@michengai/dsh-codex-ui 0.2.110 → 0.2.112

package/CHANGELOG.md

@@ -4,6 +4,65 @@
 
 This changelog records recent releases of DSH Codex UI and its one-click installer. Earlier changes remain available in the [Git history](https://github.com/MichengAI/dsh-codex-ui/commits/main).
 
+## Unreleased
+
+## 0.2.112 - 2026-09-08
+
+### Release automation
+
+- Fixed Chromium installation steps in release workflows and added YAML structure and prerequisite validation.
+- Installer releases now generate and commit bilingual CHANGELOG entries before extracting release notes; missing either language blocks publication.
+
+### Breaking changes
+
+- Removed the public `crossSiteRequest` export. Consumers must use the host connection’s `requestRejection()` contract. Business GET routes now require authentication, including loopback requests (401 when signed out); missing authentication services return 503. The old REST paths have no compatibility aliases. Requires `@deepseek-ai/dsh-client-connection >=0.1.2-rc.1` and Cordis `>=4.0.2`.
+
+### Fixed
+
+- Added localized 401/403/503 feedback for business requests and an explicit local-cache notice when workspace preferences cannot sync.
+- Consolidated empty-chat padding and ignored stale invisible drop markers; conflicting distinct drop positions now emit a deduplicated diagnostic.
+
+- Stopped applying custom-group spacing between projects in an ungrouped project list, keeping the empty-conversation label vertically centered between project rows.
+- Centered empty-group text between adjacent group headers, accounting for the external group gap, and unified both empty-state labels at 13px/18px with the same muted color.
+- Standardized the Chinese empty-conversation label to "暂无聊天".
+- Aligned empty-group text with the group title without changing project or conversation indentation.
+- Matched the Codex sidebar reorder marker's 8px hollow ring and 2px rounded stroke, extending the line toward its start and removing the ring-to-line gap.
+- Unified group, project, and conversation reorder indicators around the midpoint between visible rows, including scrolling and collapsed content, instead of fixed offsets from wrapper elements.
+- Added 4px below each project's conversation list, matching its top gap so the last conversation no longer touches the next project row; the spacing collapses with the list.
+- Prevented the group reorder indicator above the first sidebar group from being clipped by the expanded Projects section.
+
+### Changed
+
+- Increased group labels to 14px/600 with 32px rows and 12px spacing; project folders now switch between equally sized open and closed icons according to expansion state.
+- Strengthened sidebar groups with persistent disclosure indicators, medium-weight labels, subtle backgrounds, and spacing while preserving existing project and conversation indentation and row widths. Expansion uses the arrow state without resembling a selected conversation; improved group touch targets and keyboard focus styling.
+- Moved Codex UI's business REST routes from `/api/michengai/codex-ui/*` to `/api/dsh-codex-ui/*`, aligning their naming with the Skills Manager and IM Connect business endpoints; the old routes are no longer registered. The host baseline now requires `@deepseek-ai/dsh-client-connection >=0.1.2-rc.1` and Cordis `>=4.0.2`.
+
+### Security
+
+- Delegated all five business REST routes to the DSH host's `requestRejection()` checks for trusted hosts, origins, and login cookies. Requests now fail closed when authentication is unavailable without blocking legitimate reverse-proxy origins through a loopback-only check.
+
+### Tests
+
+- Run Chromium layout checks in `pnpm test` and CI without screenshots, including exact tertiary colors and empty-state padding. Added cross-section drag cleanup and pinned-host-package trust-boundary regression coverage with login stubbed as authenticated.
+
+- Added business-route registration and authentication regression coverage for the new and removed paths, 401, 403, unavailable authentication, unchanged request-header forwarding, and an external-origin write authorized by the host boundary.
+
+## suite-installer-v0.1.29 - 2026-09-08
+
+- Updated the suite to Codex UI `0.2.111` and IM Connect `0.1.38`, keeping the channel sidebar compatible with the authenticated `/api/dsh-im-connect/channels` endpoint.
+- Refreshed exact member versions from the official npm registry for reproducible one-click installation.
+
+## 0.2.111 - 2026-09-08
+
+### Fixed
+
+- Updated the channel sidebar to use `/api/dsh-im-connect/channels`, matching IM Connect `0.1.38` after removal of the old management endpoint.
+
+## suite-installer-v0.1.28 - 2026-09-08
+
+- Updated the bundled Codex UI to `0.2.110`, including standalone DSH Web plugin-update recovery guidance.
+- Refreshed exact member versions from the official npm registry for reproducible one-click installation.
+
 ## 0.2.110 - 2026-09-08
 
 ### Fixed

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,65 @@
 
 本日志记录 DSH Codex UI 及其一键安装器的最近发布；更早的变更可查看 [Git 提交历史](https://github.com/MichengAI/dsh-codex-ui/commits/main)。
 
+## 未发布
+
+## 0.2.112 - 2026-09-08
+
+### 发布流程
+
+- 修复发布工作流的 Chromium 安装步骤位置，增加 YAML 结构及测试前置条件校验。
+- 安装器自动发布先生成并提交双语 CHANGELOG，再提取 Release 说明；缺少任一语言时阻止发布。
+
+### 不兼容变更
+
+- 移除公共导出 `crossSiteRequest`，调用方应改用宿主 connection 的 `requestRejection()` 契约。业务 GET 现在必须认证，包括回环请求（未登录返回 401）；缺少认证服务返回 503。旧 REST 地址没有兼容入口。要求 `@deepseek-ai/dsh-client-connection >=0.1.2-rc.1` 与 Cordis `>=4.0.2`。
+
+### 修复
+
+- 业务请求增加 401/403/503 专属本地化提示；项目偏好无法同步时明确提示正在使用本地缓存。
+- 合并空聊天四边间距声明，跳过不可见的陈旧拖拽标记；多个不同落点冲突时输出去重诊断。
+
+- 普通项目列表不再误用自定义分组的组间距，使“暂无聊天”在上下项目胶囊之间保持居中。
+- 将外部组间距纳入空分组文案的垂直居中计算；“暂无项目”和“暂无聊天”统一为 13px 字号、18px 行高及相同灰色。
+- 空项目文案由“没有聊天”统一为“暂无聊天”。
+- 分组内“暂无项目”与分组标题文字左对齐，不改变项目和会话胶囊的缩进。
+- 参考 Codex 侧栏插入线，采用 8px 空心圆环与 2px 圆头线，向起点延长直线并消除圆环与线段的断口。
+- 分组、项目与会话排序蓝线统一按相邻可见行的边界中点定位，适配滚动与折叠内容，不再依赖外层容器的固定偏移。
+- 项目内会话列表底部补齐与顶部一致的 4px 留白，避免最后一条会话贴住下一个项目胶囊；留白随列表一起折叠。
+- 修复分组拖到侧栏第一组之前时，顶部蓝色插入线被项目分区容器裁剪的问题。
+
+### 变更
+
+- 分组标题增强至 14px/600、32px 行高和 12px 组间距；项目文件夹随展开、收起切换等尺寸图标。
+- 强化侧栏分组的常驻箭头、标题字重、轻底色与组间留白；保留项目和会话原有缩进及胶囊宽度，展开状态仅由箭头表达，避免与会话选中混淆；补充分组触摸目标与键盘焦点样式。
+- 将 Codex UI 自有业务 REST 从 `/api/michengai/codex-ui/*` 统一迁移到 `/api/dsh-codex-ui/*`，与 Skills Manager 和 IM Connect 的业务 endpoint 命名保持一致；旧地址不再注册。宿主依赖基线相应要求 `@deepseek-ai/dsh-client-connection >=0.1.2-rc.1` 与 Cordis `>=4.0.2`。
+
+### 安全
+
+- 五个业务 REST 全部委托 DSH 宿主 `requestRejection()` 校验可信 Host、Origin 和登录 Cookie；认证服务不可用时关闭失败，不再用仅限回环地址的判断阻断合法反向代理访问。
+
+### 测试
+
+- 将无截图的 Chromium 布局检查纳入 `pnpm test` 和 CI，精确检查三级灰与空状态间距；补齐跨区拖拽清理及锁定宿主发布包的信任边界回归，登录层固定为已登录。
+
+- 新增业务路由注册和认证回归测试，覆盖新旧路径、401、403、认证不可用、请求头原样转交及宿主认证放行的外部 Origin 写请求。
+
+## suite-installer-v0.1.29 - 2026-09-08
+
+- 将套件更新至 Codex UI `0.2.111` 和 IM Connect `0.1.38`，保证频道侧栏兼容已认证的 `/api/dsh-im-connect/channels` 接口。
+- 从官方 npm 刷新成员精确版本，保证一键安装可复现。
+
+## 0.2.111 - 2026-09-08
+
+### 修复
+
+- 频道侧栏改用 `/api/dsh-im-connect/channels`，与删除旧管理地址后的 IM Connect `0.1.38` 保持一致。
+
+## suite-installer-v0.1.28 - 2026-09-08
+
+- 将套件中的 Codex UI 更新至 `0.2.110`，包含独立 DSH Web 的插件更新恢复指引。
+- 从官方 npm 刷新成员精确版本，保证一键安装可复现。
+
 ## 0.2.110 - 2026-09-08
 
 ### 修复

package/lib/client.js

@@ -270,7 +270,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/client/channel-api.ts
-		const CHANNELS_ENDPOINT = "/dsh-im-connect/api/channels";
+		const CHANNELS_ENDPOINT = "/api/dsh-im-connect/channels";
 		/** DSH 会话头不能写 origin=im，频道会话只靠 id 前缀。 */
 		function isChannelSession(id) {
 			return id.startsWith("im:");
@@ -848,6 +848,32 @@ window.__ModuleLoader__.load({
 		function pendingInteractionForSession(sessionId, pendingInteractions, summaryKind) {
 			return visiblePendingKind(summaryKind) ?? visiblePendingKind(pendingInteractions.get(sessionId)?.kind);
 		}
+		//#endregion
+		//#region src/business-api.ts
+		const CODEX_UI_API_BASE = "/api/dsh-codex-ui";
+		const CODEX_UI_API_ENDPOINTS = Object.freeze({
+			connectors: `${CODEX_UI_API_BASE}/connectors`,
+			dependencies: `${CODEX_UI_API_BASE}/dependencies`,
+			openInExplorer: `${CODEX_UI_API_BASE}/open-in-explorer`,
+			preferences: `${CODEX_UI_API_BASE}/preferences`,
+			sessionMove: `${CODEX_UI_API_BASE}/session-move`
+		});
+		//#endregion
+		//#region src/client/business-request-error.ts
+		var BusinessRequestError = class extends Error {
+			status;
+			constructor(status) {
+				super(`业务请求失败：HTTP ${status}`);
+				this.status = status;
+				this.name = "BusinessRequestError";
+			}
+		};
+		function businessRequestErrorKey(error) {
+			if (!(error instanceof BusinessRequestError)) return void 0;
+			if (error.status === 401) return "errors.unauthorized";
+			if (error.status === 403) return "errors.forbidden";
+			if (error.status === 503) return "errors.serviceUnavailable";
+		}
 		const WORKSPACE_GROUP_ERROR_MESSAGES = {
 			"group-invalid": "分组信息无效。",
 			"workspace-invalid": "项目标识无效。",
@@ -1001,7 +1027,7 @@ window.__ModuleLoader__.load({
 		/** 浏览器本地持久化键；用于工作区偏好的首帧恢复与 Host 故障兜底。 */
 		const PINNED_WORKSPACES_STORAGE_KEY = "dsh-codex-ui.pinned-workspace-ids";
 		const WORKSPACE_GROUPS_STORAGE_KEY = "dsh-codex-ui.workspace-groups.v1";
-		const WORKSPACE_PREFERENCES_ENDPOINT = "/api/michengai/codex-ui/preferences";
+		const WORKSPACE_PREFERENCES_ENDPOINT = CODEX_UI_API_ENDPOINTS.preferences;
 		/** 清理无效或重复的工作区标识。 */
 		function normalizePinnedWorkspaceIds(ids) {
 			return [...new Set(ids.filter((id) => id.trim() !== ""))];
@@ -1040,7 +1066,7 @@ window.__ModuleLoader__.load({
 				cache: "no-store",
 				signal: AbortSignal.timeout(5e3)
 			});
-			if (!response.ok) throw new Error(`读取置顶偏好失败：HTTP ${response.status}`);
+			if (!response.ok) throw new BusinessRequestError(response.status);
 			const payload = await response.json();
 			if (payload === null || typeof payload !== "object") throw new Error("置顶偏好响应格式无效。");
 			const record = payload;
@@ -1067,7 +1093,7 @@ window.__ModuleLoader__.load({
 				}),
 				signal: AbortSignal.timeout(5e3)
 			});
-			if (!response.ok) throw new Error(`保存置顶偏好失败：HTTP ${response.status}`);
+			if (!response.ok) throw new BusinessRequestError(response.status);
 		}
 		/** 兼容旧调用方；新代码应同时写入分组。 */
 		async function readHostPinnedWorkspaceIds(fetcher = fetch) {
@@ -2009,6 +2035,8 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 		}
 		/** 将业务错误映射为当前语言，未知底层错误统一脱敏。 */
 		function userErrorText(error, t) {
+			const requestKey = businessRequestErrorKey(error);
+			if (requestKey !== void 0) return t(requestKey);
 			if (error instanceof UserFacingError) return error.message;
 			if (error instanceof WorkspaceGroupError) return t(WORKSPACE_GROUP_ERROR_KEYS[error.code]);
 			if (error instanceof HostActionError) return t(hostActionErrorKey(error));
@@ -2016,16 +2044,20 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 		}
 		/** 安装错误保留用户可执行的处理建议，但不直接展示 Host 原文。 */
 		function installErrorText(error, t) {
+			const requestKey = businessRequestErrorKey(error);
+			if (requestKey !== void 0) return t(requestKey);
 			const message = error instanceof Error ? error.message : String(error);
 			return t(INSTALL_ERROR_KEYS.find(([pattern]) => pattern.test(message))?.[1] ?? "about.installFailed");
 		}
 		//#endregion
 		//#region src/client/session-move.ts
-		const SESSION_MOVE_ENDPOINT = "/api/michengai/codex-ui/session-move";
+		const SESSION_MOVE_ENDPOINT = CODEX_UI_API_ENDPOINTS.sessionMove;
 		const MOVE_ACTION_PREFIX = "move-session:";
 		const SESSION_MOVE_ERROR_KEYS = {
 			"session-move/unavailable": "sessions.moveUnavailable",
 			"session-move/service-unavailable": "sessions.moveUnavailable",
+			"session-move/unauthorized": "sessions.moveUnauthorized",
+			"session-move/forbidden": "sessions.moveForbidden",
 			"session-move/session-not-found": "sessions.moveNotFound",
 			"session-move/workspace-not-found": "sessions.moveNotFound",
 			"session-move/subagent-unsupported": "sessions.moveSubagent",
@@ -2101,6 +2133,85 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 			for (const sessionId of new Set(sessionIds)) await archiveSession(sessionId);
 		}
 		//#endregion
+		//#region src/client/workspace-drop-indicator.ts
+		const ROWS = ".dcu-wb-section-head,.dcu-wb-collection-head,.dcu-wb-project-head,.dcu-wb-session,.dcu-wb-nochat,.dcu-wb-empty";
+		const TARGETS = ".dcu-wb-drop,.dcu-wb-group-order-drop";
+		function measureWorkspaceDropIndicator(root, onTargets) {
+			const measured = Array.from(root.querySelectorAll(TARGETS)).filter((node) => node.closest("[data-open=false]") === null).map((target) => ({
+				target,
+				rect: measureTarget(root, target)
+			})).filter((item) => item.rect !== void 0);
+			const unique = measured.filter((item, index) => !measured.slice(0, index).some((previous) => previous.rect.top === item.rect.top && previous.rect.left === item.rect.left && previous.rect.width === item.rect.width));
+			onTargets?.(unique.map((item) => item.target));
+			return unique[0]?.rect;
+		}
+		function measureTarget(root, target) {
+			const section = target.closest(".dcu-wb-section") ?? root;
+			const rows = Array.from(section.querySelectorAll(ROWS)).filter((node) => node.closest("[data-open=false]") === null).map((node) => ({
+				node,
+				rect: node.getBoundingClientRect()
+			})).filter((row) => row.rect.height > 0 && row.rect.width > 0);
+			const owned = rows.filter((row) => row.node === target || target.contains(row.node));
+			const after = target.classList.contains("dcu-wb-drop-after");
+			let upper;
+			let lower;
+			let anchor = target.getBoundingClientRect();
+			if (owned.length > 0) {
+				const edge = after ? owned[owned.length - 1] : owned[0];
+				const index = rows.indexOf(edge);
+				anchor = edge.rect;
+				upper = after ? edge.rect.bottom : rows[index - 1]?.rect.bottom;
+				lower = after ? rows[index + 1]?.rect.top : edge.rect.top;
+			} else if (target.matches(".dcu-wb-pin-start,.dcu-wb-pin-end")) {
+				if (anchor.width <= 0 || anchor.height <= 0) return void 0;
+				upper = rows.filter((row) => row.rect.bottom <= anchor.top).at(-1)?.rect.bottom;
+				lower = rows.find((row) => row.rect.top >= anchor.bottom)?.rect.top;
+				if (lower === void 0) lower = anchor.bottom;
+				if (upper === void 0) upper = anchor.top;
+			} else return void 0;
+			const center = upper === void 0 ? lower - 4 : lower === void 0 ? upper + 4 : (upper + lower) / 2;
+			const box = root.getBoundingClientRect();
+			return {
+				top: center - box.top - root.clientTop + root.scrollTop - 4,
+				left: anchor.left - box.left - root.clientLeft + root.scrollLeft + 4,
+				width: Math.max(0, anchor.width - 12)
+			};
+		}
+		/** 仅拖拽期间刷新，滚动、折叠动画和尺寸变化都使用当前帧的布局；结束时完整清理。 */
+		function mountWorkspaceDropIndicator(root) {
+			const line = root.ownerDocument.createElement("div");
+			line.className = "dcu-wb-drop-indicator";
+			line.setAttribute("aria-hidden", "true");
+			root.append(line);
+			root.dataset.dropIndicator = "measured";
+			const view = root.ownerDocument.defaultView;
+			let frame = 0;
+			let previous = "";
+			let previousConflict = [];
+			const update = () => {
+				const rect = measureWorkspaceDropIndicator(root, (targets) => {
+					const conflict = targets.length > 1 ? targets : [];
+					if (conflict.length > 1 && (conflict.length !== previousConflict.length || conflict.some((target, index) => target !== previousConflict[index]))) console.warn("Codex UI 拖拽存在多个有效落点，请检查跨区状态清理。", { count: conflict.length });
+					previousConflict = conflict;
+				});
+				const next = rect === void 0 ? "" : `${rect.top},${rect.left},${rect.width}`;
+				line.hidden = rect === void 0;
+				if (rect !== void 0 && next !== previous) {
+					line.style.top = `${rect.top}px`;
+					line.style.left = `${rect.left}px`;
+					line.style.width = `${rect.width}px`;
+				}
+				previous = next;
+				frame = view.requestAnimationFrame(update);
+			};
+			update();
+			return () => {
+				view.cancelAnimationFrame(frame);
+				line.remove();
+				delete root.dataset.dropIndicator;
+			};
+		}
+		//#endregion
 		//#region src/client/CodexWorkspaceBrowser.tsx
 		const DISCLOSURE_EXIT_MS = 180;
 		function NewSessionIcon() {
@@ -2259,8 +2370,40 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 .dcu-wb-rename-input:focus{border-color:var(--dsw-alias-state-business-primary);box-shadow:0 0 0 1px color-mix(in srgb,var(--dsw-alias-state-business-primary) 28%,transparent)}
 `;
 		const runningStyles = `.dcu-wb-running{position:absolute;right:10px;top:50%;flex:none;width:12px;height:12px;margin-top:-6px;border:2px solid color-mix(in srgb,var(--dcu-sidebar-secondary) 25%,transparent);border-top-color:var(--dcu-sidebar-secondary);border-radius:50%;animation:dcu-wb-spin .8s linear infinite}@keyframes dcu-wb-spin{to{transform:rotate(360deg)}}@media (prefers-reduced-motion:reduce){.dcu-wb-running{animation:none}}`;
-		const typographyStyles = `.dcu-wb{--dcu-wb-disclosure-duration:180ms;--dcu-wb-disclosure-ease:cubic-bezier(.16,1,.3,1);font:14px/20px var(--dcu-font,var(--dsw-font-family))}.dcu-wb-section-label{color:var(--dcu-sidebar-secondary);font:13px/20px var(--dcu-font,var(--dsw-font-family));font-weight:400;letter-spacing:0;padding-left:0}.dcu-wb-section-caret{transition:opacity var(--dcu-wb-disclosure-duration) var(--dcu-wb-disclosure-ease),transform var(--dcu-wb-disclosure-duration) var(--dcu-wb-disclosure-ease)}.dcu-wb-section-head .dcu-wb-section-caret{position:static;left:auto;top:auto;opacity:.78}.dcu-wb-section-body,.dcu-wb-project-body,.dcu-wb-collection-body{display:block;min-height:0;height:auto;overflow:clip;opacity:1;transform:none;visibility:visible}.dcu-wb-section-body[data-open=false],.dcu-wb-project-body[data-open=false],.dcu-wb-collection-body[data-open=false]{display:block;height:0;opacity:0;transform:translateY(-2px);pointer-events:none}.dcu-wb-section-body[data-open=true]:has(.dcu-wb-drop),.dcu-wb-project-body[data-open=true]:has(.dcu-wb-drop),.dcu-wb-collection-body[data-open=true]:has(.dcu-wb-drop){overflow:visible}.dcu-wb-section-body[data-open=true]>div{animation:none}@media (prefers-reduced-motion:reduce){.dcu-wb-section-caret{transition:none}}.dcu-wb-project-title{font-size:14px;line-height:20px;font-weight:400;color:var(--dcu-sidebar-primary)}.dcu-wb-session-title{font-size:14px;line-height:20px;font-weight:400;color:var(--dcu-sidebar-secondary)}.dcu-wb-session.dcu-wb-selected .dcu-wb-session-title,.dcu-wb-session:hover .dcu-wb-session-title{color:var(--dcu-sidebar-primary)}.dcu-wb-empty{color:var(--dcu-sidebar-tertiary);font-size:13px;line-height:18px}.dcu-wb-nochat{padding:0 8px 4px 28px;color:var(--dcu-sidebar-tertiary);font-size:14px;line-height:20px}`;
-		const collectionLayoutStyles = `.dcu-wb-collection-body{padding-left:0}.dcu-wb-collection-body .dcu-wb-project-head{padding-left:8px}.dcu-wb-collection-body::before,.dcu-wb-group-member::after{display:none}.dcu-wb-collection-head,.dcu-wb-collection-head:focus-within{background:color-mix(in srgb,var(--dcu-sidebar-hover) 28%,transparent)}.dcu-wb-collection-head:hover{background:var(--dcu-sidebar-hover)}.dcu-wb-collection-head.dcu-wb-group-drop{background:var(--dcu-sidebar-hover)}.dcu-wb-workspace-move-drop>.dcu-wb-collection-head{background:transparent}`;
+		const typographyStyles = `.dcu-wb{--dcu-wb-disclosure-duration:180ms;--dcu-wb-disclosure-ease:cubic-bezier(.16,1,.3,1);font:14px/20px var(--dcu-font,var(--dsw-font-family))}.dcu-wb-section-label{color:var(--dcu-sidebar-secondary);font:13px/20px var(--dcu-font,var(--dsw-font-family));font-weight:400;letter-spacing:0;padding-left:0}.dcu-wb-section-caret{transition:opacity var(--dcu-wb-disclosure-duration) var(--dcu-wb-disclosure-ease),transform var(--dcu-wb-disclosure-duration) var(--dcu-wb-disclosure-ease)}.dcu-wb-section-head .dcu-wb-section-caret{position:static;left:auto;top:auto;opacity:.78}.dcu-wb-section-body,.dcu-wb-project-body,.dcu-wb-collection-body{display:block;min-height:0;height:auto;overflow:clip;opacity:1;transform:none;visibility:visible}.dcu-wb-section-body[data-open=false],.dcu-wb-project-body[data-open=false],.dcu-wb-collection-body[data-open=false]{display:block;height:0;opacity:0;transform:translateY(-2px);pointer-events:none}.dcu-wb-section-body[data-open=true]:has(.dcu-wb-drop),.dcu-wb-project-body[data-open=true]:has(.dcu-wb-drop),.dcu-wb-collection-body[data-open=true]:has(.dcu-wb-drop){overflow:visible}.dcu-wb-section-body[data-open=true]>div{animation:none}@media (prefers-reduced-motion:reduce){.dcu-wb-section-caret{transition:none}}.dcu-wb-project-title{font-size:14px;line-height:20px;font-weight:400;color:var(--dcu-sidebar-primary)}.dcu-wb-session-title{font-size:14px;line-height:20px;font-weight:400;color:var(--dcu-sidebar-secondary)}.dcu-wb-session.dcu-wb-selected .dcu-wb-session-title,.dcu-wb-session:hover .dcu-wb-session-title{color:var(--dcu-sidebar-primary)}.dcu-wb-empty{color:var(--dcu-sidebar-tertiary);font-size:13px;line-height:18px}`;
+		const collectionLayoutStyles = `
+.dcu-wb-tree{position:relative}
+.dcu-wb-tree[data-drop-indicator=measured] .dcu-wb-drop::before,.dcu-wb-tree[data-drop-indicator=measured] .dcu-wb-group-order-drop::before{display:none}
+.dcu-wb-drop-indicator{position:absolute;z-index:3;height:8px;pointer-events:none;color:var(--dsw-alias-state-business-primary)}
+.dcu-wb-drop-indicator::before{content:"";position:absolute;left:6px;right:0;top:3px;height:2px;border-radius:999px;background:currentColor}
+.dcu-wb-drop-indicator::after{content:"";position:absolute;box-sizing:border-box;left:0;top:0;width:8px;height:8px;border:2px solid currentColor;border-radius:50%}
+.dcu-wb-project-body:has(>.dcu-wb-session)::after{content:"";display:block;height:4px;pointer-events:none}
+.dcu-wb-section-body[data-open=true]:has(.dcu-wb-group-order-drop){overflow:visible}
+.dcu-wb-collection-body{padding-left:0}
+.dcu-wb-collection-body>.dcu-wb-group-member:first-child{padding-top:4px}
+.dcu-wb-collection-body .dcu-wb-project-head{padding-left:8px}
+.dcu-wb-collection-body>.dcu-wb-empty{padding:8px 8px 8px 26px}
+.dcu-wb-collection-body>.dcu-wb-empty,.dcu-wb-nochat{font-size:13px;line-height:18px;color:var(--dcu-sidebar-tertiary)}
+.dcu-wb-nochat{padding:1px 8px 5px 28px}
+.dcu-wb-collection:has(+.dcu-wb-collection)>.dcu-wb-collection-body>.dcu-wb-empty,.dcu-wb-collection:has(+.dcu-wb-ungrouped)>.dcu-wb-collection-body>.dcu-wb-empty{padding-top:14px;padding-bottom:2px}
+.dcu-wb-collection-body::before,.dcu-wb-group-member::after{display:none}
+.dcu-wb-collections{gap:12px}
+.dcu-wb-collections:has(>.dcu-wb-project){gap:0}
+.dcu-wb-collection-head{min-height:32px}
+.dcu-wb-collection-head:hover{background:var(--dcu-sidebar-hover)}
+.dcu-wb-collection-head.dcu-wb-group-drop{background:var(--dcu-sidebar-hover)}
+.dcu-wb-collection-head{background:color-mix(in srgb,var(--dcu-sidebar-hover) 55%,transparent)}
+.dcu-wb-collection-label{gap:4px;min-height:32px;font-size:14px;font-weight:600}
+.dcu-wb-collection-label .dcu-wb-section-caret{width:14px;height:14px;opacity:1;color:var(--dcu-sidebar-primary)}
+.dcu-wb-collection-label .dcu-wb-section-caret svg{width:14px;height:14px}
+.dcu-wb-collection-label .dcu-wb-section-caret svg path{stroke-width:2}
+.dcu-wb-collection-count{flex:none;font-size:12px;font-weight:400;padding-left:8px}
+.dcu-wb-ungrouped .dcu-wb-collection-label{color:var(--dcu-sidebar-secondary)}
+.dcu-wb-collection-head:focus-within,.dcu-wb-collection-head:has(.dcu-wb-more[aria-expanded=true]){background:var(--dcu-sidebar-hover)}
+.dcu-wb-workspace-move-drop>.dcu-wb-collection-head{background:transparent}
+.dcu-wb-collection-label:focus-visible,.dcu-wb-project-head:focus-visible,.dcu-wb-session:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:-2px;border-radius:6px}
+@media (pointer:coarse){.dcu-wb-collection-head,.dcu-wb-collection-label{min-height:36px}.dcu-wb-collection-actions{width:28px}.dcu-wb-collection-actions .dcu-wb-more{width:28px;height:28px}}
+`;
 		const WORKSPACE_TREE_STYLE = stylesheet$4 + runningStyles + typographyStyles + collectionLayoutStyles;
 		function storage$1() {
 			return browserStorage();
@@ -2296,6 +2439,7 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 			const pinnedHostDirtyRef = (0, react.useRef)(false);
 			const pinnedHostSkipWriteRef = (0, react.useRef)();
 			const pinnedHostWriteRef = (0, react.useRef)(Promise.resolve());
+			const [preferencesFailure, setPreferencesFailure] = (0, react.useState)();
 			const workspaceBaselineRef = (0, react.useRef)({
 				ready: false,
 				validIds: []
@@ -2314,12 +2458,15 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 				};
 				const pending = pinnedHostWriteRef.current.then(async () => {
 					await writeHostWorkspacePreferences(snapshot.pinnedWorkspaceIds, snapshot.workspaceGroups);
+					setPreferencesFailure(void 0);
 					if (!pinnedHostSupportsWorkspaceGroupsRef.current) return;
 					if (!sameIds(pinnedWorkspaceIdsRef.current, snapshot.pinnedWorkspaceIds) || !sameWorkspaceGroups(workspaceGroupsRef.current, snapshot.workspaceGroups)) return;
 					workspaceGroupsPendingHostSyncRef.current = false;
 					saveWorkspaceGroupsCache(storage$1(), snapshot.workspaceGroups, false);
 				});
-				pinnedHostWriteRef.current = pending.catch(() => void 0);
+				pinnedHostWriteRef.current = pending.catch((reason) => {
+					setPreferencesFailure(reason);
+				});
 			};
 			const setPinnedWorkspaceIds = (update) => {
 				pinnedHostDirtyRef.current = true;
@@ -2427,7 +2574,9 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 					}
 					savePinnedWorkspaceIds(storage$1(), ids);
 					if (writeHost) queuePinnedHostWrite(ids, groups);
-				}).catch(() => {
+				}).catch((reason) => {
+					if (!alive) return;
+					setPreferencesFailure(reason);
 					pinnedHostHydratedRef.current = true;
 				});
 				return () => {
@@ -2980,7 +3129,7 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 										top: box.top
 									}, { immediate: true });
 								},
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconFolderClose16, { size: 16 })
+								children: isExpanded ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconFolderOpenOutline16, { size: 16 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconFolderClose16, { size: 16 })
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: "dcu-wb-project-title",
@@ -3592,6 +3741,11 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 			};
 			const treeRef = (0, react.useRef)(null);
 			useSectionDisclosureMotion(treeRef);
+			const sorting = workspaceDragId !== void 0 || workspaceGroupDragId !== void 0 || sessionDrag !== void 0;
+			(0, react.useLayoutEffect)(() => {
+				if (!wide || !sorting || treeRef.current === null) return;
+				return mountWorkspaceDropIndicator(treeRef.current);
+			}, [wide, sorting]);
 			if (!wide) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 				className: "dcu-wb dcu-wb-rail",
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("style", { children: stylesheet$4 })
@@ -3606,6 +3760,11 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 						typographyStyles,
 						collectionLayoutStyles
 					] }),
+					preferencesFailure !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dcu-wb-error",
+						role: "status",
+						children: [t("workspace.preferencesLocalOnly"), businessRequestErrorKey(preferencesFailure) !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" ", userErrorText(preferencesFailure, t)] })]
+					}),
 					error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "dcu-wb-error",
 						role: "alert",
@@ -6139,7 +6298,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			"linking",
 			"building"
 		]);
-		const endpoint = "/api/michengai/codex-ui/dependencies";
+		const endpoint = CODEX_UI_API_ENDPOINTS.dependencies;
 		const stylesheet$2 = `
 .dcu-about{color:var(--dsw-alias-label-primary)}.dcu-about h2{margin:0;font-size:20px;line-height:28px}.dcu-about-intro{margin:6px 0 22px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:20px}.dcu-about h3{margin:24px 0 8px;font-size:14px;line-height:20px}.dcu-about-features{margin:0;padding-left:20px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:24px}.dcu-about-dependencies-heading{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:24px}.dcu-about-dependencies-heading h3{margin:0}.dcu-about-dependencies-heading+.dcu-about-intro{margin-bottom:14px}.dcu-about-dependencies{overflow:hidden;border:1px solid var(--dsw-alias-border-l2);border-radius:10px}.dcu-about-dependency{display:flex;align-items:center;gap:12px;min-height:64px;padding:12px;border-bottom:1px solid var(--dsw-alias-border-l2)}.dcu-about-dependency:last-child{border-bottom:0}.dcu-about-copy{min-width:0;flex:1}.dcu-about-name{font-size:13px;line-height:20px;font-weight:600}.dcu-about-package{overflow:hidden;margin-top:2px;color:var(--dsw-alias-label-tertiary);font-size:12px;text-overflow:ellipsis;white-space:nowrap}.dcu-about-status{display:flex;align-items:center;gap:5px;font-size:12px}.dcu-about-status[data-installed=true]{color:var(--dsw-alias-state-success-primary)}.dcu-about-status[data-installed=false]{color:var(--dsw-alias-state-error-primary)}.dcu-about-status[data-update=true]{color:var(--dsw-alias-state-warning-primary)}.dcu-about-install{display:inline-flex;align-items:center;justify-content:center;gap:5px;min-height:32px;border:1px solid var(--dsw-alias-border-l2);border-radius:7px;padding:6px 9px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;cursor:pointer}.dcu-about-install:hover:not(:disabled){background:var(--dsw-specific-menu-item-hover)}.dcu-about-install:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:2px}.dcu-about-install:disabled{cursor:wait;opacity:.65}.dcu-about-update-all{min-width:92px}.dcu-about-message{margin:10px 0 0;border-radius:8px;padding:9px 10px;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 12%,transparent);color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}.dcu-about-message[data-error=true]{background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent);color:var(--dsw-alias-state-error-primary)}.dcu-about-progress{display:grid;grid-template-columns:auto 1fr auto;gap:8px 10px;align-items:center;margin-top:10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:9px 10px}.dcu-about-progress code{min-width:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dcu-about-progress-pct{color:var(--dsw-alias-label-tertiary);font-size:12px;font-variant-numeric:tabular-nums}.dcu-about-progress-bar{grid-column:1/-1;height:4px;overflow:hidden;border-radius:99px;background:var(--dsw-alias-border-l2)}.dcu-about-progress-fill{height:100%;background:var(--dsw-alias-state-business-primary);transition:width .2s ease}.dcu-about-progress-fill[data-wave=true]{width:28%;animation:dcu-about-progress-wave 1.2s ease-in-out infinite}@keyframes dcu-about-progress-wave{0%{transform:translateX(-60%)}100%{transform:translateX(280%)}}
 .dcu-about-title-row{display:flex;align-items:center;gap:8px;min-width:0}.dcu-about-links{display:flex;align-items:center;gap:4px}.dcu-about-external-link{display:inline-flex;align-items:center;gap:5px;min-height:28px;padding:0 8px;color:var(--dsw-alias-label-secondary);background:transparent;border:1px solid var(--dsw-alias-border-l2);border-radius:7px;font-size:12px;font-weight:500;line-height:18px;text-decoration:none;white-space:nowrap}.dcu-about-external-link:hover{color:var(--dsw-alias-label-primary);background:var(--dsw-alias-interactive-bg-hover)}.dcu-about-external-link:focus-visible{outline:2px solid var(--dsw-alias-state-success-primary);outline-offset:2px}.dcu-about-external-link svg{flex:none}@media(max-width:720px){.dcu-about-title-row{flex-wrap:wrap}}
@@ -6190,6 +6349,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			const [progress, setProgress] = (0, react.useState)();
 			const [message, setMessage] = (0, react.useState)();
 			const [refreshFailed, setRefreshFailed] = (0, react.useState)(false);
+			const [loadFailure, setLoadFailure] = (0, react.useState)();
 			const alive = (0, react.useRef)(true);
 			const root = (0, react.useRef)(null);
 			const stateRef = (0, react.useRef)("loading");
@@ -6210,14 +6370,17 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 						cache: "no-store",
 						signal
 					});
+					if (!response.ok) throw new BusinessRequestError(response.status);
 					const payload = await response.json();
 					if (signal?.aborted || currentRequest !== requestId.current) return;
-					if (!response.ok || !Array.isArray(payload.dependencies) || !payload.dependencies.every(isDependencyStatus)) throw new Error();
+					if (!Array.isArray(payload.dependencies) || !payload.dependencies.every(isDependencyStatus)) throw new Error();
 					setDependencies(payload.dependencies);
 					setState("ready");
 					setRefreshFailed(false);
+					setLoadFailure(void 0);
 				} catch (error) {
 					if (signal?.aborted || error instanceof DOMException && error.name === "AbortError" || currentRequest !== requestId.current) return;
+					setLoadFailure(error);
 					if (stateRef.current === "ready") setRefreshFailed(true);
 					else setState("failed");
 				}
@@ -6282,6 +6445,11 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 				setMessage(void 0);
 				try {
 					const response = await fetch(`${endpoint}?dependency=${encodeURIComponent(id)}`, { method: "POST" });
+					if ([
+						401,
+						403,
+						503
+					].includes(response.status)) throw new BusinessRequestError(response.status);
 					const payload = await response.json();
 					if (!response.ok || !Array.isArray(payload.dependencies) || !payload.dependencies.every(isDependencyStatus)) throw new Error(typeof payload.error === "string" ? payload.error : t("about.installFailed"));
 					if (!alive.current) return;
@@ -6310,6 +6478,11 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 				setMessage(void 0);
 				try {
 					const response = await fetch(`${endpoint}?action=update-all`, { method: "POST" });
+					if ([
+						401,
+						403,
+						503
+					].includes(response.status)) throw new BusinessRequestError(response.status);
 					const payload = await response.json();
 					if (!response.ok || !Array.isArray(payload.dependencies) || !payload.dependencies.every(isDependencyStatus)) throw new Error(typeof payload.error === "string" ? payload.error : t("about.installFailed"));
 					if (!alive.current) return;
@@ -6405,7 +6578,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 						className: "dcu-about-message",
 						"data-error": "true",
 						role: "alert",
-						children: t("about.statusFailed")
+						children: t(businessRequestErrorKey(loadFailure) ?? "about.statusFailed")
 					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "dcu-about-dependencies",
 						"aria-busy": installing !== void 0,
@@ -6468,7 +6641,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 						className: "dcu-about-message",
 						"data-error": "true",
 						role: "status",
-						children: t("about.refreshFailed")
+						children: t(businessRequestErrorKey(loadFailure) ?? "about.refreshFailed")
 					}),
 					message !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "dcu-about-message",
@@ -6560,6 +6733,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			const sessionId = (0, react.useSyncExternalStore)(sessionStore.subscribe, () => sessionStore.getSnapshot().current);
 			const [connectors, setConnectors] = (0, react.useState)([]);
 			const [state, setState] = (0, react.useState)("loading");
+			const [failure, setFailure] = (0, react.useState)();
 			(0, react.useEffect)(() => {
 				if (sessionId === void 0) {
 					setConnectors([]);
@@ -6568,15 +6742,18 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 				}
 				const controller = new AbortController();
 				setState("loading");
-				fetch(`/api/michengai/codex-ui/connectors?sessionId=${encodeURIComponent(sessionId)}`, { signal: controller.signal }).then(async (response) => {
-					if (!response.ok) throw new Error("连接器目录暂不可用。");
+				fetch(`${CODEX_UI_API_ENDPOINTS.connectors}?sessionId=${encodeURIComponent(sessionId)}`, { signal: controller.signal }).then(async (response) => {
+					if (!response.ok) throw new BusinessRequestError(response.status);
 					const payload = await response.json();
 					if (!Array.isArray(payload.connectors) || !payload.connectors.every(isConnector)) throw new Error("连接器目录返回格式无效。");
 					if (!controller.signal.aborted) setConnectors(payload.connectors);
 				}).then(() => {
 					if (!controller.signal.aborted) setState("ready");
-				}).catch(() => {
-					if (!controller.signal.aborted) setState("failed");
+				}).catch((error) => {
+					if (!controller.signal.aborted) {
+						setFailure(error);
+						setState("failed");
+					}
 				});
 				return () => {
 					controller.abort();
@@ -6592,7 +6769,8 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			});
 			if (state === "failed") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 				className: "dcu-connector-empty",
-				children: t("connectors.failed")
+				role: "alert",
+				children: t(businessRequestErrorKey(failure) ?? "connectors.failed")
 			});
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "dcu-connector-list",
@@ -6722,7 +6900,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			"workspace.renameGroup": "重命名分组",
 			"workspace.recent": "最近",
 			"workspace.recentEmpty": "无聊天",
-			"workspace.noChat": "没有聊天",
+			"workspace.noChat": "暂无聊天",
 			"workspace.empty": "暂无项目",
 			"workspace.newSession": "新建会话",
 			"workspace.rename": "重命名项目",
@@ -6770,6 +6948,8 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			"sessions.openPath": "在资源管理器中打开",
 			"sessions.moveWorkspace": "项目",
 			"sessions.moveUnavailable": "会话移动服务暂不可用，请重启 DSH 后重试。",
+			"sessions.moveUnauthorized": "登录状态已失效，请刷新页面并重新登录。",
+			"sessions.moveForbidden": "当前访问地址不受信任，或请求来源已被拒绝。",
 			"sessions.moveNotFound": "会话或目标项目已不存在，请刷新后重试。",
 			"sessions.moveSubagent": "子代理会话不能移动到其他项目。",
 			"sessions.moveBusy": "该会话正在移动，请稍后重试。",
@@ -6859,6 +7039,10 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			"time.minutes": "{count}分",
 			"time.hours": "{count}小时",
 			"time.days": "{count}天",
+			"errors.unauthorized": "请先登录 DSH，再重试。",
+			"errors.forbidden": "请求被安全检查拒绝，请从可信的 DSH 地址重试。",
+			"errors.serviceUnavailable": "服务暂不可用，请稍后重试。",
+			"workspace.preferencesLocalOnly": "项目偏好尚未同步，当前使用本地缓存。",
 			"errors.generic": "操作未完成，请重试。",
 			"errors.groupInvalid": "分组信息无效。",
 			"errors.workspaceInvalid": "项目标识无效。",
@@ -6976,6 +7160,8 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			"sessions.openPath": "Open in file explorer",
 			"sessions.moveWorkspace": "Project",
 			"sessions.moveUnavailable": "Conversation moving is unavailable. Restart DSH and try again.",
+			"sessions.moveUnauthorized": "Your login session has expired. Refresh the page and sign in again.",
+			"sessions.moveForbidden": "The current address is not trusted, or the request origin was rejected.",
 			"sessions.moveNotFound": "The conversation or target project no longer exists. Refresh and try again.",
 			"sessions.moveSubagent": "Subagent conversations cannot be moved to another project.",
 			"sessions.moveBusy": "This conversation is already being moved. Try again shortly.",
@@ -7065,6 +7251,10 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			"time.minutes": "{count}m",
 			"time.hours": "{count}h",
 			"time.days": "{count}d",
+			"errors.unauthorized": "Sign in to DSH, then try again.",
+			"errors.forbidden": "The security check rejected this request. Try again from a trusted DSH address.",
+			"errors.serviceUnavailable": "The service is unavailable. Try again later.",
+			"workspace.preferencesLocalOnly": "Workspace preferences are not synced. Using the local cache.",
 			"errors.generic": "The action could not be completed. Try again.",
 			"errors.groupInvalid": "The group information is invalid.",
 			"errors.workspaceInvalid": "The project identifier is invalid.",
@@ -7074,7 +7264,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 		};
 		//#endregion
 		//#region src/client/host-open-path.ts
-		const OPEN_IN_EXPLORER_ENDPOINT = "/api/michengai/codex-ui/open-in-explorer";
+		const OPEN_IN_EXPLORER_ENDPOINT = CODEX_UI_API_ENDPOINTS.openInExplorer;
 		/** “在资源管理器中打开”属于明确的系统动作，不应被侧边栏文件预览器接管。 */
 		async function openPathInHost(connection, path, fetcher = fetch) {
 			let foregroundResponse;
@@ -7086,6 +7276,11 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 				});
 			} catch {}
 			if (foregroundResponse?.ok) return;
+			if (foregroundResponse !== void 0 && [
+				401,
+				403,
+				503
+			].includes(foregroundResponse.status)) throw new BusinessRequestError(foregroundResponse.status);
 			if (foregroundResponse !== void 0 && foregroundResponse.status !== 404 && foregroundResponse.status !== 501) {
 				const payload = await foregroundResponse.json().catch(() => ({}));
 				throw new Error(typeof payload.error === "string" ? payload.error : "无法在前台打开资源管理器。");
@@ -7326,7 +7521,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 		const OFFICIAL_TURN_MARK_ATTRIBUTE = "data-dcu-official-turn-mark";
 		const OFFICIAL_TURN_TOOLTIP_ATTRIBUTE = "data-dcu-official-turn-tooltip";
 		const OFFICIAL_TURN_NAVIGATOR_SUPPORTED_ATTRIBUTE = "data-dcu-official-turn-navigator-supported";
-		const CAPABILITIES_ENDPOINT = "/api/michengai/codex-ui/dependencies?action=capabilities";
+		const CAPABILITIES_ENDPOINT = `${CODEX_UI_API_ENDPOINTS.dependencies}?action=capabilities`;
 		function isOfficialTurnNavigator(element) {
 			return element instanceof HTMLElement && element.tagName === "NAV" && element.style.getPropertyValue("--turn-natural-height") !== "" && element.querySelector("button[type=\"button\"][aria-label]") !== null;
 		}

package/lib/index.d.mts

@@ -4,16 +4,8 @@ type HostRequest = {
   method?: string;
   url?: string;
   headers?: Record<string, string | string[] | undefined>;
-  socket?: {
-    remoteAddress?: string;
-  };
   [Symbol.asyncIterator]?: () => AsyncIterator<Uint8Array | string>;
 };
-/**
- * 依赖安装会改写用户配置并拉起子进程，只允许回环地址上的同源浏览器请求。
- * Origin、Host 和 Sec-Fetch-Site 都可被非浏览器客户端伪造，不能单独作为授权依据。
- */
-declare function crossSiteRequest(request: HostRequest): boolean;
 /** 把安装错误收成可给浏览器看的文案：我们自己的中文说明保留，带本地路径的底层错误脱敏。 */
 declare function publicDependencyError(error: unknown): string;
 declare class RequestBodyTooLargeError extends Error {}
@@ -23,4 +15,4 @@ declare const inject: string[];
 /** 提供不泄露地址、命令和凭证的连接器目录。 */
 declare function apply(ctx: Context): void;
 //#endregion
-export { RequestBodyTooLargeError, apply, crossSiteRequest, inject, publicDependencyError, readRequestBody };
+export { RequestBodyTooLargeError, apply, inject, publicDependencyError, readRequestBody };

package/lib/index.mjs

@@ -5,6 +5,16 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes, randomUUID } from "node:crypto";
+//#region src/business-api.ts
+const CODEX_UI_API_BASE = "/api/dsh-codex-ui";
+const CODEX_UI_API_ENDPOINTS = Object.freeze({
+	connectors: `${CODEX_UI_API_BASE}/connectors`,
+	dependencies: `${CODEX_UI_API_BASE}/dependencies`,
+	openInExplorer: `${CODEX_UI_API_BASE}/open-in-explorer`,
+	preferences: `${CODEX_UI_API_BASE}/preferences`,
+	sessionMove: `${CODEX_UI_API_BASE}/session-move`
+});
+//#endregion
 //#region src/dependencies.ts
 const SUITE_PACKAGE = "@michengai/dsh-codex-suite";
 const SUITE_MEMBER_PACKAGES = [
@@ -1558,41 +1568,17 @@ function writeWorkspacePreferences(pinnedWorkspaceIds, workspaceGroups = [], pat
 }
 //#endregion
 //#region src/index.ts
-const connectorsEndpoint = "/api/michengai/codex-ui/connectors";
-const dependenciesEndpoint = "/api/michengai/codex-ui/dependencies";
-const explorerEndpoint = "/api/michengai/codex-ui/open-in-explorer";
-const preferencesEndpoint = "/api/michengai/codex-ui/preferences";
-const sessionMoveEndpoint = "/api/michengai/codex-ui/session-move";
+const connectorsEndpoint = CODEX_UI_API_ENDPOINTS.connectors;
+const dependenciesEndpoint = CODEX_UI_API_ENDPOINTS.dependencies;
+const explorerEndpoint = CODEX_UI_API_ENDPOINTS.openInExplorer;
+const preferencesEndpoint = CODEX_UI_API_ENDPOINTS.preferences;
+const sessionMoveEndpoint = CODEX_UI_API_ENDPOINTS.sessionMove;
 const maxPreferencesBodyBytes = 32768;
-function isLoopbackAddress(value) {
-	const address = value?.toLowerCase().replace(/^\[|\]$/g, "");
-	return address === "localhost" || address === "localhost." || address === "::1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
-}
 function headerValue(headers, name) {
 	const value = headers[name];
 	if (typeof value === "string") return value;
 	if (Array.isArray(value)) return value[0];
 }
-/**
-* 依赖安装会改写用户配置并拉起子进程，只允许回环地址上的同源浏览器请求。
-* Origin、Host 和 Sec-Fetch-Site 都可被非浏览器客户端伪造，不能单独作为授权依据。
-*/
-function crossSiteRequest(request) {
-	if (!isLoopbackAddress(request.socket?.remoteAddress)) return true;
-	const headers = request.headers;
-	if (headers === void 0) return true;
-	const site = headerValue(headers, "sec-fetch-site");
-	if (site !== void 0 && site !== "same-origin") return true;
-	const origin = headerValue(headers, "origin");
-	const host = headerValue(headers, "host");
-	if (origin === void 0 || host === void 0) return true;
-	try {
-		const url = new URL(origin);
-		return url.protocol !== "http:" && url.protocol !== "https:" || !isLoopbackAddress(url.hostname) || url.host !== host;
-	} catch {
-		return true;
-	}
-}
 /** 把安装错误收成可给浏览器看的文案：我们自己的中文说明保留，带本地路径的底层错误脱敏。 */
 function publicDependencyError(error) {
 	const message = error instanceof Error ? error.message : "依赖管理暂不可用。";
@@ -1615,6 +1601,35 @@ async function readRequestBody(request, maxBytes = maxPreferencesBodyBytes) {
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
+/**
+* 所有业务 REST 依赖 connection >=0.1.2-rc.1 的 Host/Origin/Fetch Metadata 与登录检查。
+* 必须在读取请求体及执行副作用前调用；不得将 undefined 以外的拒绝结果当作放行。
+* 发布包信任边界由 tests/business-rest-auth.assert.ts 的真实宿主契约用例验证。
+*/
+function authenticateBusinessRequest(ctx, request, response, errorBody = (_status, message) => ({ error: message })) {
+	const reject = (status, message) => {
+		response.writeHead(status, {
+			"content-type": "application/json; charset=utf-8",
+			"cache-control": "no-store"
+		});
+		response.end(JSON.stringify(errorBody(status, message)));
+		return false;
+	};
+	try {
+		const connection = ctx.get("connection");
+		if (typeof connection?.requestRejection !== "function") {
+			ctx.logger.warn("Codex UI 业务 REST 认证不可用：缺少 connection.requestRejection。");
+			return reject(503, "宿主认证服务暂不可用。");
+		}
+		const rejection = connection.requestRejection(request);
+		if (rejection !== void 0) return reject(rejection, rejection === 401 ? "请先登录 DSH。" : "已拒绝不可信或跨站请求。");
+		return true;
+	} catch (error) {
+		const reason = error instanceof Error ? `${error.name}: ${error.message}` : typeof error;
+		ctx.logger.warn("Codex UI 业务 REST 认证调用失败：%s", reason);
+		return reject(503, "宿主认证服务暂不可用。");
+	}
+}
 const inject = [
 	"webServer",
 	"agents",
@@ -1650,6 +1665,13 @@ function publicSessionMoveError(error) {
 		}[code] ?? "暂时无法移动该会话，请稍后重试。"
 	};
 }
+function sessionMoveAuthenticationError(status, error) {
+	return {
+		ok: false,
+		code: status === 401 ? "session-move/unauthorized" : status === 403 ? "session-move/forbidden" : "session-move/service-unavailable",
+		error
+	};
+}
 /** 提供不泄露地址、命令和凭证的连接器目录。 */
 function apply(ctx) {
 	const host = hostServices(ctx);
@@ -1660,6 +1682,7 @@ function apply(ctx) {
 			kind: "exact",
 			path: connectorsEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				if (request.method !== "GET" && request.method !== "HEAD") {
 					response.writeHead(405);
 					response.end();
@@ -1702,6 +1725,7 @@ function apply(ctx) {
 			kind: "exact",
 			path: dependenciesEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				const url = new URL(request.url ?? "/", "http://localhost");
 				try {
 					if (request.method === "GET") {
@@ -1731,14 +1755,6 @@ function apply(ctx) {
 						return;
 					}
 					if (request.method === "POST") {
-						if (crossSiteRequest(request)) {
-							response.writeHead(403, {
-								"content-type": "application/json; charset=utf-8",
-								"cache-control": "no-store"
-							});
-							response.end(JSON.stringify({ error: "已拒绝非本机同源请求。" }));
-							return;
-						}
 						if (url.searchParams.get("action") === "update-all") {
 							const runtime = resolveDependencyRuntime(ctx);
 							const notifyParent = canRequestParentReload(runtime);
@@ -1800,6 +1816,7 @@ function apply(ctx) {
 			kind: "exact",
 			path: preferencesEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				try {
 					if (request.method === "GET" || request.method === "HEAD") {
 						const preferences = await readWorkspacePreferences();
@@ -1811,14 +1828,6 @@ function apply(ctx) {
 						return;
 					}
 					if (request.method === "PUT") {
-						if (crossSiteRequest(request)) {
-							response.writeHead(403, {
-								"content-type": "application/json; charset=utf-8",
-								"cache-control": "no-store"
-							});
-							response.end(JSON.stringify({ error: "已拒绝跨站请求。" }));
-							return;
-						}
 						const body = JSON.parse(await readRequestBody(request));
 						const record = body !== null && typeof body === "object" ? body : void 0;
 						const pinnedWorkspaceIds = record === void 0 ? void 0 : parsePinnedWorkspaceIds(record.pinnedWorkspaceIds);
@@ -1878,23 +1887,12 @@ function apply(ctx) {
 			kind: "exact",
 			path: sessionMoveEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response, sessionMoveAuthenticationError)) return;
 				if (request.method !== "POST") {
 					response.writeHead(405, { allow: "POST" });
 					response.end();
 					return;
 				}
-				if (crossSiteRequest(request)) {
-					response.writeHead(403, {
-						"content-type": "application/json; charset=utf-8",
-						"cache-control": "no-store"
-					});
-					response.end(JSON.stringify({
-						ok: false,
-						code: "session-move/cross-site",
-						error: "已拒绝跨站请求。"
-					}));
-					return;
-				}
 				try {
 					const body = JSON.parse(await readRequestBody(request));
 					const record = body !== null && typeof body === "object" ? body : void 0;
@@ -1951,19 +1949,12 @@ function apply(ctx) {
 			kind: "exact",
 			path: explorerEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				if (request.method !== "POST") {
 					response.writeHead(405, { allow: "POST" });
 					response.end();
 					return;
 				}
-				if (crossSiteRequest(request)) {
-					response.writeHead(403, {
-						"content-type": "application/json; charset=utf-8",
-						"cache-control": "no-store"
-					});
-					response.end(JSON.stringify({ error: "已拒绝跨站请求。" }));
-					return;
-				}
 				if (process.platform !== "win32") {
 					response.writeHead(501, {
 						"content-type": "application/json; charset=utf-8",
@@ -2022,4 +2013,4 @@ function apply(ctx) {
 	}, "michengai-codex-ui: catalogs");
 }
 //#endregion
-export { RequestBodyTooLargeError, apply, crossSiteRequest, inject, publicDependencyError, readRequestBody };
+export { RequestBodyTooLargeError, apply, inject, publicDependencyError, readRequestBody };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-codex-ui",
-  "version": "0.2.110",
+  "version": "0.2.112",
   "description": "以 Codex 风格重构 DSH Web 侧栏的独立客户端插件",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -62,10 +62,12 @@
   "scripts": {
     "build": "tsc --noEmit && tsdown",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm run typecheck && vitest run && tsdown && node tests/run-assertions.mjs"
+    "test": "pnpm run typecheck && vitest run && tsdown && node tests/run-assertions.mjs && pnpm run test:layout",
+    "test:layout": "node scripts/verify-workspace-drop-layout.mjs --run"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.1 <5.0.0",
+    "@deepseek-ai/cordis": ">=4.0.2 <5.0.0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.0-rc.5 <0.2.0",
@@ -119,12 +121,14 @@
     "@types/node": "^26.0.0",
     "@types/react": "~18.3.1",
     "jsdom": "^29.1.1",
+    "playwright": "1.63.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tsdown": "^0.22.2",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "workflow-yaml": "npm:yaml@2.9.0"
   },
   "dependencies": {
     "lucide-react": "^1.39.0"