@songtonyli/dsh-cli 0.1.11 → 0.1.13

package/node_modules/@deepseek-ai/dsh-client-ui-settings-plugins/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-settings-plugins",
   "description": "Plugins settings section with feature-owned tabs and configurable host-plane plugin cards",
-  "version": "0.1.6-alpha.1",
+  "version": "0.1.6-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -41,13 +41,16 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.6-alpha.2",
     "@types/react": "~18.3.1",
-    "react": "^18.2.0",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.1",
-    "clsx": "^2.0.0"
+    "clsx": "^2.0.0",
+    "react": "^18.2.0"
   },
   "files": [
     "lib/index.js",

package/node_modules/@deepseek-ai/dsh-client-ui-settings-signin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-settings-signin",
   "description": "Provider sign-in controls on the Web Models page: subscription and key logins over the authorization seam",
-  "version": "0.1.6-alpha.1",
+  "version": "0.1.6-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -41,10 +41,12 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.6-alpha.2",
     "@testing-library/react": "^16.1.0",
     "@types/react": "~18.3.1",
     "react": "^18.2.0",

package/node_modules/@deepseek-ai/dsh-client-ui-settings-unarchive-sessions/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-settings-unarchive-sessions",
   "description": "Archived-session settings page: the registry-global archive set with one Unarchive action per row",
-  "version": "0.1.6-alpha.1",
+  "version": "0.1.6-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -43,14 +43,16 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-api-workspace-controller": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-session": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-workspace": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-session": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-api-session-controller": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-api-workspace-controller": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-session": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-workspace": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.6-alpha.2",
     "@testing-library/react": "^16.1.0",
     "@types/react": "~18.3.1",
     "react": "^18.2.0",

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-sidebar/README.md
-README.md: 1b520213809ca98a6819483a4ee5ea4f451841d2
-README.zh.md: ee694d0067db50eff52051d8d9f8fd3baac0fc27
+README.md: a0b9ffe8ca601fade50ff86fc1921d6b41b84748
+README.zh.md: 44b08c8ef76ec266c813c8199db8291f47db3d53

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar/README.md

@@ -37,8 +37,16 @@ Plugins add an icon component to the root-scoped `sidebar.panellist` list with a
 
 ### Collapse behavior
 
+The top expand button hosts the optional, non-interactive `sidebar.toggle.badge` slot while collapsed. Its occupant supplies status and tooltip content without adding another action or changing the button's navigation behavior.
+
 During a live collapse, the expanded content fades out at its current width, the upper controls share one fade and leftward translation into the 56px rail, and the layout's column slide ends the motion. A page that starts collapsed renders the rail statically, and reduced-motion mode disables both transitions. The bottom-pinned `sidebar.settings` control shares the fade timing but has no horizontal translation.
 
+On Windows Electron, `html[data-windows-titlebar]` fixes the sidebar toggle in the caption's top-left corner in both states, aligned with New Session's left edge only when expanded. The expanded brand sits below the caption and above New Session, with 8px of extra space above that button. Collapsing hides the brand and sidebar content and places New Session between the sidebar toggle and the Desktop-owned menus. The sidebar sets the root `--dsh-windows-menu-start` to 84px when collapsed; the Desktop preload uses it to position its menu after New Session and defaults to 48px when expanded. Caption icon buttons use centered 16px glyphs in 28px circular controls and exclude themselves from the window drag region.
+
+### macOS desktop
+
+Under `html[data-platform='darwin']` (set only by the desktop preload) the expanded column opens with a 52px top strip that clears the hiddenInset traffic lights, carries the collapse toggle, and acts as the window drag region; collapsing hides the column entirely instead of leaving the rail. The package registers `HeaderLeadingControls` into the conversation header's `conversation.session.header.leading` seat — the open-sidebar and New Session controls shown, purely via CSS against the AppFrame-published `data-sidebar-collapsed` attribute, only while the column is hidden. Rationale and the window-integration contract: the [macOS hidden-titlebar Agent Note](../../../.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md).
+
 ### Scrollbars
 
 Scrollbars in the column are a pointer affordance: the shell rebinds the scrollbar indirection to `transparent` whenever the pointer is outside the column and keeps the thumb drawn for 2s after the pointer leaves, so a list nobody is pointing at carries no bar. The reservation that keeps rows from moving belongs to the scrolling region (ui-workspace), so revealing a thumb never reflows.

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar/README.zh.md

@@ -37,8 +37,16 @@ dsh Web 客户端的侧边栏让用户识别当前构建、启动新会话、将
 
 ### 折叠行为
 
+侧栏收起时，顶部展开按钮承载可选、不可交互的 `sidebar.toggle.badge` slot。占用方提供状态和提示内容，不增加操作，也不改变按钮的导航行为。
+
 实时收起时，展开内容在当前宽度淡出，上方控件共用同一段透明度渐变，并向左平移进入 56px 轨道，由布局的栏滑动结束整段动画。页面初始即为收起状态时会静态渲染轨道；减少动态效果模式会禁用两段过渡。固定在底部的 `sidebar.settings` 控件共用相同的透明度渐变时序，但不发生横向位移。
 
+在 Windows Electron 中，`html[data-windows-titlebar]` 将两种状态下的侧栏开关固定在顶栏左上角，仅在展开态与新建会话按钮左边缘对齐。展开态品牌位于顶栏下方、新建会话按钮上方，按钮上方额外留出 8px。收起后，品牌和侧栏内容隐藏，新建会话按钮排在侧栏开关与 Desktop 菜单之间。侧栏在收起态将根元素的 `--dsh-windows-menu-start` 设为 84px；Desktop preload 使用它将菜单放在新建会话之后，展开态默认为 48px。顶栏图标按钮采用 28px 圆形控件中的居中 16px 图标，并从窗口拖拽区域中排除。
+
+### macOS 桌面
+
+在 `html[data-platform='darwin']`（仅由桌面 preload 设置）下，展开的侧边栏列顶部有一条 52px 的顶部条：避开 hiddenInset 红绿灯、承载收起按钮，并作为窗口拖拽区；收起时整列隐藏而非保留轨道。本包向会话头部的 `conversation.session.header.leading` 座注册 `HeaderLeadingControls`——打开侧边栏与 New Session 两个控件，纯由 CSS 依据 AppFrame 发布的 `data-sidebar-collapsed` 属性仅在列隐藏时显示。设计依据与窗口集成约定见 [macOS 隐藏标题栏 Agent Note](../../../.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md)。
+
 ### 滚动条
 
 栏内的滚动条是一种指针可供性：只要指针不在栏内，外壳就把滚动条间接层重新绑定为 `transparent`；指针离开后滑块再保留 2 秒，因此没人指向的列表不会带着滚动条。避免行位移的空间预留属于滚动区域本身（ui-workspace），所以显示滑块不会引起重排。

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar/lib/client.js

@@ -7,8 +7,67 @@ window.__ModuleLoader__.load({
 		let _deepseek_ai_dsh_client_store = require("@deepseek-ai/dsh-client-store");
 		let _deepseek_ai_dsh_client_ui_slots = require("@deepseek-ai/dsh-client-ui-slots");
 		let react_jsx_runtime = require("react/jsx-runtime");
-		let react = require("react");
 		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
+		let react = require("react");
+		//#region \0dsh-css:/Users/songli/deepseek-harness/packages/client/ui-sidebar/src/client/HeaderLeadingControls.module.css.mjs
+		const css$1 = ".tDg5ZW_controls{display:none}[data-sidebar-collapsed] .tDg5ZW_controls{align-items:center;gap:8px;margin-right:8px;padding-left:68px;display:flex}.tDg5ZW_iconButton{corner-shape:round;width:28px;height:28px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:none;border-radius:50%;flex:none;justify-content:center;align-items:center;padding:0;display:inline-flex}.tDg5ZW_iconButton:hover{background:var(--dsw-alias-interactive-bg-hover)}.tDg5ZW_iconButton svg{width:15px;height:15px}";
+		const tagId$1 = "@deepseek-ai/dsh-client-ui-sidebar/HeaderLeadingControls.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$1) + "]") === null) {
+			const tag = document.createElement("style");
+			tag.dataset.plugin = "@deepseek-ai/dsh-client-ui-sidebar";
+			tag.dataset.pluginCss = tagId$1;
+			tag.textContent = css$1;
+			document.head.appendChild(tag);
+		}
+		var HeaderLeadingControls_module_css_default = {
+			"controls": "tDg5ZW_controls",
+			"iconButton": "tDg5ZW_iconButton"
+		};
+		//#endregion
+		//#region lib/types/client/HeaderLeadingControls.js
+		/** macOS-desktop conversation-header controls for the fully hidden sidebar. */
+		/**
+		* Sidebar-open and New Session controls in the conversation header's leading
+		* seat. On macOS desktop a collapsed sidebar hides entirely (no rail), taking
+		* both controls off screen; this occupant puts them back beside the traffic
+		* lights. Mounted whenever the platform matches; visibility rides the
+		* AppFrame-published `data-sidebar-collapsed` attribute in CSS, so no
+		* collapse-state pipe is added here.
+		* @param props - Injected sidebar actions plus the sidebar locale seat.
+		* @returns the two header controls, or null off macOS desktop.
+		*/
+		function HeaderLeadingControls({ toggleSidebar, startSession, t }) {
+			if (!(0, _deepseek_ai_dsh_client_ui_primitives.isDarwinDesktop)()) return null;
+			return (0, react_jsx_runtime.jsxs)("div", {
+				className: HeaderLeadingControls_module_css_default.controls,
+				children: [(0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
+					label: t("toggle.open"),
+					delayMs: 500,
+					children: (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: HeaderLeadingControls_module_css_default.iconButton,
+						"aria-label": t("toggle.open"),
+						onClick: () => {
+							toggleSidebar();
+						},
+						children: (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconPanelLeftOutline16, { size: 16 })
+					})
+				}), (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
+					label: t("session.new.label"),
+					delayMs: 500,
+					children: (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: HeaderLeadingControls_module_css_default.iconButton,
+						"aria-label": t("session.new.label"),
+						onClick: () => {
+							startSession();
+						},
+						children: (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconNewChatOutline16, { size: 16 })
+					})
+				})]
+			});
+		}
+		//#endregion
 		//#region ../../../node_modules/.pnpm/clsx@2.1.1/node_modules/clsx/dist/clsx.mjs
 		function r(e) {
 			var t, f, n = "";
@@ -25,7 +84,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region \0dsh-css:/Users/songli/deepseek-harness/packages/client/ui-sidebar/src/client/SidebarRoot.module.css.mjs
-		const css = "._8rwhZW_root{--dsh-sidebar-inline-padding:12px;height:100%;padding:6px var(--dsh-sidebar-inline-padding);box-sizing:border-box;background:var(--dsw-specific-sidebar-fill);color:var(--dsw-alias-label-primary);--dsh-scrollbar-thumb:var(--dsw-alias-scrollbar-bg-l2);--dsh-scrollbar-thumb-hover:var(--dsw-alias-scrollbar-hover-l2);flex-direction:column;font-size:14px;display:flex}._8rwhZW_root._8rwhZW_collapsed{padding:18px 10px 6px}._8rwhZW_root._8rwhZW_quietBars{--dsh-scrollbar-thumb:transparent;--dsh-scrollbar-thumb-hover:transparent}._8rwhZW_fading>*{opacity:0;transition:opacity .15s var(--ds-ease-in-out)}._8rwhZW_wide{animation:_8rwhZW_wide-in .2s var(--ds-ease-in-out)}@keyframes _8rwhZW_wide-in{0%{opacity:0}}._8rwhZW_railIn ._8rwhZW_iconButton,._8rwhZW_railIn ._8rwhZW_newSession,._8rwhZW_railIn ._8rwhZW_panelList,._8rwhZW_railIn ._8rwhZW_regionArea{animation:_8rwhZW_rail-in .15s var(--ds-ease-in-out) backwards}._8rwhZW_railIn ._8rwhZW_footArea{animation:_8rwhZW_rail-fade-in .15s var(--ds-ease-in-out) backwards}@keyframes _8rwhZW_rail-in{0%{opacity:0;transform:translate(49px)}}@keyframes _8rwhZW_rail-fade-in{0%{opacity:0}}._8rwhZW_logoRow{box-sizing:border-box;flex:none;justify-content:flex-end;align-items:center;gap:8px;height:60px;margin-bottom:8px;padding:8px 0 8px 4px;display:flex;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_logoRow{justify-content:flex-start;height:36px;margin-bottom:12px;padding:0}._8rwhZW_brand{min-width:0;color:inherit;cursor:pointer;background:0 0;border:none;flex:1;align-items:center;padding:0;display:inline-flex;overflow:hidden}._8rwhZW_brandIdentity{align-items:center;gap:8px;min-width:0;height:24px;display:inline-flex}._8rwhZW_brandMark{flex:none;justify-content:center;align-items:center;display:inline-flex}._8rwhZW_brandName{letter-spacing:.04em;align-items:center;gap:6px;min-width:0;height:24px;font-size:18px;font-weight:600;line-height:24px;display:inline-flex}._8rwhZW_fallbackBrandName{letter-spacing:0;white-space:nowrap;font-size:17px}._8rwhZW_localBuildBrand{white-space:nowrap;flex-direction:column;flex:none;justify-content:center;align-items:flex-start;gap:1px;height:24px;display:inline-flex}._8rwhZW_localBuildTitle{letter-spacing:0;font-size:12px;line-height:13px}._8rwhZW_iconButton{corner-shape:round;cursor:pointer;width:28px;height:28px;color:var(--dsw-alias-label-secondary);background:0 0;border:none;border-radius:50%;flex:none;justify-content:center;align-items:center;padding:0;display:inline-flex}._8rwhZW_iconButton:hover{background:var(--dsw-alias-interactive-bg-hover)}._8rwhZW_collapsed ._8rwhZW_iconButton{width:36px;height:36px}._8rwhZW_collapsed ._8rwhZW_toggle ._8rwhZW_panelIcon{display:none}._8rwhZW_collapsed ._8rwhZW_toggle:hover ._8rwhZW_panelIcon{display:inline}._8rwhZW_collapsed ._8rwhZW_toggle:hover ._8rwhZW_railMark{display:none}._8rwhZW_railMark{justify-content:center;align-items:center;display:inline-flex}._8rwhZW_collapsed ._8rwhZW_iconButton{color:var(--dsw-alias-label-primary)}._8rwhZW_buildVersion{height:10px;color:var(--dsw-alias-label-primary-inverted);background:var(--dsw-alias-label-primary);font-family:var(--ds-font-family-code);white-space:nowrap;border-radius:2px;flex:none;align-items:center;padding:0 3px;font-size:6px;font-weight:500;line-height:10px;display:inline-flex}._8rwhZW_newSession{box-sizing:border-box;border:.5px solid var(--dsw-alias-border-l3);background:var(--dsw-alias-button-elevated-fill);height:38px;color:var(--dsw-alias-label-primary);cursor:pointer;border-radius:12px;flex:none;justify-content:center;align-items:center;gap:6px;margin:0 2px 8px;padding:8px 16px;font-size:14px;font-weight:500;line-height:22px;display:flex;overflow:hidden}._8rwhZW_newSession:hover{background:var(--dsw-alias-button-floating-hover)}._8rwhZW_collapsed ._8rwhZW_newSession{background:0 0;border-color:#0000;align-self:flex-start;gap:0;width:36px;height:36px;margin:0 0 12px;padding:0}._8rwhZW_collapsed ._8rwhZW_newSession:hover{background:var(--dsw-alias-interactive-bg-hover)}._8rwhZW_newSessionLabel{white-space:nowrap;max-width:200px;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_newSessionLabel{max-width:0}._8rwhZW_panelList{flex-direction:column;flex:none;gap:4px;margin-bottom:8px;display:flex}._8rwhZW_panelRow{box-sizing:border-box;width:100%;min-height:36px;color:var(--dsw-alias-label-secondary);font:inherit;text-align:left;cursor:pointer;background:0 0;border:none;border-radius:8px;align-items:center;gap:8px;padding:7px 8px;line-height:22px;display:flex}._8rwhZW_panelRow:hover{background:var(--dsw-alias-interactive-bg-hover)}._8rwhZW_panelRow._8rwhZW_panelActive{background:var(--dsw-alias-interactive-bg-active);color:var(--dsw-alias-label-primary);font-weight:500}._8rwhZW_panelRow:focus-visible{outline:2px solid var(--dsw-alias-label-primary);outline-offset:-2px}._8rwhZW_panelGlyph{flex:none;justify-content:center;align-items:center;display:inline-flex}._8rwhZW_panelTitle{text-overflow:ellipsis;white-space:nowrap;min-width:0;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_panelList{gap:12px;margin-bottom:12px}._8rwhZW_collapsed ._8rwhZW_panelRow{width:36px;height:36px;color:var(--dsw-alias-label-primary);justify-content:center;padding:0}._8rwhZW_regionArea{min-height:0;margin-left:-4px;margin-right:calc(-1 * var(--dsh-sidebar-inline-padding));flex-direction:column;flex:1;padding-left:4px;display:flex;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_regionArea{margin-left:0;margin-right:0;padding-left:0}._8rwhZW_footArea{flex-direction:column;flex:none;display:flex}._8rwhZW_settingsArea,._8rwhZW_footerActions{flex:none;width:100%;min-width:0}._8rwhZW_footerActions{display:flex}._8rwhZW_collapsed ._8rwhZW_footArea{align-items:center}._8rwhZW_collapsed ._8rwhZW_settingsArea,._8rwhZW_collapsed ._8rwhZW_footerActions{justify-content:center;width:auto;display:flex}@media (prefers-reduced-motion:reduce){._8rwhZW_wide,._8rwhZW_fading>*,._8rwhZW_railIn ._8rwhZW_iconButton,._8rwhZW_railIn ._8rwhZW_newSession,._8rwhZW_railIn ._8rwhZW_panelList,._8rwhZW_railIn ._8rwhZW_footArea,._8rwhZW_railIn ._8rwhZW_regionArea{transition:none;animation:none}}";
+		const css = "._8rwhZW_root{--dsh-sidebar-inline-padding:12px;height:100%;padding:6px var(--dsh-sidebar-inline-padding);box-sizing:border-box;background:var(--dsw-specific-sidebar-fill);color:var(--dsw-alias-label-primary);--dsh-scrollbar-thumb:var(--dsw-alias-scrollbar-bg-l2);--dsh-scrollbar-thumb-hover:var(--dsw-alias-scrollbar-hover-l2);flex-direction:column;font-size:14px;display:flex}[data-platform=darwin] ._8rwhZW_root{background:0 0}._8rwhZW_root._8rwhZW_collapsed{padding:18px 10px 6px}[data-windows-titlebar] ._8rwhZW_root ._8rwhZW_logoRow{height:40px;margin:0;padding:0}[data-windows-titlebar] ._8rwhZW_toggle{top:calc((var(--dsh-windows-titlebar-height) - 28px) / 2);z-index:30;-webkit-app-region:no-drag;position:fixed;left:12px}[data-windows-titlebar] ._8rwhZW_root._8rwhZW_collapsed ._8rwhZW_logoRow{height:0}[data-windows-titlebar] ._8rwhZW_root:not(._8rwhZW_collapsed) ._8rwhZW_brand{padding-left:4px}[data-windows-titlebar] ._8rwhZW_brandIdentity{transform:translateY(1px)}[data-windows-titlebar] ._8rwhZW_brandMark{transform:translate(1px)}[data-windows-titlebar] ._8rwhZW_brandName{font-weight:400}[data-windows-titlebar] ._8rwhZW_root._8rwhZW_collapsed{padding:0}[data-windows-titlebar] ._8rwhZW_root:not(._8rwhZW_collapsed) ._8rwhZW_newSession{margin-top:8px;margin-left:0}[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_panelList,[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_regionArea,[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_footArea{display:none}html[data-windows-titlebar]:has([data-sidebar-collapsed=true]){--dsh-windows-menu-start:84px}[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_newSession{top:calc((var(--dsh-windows-titlebar-height) - 28px) / 2);z-index:30;-webkit-app-region:no-drag;border:none;margin:0;padding:0;position:fixed;left:48px}[data-windows-titlebar] ._8rwhZW_railIn ._8rwhZW_iconButton,[data-windows-titlebar] ._8rwhZW_railIn ._8rwhZW_newSession{animation:none}[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_toggle,[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_newSession{corner-shape:round;width:28px;height:28px;color:var(--dsw-alias-label-secondary);border-radius:50%}[data-windows-titlebar] ._8rwhZW_collapsed ._8rwhZW_toggle ._8rwhZW_panelIcon{display:inline}._8rwhZW_root._8rwhZW_quietBars{--dsh-scrollbar-thumb:transparent;--dsh-scrollbar-thumb-hover:transparent}._8rwhZW_fading>*{opacity:0;transition:opacity .15s var(--ds-ease-in-out)}._8rwhZW_wide{animation:_8rwhZW_wide-in .2s var(--ds-ease-in-out)}@keyframes _8rwhZW_wide-in{0%{opacity:0}}._8rwhZW_railIn ._8rwhZW_iconButton,._8rwhZW_railIn ._8rwhZW_newSession,._8rwhZW_railIn ._8rwhZW_panelList,._8rwhZW_railIn ._8rwhZW_regionArea{animation:_8rwhZW_rail-in .15s var(--ds-ease-in-out) backwards}._8rwhZW_railIn ._8rwhZW_footArea{animation:_8rwhZW_rail-fade-in .15s var(--ds-ease-in-out) backwards}@keyframes _8rwhZW_rail-in{0%{opacity:0;transform:translate(49px)}}@keyframes _8rwhZW_rail-fade-in{0%{opacity:0}}._8rwhZW_topStrip{box-sizing:border-box;height:52px;margin:-6px calc(-1 * var(--dsh-sidebar-inline-padding)) 0;-webkit-app-region:drag;flex:none;justify-content:flex-end;align-items:center;padding:0 12px;display:flex}._8rwhZW_topStrip ._8rwhZW_iconButton{-webkit-app-region:no-drag}._8rwhZW_topStrip+._8rwhZW_logoRow{margin-top:-12px}._8rwhZW_logoRow{box-sizing:border-box;flex:none;justify-content:flex-end;align-items:center;gap:8px;height:60px;margin-bottom:8px;padding:8px 0 8px 4px;display:flex;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_logoRow{justify-content:flex-start;height:36px;margin-bottom:12px;padding:0}._8rwhZW_brand{min-width:0;color:inherit;cursor:pointer;background:0 0;border:none;flex:1;align-items:center;padding:0;display:inline-flex;overflow:hidden}._8rwhZW_brandIdentity{align-items:center;gap:8px;min-width:0;height:24px;display:inline-flex}._8rwhZW_brandMark{flex:none;justify-content:center;align-items:center;display:inline-flex}._8rwhZW_brandName{letter-spacing:.04em;align-items:center;gap:6px;min-width:0;height:24px;font-size:18px;font-weight:600;line-height:24px;display:inline-flex}._8rwhZW_fallbackBrandName{letter-spacing:0;white-space:nowrap;font-size:17px}._8rwhZW_localBuildBrand{white-space:nowrap;flex-direction:column;flex:none;justify-content:center;align-items:flex-start;gap:1px;height:24px;display:inline-flex}._8rwhZW_localBuildTitle{letter-spacing:0;font-size:12px;line-height:13px}._8rwhZW_iconButton{corner-shape:round;cursor:pointer;width:28px;height:28px;color:var(--dsw-alias-label-secondary);background:0 0;border:none;border-radius:50%;flex:none;justify-content:center;align-items:center;padding:0;display:inline-flex;position:relative}._8rwhZW_iconButton:hover{background:var(--dsw-alias-interactive-bg-hover)}._8rwhZW_collapsed ._8rwhZW_iconButton{border-radius:12px;width:36px;height:36px}._8rwhZW_collapsed ._8rwhZW_toggle ._8rwhZW_panelIcon{display:none}._8rwhZW_collapsed ._8rwhZW_toggle:hover ._8rwhZW_panelIcon{display:inline}._8rwhZW_collapsed ._8rwhZW_toggle:hover ._8rwhZW_railMark{display:none}._8rwhZW_railMark{justify-content:center;align-items:center;display:inline-flex}._8rwhZW_collapsed ._8rwhZW_iconButton{color:var(--dsw-alias-label-primary)}._8rwhZW_buildVersion{height:10px;color:var(--dsw-alias-label-primary-inverted);background:var(--dsw-alias-label-primary);font-family:var(--ds-font-family-code);white-space:nowrap;border-radius:2px;flex:none;align-items:center;padding:0 3px;font-size:6px;font-weight:500;line-height:10px;display:inline-flex}._8rwhZW_newSession{box-sizing:border-box;border:.5px solid var(--dsw-alias-border-l3);background:var(--dsw-alias-button-elevated-fill);height:38px;color:var(--dsw-alias-label-primary);cursor:pointer;border-radius:12px;flex:none;justify-content:center;align-items:center;gap:6px;margin:0 2px 12px;padding:8px 16px;font-size:14px;font-weight:500;line-height:22px;display:flex;overflow:hidden}._8rwhZW_newSession:hover{background:var(--dsw-alias-button-floating-hover)}[data-platform=darwin] ._8rwhZW_newSession{background:color-mix(in srgb, var(--dsw-alias-button-elevated-fill) 75%, transparent)}[data-platform=darwin] ._8rwhZW_newSession:hover{background:color-mix(in srgb, var(--dsw-alias-button-floating-hover) 75%, transparent)}._8rwhZW_collapsed ._8rwhZW_newSession{background:0 0;border-color:#0000;align-self:flex-start;gap:0;width:36px;height:36px;margin:0 0 12px;padding:0}._8rwhZW_collapsed ._8rwhZW_newSession:hover{background:var(--dsw-alias-interactive-bg-hover)}._8rwhZW_newSessionLabel{white-space:nowrap;max-width:200px;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_newSessionLabel{max-width:0}._8rwhZW_panelList{flex-direction:column;flex:none;gap:4px;margin-bottom:8px;display:flex}._8rwhZW_panelRow{box-sizing:border-box;min-height:36px;color:var(--dsw-alias-label-primary);font:inherit;text-align:left;cursor:pointer;background:0 0;border:none;border-radius:12px;align-items:center;gap:8px;margin:0 2px;padding:7px 8px;line-height:22px;display:flex}._8rwhZW_panelRow:hover{background:var(--dsw-alias-interactive-bg-hover)}._8rwhZW_panelRow._8rwhZW_panelActive{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}._8rwhZW_panelRow:focus-visible{outline:2px solid var(--dsw-alias-label-primary);outline-offset:-2px}._8rwhZW_panelGlyph{flex:none;justify-content:center;align-items:center;display:inline-flex}._8rwhZW_panelTitle{text-overflow:ellipsis;white-space:nowrap;min-width:0;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_panelList{gap:12px;margin-bottom:12px}._8rwhZW_collapsed ._8rwhZW_panelRow{width:36px;height:36px;color:var(--dsw-alias-label-primary);justify-content:center;margin:0;padding:0}._8rwhZW_regionArea{min-height:0;margin-left:-4px;margin-right:calc(-1 * var(--dsh-sidebar-inline-padding));flex-direction:column;flex:1;padding-left:4px;display:flex;overflow:hidden}._8rwhZW_collapsed ._8rwhZW_regionArea{margin-left:0;margin-right:0;padding-left:0}._8rwhZW_footArea{flex-direction:column;flex:none;display:flex}._8rwhZW_settingsArea,._8rwhZW_footerActions{flex:none;width:100%;min-width:0}._8rwhZW_footerActions{display:flex}._8rwhZW_collapsed ._8rwhZW_footArea{align-items:center}._8rwhZW_collapsed ._8rwhZW_settingsArea,._8rwhZW_collapsed ._8rwhZW_footerActions{justify-content:center;width:auto;display:flex}@media (prefers-reduced-motion:reduce){._8rwhZW_wide,._8rwhZW_fading>*,._8rwhZW_railIn ._8rwhZW_iconButton,._8rwhZW_railIn ._8rwhZW_newSession,._8rwhZW_railIn ._8rwhZW_panelList,._8rwhZW_railIn ._8rwhZW_footArea,._8rwhZW_railIn ._8rwhZW_regionArea{transition:none;animation:none}}";
 		const tagId = "@deepseek-ai/dsh-client-ui-sidebar/SidebarRoot.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
 			const tag = document.createElement("style");
@@ -66,6 +125,7 @@ window.__ModuleLoader__.load({
 			"root": "_8rwhZW_root",
 			"settingsArea": "_8rwhZW_settingsArea",
 			"toggle": "_8rwhZW_toggle",
+			"topStrip": "_8rwhZW_topStrip",
 			"wide": "_8rwhZW_wide",
 			"wide-in": "_8rwhZW_wide-in"
 		};
@@ -100,7 +160,7 @@ window.__ModuleLoader__.load({
 		const SCROLLBAR_LINGER_MS = 2e3;
 		/** Format complete-build metadata for the local brand badge. */
 		function localBuildVersion() {
-			return `0.1.6-alpha.1-9ed61dc-dirty`;
+			return `0.1.6-alpha.2-c107a31` + ({}.DSH_CLIENT_GIT_DIRTY === "true" ? "-dirty" : "");
 		}
 		/** Each panel row subscribes only to its own selection state. */
 		function PanelRow({ id, label, wide, usePanelInfo, selectPanel, renderSlot }) {
@@ -151,7 +211,8 @@ window.__ModuleLoader__.load({
 					window.clearTimeout(timer);
 				};
 			}, [collapsed]);
-			const wide = !collapsed || !settled;
+			const windowsTitlebar = document.documentElement.hasAttribute("data-windows-titlebar");
+			const wide = windowsTitlebar ? !collapsed : !collapsed || !settled;
 			const lastWideWidth = (0, react.useRef)(width);
 			if (!collapsed) lastWideWidth.current = width;
 			const everWide = (0, react.useRef)(!collapsed);
@@ -186,6 +247,31 @@ window.__ModuleLoader__.load({
 				};
 			}, [pointerInside]);
 			const buildVersion = localBuildVersion();
+			const darwinDesktop = (0, _deepseek_ai_dsh_client_ui_primitives.isDarwinDesktop)();
+			const toggle = (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
+				label: collapsed ? t("toggle.open") : t("toggle.collapse"),
+				delayMs: 500,
+				children: (0, react_jsx_runtime.jsxs)("button", {
+					type: "button",
+					className: clsx(SidebarRoot_module_css_default.iconButton, SidebarRoot_module_css_default.toggle),
+					"aria-label": collapsed ? t("toggle.open") : t("toggle.collapse"),
+					onClick: () => {
+						toggleSidebar();
+					},
+					children: [
+						!wide && !windowsTitlebar && (0, react_jsx_runtime.jsx)("span", {
+							className: SidebarRoot_module_css_default.railMark,
+							"aria-hidden": "true",
+							children: renderSlot("sidebar.brand.mark", { size: 24 }, { fallback: (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.FishLogo, { size: 24 }) })
+						}),
+						(0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconPanelLeftOutline16, {
+							className: SidebarRoot_module_css_default.panelIcon,
+							size: wide || windowsTitlebar ? 16 : 18
+						}),
+						!wide && renderSlot("sidebar.toggle.badge", {})
+					]
+				})
+			});
 			return (0, react_jsx_runtime.jsxs)("div", {
 				ref: column,
 				className: clsx(SidebarRoot_module_css_default.root, !wide && SidebarRoot_module_css_default.collapsed, !wide && everWide.current && SidebarRoot_module_css_default.railIn, collapsed && wide && SidebarRoot_module_css_default.fading, !pointerInside && SidebarRoot_module_css_default.quietBars),
@@ -198,6 +284,10 @@ window.__ModuleLoader__.load({
 					armLinger();
 				},
 				children: [
+					darwinDesktop && (0, react_jsx_runtime.jsx)("div", {
+						className: SidebarRoot_module_css_default.topStrip,
+						children: toggle
+					}),
 					(0, react_jsx_runtime.jsxs)("div", {
 						className: SidebarRoot_module_css_default.logoRow,
 						children: [wide && (0, react_jsx_runtime.jsx)("button", {
@@ -230,26 +320,7 @@ window.__ModuleLoader__.load({
 									}) })
 								})]
 							})
-						}), (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
-							label: collapsed ? t("toggle.open") : t("toggle.collapse"),
-							delayMs: 500,
-							children: (0, react_jsx_runtime.jsxs)("button", {
-								type: "button",
-								className: clsx(SidebarRoot_module_css_default.iconButton, SidebarRoot_module_css_default.toggle),
-								"aria-label": collapsed ? t("toggle.open") : t("toggle.collapse"),
-								onClick: () => {
-									toggleSidebar();
-								},
-								children: [!wide && (0, react_jsx_runtime.jsx)("span", {
-									className: SidebarRoot_module_css_default.railMark,
-									"aria-hidden": "true",
-									children: renderSlot("sidebar.brand.mark", { size: 24 }, { fallback: (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.FishLogo, { size: 24 }) })
-								}), (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconPanelLeftOutline16, {
-									className: SidebarRoot_module_css_default.panelIcon,
-									size: wide ? 16 : 18
-								})]
-							})
-						})]
+						}), !darwinDesktop && toggle]
 					}),
 					(0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
 						label: t("session.new.label"),
@@ -262,7 +333,7 @@ window.__ModuleLoader__.load({
 							onClick: () => {
 								startSession();
 							},
-							children: [(0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconNewChatOutline16, { size: wide ? 14 : 18 }), wide && (0, react_jsx_runtime.jsx)("span", {
+							children: [(0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconNewChatOutline16, { size: wide ? 14 : windowsTitlebar ? 16 : 18 }), wide && (0, react_jsx_runtime.jsx)("span", {
 								className: clsx(SidebarRoot_module_css_default.newSessionLabel, SidebarRoot_module_css_default.wide),
 								children: t("session.new")
 							})]
@@ -384,6 +455,10 @@ window.__ModuleLoader__.load({
 						kind: "single",
 						scope: "root"
 					},
+					"sidebar.toggle.badge": {
+						kind: "single",
+						scope: "root"
+					},
 					"sidebar.panellist": {
 						kind: "list",
 						scope: "root"
@@ -403,6 +478,11 @@ window.__ModuleLoader__.load({
 				},
 				inject: injectProps
 			}, SidebarRoot));
+			ctx.slots.inject("conversation.session.header.leading", () => ctx.slots.register({
+				name: "conversation.session.header.leading",
+				locale: NS,
+				inject: injectProps
+			}, HeaderLeadingControls));
 			syncPanels();
 		}
 		//#endregion

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-sidebar",
   "description": "Sidebar plugin: session multi-level tree, search, grouping, state dots",
-  "version": "0.1.6-alpha.1",
+  "version": "0.1.6-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -30,6 +30,7 @@
       "inject": [
         "@deepseek-ai/dsh-api-workspace-controller",
         "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-layout",
         "@deepseek-ai/dsh-client-ui-session",
         "@deepseek-ai/dsh-client-ui-workspace",
@@ -43,12 +44,15 @@
     "@deepseek-ai/cordis": "4.0.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-api-workspace-controller": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-session": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-workspace": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-api-workspace-controller": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-session": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-workspace": "0.1.6-alpha.2",
     "@types/react": "~18.3.1",
     "@deepseek-ai/cordis": "4.0.2",
     "react": "^18.2.0",

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar-browser/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/client/ui-sidebar-browser/README.md
+README.md: 61de40ef98c72501c20c56cffb1075322bcb4886
+README.zh.md: 8bdc88a85f2473e62c640e509db53577c1f2e6d4

package/node_modules/@deepseek-ai/dsh-client-ui-sidebar-browser/README.md

@@ -0,0 +1,117 @@
+---
+description: "Right-Sidebar browser tabs for sandboxed HTTP(S) pages, including loopback services."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-client-ui-sidebar-browser
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Browse HTTP(S) pages, including loopback services, inside independent right-Sidebar tabs. The current carrier is an iframe with application-managed history in both Web and Desktop. The package never injects Electron or Node access into visited content.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+The shipped Web and Desktop compositions already mount this package. Open **Browser** from the right-Sidebar guide, enter an HTTP(S) URL, or select an HTTP(S) link in Assistant Markdown. A host name without a scheme becomes HTTPS. Public and loopback targets use the same default sandbox. Each guide action or message-link activation creates another Browser tab.
+
+### When to choose it
+
+Choose Browser for a Web page that should remain beside the current Session. Choose [Document Preview](../ui-sidebar-documentpreview/README.md) for local files, and use the explicit external-browser action when a site refuses iframe embedding or needs browser capabilities this package withholds.
+
+### Minimal configuration
+
+The package has no configuration. A custom Web composition mounts its Host companion; the Client loader then discovers the browser entry declared by the package manifest:
+
+```yaml
+- id: ui-sidebar-browser
+  name: '@deepseek-ai/dsh-client-ui-sidebar-browser'
+```
+
+Client plugins can open a tab through `ctx.sidebarRight.openTab('browser', { params: { url } })`. The optional URL passes the same validation as address-bar input before navigation.
+
+The toolbar provides Back, Forward, Reload, Go, Open in system browser, and a rightmost per-tab sandbox toggle. Disabling the sandbox is temporary and displays a warning. The external action accepts a known HTTP(S) target. The tab title is the Web host.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals — click to expand</summary>
+
+### Protocol policy
+
+The address parser accepts HTTP and HTTPS, including loopback targets. It rejects `file:` URLs, script/data/blob input, embedded credentials, the DSH application origin, and malformed addresses. Document Preview owns local-file rendering.
+
+### Iframe carrier
+
+Web and Desktop use `sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"` by default. The frame has no direct download or top-navigation flag. Popups leave the sandbox; in Web, an escaped popup retains its opener and can navigate the top-level application. The visited origin can use its own cookies and Web storage but a cross-origin target cannot read DSH DOM, storage, or API responses. The iframe sends no referrer and adds no package-owned Permissions Policy, so browser defaults and user grants apply. The toolbar can remove the sandbox for the current tab occurrence; the choice is not persisted. An unsandboxed page can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. The package does not proxy or probe remote pages.
+
+Web records toolbar submissions and typed tab opens. A navigation state machine treats the first iframe load for each controlled revision as known and a later load as proof that the page changed to an unreadable URL. In that unknown state the address is marked, Back, Forward, and external-open are disabled, and Reload returns to the last controlled URL. A remounted body reloads the latest application-known URL and uses its optional initial URL only before the first controlled target. History API and fragment changes that emit no iframe load remain invisible. An iframe `error` event displays a transient load-failure notice until the next controlled load without changing URL history.
+
+### Controller
+
+Each tab receives one `BrowserController` class. Its public commands are `loadUrl`, `goBack`, `goForward`, and `reload`; address validation and history mutation stay behind that object. Its `BrowserNavigation` class owns the serializable URL state machine. The `BrowserFrame` interface owns transient sandbox and document state plus carrier operations, and `IframeImpl` implements that interface for the current iframe carrier. Slot injection exposes keyed frame state through `useBrowserFrame` and supplies plain callbacks, so the React body receives neither the controller nor an observable source; it keeps only the editable draft and iframe DOM.
+
+The controller interface does not depend on iframe APIs. A future `ElectronWebViewImpl` can implement `BrowserFrame` while owning `<webview>` attachment and target identity. That deferred carrier is documented in the same Sidebar Browser decision, but is not registered or tested today.
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+- [Right Sidebar](../../../docs/subsystems/sidebar-right.md) — tab composition, navigation, and lifecycle.
+- [Document Preview](../ui-sidebar-documentpreview/README.md) — local source, Markdown, images, HTML, and PDF rendering.
+- [Sidebar Browser decision](../../../.agents/notes/implemented/feature/2026-09-16-sidebar-browser.md) — current iframe behavior, controller ownership, and deferred Electron carrier.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+None, as Browser tabs are user-facing presentation state and register no tool, prompt section, or Session event.
+
+#### KV Cache effect
+
+None; browsing does not enter a model request.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+The isolation policy deliberately gives up some browser compatibility:
+
+- Many sites refuse iframe embedding or need downloads or top-level navigation withheld from the frame by the default sandbox. An HTTPS application can also block public HTTP pages as mixed content. Disabling the sandbox trades its restrictions for compatibility but does not bypass mixed-content or private-network policy. The unsandboxed frame can navigate the top-level application under browser activation rules and use downloads, modal dialogs, and input locks. It does not isolate the visited origin's cookies per Browser tab or prevent an in-frame page from choosing its own next URL.
+- In Web, a popup that escapes the sandbox retains its opener and can use that chain to navigate the top-level application. Desktop handles popup creation separately.
+- A later iframe load reveals that navigation occurred but not the new cross-origin URL. History API and fragment changes may remain invisible; Web Back and Forward are unavailable after the state becomes unknown.
+- Browsers conceal many iframe failures for security: DNS, TLS, mixed-content, CSP, and `X-Frame-Options` failures may emit `load` or no actionable event instead of `error`. The load-failure notice is best-effort.
+- Browser history survives body remounts and ordinary page reloads, but closing the tab or unloading `ui-sidebar-right` aborts its occurrence and removes the stored history bucket.
+- Local files are rejected and remain owned by Document Preview.
+- The proposed Electron `<webview>` carrier, per-tab cookie partitions, native history, and target-specific CDP connection are not implemented.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>
+
+**Runtime invariant:** No companion is published. `BrowserNavigation` is the sole URL-state writer; the store receives its immutable snapshots, and focused controller and component tests exercise publication and cleanup directly.