@kkabuka/dsh-agent-notify 0.0.0-stage → 1.0.2

package/CHANGELOG.md

@@ -0,0 +1,234 @@
+# CHANGELOG
+
+## 1.0.2（2026-10-24，修 1.0.1 的改名遗漏）
+
+- **Fixed：`cordis.patch.yml` 仍写旧包名 `dsh-agent-notify`** ⇒ 宿主 boot 报 `1 entry did not activate` + `Cannot find package 'dsh-agent-notify'`（bundle 行按名字 import，改名后必须同步）。现改成 `@kkabuka/dsh-agent-notify`，并加**回归锁** `test/patch-name.test.cjs`（断言 patch 的 `name` 与 `package.json` 逐字一致）。
+- 影响面：1.0.1 对**新装机器**不可用（装上也起不来）；已发布版本无法修改 ⇒ 以 1.0.2 覆盖。本机 1.0.1 的装机副本已手工同步该行（内容 = 1.0.2）。
+
+## 1.0.1（2026-10-24，首次以 `@kkabuka/dsh-agent-notify` 发布）
+
+- **内容 = 内部 `1.0.0-fork.4`**（详见下一条）。改名重定的原因：上游 npm 自 2026-08-22 起停更在 `1.0.0`，`dsh-agent-notify` 这个名字归上游 ⇒ 我们的 0.2.x 适配无法按原名发布；`1.0.1` 语义 = "上游 1.0.0 + 一个补丁"，`-fork.N` 后缀不再出现在对外版本号里。
+- **发布形态**：`npm stage publish`（免 2FA）⇒ 网页 Staged Packages 点 Approve + 2FA 批准。npm 已收窄 bypass-2FA 直发（2027-01 全关），故不勾 bypass。
+- **安装**：`dsh plugin --profile web add @kkabuka/dsh-agent-notify@1.0.1`。⚠ 旧名 `dsh-agent-notify`（上游）未适配 0.2.x，勿装。
+- **兼容声明**：`dshCompatibility.testedVersions = 0.2.0-rc.2 / 0.2.1-rc.2`。
+
+## 1.0.0-fork.4（2026-10-06，通知正文改接 Conversation，本库）
+
+- 补：**单测 21 例**（2026-10-12 立，`test/{_harness,client.test,card.test}.cjs` + `npm test` = `node --test "test/*.test.cjs"`，**零依赖免安装**）——覆盖决策面（何时发/不发、权限与 send mode 降级留痕、首见只建基线不重放、pending 抑制「任务完成」、子代理开关）与卡片契约（注册面、CHANGELOG fork.3 三枚死令牌回归锁、开关落盘、写失败降级）。**与真页面探针分工**：本册证明不了"浏览器里真的弹出来了"，那一面仍归 `scripts/verify-notify.mjs`。**不 bump 版本**（不改包行为）；沿革 = 2026-09-27 曾按"不假装成功"撤除指向不存在 `test/` 的声明，本次先有测试再挂声明。
+
+收掉 fork.2 起就挂着的「留档待办」：**通知正文的「最后一句回复」**。rc.2 删了
+`SessionSnapshot.nodes` ⇒ 旧代码 `sessions.binding(id).session.getSnapshot().nodes` **恒空**
+（静默：`Array.isArray(undefined)` 不报错，只是正文悄悄退化成只有标题）。
+
+### 修
+
+装配好的对话在 rc.2 归 **Conversation 视图所有者**管，故正文改用这条链：
+
+```
+ctx.uiConversation.binding(sessionId)            // 未 retain 会抛错 ⇒ 由 try/catch 降级
+  .target('chat').getSnapshot()                  // ChatSnapshot
+    ├─ navigation.items()[].response             // ① 首选：内核自带「有界 assistant 回复预览」
+    └─ legacy.nodes（kind='assistant'.blocks[].text）  // ② 回退：与旧代码逐字同形的兼容投影
+```
+
+- **① `navigation` 为一等公民**：ChatSnapshot 的 `navigation` 是"Stable live navigation
+  projection of the loaded Turns"，其 `response` 就是为紧凑预览而生的有界串；`legacy` 是
+  明标 **compatibility** 的投影（将来会撤），故只作回退。
+- **可达性约束与旧版一致**（不是新增限制）：`uiConversation.binding()` 对 unknown/inactive
+  会话**抛错**，而 `sessions.binding()` 是"borrow without extending lifetime" ⇒ 只有
+  **retained（窗口开着）**的会话才拿得到正文；否则诚实地只显示标题。
+  ⚠ 不引入 retain ⇒ **无泄漏**（binding 由 owner 的 ctx effect 回收）。
+- 取值一路 `try/catch`；未 retain 是**正常路径**（不是失败），故不再打 warn（旧代码在这里
+  会刷 `summary read failed`）。
+- 新增诊断：`__agentNotify.preview([sessionId])` → `{ sessionId, text, source }`
+  （`source ∈ navigation | legacy-nodes | null`；省略 id = 当前主视图会话，由
+  `retainedBy.mainView` 定，**client-local**，不影响别的窗口）。供探针与用户自检。
+- `BUNDLE_VERSION` → `1.0.7-fork.4`；包 `version` → `1.0.0-fork.4`。
+
+### 新增验收件：`scripts/verify-notify.mjs`（真页面 · 只读 · 6 判据）
+
+本包三次修复**全是静默失效型** ⇒ 只有真页面能判。故按 `headless-cdp-standards` §四 建了探针，
+**共用外壳取 `dsh-clips/scripts/probe-harness.mjs`（唯一权威）**，本文件只放自己的判据：
+
+| 判据 | 打在哪个修复上 |
+|---|---|
+| N1 版本面 | 装机件确实换新（防「install 成功 ≠ 更新成功」） |
+| N2 信号源面 `sources()` 两项均解析 | fork.2（`sessions.open` / `pendingInteractions` 两处漂移） |
+| N3a/N3b 选择框 computed 底色/边框 = **内核令牌解析值**且 ≠ rgba 兜底 | fork.3（三枚死令牌） |
+| N4 `preview()` 对 mainView 会话给出非空 text + 命名 source | fork.4（本次） |
+| N5 预览有界（≤91 = 90 + 省略号） | fork.4 |
+
+**实测（2026-10-06，在役 3080，`--allow-main`，只读）：6/6 PASS，exit 0**
+
+```
+N1 PASS  __agentNotify.version=1.0.7-fork.4 · 期望=1.0.7-fork.4
+N2 PASS  pending=sessionStatus · navigation=uiWorkspace.openSession
+N3a PASS select=rgba(26, 34, 56, 0.65)  · token(--dsw-specific-input-major@body)=rgba(26, 34, 56, 0.65)  · 兜底=rgba(128,128,128,0.12)
+N3b PASS select=rgba(160, 180, 230, 0.18) · token(--dsw-alias-border-l2@body)=rgba(160, 180, 230, 0.18) · 兜底=rgba(128,128,128,0.35)
+N4 PASS  session=session-6260ee54… · source=navigation · len=89
+N5 PASS  len=89（上限 91）
+```
+
+- 报告落 `$DSH_HOME/logs/verify-notify-<stamp>.json`（含全文预览）；**token 不入报告、不入 stdout**
+  （实测报告里 `token=` 零命中）。
+- ⚠ **探针自身踩过一个坑，已修并留痕**：首版读 `document.documentElement` 拿令牌 ⇒ 空串 ⇒ 把
+  「探针读错节点」误报成「令牌不存在」（当时 select 的 computed 值**已经**是非兜底主题色）。
+  根因 = 设计平台表把令牌声明在 **`body`**（`body{--dsw-…}`）而非 `html`。现按 body 优先 /
+  html 兜底读，并回报命中处（`@body`）。
+- 隔离实例口径（本域通用）：`node <dsh>/lib/bin.js --profile <名> --host 127.0.0.1 --port <端口> --no-open`
+  ⇒ token 只落该实例启动日志；**3080 承载进程不碰/不重启/不杀**（实测探针跑完 3080 PID 20936 未变）。
+
+## 1.0.0-fork.3（2026-10-06，卡片令牌修正，本库）
+
+起因 = 收口扫描时逐个复核卡片样式里的 `var()`：**三枚令牌在内核里根本不存在**，全部静默落到
+`rgba()` 兜底色 ⇒ 卡片永远不跟主题走（评审 R21 只抓到其中一枚，且当时把「应为 `-major`」
+明确标为**推断**）。这是「静默失效」型缺陷：不报错、不崩、控制台无线索。
+
+### 修（只改令牌名，不动任何视觉参数）
+
+| 旧（内核不存在） | 新（内核有 `name:` 定义） | 依据 |
+|---|---|---|
+| `--dsw-specific-input-bg` | **`--dsw-specific-input-major`** | 内核**自己就把它当输入面背景**用：`ImageLightbox.module.css:24,41`、多个 client bundle 的 `background:var(--dsw-specific-input-major` ⇒ R21 的推断**至此有实据** |
+| `--dsw-specific-input-border` | **`--dsw-alias-border-l2`** | 内核**没有** input-border 同义令牌 ⇒ 取通用发丝边（全树大量 `.5px solid var(--dsw-alias-border-l2)`），属**替代**而非同名替换 |
+| `--dsw-specific-divider` | **`--dsw-alias-border-l2`** | 同上；这枚 R21 / theme-hub C4 此前**漏抓** |
+
+- 三处仍保留原 `rgba()` 兜底值（非 dsh 宿主 / 令牌缺失时照常渲染）。
+- ⚠ 三枚死令牌的**字面量仍留在 `ensureStyle()` 的注释里**（作为「这些名字曾被写错」的留痕）
+  ⇒ 将来若有基于 grep 的令牌消费面检查器，会在这三处产生 **3 条已知误报**，属预期。
+- **防复发口径写进注释**：令牌必须在内核里查到 `name:` **定义**才算存在——裸 `var()` 引用
+  不是证据（R21 的「推断」正是缺这一步才没敢下判）。
+
+### 版本面
+
+`BUNDLE_VERSION` → `1.0.7-fork.3`；包 `version` → `1.0.0-fork.3`（tgz 改名 ⇒
+`dsh-agent-notify-1.0.0-fork.3.tgz`，破 pnpm store 同版复用）。
+
+### 验证
+
+- 装机：`npm pack --pack-destination $DSH_HOME/plugins-local` ⇒
+  `dsh-agent-notify-1.0.0-fork.3.tgz` ⇒ `dsh plugin --profile web add <tgz>` ⇒
+  装机副本 `package.json` = 1.0.0-fork.3 / `BUNDLE_VERSION` = 1.0.7-fork.3；
+  profile 依赖 = `file:C:/Users/jankin_lv/.dsh/plugins-local/dsh-agent-notify-1.0.0-fork.3.tgz`。
+- **tgz 内特征 grep**（`tar -xOf … package/lib/client.js`）：`BUNDLE_VERSION = '1.0.7-fork.3'`、
+  `--dsw-specific-input-major`、`--dsw-alias-border-l2` 三处在位；三枚死令牌**不再出现在
+  任何 CSS 规则里**（仅注释命中）。
+- `node --check lib/client.js` ⇒ exit 0。
+- ✅ **页面级复核已补做（2026-10-06，fork.4 那批）**：`scripts/verify-notify.mjs` 的
+  **N3a/N3b 判据**在真页面把这条钉死 —— 选择框 computed 底色/边框 = `body` 上
+  `--dsw-specific-input-major` / `--dsw-alias-border-l2` 的**解析值**，且**不等于** rgba 兜底
+  （`rgba(128,128,128,0.12)` / `rgba(128,128,128,0.35)`）⇒ 三枚死令牌的修复**有机械判据**，
+  不再依赖肉眼。实测值见 fork.4 条目。
+  （原登记：本机 headless 上下文丢鉴权 cookie、一次性 token 按纪律不入对话 ⇒ 当时只做到文件级。
+   现由**探针在进程内取 token** 解决，见 fork.4 的 `verify-notify.mjs`。）
+- 回归面：本次只动 CSS 模板串与一处注释，未触碰 `apply` / 订阅 / 导航解析 ⇒ fork.2 的
+  `__agentNotify.sources()` 判据不受影响（真机一并看）。
+
+## 1.0.0-fork.2（2026-10-06，0.2.0-rc.2 内核适配，本库）
+
+内核从 0.1.2-rc.1 升到 0.2.0-rc.2 后，本 fork 有三处 client 契约漂移。起报症状 =
+「点击系统通知不再切换到对应会话」。本次修前两处（都是功能性坏点），第三处只留档。
+
+### 修复 1 · 点击系统通知 → 打开对应会话（用户报的症状）
+
+- **旧形**：`ctxRef.sessions.open(sessionId)`，守卫 `typeof ctxRef.sessions.open === 'function'`。
+- **为什么哑**：0.2.0-rc.2 的 `ISessions`（= `ctx.sessions` 的对外面）**已无 `open()`** ——
+  契约注释原话 "navigation belongs to view owners"，实现类 `ClientSessions` 方法表里也确实没有。
+  守卫恒为假 ⇒ 点击**静默只聚焦**（不抛错，所以控制台连线索都没有）。
+- **新形**：`resolveOpenSession()` 惰性解析导航动词 —— 优先
+  `ctx.uiWorkspace.openSession(target)`（0.2.0-rc.2 的 Workspace 视图所有者入口，实现即
+  `replaceMain(...)`，顺带清掉该会话的 completionUnread 小红点），保留旧 `sessions.open()` 回退；
+  **只缓存成功结果**（服务可能晚于 apply 注册）；解析不到时 `console.warn` 一次（不再静默）。
+- **取值姿势 = `ctx.reflect.get(name, false)`**（cordis 明文档的「免 inject 读服务」）⇒
+  **不把 `uiWorkspace` 加进 `exports.inject`**：该服务在组合里缺失时插件仍能加载并继续弹通知
+  （硬 inject 会让整个插件永不 apply，连通知一起没）。实测：直接 `ctx.uiWorkspace` 读会抛
+  `cannot get property "uiWorkspace" without inject`（插件 fiber 的 inject 里没有它），
+  走 reflect 才拿得到。
+
+### 修复 2 · 「需要你的输入 / 批准 / 审阅」通知全哑（同因；用户未报，自查发现）
+
+- **旧形**：`ctx.uiSession.pendingInteractions`（`Map<sessionId, interaction>`）。
+- **为什么哑**：0.2.0-rc.2 **已删该 store**（整个内核 client bundle 里 `pendingInteractions` 零命中），
+  换成 **`ctx.uiSession.sessionStatus`**：
+  `Map<sessionId, { running, pendingInteraction, completionUnread }>` + `subscribe`。
+  旧代码 `trySubscribePending()` 撞守卫直接 `return false` ⇒ 这类通知**一条都不弹**。
+- **新形**：`pendingSourceFor(ui)` 把两种 store 归一成
+  `{ id, subscribe, entries(), pendingOf(id) }`，优先 `sessionStatus`、回退 `pendingInteractions`
+  ⇒ **同一份 bundle 同时服务 0.2.0-rc.2 与 0.1.2-rc.1**（另一台机器若仍在该线不回退）。
+- 交互对象字段**未变**（`kind` / `key` / `sessionId` / `questions` / `reason` / `toolName` 实测仍在），
+  故 body 取值（`pendingSummaryText`）与 identity-diff 语义**原样保留**。
+- 订阅纪律微调：`subscribe()` 成功返回后才置 `pendingSubscribed`（旧代码先置位，subscribe 抛错会留下
+  「以为订上了其实没订」的哑状态）。
+
+### 留档待办（本次未修）· 通知正文缺「最后一句回复」
+
+- `lastAssistantText()` 读 `snap.nodes`，但 0.2.0-rc.2 的 `SessionSnapshot` **已无 `nodes` 字段**
+  ⇒ 恒返回 `''`，正文退化为只有会话标题（**外观降级，不影响功能**）。
+- 替代走 `ctx.uiConversation.binding(sessionId).snapshot → views[目标视图]`，但 `binding()`
+  会**物化会话绑定**（副作用面）且需选定视图 key ⇒ 单列，不挤进本次修复。
+
+### 诊断面（新增）
+
+- `window.__agentNotify.sources()` → `{ pending: 'sessionStatus' | 'pendingInteractions' | null,
+  navigation: 'uiWorkspace.openSession' | 'missing' }` —— 下次内核漂移时一眼判面。
+- `BUNDLE_VERSION` → `1.0.7-fork.2`；启动日志行 `loaded (rc.1)` → `loaded (0.2.0-rc.2)`。
+
+### 已复核、未变（别顺手改）
+
+- `sessions.list` 的 `phase` / `byId` / `running` / `displayTitle` / `origin` —— 「任务完成」检测照旧。
+- `settings.section` 注册：0.2.0-rc.2 的 slots 面**已无 `ctx.slots.inject()` 方法**（`inject` 变成
+  `register` 的选项字段），而插件原有的「无 inject 面则直注册」回退正好走通 ⇒ 设置页正常，无需改。
+
+### 验证
+
+- 装机：`npm pack --pack-destination $DSH_HOME/plugins-local` ⇒
+  `dsh-agent-notify-1.0.0-fork.2.tgz`（**改名破 pnpm store 同版复用**）⇒
+  `dsh plugin --profile web add <tgz>` ⇒ profile 依赖指向 `-1.0.0-fork.2.tgz`，
+  装机副本 `package.json` = 1.0.0-fork.2 / `BUNDLE_VERSION` = 1.0.7-fork.2。
+- 组合树复验：`Get-LoaderDupId`（`dsh --profile web --dump-config`，414 条）= **0 重复**；
+  宿主存活（`http://127.0.0.1:3080/` 返回 401 = 未带 token 的正常应答）。
+- 运行时（真页面 headless）：`__DSH_BOOT__` 条目 rev `e404e71efbca` → `1947aa3669ca`；
+  `__agentNotify.version` = `1.0.7-fork.2`；
+  **`__agentNotify.sources()` = `{ pending: 'sessionStatus', navigation: 'uiWorkspace.openSession' }`**
+  （`pending` 非 null ⟺ `subscribe()` 已成功返回，故同时证明修 2 的订阅已挂上）。
+- 跳转端到端：从真页面取到 client 根 ctx，调 `uiWorkspace.openSession(<另一会话>)` ⇒
+  `retainedBy.mainView` 从原会话移到目标会话、页面标题随之切换（`switched: true`）。
+  ⚠ 该动词 = 侧栏每次点击会话走的同一条内核路径。
+- ✅ **真机确收（2026-10-06，用户）**：点通知气泡**已能跳到该会话** —— fork.2 主修闭环。
+  本机 headless 通知权限为 `denied`，只能验到「动词已解析 + 动词可用」这一层；真机链路
+  （OS toast 弹出 → 点击 → 跳转）由用户实测确收。附带确收面 = 通知链路本身在 0.2.0-rc.2
+  上仍是通的（能弹出、可点击）。
+
+## 1.0.0-fork.1（2026-09-07，rc.1 适配 fork，本库）
+
+上游 `1.0.0`（chidaic/dsh-agent-notify，rc.6 时代 client 契约）在 dsh 0.1.2-rc.1 +
+web-all 0.3.13 下冷启动整页崩（`require("@deepseek-ai/dsh-client-runtime/client") missed
+the module table`，见 PITFALLS §12.5）。本 fork 做最小适配救回，行为差异如下：
+
+### 移除（rc.1 硬不兼容点）
+- manifest `dsh.client.inject: ["@deepseek-ai/dsh-client-runtime"]` 删除（只留 `platform: web`）。
+- `lib/client.js` 顶部 `require('@deepseek-ai/dsh-client-runtime/client')` 删除
+  （rc.1 运行时无此模块 id；`react` 仍走平台 seed）。
+
+### 需输入信号换源（核心改动）
+- 旧：从 `summary.pendingInteraction` 判「需要你的回答 / 批准 / 审阅」——rc.1
+  `SessionSummary` 已移除该字段。
+- 新：订阅根级 **`ctx.uiSession.pendingInteractions`**（Map<sessionId, interaction> +
+  subscribe，kind = question / approval / plan-review）。`exports.inject` 增加
+  `uiSession`；订阅懒挂（服务可能晚于 apply 注册）+ 存在性守卫。
+- 判新按 interaction 对象身份 diff（新对象 = 新请求，同会话重复来也通知；移除不通知）；
+  首次快照即通知既有 pending（「未答问题不静默吞掉」，同旧语义）；kind 三值过滤；
+  subagent 过滤开关保留。
+- 「任务完成」在停止瞬间若有活 pending 则抑制（避免与「需要回答」双弹）。
+
+### 其它
+- `settings.section` 注册改 `ctx.slots.inject('settings.section', () => ctx.slots.register(...))`
+  姿势（rc.1 slot 目录要求），`label` 改静态字符串；保留无 inject 面时的直注册回退。
+- 点击系统通知 = 聚焦窗口（用户窄化需求：无通知内操作），原 open-session 尝试保留。⛔ **本口径已被 1.0.0-fork.2 取代**（2026-10-06 用户改要「点了就跳到该会话」）—— 看当前行为请读本册顶部 fork.2 条目。
+- 诊断钩子 `window.__agentNotify` 增加 `events()`（最近 20 条通知尝试打点，含
+  fired/reason/kind/title/sessionId/mode/permission）——无头验收与排障用。
+- `BUNDLE_VERSION` → `1.0.7-fork.1`。
+
+### 验证
+无头验收 6/6（无横幅 / hook / 设置卡 / 测试诊断 / 完成事件端到端打点 / requestPermission
+denied 预期）；真机 Chrome 授权后 OS toast 与点击聚焦待用户确收。机制全文见
+dsh-internals §3.10。

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 chidaic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,95 @@
-# Temporary Holding Version
+# dsh-agent-notify
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **维护中的 fork（`@kkabuka/dsh-agent-notify`，v1.0.1）**：源自 [chidaic/dsh-agent-notify](https://github.com/chidaic/dsh-agent-notify)（MIT；上游 npm 停在 1.0.0 / 2026-08-22，已停更）。本 fork 面向 **dsh 0.2.x** 持续修复，许可与署名仍归上游（见文末）。
+>
+> 相对上游 1.0.0 的四处适配（差异全文 = [CHANGELOG](./CHANGELOG.md)）：① 点击跳转改接 `ctx.uiWorkspace.openSession` ② 需输入信号改接 `ctx.uiSession.sessionStatus`（两者保留旧内核回退）③ 卡片三枚失效 CSS 令牌改回内核实有令牌 ④ 通知正文摘要改接 `ctx.uiConversation`（替换已删的 `SessionSnapshot.nodes`）。
+
+**安装（npm）**
+
+```
+dsh plugin --profile web add @kkabuka/dsh-agent-notify@1.0.1
+```
+
+> 旧名 `dsh-agent-notify` 是上游包（未适配 0.2.x：会话导航与通知正文会静默失效）——**不要装**。源码安装 = `npm pack` → `dsh plugin --profile web add file:<tgz>`。
+
+[![License](https://img.shields.io/npm/l/dsh-agent-notify)](LICENSE)
+
+DSH Web GUI 的「任务完成通知」插件：当 agent 执行完任务 / 回复完对话、或需要你做出选择（提问 / 批准 / 审阅计划）时，弹出 **Windows 系统级通知**（通知中心气泡，声音为 Windows 系统通知音）——无论你在哪个窗口都能看到。**纯系统提示：无网页内弹窗、无合成音、无额外 UI 按钮。**
+
+纯浏览器端插件（host half 为空），无需构建工具，手写 bundle 直接加载。
+
+## 功能
+
+- **任务完成通知**：会话从 `running` 变为停止时，发送「任务完成」系统通知。
+- **需要输入通知**：agent 提问（`question`）时发送「需要你的回答」。
+- **批准 / 计划审阅通知**：`approval` / `plan-review` 时发送「需要你的批准 / 请审阅计划」。
+- **系统级通知**（浏览器 Notification API，类 Codex CLI 体验）：Windows 通知中心弹出气泡，声音为 **Windows 系统通知音**（由 Windows 设置控制）；点击气泡会聚焦页面并打开对应会话。三种模式可选：`不发送` / `后台时发送` / `始终发送`（默认）。
+- **自动授权**：首次点击页面时自动请求通知权限（浏览器会询问，选「允许」即可）；也可在设置页手动授权。
+- **通知内容**：会话标题（+ 该会话最后一条 assistant 回复的前 90 字摘要）。摘要取自 `ctx.uiConversation` 的 Chat 视图：优先 `navigation.items()[].response`（内核自带的**有界回复预览**），回退 `legacy.nodes` 逐节点取文本。⚠ **前提 = 该会话仍被 retain（窗口开着）**——`uiConversation.binding()` 对未 retain 的会话会抛错，故窗口已关闭的会话只显示标题（与 rc.1 时代同一约束）。每条通知都是全新气泡（不带 `tag`——Windows 上 Chrome 对同 tag 通知只静默更新不弹新气泡，这是本插件历史上「通知消失」的根因，已移除）。
+- **设置入口 = DSH 官方设置界面的一级页面**：设置 → **任务提示**（注册进官方 `settings.section` slot，与「设置 → 宠物」同级）：启用通知、是否包含子代理通知、系统通知模式、权限状态与授权、**发送测试通知**（一键诊断，显示具体结果）。设置保存在 `localStorage`（`dsh.agentNotify.settings.v3`）。页面顶部显示插件版本与当前生效配置，便于排查旧缓存。
+- **诊断**：设置页的「发送测试通知」无视发送模式直接弹一条系统通知，并显示结果——「已发送 ✓」却没弹，说明问题在浏览器/Windows 通知设置（地址栏站点权限、Windows 设置 → 系统 → 通知 → 浏览器通知开关与通知声音、专注助手），与插件逻辑无关。
+- **防误报**：
+  - 页面加载 / 重连后，第一个列表快照只作为基线，不重放历史完成事件；
+  - 重连期间发生的完成不会在恢复连接后误报；
+  - 同一 pending 状态不重复通知；
+  - 子代理会话默认不通知（可在设置中开启）。
+
+## 安装
+
+从 npm（推荐，安装走 tarball 秒级完成）：
+
+```sh
+dsh plugin --profile web add dsh-agent-notify
+```
+
+从 GitHub：
+
+```sh
+dsh plugin --profile web add github:chidaic/dsh-agent-notify
+```
+
+或在 **DSH 设置 → 插件市场**（[dshmarket](https://github.com/dsh-market/dsh-market)）中搜索 `dsh-agent-notify` 一键安装。
+
+浏览器端 bundle 变更后**刷新页面即可**（`/plugins/dsh-agent-notify/client.js` 每次读取最新文件；若遇到旧缓存，用 Ctrl+Shift+R 硬刷新）。
+
+## 配置
+
+无 host 配置。浏览器端设置位于官方设置界面 →「任务提示」页面，持久化于 localStorage。
+
+## 目录结构
+
+```
+dsh-agent-notify/
+├── package.json          # dsh.client 声明（platform: web；inject 已于 rc.1 fork 删除，见 CHANGELOG）
+├── cordis.patch.yml      # 插件行（bundle patch）
+├── LICENSE               # MIT
+├── CHANGELOG.md
+├── scripts/
+│   └── verify-notify.mjs # 真页面验收探针（只读；6 判据；共用外壳 = dsh-clips/scripts/probe-harness.mjs）
+├── test/                 # 单测（node:test · 零依赖，`npm test`；夹具 = test/_harness.cjs）
+│   ├── client.test.cjs   # 决策契约：何时发/不发、降级留痕、基线不重放、诊断面
+│   └── card.test.cjs     # 设置卡片：注册面、死令牌回归锁、落盘、失败路径
+└── lib/
+    ├── index.js          # host half（空 apply）
+    └── client.js         # 浏览器 bundle（手写，无构建步骤）
+```
+
+**测试面分工（2026-10-12 补单测）**：① **单测**（`npm test` = `node --test "test/*.test.cjs"`，21 例，**零依赖免安装**）= 决策与契约面（何时发/何时不发、降级留痕、基线不重放、注册面与卡片内容契约）；② **无头真页面探针**（`node dsh/plugins/dsh-agent-notify/scripts/verify-notify.mjs --allow-main`，6 判据；口径与证据 = `docs/plugin-matrix.md` 本包行 + 无头验收报告）= 真 DOM / 真 React / 真弹窗面。⚠ **两册互补、不可互替**：单测跑在 `node:vm` 沙箱（stub React/Notification），证明不了"浏览器里真的弹出来了"。
+> 沿革：2026-09-27 曾按"不假装成功"撤除指向**不存在** `test/` 的声明（`test` 脚本 / CI 徽章 / npm test 说明三处）；本次是**先有测试再挂声明**，故声明重新成立。`devDependencies`（jsdom / react / react-dom）为真页面链所备，单测不依赖它们。
+
+## 开发
+
+- 修改 `lib/client.js` 后运行 `node --check lib/client.js` 验证语法。
+- **单测**：`npm test`（= `node --test "test/*.test.cjs"`；21 例，零依赖免安装）。改 `lib/client.js` 的决策面 / 卡片文案 / 令牌名后必跑；新增测试文件按 `test/<名>.test.cjs` 命名即被 glob 收进（无需改脚本）。
+- 行为改动**必须跑真页面探针**（本包的三个历史缺陷全是「静默失效」型：不报错、不崩、控制台无线索，只有真页面能判）：
+  ```sh
+  node dsh/plugins/dsh-agent-notify/scripts/verify-notify.mjs --allow-main            # 在役/隔离实例 3080
+  node ... --port 3081 --log <该实例启动日志> --allow-main                            # 隔离实例
+  ```
+  ⛔ 探针**只读**（读 computed 样式 + 调插件诊断钩子；会话导航只发生在本探针浏览器内）；token 由共用外壳从启动日志**在进程内**取用，不打印、不落报告。
+- 每次行为变更请递增 `BUNDLE_VERSION`（设置页会显示，用于诊断浏览器缓存旧 bundle）。
+- 页内诊断钩子：`__agentNotify.version` / `sources()`（信号源是否解析到）/ `preview([sessionId])`（通知正文会写什么，省略 id 即当前主视图会话）/ `events()`（最近 20 条通知尝试）。
+
+## 许可
+
+MIT © [chidaic](https://github.com/chidaic)

package/cordis.patch.yml

@@ -0,0 +1,16 @@
+# @kkabuka/dsh-agent-notify bundle patch: registers the plugin row into the web
+# profile roster. Applied as a profile bundle layer (the `dsh.bundle.patch`
+# manifest field); activate with
+# `dsh plugin --profile web add @kkabuka/dsh-agent-notify@<ver>`.
+#
+# The row is a bare plugin by package name: the host half (exports ".") is an
+# empty apply, and the `dsh.client` declaration in package.json makes the
+# browser half (exports "./client", served at /plugins/@kkabuka/dsh-agent-notify/client.js)
+# load in the web GUI.
+#
+# ⚠ `name` 必须与 package.json 的 `name` 逐字一致：2026-10-24 改名发布时这里漏改
+#   （仍写 dsh-agent-notify）⇒ 宿主 boot 报 `1 entry did not activate` +
+#   `Cannot find package 'dsh-agent-notify'`。回归锁 = test/patch-name.test.cjs。
+- insert:
+    - id: agent-notify
+      name: '@kkabuka/dsh-agent-notify'

package/lib/client.js

@@ -0,0 +1,818 @@
+/**
+ * dsh-agent-notify — browser half (hand-written bundle, no build step).
+ *
+ * What it does:
+ *   1. Subscribes to the client sessions list snapshot.
+ *   2. When a session flips running:true -> false  -> "task done" system
+ *      notification.
+ *   3. When a session gains a pending interaction (question / approval /
+ *      plan-review) -> "needs your input" system notification. The signal comes
+ *      from the root uiSession pending store: `ctx.uiSession.sessionStatus` on
+ *      0.2.0-rc.2, falling back to the rc.1 `ctx.uiSession.pendingInteractions`
+ *      map (summary.pendingInteraction was removed back in 0.1.2-rc.1).
+ *   4. All notices go through the OS-level notification center (browser
+ *      Notification API) — no in-page popups, no synthesized sounds.
+ *      Clicking a system notification focuses the page and opens the owning
+ *      session through the Workspace view owner (`ctx.uiWorkspace.openSession`,
+ *      the 0.2.0-rc.2 navigation verb; the pre-0.2 `ctx.sessions.open` read is
+ *      kept as a fallback). The bubble's sound is the Windows notification sound.
+ *   5. Settings live as a first-level page in the official DSH settings
+ *      surface (`settings.section` slot — Settings → 任务提示, the same
+ *      mechanism as Settings → 宠物): notifications / subagents / system
+ *      mode / permission / test button. Persisted in localStorage.
+ *
+ * Failure policy: nothing here may take the web shell down — every DOM
+ * interaction is guarded, and subscription errors degrade to console logs.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-agent-notify',
+  factory: (require) => {
+    // rc.1 fork: the legacy `@deepseek-ai/dsh-client-runtime` module id does not
+    // exist in the 0.1.2-rc.1 runtime (no seed word / graph row / factory), so
+    // the original require was dropped. `react` below is a platform seed word.
+    const React = require('react')
+    var module = { exports: {} }
+    var exports = module.exports
+
+    /** Bump on every behavioral change; shown in the settings page for diagnosing stale bundles. */
+    const BUNDLE_VERSION = '1.0.7-fork.4'
+    try {
+      console.log('[dsh-agent-notify] fork v' + BUNDLE_VERSION + ' loaded (0.2.0-rc.2)')
+    } catch (error) { /* ignore */ }
+
+    // ------------------------------------------------------------------ settings
+    // v3: synthesized-sound options removed entirely (pure system notices).
+    const SETTINGS_KEY = 'dsh.agentNotify.settings.v3'
+    const DEFAULT_SETTINGS = {
+      enabled: true,
+      subagents: false,
+      // System-level notifications (browser Notification API): 'off' never
+      // sends, 'background' sends only while the page is hidden (you are in
+      // another window), 'always' sends for every event.
+      system: 'always',
+    }
+
+    function loadSettings() {
+      const base = Object.assign({}, DEFAULT_SETTINGS)
+      try {
+        const raw = localStorage.getItem(SETTINGS_KEY)
+        if (!raw) return base
+        const parsed = JSON.parse(raw)
+        if (typeof parsed.enabled === 'boolean') base.enabled = parsed.enabled
+        if (typeof parsed.subagents === 'boolean') base.subagents = parsed.subagents
+        if (parsed.system === 'off' || parsed.system === 'background' || parsed.system === 'always') {
+          base.system = parsed.system
+        }
+      } catch (error) {
+        console.warn('[dsh-agent-notify] settings read failed:', error)
+      }
+      return base
+    }
+
+    const settings = loadSettings()
+
+    function saveSettings() {
+      try {
+        localStorage.setItem(SETTINGS_KEY, JSON.stringify(settings))
+      } catch (error) {
+        console.warn('[dsh-agent-notify] settings write failed:', error)
+      }
+    }
+
+    // ---------------------------------------------------------------- card styles
+    const STYLE_ID = 'dsh-agent-notify-style'
+
+    function ensureStyle() {
+      if (typeof document === 'undefined') return
+      if (document.getElementById(STYLE_ID) !== null) return
+      const style = document.createElement('style')
+      style.id = STYLE_ID
+      style.setAttribute('data-plugin', 'dsh-agent-notify')
+      // Token audit (2026-10-06): every var() below must exist in the kernel's
+      // design-platform sheet — a name that does not exist fails **silently**
+      // into the rgba() default, so it looks fine and simply ignores the theme.
+      // Three earlier names never existed (`--dsw-specific-input-bg`,
+      // `--dsw-specific-input-border`, `--dsw-specific-divider`); the live
+      // equivalents are `--dsw-specific-input-major` (the input-surface
+      // background the kernel itself paints, e.g. ImageLightbox.module.css) and
+      // `--dsw-alias-border-l2` (the kernel's standard hairline border, used as
+      // `.5px solid var(--dsw-alias-border-l2)` all over the tree).
+      // Audit method: grep the token name across `node_modules/@deepseek-ai/**`
+      // for a `name:` **definition** — a bare use is not proof it exists.
+      style.textContent = `
+.dan-card { font-size: 13px; line-height: 1.5; max-width: 560px; }
+.dan-card h3 { margin: 0 0 4px; font-size: 14px; font-weight: 600; }
+.dan-card .dan-card-desc { margin: 0 0 10px; color: var(--dsw-alias-label-secondary, rgba(128, 128, 128, 0.9)); font-size: 12px; }
+.dan-card-row { display: flex; align-items: center; justify-content: space-between; gap: 12px; padding: 6px 0; min-height: 28px; }
+.dan-card-row + .dan-card-row { border-top: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.15)); }
+.dan-card-row > label { display: flex; align-items: center; gap: 8px; cursor: pointer; flex: 1; min-width: 0; }
+.dan-card-row .dan-card-hint { font-size: 11px; color: var(--dsw-alias-label-secondary, rgba(128, 128, 128, 0.9)); }
+.dan-card input[type="checkbox"] { accent-color: #4f8cff; width: 14px; height: 14px; margin: 0; cursor: pointer; flex: none; }
+.dan-card select { background: var(--dsw-specific-input-major, rgba(128, 128, 128, 0.12)); color: inherit;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35)); border-radius: 6px;
+  font-size: 12px; padding: 3px 6px; cursor: pointer; max-width: 140px; }
+.dan-card button.dan-card-btn { border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));
+  background: transparent; color: inherit; border-radius: 6px; padding: 3px 10px; font-size: 12px; cursor: pointer; }
+.dan-card button.dan-card-btn:hover { background: var(--dsw-specific-sidebar-nav-item-hover, rgba(128, 128, 128, 0.12)); }
+.dan-card .dan-card-perm { font-size: 11px; color: var(--dsw-alias-label-secondary, rgba(128, 128, 128, 0.9)); white-space: nowrap; }
+`
+      document.head.appendChild(style)
+    }
+
+    function truncate(text, max) {
+      if (text.length <= max) return text
+      return text.slice(0, max - 1).trimEnd() + '…'
+    }
+
+    // ------------------------------------------------- system-level notifications
+    const SYSTEM_MODES = {
+      off: '不发送',
+      background: '后台时发送',
+      always: '始终发送',
+    }
+
+    function systemNotificationSupported() {
+      return typeof window !== 'undefined' && 'Notification' in window
+    }
+
+    function systemPermission() {
+      if (!systemNotificationSupported()) return 'unsupported'
+      return window.Notification.permission // 'granted' | 'denied' | 'default'
+    }
+
+    /** Ask the browser for notification permission (must run from a user gesture). */
+    function requestSystemPermission() {
+      if (!systemNotificationSupported()) return Promise.resolve('unsupported')
+      try {
+        return Promise.resolve(window.Notification.requestPermission())
+      } catch (error) {
+        console.warn('[dsh-agent-notify] permission request failed:', error)
+        return Promise.resolve('denied')
+      }
+    }
+
+    /** Whether the current settings want a system notification for this event. */
+    function shouldSendSystemNotification() {
+      if (!settings.enabled) return false
+      if (settings.system === 'off') return false
+      if (settings.system === 'always') return true
+      // 'background': only while the page is hidden (user is in another window).
+      return typeof document !== 'undefined' && document.hidden === true
+    }
+
+    // ------------------------------------------------------- session navigation
+    /**
+     * Read one client service without declaring it in `inject`.
+     *
+     * `ctx.reflect.get(name, false)` is cordis's documented non-inject read
+     * ("Read a service from the store without the inject requirement"). Going
+     * through it keeps this bundle free of a hard dependency: a deployment whose
+     * composition lacks the service still loads and still notifies, instead of
+     * never applying because one `inject` entry cannot be satisfied. The plain
+     * property read is the fallback for a runtime that exposes it normally.
+     */
+    function serviceRef(name) {
+      const ctx = ctxRef
+      if (!ctx) return undefined
+      try {
+        const reflect = ctx.reflect
+        if (reflect && typeof reflect.get === 'function') {
+          const impl = reflect.get(name, false)
+          if (impl) return impl
+        }
+      } catch (error) { /* fall through to the direct property read */ }
+      try { return ctx[name] } catch (error) { return undefined }
+    }
+
+    /**
+     * Resolve the main-view navigation verb for the running kernel.
+     *
+     * 0.2.0-rc.2 moved selection out of the Session Controller: the `ctx.sessions`
+     * face (`ISessions`) no longer has `open()` — "navigation belongs to view
+     * owners" — and the Workspace view owner exposes it as
+     * `ctx.uiWorkspace.openSession(target)`. The pre-0.2 `sessions.open()` read
+     * is kept as a fallback so one bundle serves both kernels.
+     *
+     * Resolved lazily and cached only on success (the service may activate after
+     * this plugin's apply). A miss is logged once, so the next kernel move shows
+     * up in the console instead of silently turning the click into focus-only.
+     */
+    let openSessionVerb = null
+    let openSessionMissingLogged = false
+
+    function resolveOpenSession() {
+      if (openSessionVerb) return openSessionVerb
+      try {
+        const workspace = serviceRef('uiWorkspace')
+        if (workspace && typeof workspace.openSession === 'function') {
+          openSessionVerb = (id) => workspace.openSession(id)
+          return openSessionVerb
+        }
+        const sessions = serviceRef('sessions')
+        if (sessions && typeof sessions.open === 'function') {
+          openSessionVerb = (id) => sessions.open(id)
+          return openSessionVerb
+        }
+      } catch (error) {
+        console.warn('[dsh-agent-notify] session navigation lookup failed:', error)
+      }
+      if (!openSessionMissingLogged) {
+        openSessionMissingLogged = true
+        console.warn('[dsh-agent-notify] no session navigation verb on this kernel (expected ctx.uiWorkspace.openSession); notification clicks will only focus the window')
+      }
+      return null
+    }
+
+    /**
+     * Push a Windows/system-level notification (browser Notification API).
+     * Clicking it focuses the page and opens the owning session.
+     *
+     * No `tag` on purpose: on Windows, Chrome replaces a still-listed
+     * notification with the same tag by updating it in place — the bubble
+     * never re-pops. A stale entry in the notification center therefore
+     * silently swallows every later notification with that tag. Without a
+     * tag every notice is a fresh bubble.
+     */
+    function sendSystemNotification(kind, title, detail, sessionId) {
+      // Record every attempted notice for diagnostics (window.__agentNotify.events())
+      // regardless of the send-mode / OS-permission outcome further down.
+      const attempted = { kind, title, detail, sessionId: sessionId || null, permission: systemPermission(), mode: settings.system }
+      if (!shouldSendSystemNotification()) { recordEvent(Object.assign({ fired: false, reason: 'mode' }, attempted)); return }
+      if (systemPermission() !== 'granted') { recordEvent(Object.assign({ fired: false, reason: 'permission' }, attempted)); return }
+      try {
+        const body = detail && detail !== '' ? detail : title
+        const notification = new window.Notification(title, {
+          body: truncate(body, 200),
+        })
+        recordEvent(Object.assign({ fired: true, reason: 'ok' }, attempted))
+        notification.onclick = () => {
+          try {
+            window.focus()
+            const open = sessionId ? resolveOpenSession() : null
+            if (open) open(sessionId)
+          } catch (error) { /* ignore */ }
+          try { notification.close() } catch (error) { /* ignore */ }
+        }
+      } catch (error) {
+        console.warn('[dsh-agent-notify] system notification failed:', error)
+      }
+    }
+
+    /**
+     * Diagnostic: send a system notification regardless of the configured send
+     * mode (permission still applies). Returns a short result string so the
+     * settings page can show exactly what happened.
+     */
+    function sendTestNotification() {
+      if (systemPermission() === 'denied') return '权限被拒绝：点地址栏 🔒 → 网站设置 → 通知 → 允许'
+      if (systemPermission() === 'default') return '未授权：再点一次本按钮触发浏览器询问'
+      if (systemPermission() === 'unsupported') return '浏览器不支持系统通知（请用 Edge / Chrome）'
+      try {
+        const notification = new window.Notification('测试通知', {
+          body: '如果你看到这条消息，系统通知链路正常 ✓',
+        })
+        notification.onclick = () => {
+          try { window.focus() } catch (error) { /* ignore */ }
+          try { notification.close() } catch (error) { /* ignore */ }
+        }
+        return '已发送 ✓（若未弹出，检查 Windows 通知设置与专注助手）'
+      } catch (error) {
+        console.warn('[dsh-agent-notify] test notification failed:', error)
+        return '发送失败：' + (error && error.message ? error.message : String(error))
+      }
+    }
+
+    // Ask for notification permission on the first user gesture (browsers
+    // require a gesture for the permission prompt). Asked at most once.
+    let permissionAsked = false
+    function maybeAskPermission() {
+      if (permissionAsked) return
+      if (!systemNotificationSupported()) return
+      if (settings.system === 'off') return
+      if (window.Notification.permission !== 'default') return
+      permissionAsked = true
+      requestSystemPermission().then((permission) => {
+        if (permission === 'granted') {
+          sendSystemNotification('done', '系统通知已授权', '任务完成时将弹出系统级通知')
+        }
+      })
+    }
+    if (typeof document !== 'undefined') {
+      document.addEventListener('pointerdown', maybeAskPermission, { passive: true })
+      document.addEventListener('keydown', maybeAskPermission, { passive: true })
+    }
+
+    // ------------------------------------------------------------------- card UI
+    /**
+     * The settings page registered into the official `settings.section` slot
+     * (Settings → 任务提示). Built with plain createElement — no JSX, no
+     * build step. Reads/writes the bundle-level settings object and persists
+     * to localStorage; component state only drives re-renders.
+     */
+    function SettingsCard() {
+      const [state, setState] = React.useState({
+        enabled: settings.enabled,
+        subagents: settings.subagents,
+        system: settings.system,
+        perm: systemPermission(),
+      })
+      const update = (patch) => {
+        Object.assign(settings, patch)
+        saveSettings()
+        setState((prev) => ({ ...prev, ...patch }))
+      }
+      const refreshPerm = () => setState((prev) => ({ ...prev, perm: systemPermission() }))
+
+      const e = React.createElement
+      const row = (labelText, control, hint) =>
+        e('div', { className: 'dan-card-row', key: labelText },
+          e('label', null, control, labelText),
+          hint !== undefined ? e('span', { className: 'dan-card-hint' }, hint) : null)
+
+      const cb = (checked, onChange) =>
+        e('input', {
+          type: 'checkbox',
+          checked,
+          onChange: (ev) => onChange(ev.target.checked),
+        })
+
+      const permLabel =
+        state.perm === 'granted' ? '✓ 已授权' :
+        state.perm === 'denied' ? '✕ 已拒绝' :
+        state.perm === 'unsupported' ? '浏览器不支持' : '未授权'
+
+      return e('div', { className: 'dan-card' },
+        e('h3', null, '通知设置（agent 完成提醒）'),
+        e('p', { className: 'dan-card-desc' },
+          'agent 执行完任务或需要你输入 / 批准时，弹出 Windows 系统通知（声音为系统通知音，由 Windows 设置控制）。'),
+        e('p', { className: 'dan-card-desc', style: { marginTop: '4px', fontSize: '11px' } },
+          '版本 v' + BUNDLE_VERSION + ' · 当前：通知 ' + (state.enabled ? '开' : '关') +
+          ' · 系统通知 ' + SYSTEM_MODES[state.system] + ' · 权限 ' + permLabel),
+        row('启用通知', cb(state.enabled, (v) => {
+          update({ enabled: v })
+          if (v) sendSystemNotification('done', '通知已开启', '任务完成时将弹出系统通知')
+        })),
+        row('包含子代理通知', cb(state.subagents, (v) => update({ subagents: v }))),
+        row('系统通知', e('select', {
+          value: state.system,
+          onChange: (ev) => update({ system: ev.target.value }),
+        }, Object.keys(SYSTEM_MODES).map((mode) =>
+          e('option', { value: mode, key: mode }, SYSTEM_MODES[mode])))),
+        row('权限', e('span', { className: 'dan-card-perm' }, permLabel),
+          state.perm === 'denied' ? '被拒绝：点地址栏 🔒 图标 → 网站设置 → 通知 → 允许' : ''),
+        row('测试', e('button', {
+          className: 'dan-card-btn',
+          onClick: () => {
+            const send = () => {
+              const result = sendTestNotification()
+              setState((prev) => ({ ...prev, lastTest: result }))
+            }
+            if (systemPermission() === 'default') {
+              requestSystemPermission().then(() => { refreshPerm(); send() })
+            } else {
+              send()
+            }
+          },
+        }, '发送测试通知'),
+          state.lastTest ? state.lastTest : '点击立即弹一条系统通知，用于诊断'),
+      )
+    }
+
+    // ------------------------------------------------------------------- detection
+    // Detection model across kernel generations:
+    //   * running transitions come from the sessions list store (SessionSummary
+    //     keeps `running` / `displayTitle` / `origin` on both lines);
+    //   * "needs your input" comes from a root uiSession pending store whose
+    //     shape moved: 0.2.0-rc.2 exposes `ctx.uiSession.sessionStatus`
+    //     (Map<sessionId, { running, pendingInteraction, completionUnread }>),
+    //     while 0.1.2-rc.1 exposed `ctx.uiSession.pendingInteractions`
+    //     (Map<sessionId, interaction>). Both carry the same interaction objects
+    //     (kind question / approval / plan-review) and both are still accepted
+    //     here, so one bundle serves either kernel; `summary.pendingInteraction`
+    //     was removed back in rc.1.
+    const prevStates = new Map()      // sessionId -> { running }
+    const pendingBaseline = new Map() // sessionId -> last interaction object seen
+    let pendingSource = null          // resolved uiSession pending store adapter
+    let pendingSubscribed = false
+    let ctxRef = null
+
+    // Diagnostics ring buffer: every attempted notification is recorded here so
+    // headless/console verification can prove a trigger fired even when the OS
+    // toast itself is gated by send mode or permission. Exposed as
+    // window.__agentNotify.events().
+    const recentEvents = []
+    function recordEvent(entry) {
+      try {
+        recentEvents.push(entry)
+        if (recentEvents.length > 20) recentEvents.shift()
+      } catch (error) { /* ignore */ }
+    }
+
+    const PENDING_LABELS = {
+      question: { title: '需要你的回答', kind: 'ask' },
+      approval: { title: '需要你的批准', kind: 'warn' },
+      'plan-review': { title: '请审阅计划', kind: 'warn' },
+    }
+
+    function pendingInfo(kind) {
+      return PENDING_LABELS[kind] || { title: '需要你的操作', kind: 'ask' }
+    }
+
+    /** Last answered Turn's bounded assistant preview, from the Chat navigation index. */
+    function lastRailResponse(chat) {
+      try {
+        const rail = chat && chat.navigation
+        if (!rail || typeof rail.items !== 'function') return ''
+        const items = rail.items()
+        if (!Array.isArray(items)) return ''
+        for (let i = items.length - 1; i >= 0; i--) {
+          const item = items[i]
+          if (!item || typeof item.response !== 'string') continue
+          const text = item.response.replace(/\s+/g, ' ').trim()
+          if (text !== '') return text
+        }
+      } catch (error) { /* fall through to the node walk */ }
+      return ''
+    }
+
+    /** The pre-rc.2 walk, over the Chat legacy node projection (same node shape). */
+    function lastNodeText(chat) {
+      const nodes = chat && chat.legacy && Array.isArray(chat.legacy.nodes) ? chat.legacy.nodes : []
+      for (let i = nodes.length - 1; i >= 0; i--) {
+        const node = nodes[i]
+        if (!node || node.kind !== 'assistant') continue
+        const blocks = Array.isArray(node.blocks) ? node.blocks : []
+        const parts = []
+        for (const block of blocks) {
+          if (block && block.kind === 'text' && typeof block.text === 'string' && block.text.trim() !== '') {
+            parts.push(block.text.trim())
+          }
+        }
+        const text = parts.join(' ').replace(/\s+/g, ' ').trim()
+        if (text !== '') return text
+      }
+      return ''
+    }
+
+    /**
+     * The Session the main view currently shows, or null.
+     *
+     * `retainedBy.mainView` is the client-local (per-browser) main-view retention
+     * count, so this reads *this* browser's selection — not another window's.
+     * Used by the diagnostic hook's `preview()` and nothing else.
+     */
+    function mainViewSessionId() {
+      try {
+        const sessions = ctxRef && ctxRef.sessions
+        const list = sessions && sessions.list
+        const snap = list && typeof list.getSnapshot === 'function' ? list.getSnapshot() : null
+        const byId = snap && snap.byId ? snap.byId : {}
+        for (const id of Object.keys(byId)) {
+          const row = byId[id]
+          if (row && row.retainedBy && row.retainedBy.mainView > 0) return id
+        }
+      } catch (error) { /* ignore */ }
+      return null
+    }
+
+    /** Which source produced the last preview (diagnostics: `__agentNotify.preview`). */
+    let lastPreviewSource = null
+
+    /**
+     * Preview text for one finished session — the notification body's "what did it
+     * say" half.
+     *
+     * 0.2.0-rc.2 removed `SessionSnapshot.nodes`, so the old
+     * `sessions.binding(id).session.getSnapshot().nodes` walk returns nothing
+     * (silently: `Array.isArray(undefined)` — no error, just an empty body).
+     * The assembled conversation now belongs to the Conversation view owner:
+     * `ctx.uiConversation.binding(sessionId).target('chat')`, whose
+     * `navigation.items()[].response` is a purpose-built **bounded
+     * assistant-response preview** per loaded Turn. `legacy.nodes` (a
+     * compatibility projection carrying the very node shape the old code read) is
+     * the fallback, so the pre-rc.2 semantics stay available.
+     *
+     * Reachability limit, unchanged from the old code: `uiConversation.binding()`
+     * **throws** for an unknown/inactive Session, and `sessions.binding()` is a
+     * borrow that never extends a lifetime ⇒ this only yields text while the
+     * Session is retained (its window open). Title-only is the honest fallback.
+     */
+    function lastAssistantText(sessionId) {
+      lastPreviewSource = null
+      try {
+        const conversation = serviceRef('uiConversation')
+        if (!conversation || typeof conversation.binding !== 'function') return ''
+        const binding = conversation.binding(sessionId)
+        if (!binding || typeof binding.target !== 'function') return ''
+        const target = binding.target('chat')
+        const snap = target && typeof target.getSnapshot === 'function' ? target.getSnapshot() : null
+        if (!snap) return ''
+        const rail = lastRailResponse(snap)
+        if (rail !== '') { lastPreviewSource = 'navigation'; return truncate(rail, 90) }
+        const nodes = lastNodeText(snap)
+        if (nodes !== '') { lastPreviewSource = 'legacy-nodes'; return truncate(nodes, 90) }
+      } catch (error) {
+        // Not retained (or no Conversation view owner): title-only, no warning —
+        // this is the normal case for a session that finished while closed.
+      }
+      return ''
+    }
+
+    /**
+     * Adapt whichever pending-interaction store this kernel's `ctx.uiSession`
+     * exposes into one shape: `{ id, subscribe, entries(), pendingOf(id) }`.
+     *
+     * 0.2.0-rc.2 replaced the rc.1 `pendingInteractions` Map with `sessionStatus`,
+     * which wraps the same interaction object one level deeper. Both adapters are
+     * stateless: every read goes to the live snapshot.
+     */
+    function pendingSourceFor(ui) {
+      if (!ui) return null
+      const status = ui.sessionStatus
+      if (status && typeof status.subscribe === 'function' && typeof status.getSnapshot === 'function') {
+        return {
+          id: 'sessionStatus',
+          subscribe: (listener) => status.subscribe(listener),
+          entries: () => {
+            const snap = status.getSnapshot()
+            const out = []
+            if (snap instanceof Map) {
+              for (const [sessionId, state] of snap) {
+                const interaction = state ? state.pendingInteraction : undefined
+                if (interaction) out.push([sessionId, interaction])
+              }
+            }
+            return out
+          },
+          pendingOf: (sessionId) => {
+            const snap = status.getSnapshot()
+            const state = snap instanceof Map ? snap.get(sessionId) : undefined
+            return state ? state.pendingInteraction : undefined
+          },
+        }
+      }
+      const legacy = ui.pendingInteractions
+      if (legacy && typeof legacy.subscribe === 'function' && typeof legacy.getSnapshot === 'function') {
+        return {
+          id: 'pendingInteractions',
+          subscribe: (listener) => legacy.subscribe(listener),
+          entries: () => {
+            const snap = legacy.getSnapshot()
+            return snap instanceof Map ? Array.from(snap).filter(([, interaction]) => interaction) : []
+          },
+          pendingOf: (sessionId) => {
+            const snap = legacy.getSnapshot()
+            return snap instanceof Map ? snap.get(sessionId) : undefined
+          },
+        }
+      }
+      return null
+    }
+
+    /** Current pending interaction for one session, via the resolved store adapter. */
+    function currentPendingFor(sessionId) {
+      try {
+        return pendingSource ? pendingSource.pendingOf(sessionId) : undefined
+      } catch (error) {
+        return undefined
+      }
+    }
+
+    /** Short human text from an interaction for the notification body (guarded). */
+    function pendingSummaryText(interaction) {
+      try {
+        if (!interaction) return ''
+        if (interaction.kind === 'approval') {
+          if (typeof interaction.reason === 'string' && interaction.reason.trim() !== '') return interaction.reason.trim()
+          if (typeof interaction.toolName === 'string' && interaction.toolName.trim() !== '') return '工具 ' + interaction.toolName
+          return ''
+        }
+        const qs = Array.isArray(interaction.questions) ? interaction.questions : []
+        for (const q of qs) {
+          if (!q) continue
+          if (typeof q.question === 'string' && q.question.trim() !== '') return q.question.trim()
+          if (typeof q.detail === 'string' && q.detail.trim() !== '') return q.detail.trim()
+        }
+        if (typeof interaction.detail === 'string' && interaction.detail.trim() !== '') return interaction.detail.trim()
+      } catch (error) { /* ignore */ }
+      return ''
+    }
+
+    /** Fire the "needs your input" notice for one session/interaction. */
+    function notifyPending(sessionId, interaction) {
+      const info = pendingInfo(interaction && interaction.kind)
+      const sessions = ctxRef && ctxRef.sessions
+      const list = sessions && sessions.list
+      const byId = list && typeof list.getSnapshot === 'function' ? (list.getSnapshot().byId || {}) : {}
+      const summary = byId[sessionId]
+      const base = (summary && summary.displayTitle) || sessionId
+      const text = pendingSummaryText(interaction)
+      const detail = text !== '' ? base + ' · ' + truncate(text, 90) : base
+      sendSystemNotification(info.kind, info.title, detail, sessionId)
+    }
+
+    /**
+     * Watch the kernel's root pending-interaction store (via the resolved
+     * adapter) and raise one notice per fresh interaction. Diffed against
+     * pendingBaseline by interaction identity: a fresh interaction object (each
+     * new question/approval gets a new `key`) notifies even when the same session
+     * already had one; removal never notifies.
+     */
+    function handlePendingChange() {
+      try {
+        if (!pendingSource) return
+        const sessions = ctxRef && ctxRef.sessions
+        const list = sessions && sessions.list
+        const listSnap = list && typeof list.getSnapshot === 'function' ? list.getSnapshot() : null
+        if (!listSnap || listSnap.phase !== 'ready') return
+        const byId = listSnap.byId || {}
+        const visible = new Map()
+        for (const [sessionId, interaction] of pendingSource.entries()) {
+          if (!interaction) continue
+          const kind = interaction.kind
+          if (kind !== 'question' && kind !== 'approval' && kind !== 'plan-review') continue
+          if (!settings.subagents) {
+            const summary = byId[sessionId]
+            if (summary && summary.origin === 'subagent') continue
+          }
+          visible.set(sessionId, interaction)
+        }
+        for (const [sessionId, interaction] of visible) {
+          const seen = pendingBaseline.get(sessionId)
+          if (seen !== interaction) {
+            notifyPending(sessionId, interaction)
+            pendingBaseline.set(sessionId, interaction)
+          }
+        }
+        for (const sessionId of Array.from(pendingBaseline.keys())) {
+          if (!visible.has(sessionId)) pendingBaseline.delete(sessionId)
+        }
+      } catch (error) {
+        console.warn('[dsh-agent-notify] pending interaction handling failed:', error)
+      }
+    }
+
+    /** Lazily resolve + subscribe the uiSession pending store (it may activate after apply). */
+    function trySubscribePending() {
+      try {
+        if (pendingSubscribed) return true
+        const source = pendingSourceFor(ctxRef && ctxRef.uiSession)
+        if (!source) return false
+        const off = source.subscribe(handlePendingChange)
+        pendingSource = source
+        pendingSubscribed = true
+        ctxRef.effect(() => off, 'agent-notify: uiSession pending subscription')
+        handlePendingChange()
+        return true
+      } catch (error) {
+        console.warn('[dsh-agent-notify] pending watcher subscribe failed:', error)
+        return false
+      }
+    }
+
+    function handleListChange() {
+      try {
+        const sessions = ctxRef && ctxRef.sessions
+        if (!sessions) return
+        const snap = sessions.list.getSnapshot()
+        if (!snap || snap.phase !== 'ready') return
+        const byId = snap.byId || {}
+        for (const id of Object.keys(byId)) {
+          const summary = byId[id]
+          if (!summary) continue
+          // Subagent rows are skipped unless enabled in settings.
+          if (summary.origin === 'subagent' && !settings.subagents) {
+            prevStates.delete(id)
+            continue
+          }
+          const was = prevStates.get(id)
+          const nowRunning = summary.running === true
+          if (was === undefined) {
+            // First sighting (page load / reconnect baseline): record it and
+            // never replay a finish. Anything already pending for the session
+            // is handled by the uiSession pending watcher baseline instead.
+            prevStates.set(id, { running: nowRunning })
+            continue
+          }
+          if (was.running && !nowRunning && currentPendingFor(id) === undefined) {
+            // "任务完成" is suppressed when the stop coincides with a live
+            // question/approval — that arrival already raised its own notice.
+            const title = summary.displayTitle || id
+            const summaryText = lastAssistantText(id)
+            const detail = summaryText !== '' ? title + ' · ' + summaryText : title
+            sendSystemNotification('done', '任务完成', detail, id)
+          }
+          prevStates.set(id, { running: nowRunning })
+        }
+        for (const id of Array.from(prevStates.keys())) {
+          if (!(id in byId)) prevStates.delete(id)
+        }
+        // List ready also means: (re)sync the pending watcher baseline once the
+        // uiSession store is available (covers pending that arrived pre-list).
+        if (!pendingSubscribed) trySubscribePending()
+        else handlePendingChange()
+      } catch (error) {
+        console.warn('[dsh-agent-notify] list change handling failed:', error)
+      }
+    }
+
+    function resetBaseline() {
+      // Drop every tracked state without re-baselining from the stale
+      // snapshot: the list is about to be re-pulled, and the first snapshot
+      // after the reset becomes the new baseline. Re-baselining from the old
+      // snapshot would replay a finish (running true -> false) that happened
+      // while disconnected as a false "task done".
+      // pendingBaseline is cleared on purpose: after a reconnect the uiSession
+      // store re-publishes still-unanswered interactions as fresh objects, and
+      // a question that is still waiting on the user must not be silently
+      // swallowed (same policy as the pre-rc.1 baseline).
+      prevStates.clear()
+      pendingBaseline.clear()
+    }
+
+    // ------------------------------------------------------------------------ apply
+    let applied = false
+
+    exports.inject = ['slots', 'sessions', 'uiSession']
+
+    exports.apply = function apply(ctx) {
+      if (applied) return
+      applied = true
+      ctxRef = ctx
+      try {
+        const sessions = ctx.sessions
+        if (!sessions || !sessions.list || typeof sessions.list.subscribe !== 'function') {
+          console.warn('[dsh-agent-notify] sessions list service unavailable; notifications disabled')
+          return
+        }
+        const unsubscribe = sessions.list.subscribe(handleListChange)
+        ctx.effect(() => unsubscribe, 'agent-notify: sessions list subscription')
+        ctx.on('connection/reset', resetBaseline)
+        // Register a first-level settings page (Settings → 任务提示). rc.1
+        // posture: ctx.slots.inject wraps the register so the entry only mounts
+        // once the slot is declared; direct-register kept as a fallback for
+        // runtimes whose slots face has no inject().
+        if (ctx.slots) {
+          try {
+            ensureStyle()
+            const registerSection = () => ctx.slots.register({
+              name: 'settings.section',
+              id: 'agent-notify',
+              order: 131,
+              label: '任务提示',
+            }, SettingsCard)
+            if (typeof ctx.slots.inject === 'function') {
+              ctx.slots.inject('settings.section', registerSection)
+            } else if (typeof ctx.slots.register === 'function') {
+              const unregister = registerSection()
+              ctx.effect(() => unregister, 'agent-notify: settings section')
+            } else {
+              console.warn('[dsh-agent-notify] slots service unusable; settings section not registered')
+            }
+          } catch (error) {
+            console.warn('[dsh-agent-notify] settings section registration failed:', error)
+          }
+        } else {
+          console.warn('[dsh-agent-notify] slots service unavailable; settings section not registered')
+        }
+        // Establish the baselines once services are ready. The pending watcher
+        // subscribes lazily (uiSession may activate after this apply runs).
+        handleListChange()
+        trySubscribePending()
+        // Console diagnostic hook: `window.__agentNotify.test()` sends a test
+        // notification and returns the exact result string.
+        try {
+          window.__agentNotify = {
+            version: BUNDLE_VERSION,
+            settings: () => Object.assign({}, settings),
+            permission: () => systemPermission(),
+            test: () => sendTestNotification(),
+            events: () => recentEvents.map((e) => Object.assign({}, e)),
+            // Which kernel-generation surfaces this bundle actually resolved.
+            // `pending` names the adapter in use; `navigation` reports whether a
+            // click can still open its session (a miss also logs one warning).
+            sources: () => ({
+              pending: pendingSource ? pendingSource.id : null,
+              navigation: resolveOpenSession() ? 'uiWorkspace.openSession' : 'missing',
+            }),
+            // Read the notification body's preview half for one session, exactly as
+            // a notice would build it, plus which source produced it. `''` means
+            // the session is not retained (its window is closed) — the honest
+            // title-only case, not a failure. Used by scripts/verify-notify.mjs.
+            preview: (sessionId) => {
+              const id = sessionId || mainViewSessionId()
+              const text = id ? lastAssistantText(id) : ''
+              return { sessionId: id, text, source: lastPreviewSource }
+            },
+          }
+        } catch (error) {
+          console.warn('[dsh-agent-notify] debug hook install failed:', error)
+        }
+      } catch (error) {
+        console.warn('[dsh-agent-notify] apply failed:', error)
+      }
+    }
+
+    return module.exports
+  },
+})

package/lib/index.js

@@ -0,0 +1,11 @@
+/**
+ * dsh-agent-notify — host half.
+ *
+ * This plugin is pure browser-side capability: the empty apply exists so the
+ * row appears in the host cordis.yml / Loader, while the browser half ships
+ * through exports["./client"], discovered from the package.json `dsh.client`
+ * declaration (see @deepseek-ai/dsh-client-modules).
+ */
+
+/** Host plugin body — this package contributes nothing host-side. */
+export function apply() {}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@kkabuka/dsh-agent-notify",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "description": "DSH Web GUI 任务完成/需你输入通知（维护中的 fork，适配 dsh 0.2.x）：agent 完成任务或需要你输入/批准时弹出 Windows 系统级通知，点气泡跳回该会话。相对上游 1.0.0：① 点击跳转改接 ctx.uiWorkspace.openSession ② 需输入信号改接 ctx.uiSession.sessionStatus ③ 卡片三枚失效令牌改为内核实有令牌 ④ 通知正文摘要改接 ctx.uiConversation（替换已删的 SessionSnapshot.nodes）。MIT，保留上游版权；源码在 personal-docs/dsh/plugins/dsh-agent-notify。",
+  "version": "1.0.2",
+  "dshCompatibility": {
+    "testedVersions": ["0.2.0-rc.2", "0.2.1-rc.2"]
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "node --test \"test/*.test.cjs\""
+  },
+  "author": "chidaic (original); kkabuka (fork)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chidaic/dsh-agent-notify.git"
+  },
+  "homepage": "https://github.com/chidaic/dsh-agent-notify",
+  "bugs": {
+    "url": "https://github.com/chidaic/dsh-agent-notify/issues"
+  },
+  "keywords": [
+    "deepseek",
+    "harness",
+    "dsh",
+    "dsh-plugin",
+    "notification",
+    "notify",
+    "windows",
+    "toast",
+    "web"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "form": "handwritten"
+    }
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "devDependencies": {
+    "jsdom": "^30.0.1",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8"
+  }
+}