npm - @jaychang1989/dsh-webchat - Versions diffs - 0.4.2 → 0.5.1 - Mend

@jaychang1989/dsh-webchat 0.4.2 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/README.en.md CHANGED Viewed

@@ -2,23 +2,24 @@
 [简体中文](./README.md) | **English**
-Opens the official [chat.deepseek.com](https://chat.deepseek.com) web app from [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) in one click.
+Opens the official [chat.deepseek.com](https://chat.deepseek.com) web app inside [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — **click the sidebar entry and the page renders in the DSH window itself**, filling the center column like the Automation Tasks page does.
-**One sidebar entry. Click it, and the official page opens in a window.**
+No chat UI is reimplemented: model picker, deep think, smart search, history and attachments are all the official ones.
-That is the whole plugin. No chat UI, no transcript store, no agent tools — the official web app already is the client: model picker, deep think, smart search, history and attachments all live there.
+## How it can render inside the window
-## Why it opens a window instead of a pane
+The obvious routes really are closed:
-Three routes are closed, and these are measurements rather than preferences:
-| Route | Measured result |
+| Route | Result |
 | --- | --- |
-| `<iframe>` | `chat.deepseek.com` answers with `Content-Security-Policy: frame-ancestors 'none'`, so the browser refuses to render it in a frame |
-| Electron `<webview>` | both desktop windows run with `webviewTag: false`, and `will-attach-webview` is explicitly blocked |
-| The desktop app's own `WebContentsView` | reserved for platform pages (account/top-up) with navigation pinned to that origin; not reachable from a plugin |
+| `<iframe>` | the site answers `Content-Security-Policy: frame-ancestors 'none'`, so the browser refuses |
+| A plain `<webview>` | the desktop build disables the tag and blocks `will-attach-webview` |
+But the desktop shell keeps a door open for **approved browser guests**: the renderer asks `globalThis.dshDesktop.browser` for a lease, and the shell approves exactly the `<webview>` whose `src` is `about:blank#<lease>` and whose `partition` matches — everything else stays blocked. This is the mechanism the built-in side-card browser uses; this plugin takes the same channel.
-A real window is therefore the only faithful way to show the official page.
+So the page is **not an iframe** — it is a native guest owned by the host, which is why `frame-ancestors` does not apply to it. It also means the desktop app is what makes it possible.
+Where that bridge is absent (a plain `dsh web` profile) the plugin **falls back** to opening a window, so the entry always does something.
 ## Install
@@ -38,40 +39,31 @@ dsh plugin --profile desktop add github:jaychang1989/dsh-webchat
 ## Use
-1. Click the "DeepSeek 网页 / DeepSeek Web" entry in the sidebar.
-2. Sign in to DeepSeek once in the window it opens; the session is kept afterwards.
-A short toast in the corner reports the outcome.
-## How it opens the page
-Tried in order; the first that works wins, and the toast tells you which one it was:
-1. **App window** — a window created by the DSH desktop process itself (the desktop app is Electron). An already-open one is focused instead of duplicated.
-2. **Chromeless window** — Edge/Chrome in `--app=` mode with its own `--user-data-dir` (`~/.dsh/dsh-webchat/app-window`), so its login stays separate from your everyday browser. Used when (1) cannot reach Electron.
-3. **System browser** — the fallback, so a click always does something.
+1. Click the "DeepSeek 网页 / DeepSeek Web" entry — the page loads in the center column; there is no second click.
+2. Sign in to DeepSeek once; that holds for the rest of the run.
-None of the three needs configuration.
+Click again to collapse the panel. The guest stays mounted while the panel is closed, so reopening neither reloads the page nor drops the session. Clicking **any other sidebar row** — Plugins, Automation Tasks, the task board, a session, a workspace — hands the center column back, because those pages are rendered there by the shell and this plugin does not hold their seat.
 ## Requirements
 - DeepSeek Harness **0.2.0-rc.1 or a newer 0.2.x**
 - Node.js >= 22
-- Strategy 2 needs Edge or Chrome installed; strategy 1 does not
+- The desktop app: only it provides the native guest bridge; plain `dsh web` uses the window fallback
 ## Known limitations
-- The DeepSeek web front end has its own rate limiting and sign-in flow; the plugin only hands the page over and does not mediate its requests.
-- A strategy-1 window is owned by the DSH process: if you close the DSH main window while it is still open, DSH will not quit (Electron's `window-all-closed`). Close that window too.
-- Reloading the plugin does not close a window that is already open — otherwise a settings change would close the conversation you are reading.
+- **Restarting the desktop app means signing in to DeepSeek again.** The host hands out a **process-lifetime** guest partition (a fresh random name per run, with no `persist:` prefix), so the session is not written to disk. That is the host's mechanism, not a choice this plugin makes.
+- The DeepSeek web front end has its own rate limiting and sign-in flow; the plugin only hosts it and does not mediate its requests.
+- Links the page opens are handled inside the guest; the plugin adds no navigation policy of its own.
 ## Troubleshooting
 | Symptom | Cause / fix |
 | --- | --- |
-| The toast says `HTTP 404` | The host half in memory is an older version (the host half loads once per process; the client half is re-fetched on every page load). **Restart the desktop app** |
-| The toast says it handed the page to the system browser | Strategies 1 and 2 were both unavailable — check whether the host refused a window, or whether Edge/Chrome is installed |
-| The entry is missing from the sidebar | Check that `@jaychang1989/dsh-webchat` is in the profile's `dsh.profile.bundles`, then restart the desktop app |
+| The entry is missing | Check that `@jaychang1989/dsh-webchat` is in the profile's `dsh.profile.bundles`, then restart the desktop app |
+| The center column says "载入失败：…" | The host refused the guest (the bridge threw). The text carries the host's reason |
+| Clicking the entry opened a browser window instead | This renderer had no `dshDesktop.browser` (a plain web profile, for instance), so the fallback ran |
+| It asks for a login again after a restart | See the limitations above — it is the host's partition behaviour |
 ## Development and tests
@@ -79,10 +71,10 @@ None of the three needs configuration.
 node --test
 ```
-Thirteen cases: the host's two routes and its window-strategy selection, plus the browser half executed against a DOM stand-in (it mounts the entry, posts to the right route on click, and reports success, handoff and failure honestly).
+Fourteen cases, and the browser half really executes against a DOM stand-in: in a desktop environment it checks that the entry mounts, that clicking reserves a lease, that the webview is built the way the host requires (`about:blank#<lease>`), that navigation happens on `dom-ready`, and that closing and reopening reuses the same guest; without a bridge it checks the window fallback and its reporting.
-There is no build step — `lib/index.js` and `lib/client.js` are the hand-written runtime, and the package has **zero runtime dependencies**. See [MAINTAINING.md](./MAINTAINING.md) (Chinese).
+There is no build step — `lib/index.js` and `lib/client.js` are the hand-written runtime, and the package has **zero runtime dependencies**. The guest mechanism is written up in [MAINTAINING.md](./MAINTAINING.md) (Chinese).
 ## Origin and license
-[Apache-2.0](./LICENSE). This package started as a fork of [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat): it reuses that project's plugin scaffolding (the dual-half packaging, the `cordis.patch.yml` row, the `window.__ModuleLoader__.load` bundle form) and its approach to injecting a sidebar entry, while the current behaviour — the window strategies, the entry-as-action, the toast — is new. See [NOTICE](./NOTICE) for the copyright and license statements.
+[Apache-2.0](./LICENSE). This package started as a fork of [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat): it reuses that project's plugin scaffolding (the dual-half packaging, the `cordis.patch.yml` row, the `window.__ModuleLoader__.load` bundle form) and its approach to injecting a sidebar entry, while the current behaviour — the in-window guest panel, the window fallback chain, the entry-as-action — was written here. See [NOTICE](./NOTICE) for the copyright and license statements.

package/README.md CHANGED Viewed

@@ -2,23 +2,24 @@
 **简体中文** | [English](./README.en.md)
-在 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 里一键打开 [chat.deepseek.com](https://chat.deepseek.com) 官方网页版。
+在 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 里打开 [chat.deepseek.com](https://chat.deepseek.com) 官方网页版——**点侧边栏入口，页面就直接显示在 DSH 窗口里**，占满中栏，和「自动化任务」那些页面一样。
-**侧边栏一个入口，点一下，官方页面就开在一个窗口里。**
+不重新实现聊天界面：模型选择、深度思考、智能搜索、历史记录、附件上传，全都还是官方那一套。
-仅此而已。不做聊天界面，不做会话存储，不做 agent 工具——官方网页版本身就是完整的客户端，模型选择、深度思考、智能搜索、历史记录、附件上传都在里面。
+## 它凭什么能显示在窗口内
-## 为什么不嵌在面板里
+iframe 和 `<webview>` 常规路径确实都被封死了：
-三条路都被封死，这是实测结果而不是取舍：
-| 方式 | 实测结果 |
+| 方式 | 结果 |
 | --- | --- |
-| `<iframe>` | `chat.deepseek.com` 返回 `Content-Security-Policy: frame-ancestors 'none'`，浏览器直接拒绝渲染 |
-| Electron `<webview>` | 桌面端两个窗口都是 `webviewTag: false`，且 `will-attach-webview` 被显式拦截 |
-| 桌面端内置的 `WebContentsView` | 只服务平台页面（账号/充值），导航被限制在该 origin，第三方插件拿不到 |
+| `<iframe>` | 站点返回 `Content-Security-Policy: frame-ancestors 'none'`，浏览器拒绝渲染 |
+| 直接写 `<webview>` | 桌面端默认关闭该标签，且 `will-attach-webview` 一律拦截 |
+但桌面端为**受信任的浏览器访客**留了通道：渲染进程向 `globalThis.dshDesktop.browser` 申请一个租约，宿主只放行 `src="about:blank#<lease>"` 且 `partition` 匹配的那一个 `<webview>`，其余照旧拦截。DSH 自带的侧栏浏览器用的就是这套机制，本插件走同一条通道。
-所以忠实呈现官方页面的唯一方式，就是开一个真实窗口。
+所以这个页面**不是嵌在 iframe 里**，而是宿主的原生访客——`frame-ancestors` 管不到它。这也解释了为什么它必须由 DSH 桌面端承载。
+在没有该桥接的环境（纯 `dsh web`，非桌面端）会**自动降级**为打开一个窗口，保证入口永远有反应。
 ## 安装
@@ -38,40 +39,31 @@ dsh plugin --profile desktop add github:jaychang1989/dsh-webchat
 ## 使用
-1. 点侧边栏的「DeepSeek 网页」入口；
-2. 在弹出的窗口里登录一次 DeepSeek，之后登录态会保留。
-点击后右下角会有一条短提示说明结果。
-## 它怎么打开页面
-按顺序尝试，第一个成功的生效，提示条会告诉你实际用了哪一种：
-1. **应用窗口** —— 由 DSH 桌面端进程自己创建的窗口（桌面端就是 Electron）。已经开着就聚焦，不会重复开。
-2. **无边框窗口** —— Edge/Chrome 的 `--app=` 模式，使用独立 `--user-data-dir`（`~/.dsh/dsh-webchat/app-window`），因此登录态与你日常浏览器互不干扰。用于第 1 种拿不到 Electron 的场景。
-3. **系统默认浏览器** —— 兜底，保证点击一定有反应。
+1. 点侧边栏的「DeepSeek 网页」入口 —— 页面直接在中栏载入，不需要第二次点击；
+2. 在里面登录一次 DeepSeek，当前这次运行内一直有效。
-三种都不需要额外配置。
+再点一次入口收起面板；面板关闭后访客保持挂载，重新打开不会重新加载、也不会掉登录。点侧边栏里**任何其它行**（插件、自动化任务、任务看板、会话、工作区）都会把中栏让回去——那些页面由 shell 渲染在中栏，本插件不占用它们的席位。
 ## 环境要求
 - DeepSeek Harness **0.2.0-rc.1 或更新的 0.2.x**
 - Node.js >= 22
-- 第 2 种方式需要本机装有 Edge 或 Chrome；第 1 种不需要
+- 桌面端（DSH Desktop）：只有它提供原生访客桥接；纯 `dsh web` 会走窗口降级
 ## 已知限制
-- 官方网页端有它自己的风控和登录流程，插件只负责把页面交出去，不介入其请求。
-- 第 1 种方式创建的窗口由 DSH 进程拥有：如果你先关掉 DSH 主窗口、而它仍开着，DSH 不会退出（Electron 的 `window-all-closed` 语义）。把它一起关掉即可。
-- 插件被重载时不会主动关闭已经打开的窗口——否则一次设置变更就会把你正在看的会话关掉。
+- **重启桌面端后需要重新登录 DeepSeek。** 宿主给访客分配的是**进程内**分区（每次运行随机命名、不带 `persist:`），登录态不落盘。这是宿主的机制，插件无法改变。
+- 官方网页端有自己的风控与登录流程，插件只负责把它承载起来，不介入其请求。
+- 页面里指向外部的链接在访客内处理；插件不追加自己的导航策略。
 ## 排查
 | 现象 | 原因 / 处理 |
 | --- | --- |
-| 提示条显示 `HTTP 404` | 宿主的旧版本还在内存里（宿主半区只在进程启动时加载，客户端半区每次刷新页面重新取）。**重启桌面端**即可 |
-| 提示条显示「已交给系统默认浏览器打开」 | 前两种方式都不可用；看窗口是否被宿主拒绝，或本机没装 Edge/Chrome |
-| 入口没出现在侧边栏 | 确认 profile 的 `dsh.profile.bundles` 里有 `@jaychang1989/dsh-webchat`，并重启桌面端 |
+| 入口没出现 | 确认 profile 的 `dsh.profile.bundles` 里有 `@jaychang1989/dsh-webchat`，然后重启桌面端 |
+| 中栏提示「载入失败：…」 | 宿主拒绝了访客（桥接返回异常）。文本里带着宿主给的原因 |
+| 点了入口却弹出一个浏览器窗口 | 说明当前渲染进程拿不到 `dshDesktop.browser`（例如在纯 web 环境），插件走了降级路径 |
+| 重启后要求重新登录 | 见上面的「已知限制」，属于宿主分区机制 |
 ## 开发与测试
@@ -79,10 +71,10 @@ dsh plugin --profile desktop add github:jaychang1989/dsh-webchat
 node --test
 ```
-13 个用例：宿主两条路由与窗口策略选择，以及浏览器半区在 DOM 桩里真实执行（挂载入口、点击后请求正确路由、成功/兜底/失败是否都如实提示）。
+14 个用例，其中浏览器半区在 DOM 桩里**真实执行**：桌面端环境下验证入口挂载、点击后申请租约、按宿主约定生成 `about:blank#<lease>` 的 webview、`dom-ready` 后导航到目标地址、关闭重开复用同一个访客；无桥接环境下验证降级为请求宿主开窗并如实提示结果。
-没有构建步骤——`lib/index.js` 与 `lib/client.js` 就是手写的运行时代码，包内**零运行时依赖**。细节见 [MAINTAINING.md](./MAINTAINING.md)。
+没有构建步骤——`lib/index.js` 与 `lib/client.js` 就是手写的运行时代码，包内**零运行时依赖**。访客机制的来龙去脉见 [MAINTAINING.md](./MAINTAINING.md)。
 ## 来源与许可
-[Apache-2.0](./LICENSE)。本包最初由 [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat) 分叉而来：沿用了它的插件骨架（双半区打包、`cordis.patch.yml` 行、浏览器 bundle 的 `window.__ModuleLoader__.load` 形式）与侧边栏入口的 DOM 注入思路，当前功能（打开官方页面的窗口策略、入口即动作、提示条）是新写的。版权与许可声明见 [NOTICE](./NOTICE)。
+[Apache-2.0](./LICENSE)。本包最初由 [xmuwenxiang/dsh-web-chat](https://github.com/xmuwenxiang/dsh-web-chat) 分叉而来：沿用其插件骨架（双半区打包、`cordis.patch.yml` 行、浏览器 bundle 的 `window.__ModuleLoader__.load` 形式）与侧边栏入口的 DOM 注入思路；当前功能——中栏访客面板、窗口降级链、入口即动作——都是在这里写的。版权与许可声明见 [NOTICE](./NOTICE)。

package/lib/client.js CHANGED Viewed

@@ -1,15 +1,22 @@
 /**
  * dsh-webchat — browser half.
  *
- * One sidebar entry. Clicking it opens the official DeepSeek web app in a
- * window (see lib/index.js) and reports the outcome in a short toast. There is
- * no panel and no in-GUI chat: chat.deepseek.com cannot be framed
- * (`frame-ancestors 'none'`) and this build has `webviewTag: false`, so the
- * official page can only live in a window of its own.
+ * One sidebar entry that opens the official chat.deepseek.com web app **inside
+ * the DSH window**, in the center column, exactly like the other full-page
+ * views (Automation Tasks and friends).
  *
- * Everything here is plain DOM — no React, no build step. The shell exposes no
- * slot an external plugin can register into, so the entry row is injected at
- * the DOM level and self-heals against React re-renders.
+ * It can do that because the desktop shell lends out native browser guests: the
+ * renderer asks `globalThis.dshDesktop.browser` for a reservation and then
+ * attaches a `<webview>` whose `src` is `about:blank#<lease>` and whose
+ * `partition` matches — the shell approves exactly that element and assigns the
+ * real web preferences, so the page is not subject to `frame-ancestors` the way
+ * an iframe would be. This is the same mechanism the built-in side-card browser
+ * uses; see MAINTAINING.md.
+ *
+ * Where that bridge is absent (a plain `dsh web` profile, not the desktop app)
+ * the entry falls back to asking the host half to open the page in a window.
+ *
+ * Everything here is plain DOM — no React, no build step.
  */
 window.__ModuleLoader__.load({
 	id: "@jaychang1989/dsh-webchat",
@@ -17,11 +24,26 @@ window.__ModuleLoader__.load({
 		var module = { exports: {} }
 		var exports = module.exports
-		/** Routes served by lib/index.js. */
-		var API = { open: '/api/dsh-webchat/open' }
+		/** Host route used only by the window fallback. */
+		var OPEN_ROUTE = '/api/dsh-webchat/open'
+		/** The page the panel shows. */
+		var PAGE_URL = 'https://chat.deepseek.com/'
+		/**
+		 * Storage identity for the guest partition. The shell keys one
+		 * process-lifetime partition per identity, so this string is what makes
+		 * the DeepSeek login survive panel close/reopen within one run.
+		 */
+		var STORAGE_IDENTITY = 'dsh-webchat'
 		var ENTRY_ATTR = 'data-dsh-webchat-entry'
+		var VIEW_ATTR = 'data-dsh-webchat-view'
+		var ACTIVE_ATTR = 'data-dsh-webchat-active'
+		var OTHER_ACTIVE_ATTRS = ['data-dsh-taskboard-active', 'data-dsh-ssh-active']
+		var ACTIVATE_EVENT = 'dsh-panel-activate'
+		var PANEL_NAME = 'webchat'
 		var STYLE_ID = 'dsh-webchat-style'
 		var TOAST_ATTR = 'data-dsh-webchat-toast'
+		var FRAME_CLASS = 'dsh-wc-frame'
 		var ZH = typeof navigator === 'object' && typeof navigator.language === 'string'
 			&& navigator.language.toLowerCase().indexOf('zh') === 0
@@ -30,25 +52,33 @@ window.__ModuleLoader__.load({
 		var T = ZH
 			? {
 				label: 'DeepSeek 网页',
-				tooltip: '打开 chat.deepseek.com',
-				busy: '正在打开…',
-				opened: '已打开 DeepSeek 网页',
-				handed: '已交给系统默认浏览器打开',
-				failed: '打开失败',
+				tooltip: '在 Harness 内打开 chat.deepseek.com',
+				failed: '载入失败',
+				fallbackOpened: '已打开 DeepSeek 网页',
+				fallbackHanded: '已交给系统默认浏览器打开',
+				fallbackFailed: '打开失败',
 			}
 			: {
 				label: 'DeepSeek Web',
-				tooltip: 'Open chat.deepseek.com',
-				busy: 'Opening…',
-				opened: 'DeepSeek Web is open',
-				handed: 'Handed to the system default browser',
-				failed: 'Could not open',
+				tooltip: 'Open chat.deepseek.com inside Harness',
+				failed: 'Could not load it',
+				fallbackOpened: 'DeepSeek Web is open',
+				fallbackHanded: 'Handed to the system default browser',
+				fallbackFailed: 'Could not open',
 			}
-		/** Entry and toast styling, scoped to this plugin's own attribute. */
+		/** Entry, center-column takeover and guest styling. */
 		var CSS = [
+			"[data-pane='conversation'],[class*='centerCol']{position:relative}",
+			'[' + VIEW_ATTR + ']{position:absolute;inset:0;display:none;z-index:60;background:var(--dsw-alias-bg-base)}',
+			'html[' + ACTIVE_ATTR + ']:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [' + VIEW_ATTR + ']{display:flex}',
+			"html[" + ACTIVE_ATTR + "]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [data-pane='conversation'] > :not([" + VIEW_ATTR + ']),',
+			'html[' + ACTIVE_ATTR + "]:not([data-dsh-taskboard-active]):not([data-dsh-ssh-active]) [class*='centerCol'] > :not([" + VIEW_ATTR + ']){display:none !important}',
+			'.' + FRAME_CLASS + '{-webkit-app-region:no-drag;border:0;flex:auto;width:100%;min-width:0;height:100%;min-height:0;display:flex}',
+			'.dsh-wc-message{margin:auto;max-width:460px;padding:22px;text-align:center;font-size:13px;line-height:1.65;color:var(--dsw-alias-label-secondary);font-family:var(--dsw-font-family)}',
 			'[' + ENTRY_ATTR + ']{display:flex;align-items:center;gap:8px;width:100%;height:32px;padding:0 12px;background:transparent;border:none;border-radius:8px;color:var(--dsw-alias-label-secondary);cursor:pointer;font-size:13px;white-space:nowrap}',
 			'[' + ENTRY_ATTR + ']:hover{background:var(--dsw-specific-sidebar-nav-item-hover);color:var(--dsw-alias-label-primary)}',
+			'[' + ENTRY_ATTR + '][data-active]{background:var(--dsw-specific-sidebar-nav-item-active);color:var(--dsw-alias-label-primary);font-weight:600}',
 			'[' + ENTRY_ATTR + '][disabled]{opacity:.55;cursor:progress}',
 			'[' + ENTRY_ATTR + '] [data-part=icon]{display:inline-flex;align-items:center;justify-content:center;flex:none}',
 			'[' + ENTRY_ATTR + '] [data-part=label]{overflow:hidden;text-overflow:ellipsis}',
@@ -58,6 +88,16 @@ window.__ModuleLoader__.load({
 			'[' + TOAST_ATTR + '][data-state=bad]{border-color:var(--dsw-alias-state-danger,#ef4444);color:var(--dsw-alias-state-danger,#ef4444)}',
 		].join('\n')
+		/**
+		 * The desktop shell's browser bridge, when this renderer is the desktop
+		 * app's primary frame. A plain web profile exposes only a protocol
+		 * version, so the window fallback takes over.
+		 */
+		const carrier = globalThis.dshDesktop
+		const guests = carrier !== null && typeof carrier === 'object' && carrier.protocolVersion === 1
+			? carrier.browser
+			: undefined
 		/** Inject the stylesheet once. */
 		function ensureStyle() {
 			if (document.getElementById(STYLE_ID) !== null) return
@@ -67,7 +107,7 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag)
 		}
-		/** Show one transient message next to the panel corner. */
+		/** Show one transient message in the corner. */
 		function toast(text, state) {
 			var previous = document.querySelector('[' + TOAST_ATTR + ']')
 			if (previous !== null) previous.remove()
@@ -81,15 +121,39 @@ window.__ModuleLoader__.load({
 			}, state === 'bad' ? 8000 : 3000)
 		}
-		/** Call the host route; a non-JSON or non-2xx answer becomes an error field. */
-		async function openPage() {
-			const response = await fetch(API.open, { method: 'POST', headers: { accept: 'application/json' } })
+		/** Ask the host half to open the page in a window (the non-desktop path). */
+		async function openInWindow() {
+			const response = await fetch(OPEN_ROUTE, { method: 'POST', headers: { accept: 'application/json' } })
 			let payload = {}
 			try { payload = await response.json() } catch (error) { payload = {} }
 			if (!response.ok && payload.error === undefined) payload.error = 'HTTP ' + response.status
 			return payload
 		}
+		/** Tiny observable for the panel's open state. */
+		function createController() {
+			var open = false
+			var listeners = new Set()
+			var notify = function () {
+				listeners.forEach(function (listener) {
+					try {
+						listener()
+					} catch (error) {
+						console.warn('[dsh-webchat] listener failed:', error)
+					}
+				})
+			}
+			return {
+				isOpen: function () { return open },
+				subscribe: function (listener) {
+					listeners.add(listener)
+					return function () { listeners.delete(listener) }
+				},
+				toggle: function () { open = !open; notify() },
+				close: function () { if (!open) return; open = false; notify() },
+			}
+		}
 		/** The sidebar shell root, or undefined while it is not mounted. */
 		function sidebarRoot() {
 			var column = document.querySelector('[data-pane="sidebar"], [class*="sidebarCol"]')
@@ -110,7 +174,7 @@ window.__ModuleLoader__.load({
 		}
 		/** Build the entry row. */
-		function createEntry() {
+		function createEntry(onClick) {
 			var entry = document.createElement('button')
 			entry.type = 'button'
 			entry.setAttribute(ENTRY_ATTR, '')
@@ -126,26 +190,7 @@ window.__ModuleLoader__.load({
 			label.textContent = T.label
 			entry.appendChild(icon)
 			entry.appendChild(label)
-			entry.addEventListener('click', async function () {
-				if (entry.disabled) return
-				entry.disabled = true
-				var labelNode = entry.querySelector('[data-part=label]')
-				if (labelNode !== null) labelNode.textContent = T.busy
-				try {
-					var outcome = await openPage()
-					if (outcome.ok === true) {
-						toast(String(outcome.via) === 'system-browser' ? T.handed : T.opened)
-					} else {
-						toast(T.failed + '：' + String(outcome.error || outcome.via || ''), 'bad')
-					}
-				} catch (error) {
-					toast(T.failed + '：' + (error instanceof Error ? error.message : String(error)), 'bad')
-				}
-				if (labelNode !== null) labelNode.textContent = T.label
-				entry.disabled = false
-			})
+			entry.addEventListener('click', onClick)
 			return entry
 		}
@@ -165,9 +210,7 @@ window.__ModuleLoader__.load({
 		}
 		/** Mount the sidebar entry with its self-healing observers. */
-		function mountSidebarEntry() {
-			if (document.querySelector('[' + ENTRY_ATTR + ']') !== null) return function () {}
-			var entry = createEntry()
+		function mountSidebarEntry(controller, entry) {
 			var root
 			var placed = false
@@ -200,22 +243,191 @@ window.__ModuleLoader__.load({
 				if (!root.contains(entry)) placed = placeEntry(root, entry)
 			})
+			var syncActive = function () {
+				if (controller.isOpen()) entry.dataset.active = 'true'
+				else delete entry.dataset.active
+			}
+			var unsubscribe = controller.subscribe(syncActive)
+			syncActive()
 			tryPlace()
 			return function () {
 				waitObserver.disconnect()
 				rootObserver.disconnect()
+				unsubscribe()
 				entry.remove()
 			}
 		}
-		/** Mount the entry. */
+		/** The center column that hosts full-page views. */
+		function conversationColumn() {
+			return document.querySelector('[data-pane="conversation"], [class*="centerCol"]') || undefined
+		}
+		/**
+		 * Mount the panel that carries the guest.
+		 *
+		 * The guest is created lazily on first open and then kept mounted while
+		 * the panel is closed, so re-opening does not reload the page and the
+		 * DeepSeek session stays where it was.
+		 * @param controller - panel open state.
+		 * @returns disposer removing the panel and releasing the guest.
+		 */
+		function mountPanel(controller) {
+			var container
+			var frame
+			var lease
+			var failed = false
+			var showMessage = function (text) {
+				var box = document.createElement('div')
+				box.className = 'dsh-wc-message'
+				box.textContent = text
+				container.appendChild(box)
+			}
+			/** Reserve a guest and attach its webview. */
+			var ensureGuest = async function () {
+				if (frame !== undefined || failed) return
+				try {
+					const reservation = await guests.acquire(STORAGE_IDENTITY)
+					if (reservation === null || typeof reservation !== 'object'
+						|| typeof reservation.lease !== 'string' || typeof reservation.partition !== 'string') {
+						throw new Error('the desktop browser bridge returned no reservation')
+					}
+					lease = reservation.lease
+					const element = document.createElement('webview')
+					element.className = FRAME_CLASS
+					element.setAttribute('name', reservation.lease)
+					element.setAttribute('partition', reservation.partition)
+					element.setAttribute('allowpopups', '')
+					element.setAttribute('src', 'about:blank#' + reservation.lease)
+					element.addEventListener('dom-ready', function () {
+						element.loadURL(PAGE_URL).catch(function (error) {
+							toast(T.failed + '：' + (error instanceof Error ? error.message : String(error)), 'bad')
+						})
+					}, { once: true })
+					frame = element
+					container.appendChild(element)
+				} catch (error) {
+					failed = true
+					showMessage(T.failed + '：' + (error instanceof Error ? error.message : String(error)))
+				}
+			}
+			var ensure = function () {
+				if (container !== undefined) {
+					if (container.isConnected) return
+					container.remove()
+					container = undefined
+					frame = undefined
+				}
+				var column = conversationColumn()
+				if (column === undefined) return
+				container = document.createElement('div')
+				container.setAttribute(VIEW_ATTR, '')
+				container.setAttribute('data-dsh-plugin', 'webchat')
+				column.appendChild(container)
+			}
+			var waitObserver = new MutationObserver(function () { ensure() })
+			var applyActive = function () {
+				if (controller.isOpen()) {
+					OTHER_ACTIVE_ATTRS.forEach(function (attr) { document.documentElement.removeAttribute(attr) })
+					document.documentElement.setAttribute(ACTIVE_ATTR, '')
+					// Mount before announcing: the arbitration event dispatches into
+					// other plugins, and a throwing listener must not be able to leave
+					// this panel half-open.
+					ensure()
+					void ensureGuest()
+					document.dispatchEvent(new CustomEvent(ACTIVATE_EVENT, { detail: PANEL_NAME }))
+				} else {
+					document.documentElement.removeAttribute(ACTIVE_ATTR)
+				}
+			}
+			var onOtherActivate = function (event) {
+				var detail = event.detail
+				if ((detail === 'taskboard' || detail === 'ssh') && controller.isOpen()) controller.close()
+			}
+			/**
+			 * The shell's own panel list owns the center column. Its rows —
+			 * Plugins, Automation Tasks, the task board, sessions, workspaces —
+			 * do not take part in the third-party `data-*-active` handshake, so
+			 * this panel has to yield on any navigation from the sidebar, or its
+			 * overlay would keep hiding the page the shell just selected.
+			 */
+			var SIDEBAR_SELECTOR = '[data-pane="sidebar"], [class*="sidebarCol"]'
+			var onClickSidebarRow = function (event) {
+				if (!controller.isOpen()) return
+				var target = event.target
+				if (target === null || target.closest === undefined) return
+				// This plugin's own row toggles the panel; it is not navigation.
+				if (target.closest('[' + ENTRY_ATTR + ']') !== null) return
+				if (target.closest(SIDEBAR_SELECTOR) !== null) controller.close()
+			}
+			document.addEventListener('click', onClickSidebarRow, true)
+			document.addEventListener(ACTIVATE_EVENT, onOtherActivate)
+			var unsubscribe = controller.subscribe(applyActive)
+			applyActive()
+			ensure()
+			waitObserver.observe(document.body, { childList: true, subtree: true })
+			return function () {
+				document.removeEventListener('click', onClickSidebarRow, true)
+				document.removeEventListener(ACTIVATE_EVENT, onOtherActivate)
+				waitObserver.disconnect()
+				unsubscribe()
+				document.documentElement.removeAttribute(ACTIVE_ATTR)
+				if (frame !== undefined) frame.remove()
+				if (container !== undefined) container.remove()
+				frame = undefined
+				container = undefined
+				if (lease !== undefined) {
+					const releasing = lease
+					lease = undefined
+					try { void guests.release(releasing) } catch (error) { /* already gone */ }
+				}
+			}
+		}
+		/** Mount the entry, plus the panel when the desktop bridge is present. */
 		function apply(ctx) {
 			ensureStyle()
-			var dispose = mountSidebarEntry()
+			var controller = createController()
+			var disposers = []
+			if (guests !== undefined) {
+				// Desktop: the entry toggles the in-app panel.
+				var entry = createEntry(function () { controller.toggle() })
+				disposers.push(mountSidebarEntry(controller, entry))
+				disposers.push(mountPanel(controller))
+			} else {
+				// Web: no native guest to lend, so the entry asks the host for a window.
+				var fallbackEntry = createEntry(async function () {
+					if (fallbackEntry.disabled) return
+					fallbackEntry.disabled = true
+					try {
+						var outcome = await openInWindow()
+						if (outcome.ok === true) {
+							toast(String(outcome.via) === 'system-browser' ? T.fallbackHanded : T.fallbackOpened)
+						} else {
+							toast(T.fallbackFailed + '：' + String(outcome.error || outcome.via || ''), 'bad')
+						}
+					} catch (error) {
+						toast(T.fallbackFailed + '：' + (error instanceof Error ? error.message : String(error)), 'bad')
+					}
+					fallbackEntry.disabled = false
+				})
+				disposers.push(mountSidebarEntry(controller, fallbackEntry))
+			}
 			ctx.effect(function () {
-				return function () { dispose() }
-			}, 'dsh-webchat: sidebar entry')
+				return function () {
+					disposers.splice(0).forEach(function (dispose) { dispose() })
+				}
+			}, 'dsh-webchat: ui mounts')
 		}
 		exports.apply = apply

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@jaychang1989/dsh-webchat",
-  "version": "0.4.2",
-  "description": "Opens the official DeepSeek web app (chat.deepseek.com) in a window from DeepSeek Harness: one sidebar entry that opens the page directly, so the official client keeps its model picker, deep think, smart search, history and attachments. No chat UI, no agent tools, no runtime dependencies.",
+  "version": "0.5.1",
+  "description": "Opens the official DeepSeek web app (chat.deepseek.com) inside DeepSeek Harness: one sidebar entry renders the real page in the center column, through the same native browser guest the built-in side-card browser uses. No chat UI, no agent tools, no runtime dependencies.",
   "keywords": [
     "dsh",
     "deepseek-harness",