-webchat] listener failed:', error)
+					}
+				})
+			}
+			return {
+				isOpen: function () { return open },
+				subscribe: function (listener) {
+					listeners.add(listener)
+					return function () { listeners.delete(listener) }
+				},
+				toggle: function () { open = !open; notify() },
+				close: function () { if (!open) return; open = false; notify() },
+			}
+		}
+
 		/** The sidebar shell root, or undefined while it is not mounted. */
 		function sidebarRoot() {
 			var column = document.querySelector('[data-pane="sidebar"], [class*="sidebarCol"]')
@@ -110,7 +174,7 @@ window.__ModuleLoader__.load({
 		}
 
 		/** Build the entry row. */
-		function createEntry() {
+		function createEntry(onClick) {
 			var entry = document.createElement('button')
 			entry.type = 'button'
 			entry.setAttribute(ENTRY_ATTR, '')
@@ -126,26 +190,7 @@ window.__ModuleLoader__.load({
 			label.textContent = T.label
 			entry.appendChild(icon)
 			entry.appendChild(label)
-
-			entry.addEventListener('click', async function () {
-				if (entry.disabled) return
-				entry.disabled = true
-				var labelNode = entry.querySelector('[data-part=label]')
-				if (labelNode !== null) labelNode.textContent = T.busy
-				try {
-					var outcome = await openPage()
-					if (outcome.ok === true) {
-						toast(String(outcome.via) === 'system-browser' ? T.handed : T.opened)
-					} else {
-						toast(T.failed + '：' + String(outcome.error || outcome.via || ''), 'bad')
-					}
-				} catch (error) {
-					toast(T.failed + '：' + (error instanceof Error ? error.message : String(error)), 'bad')
-				}
-				if (labelNode !== null) labelNode.textContent = T.label
-				entry.disabled = false
-			})
-
+			entry.addEventListener('click', onClick)
 			return entry
 		}
 
@@ -165,9 +210,7 @@ window.__ModuleLoader__.load({
 		}
 
 		/** Mount the sidebar entry with its self-healing observers. */
-		function mountSidebarEntry() {
-			if (document.querySelector('[' + ENTRY_ATTR + ']') !== null) return function () {}
-			var entry = createEntry()
+		function mountSidebarEntry(controller, entry) {
 			var root
 			var placed = false
 
@@ -200,22 +243,182 @@ window.__ModuleLoader__.load({
 				if (!root.contains(entry)) placed = placeEntry(root, entry)
 			})
 
+			var syncActive = function () {
+				if (controller.isOpen()) entry.dataset.active = 'true'
+				else delete entry.dataset.active
+			}
+			var unsubscribe = controller.subscribe(syncActive)
+			syncActive()
 			tryPlace()
 
 			return function () {
 				waitObserver.disconnect()
 				rootObserver.disconnect()
+				unsubscribe()
 				entry.remove()
 			}
 		}
 
-		/** Mount the entry. */
+		/** The center column that hosts full-page views. */
+		function conversationColumn() {
+			return document.querySelector('[data-pane="conversation"], [class*="centerCol"]') || undefined
+		}
+
+		/**
+		 * Mount the panel that carries the guest.
+		 *
+		 * The guest is created lazily on first open and then kept mounted while
+		 * the panel is closed, so re-opening does not reload the page and the
+		 * DeepSeek session stays where it was.
+		 * @param controller - panel open state.
+		 * @returns disposer removing the panel and releasing the guest.
+		 */
+		function mountPanel(controller) {
+			var container
+			var frame
+			var lease
+			var failed = false
+
+			var showMessage = function (text) {
+				var box = document.createElement('div')
+				box.className = 'dsh-wc-message'
+				box.textContent = text
+				container.appendChild(box)
+			}
+
+			/** Reserve a guest and attach its webview. */
+			var ensureGuest = async function () {
+				if (frame !== undefined || failed) return
+				try {
+					const reservation = await guests.acquire(STORAGE_IDENTITY)
+					if (reservation === null || typeof reservation !== 'object'
+						|| typeof reservation.lease !== 'string' || typeof reservation.partition !== 'string') {
+						throw new Error('the desktop browser bridge returned no reservation')
+					}
+					lease = reservation.lease
+					const element = document.createElement('webview')
+					element.className = FRAME_CLASS
+					element.setAttribute('name', reservation.lease)
+					element.setAttribute('partition', reservation.partition)
+					element.setAttribute('allowpopups', '')
+					element.setAttribute('src', 'about:blank#' + reservation.lease)
+					element.addEventListener('dom-ready', function () {
+						element.loadURL(PAGE_URL).catch(function (error) {
+							toast(T.failed + '：' + (error instanceof Error ? error.message : String(error)), 'bad')
+						})
+					}, { once: true })
+					frame = element
+					container.appendChild(element)
+				} catch (error) {
+					failed = true
+					showMessage(T.failed + '：' + (error instanceof Error ? error.message : String(error)))
+				}
+			}
+
+			var ensure = function () {
+				if (container !== undefined) {
+					if (container.isConnected) return
+					container.remove()
+					container = undefined
+					frame = undefined
+				}
+				var column = conversationColumn()
+				if (column === undefined) return
+				container = document.createElement('div')
+				container.setAttribute(VIEW_ATTR, '')
+				container.setAttribute('data-dsh-plugin', 'webchat')
+				column.appendChild(container)
+			}
+
+			var waitObserver = new MutationObserver(function () { ensure() })
+
+			var applyActive = function () {
+				if (controller.isOpen()) {
+					OTHER_ACTIVE_ATTRS.forEach(function (attr) { document.documentElement.removeAttribute(attr) })
+					document.documentElement.setAttribute(ACTIVE_ATTR, '')
+					// Mount before announcing: the arbitration event dispatches into
+					// other plugins, and a throwing listener must not be able to leave
+					// this panel half-open.
+					ensure()
+					void ensureGuest()
+					document.dispatchEvent(new CustomEvent(ACTIVATE_EVENT, { detail: PANEL_NAME }))
+				} else {
+					document.documentElement.removeAttribute(ACTIVE_ATTR)
+				}
+			}
+			var onOtherActivate = function (event) {
+				var detail = event.detail
+				if ((detail === 'taskboard' || detail === 'ssh') && controller.isOpen()) controller.close()
+			}
+			var SIDEBAR_ROW_SELECTOR = '[class*="sessionRow"], [class*="projectRow"], [class*="searchResultRow"], [class*="searchResultWorkspace"], [class*="newSession"]'
+			var onClickSidebarRow = function (event) {
+				if (!controller.isOpen()) return
+				var target = event.target
+				if (target === null || target.closest === undefined) return
+				if (target.closest(SIDEBAR_ROW_SELECTOR) !== null) controller.close()
+			}
+
+			document.addEventListener('click', onClickSidebarRow, true)
+			document.addEventListener(ACTIVATE_EVENT, onOtherActivate)
+			var unsubscribe = controller.subscribe(applyActive)
+			applyActive()
+			ensure()
+			waitObserver.observe(document.body, { childList: true, subtree: true })
+
+			return function () {
+				document.removeEventListener('click', onClickSidebarRow, true)
+				document.removeEventListener(ACTIVATE_EVENT, onOtherActivate)
+				waitObserver.disconnect()
+				unsubscribe()
+				document.documentElement.removeAttribute(ACTIVE_ATTR)
+				if (frame !== undefined) frame.remove()
+				if (container !== undefined) container.remove()
+				frame = undefined
+				container = undefined
+				if (lease !== undefined) {
+					const releasing = lease
+					lease = undefined
+					try { void guests.release(releasing) } catch (error) { /* already gone */ }
+				}
+			}
+		}
+
+		/** Mount the entry, plus the panel when the desktop bridge is present. */
 		function apply(ctx) {
 			ensureStyle()
-			var dispose = mountSidebarEntry()
+			var controller = createController()
+			var disposers = []
+
+			if (guests !== undefined) {
+				// Desktop: the entry toggles the in-app panel.
+				var entry = createEntry(function () { controller.toggle() })
+				disposers.push(mountSidebarEntry(controller, entry))
+				disposers.push(mountPanel(controller))
+			} else {
+				// Web: no native guest to lend, so the entry asks the host for a window.
+				var fallbackEntry = createEntry(async function () {
+					if (fallbackEntry.disabled) return
+					fallbackEntry.disabled = true
+					try {
+						var outcome = await openInWindow()
+						if (outcome.ok === true) {
+							toast(String(outcome.via) === 'system-browser' ? T.fallbackHanded : T.fallbackOpened)
+						} else {
+							toast(T.fallbackFailed + '：' + String(outcome.error || outcome.via || ''), 'bad')
+						}
+					} catch (error) {
+						toast(T.fallbackFailed + '：' + (error instanceof Error ? error.message : String(error)), 'bad')
+					}
+					fallbackEntry.disabled = false
+				})
+				disposers.push(mountSidebarEntry(controller, fallbackEntry))
+			}
+
 			ctx.effect(function () {
-				return function () { dispose() }
-			}, 'dsh-webchat: sidebar entry')
+				return function () {
+					disposers.splice(0).forEach(function (dispose) { dispose() })
+				}
+			}, 'dsh-webchat: ui mounts')
 		}
 
 		exports.apply = apply

package/lib/index.js

@@ -28,8 +28,16 @@
 
 import { spawn } from 'node:child_process'
 import { existsSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { join } from 'node:path'
 
+/**
+ * A CommonJS `require` anchored at this module. Electron hands `electron` to
+ * CJS natively, while the harness's ESM loader resolves bare specifiers itself
+ * — which is why the ESM import below is tried first and this is the fallback.
+ */
+const requireHere = createRequire(import.meta.url)
+
 /** Stable cordis plugin name. */
 export const name = 'webchat'
 
@@ -65,6 +73,9 @@ function windowSlot() {
 /** Last open attempt, reported to the panel. */
 let lastAttempt = { ok: false, via: 'none', error: '', at: 0 }
 
+/** Every strategy's outcome from the most recent open, oldest first. */
+let lastAttempts = []
+
 /**
  * Remember one attempt.
  * @param ok - whether the page was opened.
@@ -77,19 +88,41 @@ function record(ok, via, error = '') {
   return lastAttempt
 }
 
+/** Render any thrown value as a message. */
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error)
+}
+
 /**
- * Load Electron lazily. A plugin that cannot reach it must still load, and the
- * import stays inside the call so a failed probe falls through to the next
- * strategy instead of killing the entry at import time.
+ * Load Electron lazily, two ways. A plugin that cannot reach it must still
+ * load, and the probe stays inside the call so a failure falls through to the
+ * next strategy instead of killing the entry at import time.
+ *
+ * The ESM import is tried first because it is the honest form; the harness's
+ * loader resolves bare specifiers itself and does not always hand `electron`
+ * to Electron's own resolver, so a CommonJS require — which Electron serves
+ * natively — is the fallback.
  * @returns the Electron module.
- * @throws when this process has no BrowserWindow to offer.
+ * @throws with every probe failure joined, when neither path yields a window API.
  */
 async function electronApi() {
-  const electron = await import('electron')
-  if (electron === null || typeof electron !== 'object' || electron.BrowserWindow === undefined) {
-    throw new Error('electron BrowserWindow is unavailable in this process')
+  const usable = (mod) => (mod !== null && typeof mod === 'object' && mod.BrowserWindow !== undefined ? mod : undefined)
+  const failures = []
+  try {
+    const fromImport = usable(await import('electron'))
+    if (fromImport !== undefined) return fromImport
+    failures.push('esm import resolved but exposed no BrowserWindow')
+  } catch (error) {
+    failures.push(`esm import failed: ${messageOf(error)}`)
+  }
+  try {
+    const fromRequire = usable(requireHere('electron'))
+    if (fromRequire !== undefined) return fromRequire
+    failures.push('cjs require resolved but exposed no BrowserWindow')
+  } catch (error) {
+    failures.push(`cjs require failed: ${messageOf(error)}`)
   }
-  return electron
+  throw new Error(failures.join(' | '))
 }
 
 /** Windows chromeless-window executables, in preference order. */
@@ -192,15 +225,21 @@ export const OPEN_STRATEGIES = [
  * @returns the recorded attempt: ok, the winning `via`, or the last error.
  */
 export async function openPage(strategies = OPEN_STRATEGIES) {
+  const attempts = []
   let failure = { via: 'none', error: 'no strategy was tried' }
   for (const strategy of strategies) {
     try {
       const detail = await strategy.run()
-      return record(true, typeof detail === 'string' && detail !== '' ? detail : strategy.via)
+      const via = typeof detail === 'string' && detail !== '' ? detail : strategy.via
+      attempts.push({ via: strategy.via, ok: true, error: '' })
+      lastAttempts = attempts
+      return record(true, via)
     } catch (error) {
-      failure = { via: strategy.via, error: error instanceof Error ? error.message : String(error) }
+      failure = { via: strategy.via, error: messageOf(error) }
+      attempts.push({ via: strategy.via, ok: false, error: failure.error })
     }
   }
+  lastAttempts = attempts
   return record(false, failure.via, failure.error)
 }
 
@@ -229,6 +268,7 @@ export function apply(ctx) {
         url: PAGE_URL,
         appWindowOpen: slot.current !== null && slot.current.isDestroyed() === false,
         last: lastAttempt,
+        attempts: lastAttempts,
       })
     },
   }), 'dsh-webchat: state route')

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jaychang1989/dsh-webchat",
-  "version": "0.4.1",
-  "description": "Opens the official DeepSeek web app (chat.deepseek.com) in a window from inside DeepSeek Harness: one sidebar entry that opens the page directly, no reimplementation — the official page keeps its model picker, deep think, smart search, history and attachments. Fork of xmuwenxiang/dsh-web-chat, reduced to a launcher.",
+  "version": "0.5.0",
+  "description": "Opens the official DeepSeek web app (chat.deepseek.com) inside DeepSeek Harness: one sidebar entry renders the real page in the center column, through the same native browser guest the built-in side-card browser uses. No chat UI, no agent tools, no runtime dependencies.",
   "keywords": [
     "dsh",
     "deepseek-harness",
@@ -56,7 +56,7 @@
     "cordis.patch.yml",
     "NOTICE",
     "README.md",
-    "README.zh.md"
+    "README.en.md"
   ],
   "scripts": {
     "test": "node --test"

package/README.zh.md

@@ -1,83 +0,0 @@
-# dsh-webchat
-
-在 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 里打开 [chat.deepseek.com](https://chat.deepseek.com) 官方网页版：侧边栏一个入口，**点一下就直接打开官方页面**。
-
-**不再重新实现聊天界面。** 官方网页版本身就是完整的客户端——模型选择、深度思考、智能搜索、历史记录、附件上传都在里面。本插件只负责把它打开，别的一概不管。
-
-## 为什么是「开一个窗口」，而不是「嵌在面板里」
-
-两条路都被封死了，这是实测结论而非选择：
-
-- `chat.deepseek.com` 返回 **`Content-Security-Policy: frame-ancestors 'none'`** —— 任何 iframe 嵌入都会被浏览器拒绝；
-- DSH 桌面端两个窗口都是 **`webviewTag: false`**，且 `will-attach-webview` 被显式拦截 —— `<webview>` 也不可用。
-
-所以忠实呈现官方页面的唯一方式就是开一个真实窗口。
-
-## 打开顺序
-
-点击入口后会按顺序尝试，第一个成功的生效，结果用一条短提示告诉你实际用了哪种：
-
-1. **`app-window`** —— 由 DSH 桌面端进程直接创建的窗口（桌面端就是 Electron）。已经开着就聚焦，不会重复开第二个。
-2. **`app-window-shell`** —— 无边框的 Edge/Chrome 窗口（`--app=`），使用独立 `--user-data-dir`（`~/.dsh/dsh-webchat/app-window`），因此登录态与你的日常浏览器互不干扰。用于第 1 种被宿主拒绝的场景。
-3. **`system-browser`** —— 交给操作系统默认浏览器，保证按钮任何时候都有反应。
-
-登录一次即可：窗口自己的 profile 会保留登录态。
-
-## 安装
-
-```bash
-dsh plugin --profile desktop add @jaychang1989/dsh-webchat
-```
-
-或直接从仓库安装：
-
-```bash
-dsh plugin --profile desktop add github:jaychang1989/dsh-webchat
-```
-
-> npm 包名带 scope，因为不带 scope 的 `dsh-webchat` 属于已停止维护的上游项目。scope 不影响插件身份：entry id 仍是 `webchat`。
-
-**从上游或本插件 0.3.x 切换过来时**：它们都插入 `id: webchat` 这一行，同一个 profile 里不能并存（entry id 重复会在启动时报错）。先移除旧的再加新的，然后重启桌面端。
-
-## 使用
-
-1. 点侧边栏的「DeepSeek 网页」入口 —— 页面直接打开，不需要再点第二次；
-2. 在弹出的窗口里登录一次，之后正常使用官方网页版。
-
-点击后右下角会有一条短提示说明结果：`已打开 DeepSeek 网页` / `已交给系统默认浏览器打开` / 失败原因（例如 `HTTP 404`，通常意味着宿主半区还是旧版本，重启桌面端即可）。
-
-## 与 0.3.x 的差异（这是一次大幅删减）
-
-| 0.3.x | 0.4.0 |
-| --- | --- |
-| 用 Playwright 驱动网页，自研聊天面板重新渲染消息 | 不再驱动网页，直接开官方页面；自研面板删除 |
-| 5 个 agent 工具（`webchat_status/send/recover/import/transfer`） | 全部删除 |
-| 「转移到 harness」「从网页恢复」「导入」「导出」 | 全部删除 |
-| 本地会话存储 `~/.dsh/dsh-webchat/transcripts.json` | 删除（只留窗口 profile 目录） |
-| 15 条 `/api/dsh-webchat/*` 路由 | 只剩 2 条：`state` / `open` |
-| 依赖 `playwright-core`，客户端产物需 React + 构建器 | **零运行时依赖**，客户端为纯 DOM，无构建步骤 |
-| 约 3800 行（构建产物） | 约 700 行（手写 JS） |
-
-## 环境要求
-
-- DeepSeek Harness **0.2.0-rc.1 或更新的 0.2.x**
-- Node.js >= 22
-- 第 2 种策略（无边框窗口）需要本机装有 Edge 或 Chrome；第 1 种策略不需要
-
-## 限制
-
-- 官方网页端受 DeepSeek 官方风控；页面打不开时插件只负责把页面交出去，不介入其登录或请求。
-- 第 1 种策略创建的窗口由 DSH 进程拥有：若你先关掉 DSH 主窗口、而它仍开着，DSH 不会退出（Electron 的 `window-all-closed` 语义）。关掉该窗口即可。
-- 插件被重载时不会主动关闭已经打开的窗口（避免一次设置变更就关掉你正在看的会话）。
-
-## 开发与测试
-
-```bash
-node --test        # 11 个用例：宿主路由、窗口策略选择、浏览器半区在 DOM 桩里的挂载与按钮行为
-```
-
-没有构建步骤：`lib/index.js` 与 `lib/client.js` 就是手写的运行时代码。详见 [MAINTAINING.md](./MAINTAINING.md)。
-
-## License
-
-[Apache-2.0](./LICENSE) — 原始版权归 [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat) 作者所有，详见 [NOTICE](./NOTICE)。