@tianyulinfeng1/dsh-plugin-deepseek-chat 1.0.0 → 1.1.2

package/lib/client.js

@@ -1,5 +1,5 @@
 /**
- * Browser half of dsh-plugin-deepseek-chat.
+ * Browser half of dsh-plugin-deepseek-chat (v1.1.1).
  *
  * Registers one global left-sidebar panel — the same mechanism the Plugins and
  * Scheduled tasks entries use:
@@ -12,22 +12,48 @@
  * lease bridge the built-in sidebar browser uses: acquire a lease → create a
  * webview named by the lease with its approved partition → load the URL.
  *
- * Failure containment is the hard rule of this file. DSH treats any uncaught
- * error thrown by a plugin as a crash of its slot entry, and a crash inside the
- * `root` slot unmounts the entire application UI (the native frame stays, every
- * panel disappears). Electron throws from webview methods such as `getURL()`
- * and `loadURL()` as soon as the element leaves the document, and React runs
- * effect cleanups after the DOM removal — so every guest call here is attached-
- * checked and wrapped, every event handler catches, and a React error boundary
- * keeps a render failure inside this panel. A dead guest is reported in the
- * panel with a Retry button; it never escapes to the shell.
+ * Stable login session (v1.1.1)
+ * -----------------------------
+ * The desktop shell caches ONE process-lifetime session per `workspace` string
+ * passed to acquire(), and release() destroys only the guest, never the
+ * partition's cookies. So the workspace MUST be an absolute constant:
+ * `panel:deepseek-chat`. v1.1.0 keyed it to an async account probe, which
+ * transiently fails during reconnects — every change handed the panel a fresh
+ * cookie jar and forced another QR scan. That regression is fixed here.
  *
- * Leaving the panel unmounts this page and releases the guest, so the page
- * remembers the last conversation URL and reopens there instead of starting a
- * new chat every time.
+ * Account awareness (display only)
+ * --------------------------------
+ * DSH's own sign-in is a platform.deepseek.com OAuth grant; the chat site uses
+ * a different, site-owned Token. There is no official exchange, and the
+ * renderer bridge exposes no token/cookie API, so a pure plugin cannot reuse
+ * the DSH token for the web chat (see docs/login-persistence.md §6). All this
+ * file does with the account is DISPLAY it:
+ *
+ *   - a soft probe reads the Client `remote.account` namespace
+ *     (`getState`/`getProfile`, generated `{ ok, value }` envelopes) and shows
+ *     the state/name in a small strip;
+ *   - the account state NEVER feeds the lease identity, the storage key, an
+ *     epoch, or the guest lifecycle — no rebuild, no partition change, ever;
+ *   - a transient `unknown` is ignored; only a confirmed `signed-out` updates
+ *     the strip; a missing/late Remote never blocks the guest from starting.
+ *
+ * Failure containment is still the hard rule of this file. DSH treats any
+ * uncaught error thrown by a plugin as a crash of its slot entry, and a crash
+ * inside the `root` slot unmounts the entire application UI. Electron throws
+ * from webview methods such as `getURL()` / `loadURL()` as soon as the element
+ * leaves the document, and React runs effect cleanups after the DOM removal —
+ * so every guest call is attached-checked and wrapped, every event handler
+ * catches, a React error boundary keeps a render failure inside this panel, and
+ * a failure removes the dead guest before showing the in-panel Retry card.
  */
 window.__ModuleLoader__.load({
-	id: "dsh-plugin-deepseek-chat",
+	// MUST equal package.json "name" (the scoped npm name). The Host keys every
+	// client graph row by the package name and, after executing a bundle script,
+	// checks `factories.has(<row id>)`. A mismatched id makes arrive() think the
+	// bundle registered nothing, re-execute the same script, and throw
+	// "duplicate factory registration ... (bundle executed twice without
+	// invalidate?)" during web boot. See docs/RELEASE_NOTES_v1.1.1.md.
+	id: "@tianyulinfeng1/dsh-plugin-deepseek-chat",
 	factory: (require) => {
 		var module = { exports: {} };
 		var exports = module.exports;
@@ -35,13 +61,24 @@ window.__ModuleLoader__.load({
 		const react = require("react");
 
 		const PANEL_ID = "deepseek-chat";
+		/**
+		 * DSH runtime version sent as `x-client-version` on Platform account
+		 * reads. The boot manifest carries the exact connected release; the
+		 * minimum supported release is the fallback for a page without it.
+		 */
+		const HOST_VERSION_FALLBACK = "0.2.2-rc.1";
 		const CHAT_URL = "https://chat.deepseek.com/";
 		/**
-		 * Storage identity for the guest partition. The main process keeps one
-		 * partition per identity for the lifetime of the process, so switching
-		 * panels or sessions keeps the page state and its login.
+		 * Constant storage identities for the guest partition and the
+		 * last-conversation memory. The main process keeps one partition per
+		 * `workspace` string for the process lifetime; both values MUST NOT
+		 * depend on account state, or a transient probe failure would swap the
+		 * cookie jar and force a fresh QR scan. v1.1.1 regression fix.
 		 */
-		const PARTITION_KEY = "panel:deepseek-chat";
+		const PARTITION_BASE = "panel:deepseek-chat";
+		const STORAGE_BASE = "dsh-plugin-deepseek-chat:last-url";
+		/** Paths that are not a conversation: a brand-new chat, or an auth page. */
+		const NON_CONVERSATION_PATHS = new Set(["/", "/sign_in", "/login", "/signup", "/auth"]);
 
 		const english = typeof navigator !== "undefined" && /^en\b/i.test(navigator.language ?? "");
 		const COPY = english ? {
@@ -51,7 +88,12 @@ window.__ModuleLoader__.load({
 			failed: "The chat page could not be opened",
 			crashed: "The embedded chat stopped responding",
 			timeout: "The embedded chat did not start",
-			retry: "Retry"
+			retry: "Retry",
+			probing: "Syncing the DSH account…",
+			synced: "Synced with the DSH account",
+			syncedAs: (name) => `Synced with the DSH account · ${name}`,
+			unsigned: "No DSH account signed in — the chat panel is not synced",
+			unknown: "Account state unavailable — conversation kept locally"
 		} : {
 			label: "DeepSeek 聊天",
 			loading: "正在加载 DeepSeek 聊天…",
@@ -59,13 +101,45 @@ window.__ModuleLoader__.load({
 			failed: "聊天页面打开失败",
 			crashed: "内嵌聊天进程已退出",
 			timeout: "内嵌聊天页面没有启动",
-			retry: "重试"
+			retry: "重试",
+			probing: "正在同步 DSH 登录账号…",
+			synced: "已与 DSH 登录账号同步",
+			syncedAs: (name) => `已与 DSH 登录账号同步 · ${name}`,
+			unsigned: "未登录 DSH 账号，聊天面板暂未同步",
+			unknown: "账号状态不可用，会话按本地模式保存"
 		};
 
-		/** Where the last visited conversation URL is remembered; the shell keeps this storage across restarts. */
-		const STORAGE_KEY = "dsh-plugin-deepseek-chat:last-url";
-		/** Paths that are not a conversation: a brand-new chat, or an auth page. */
-		const NON_CONVERSATION_PATHS = new Set(["/", "/sign_in", "/login", "/signup", "/auth"]);
+		/** Normalized account states the panel can distinguish. */
+		const ACCOUNT_UNKNOWN = "unknown";
+		const ACCOUNT_SIGNED_IN = "signed-in";
+		const ACCOUNT_SIGNED_OUT = "signed-out";
+
+		/**
+		 * ONE stable guest partition for the whole process.
+		 *
+		 * The desktop shell keys a process-lifetime partition Map by the
+		 * `workspace` string passed to acquire() and reuses the same session for
+		 * every acquire() with that key. release() destroys only the guest, never
+		 * the partition's cookies. Consequently, changing this value — even once
+		 * — hands the panel a fresh cookie jar and forces the user to scan the
+		 * chat login QR code again. It MUST NOT depend on the DSH account probe:
+		 * that probe is asynchronous, runs every 5 seconds, and can transiently
+		 * return "unknown" during a reconnect or session switch.
+		 * @returns the fixed workspace identity for guest leases.
+		 */
+		function partitionKeyFor() {
+			return PARTITION_BASE;
+		}
+
+		/**
+		 * ONE stable conversation-memory key. Account status changes must not
+		 * move it either, or a transient probe failure would silently lose the
+		 * remembered conversation.
+		 * @returns the fixed localStorage key.
+		 */
+		function storageKeyFor() {
+			return STORAGE_BASE;
+		}
 
 		/**
 		 * Parse a chat.deepseek.com page URL.
@@ -77,13 +151,33 @@ window.__ModuleLoader__.load({
 			try {
 				const url = new URL(value);
 				if (url.protocol !== "https:" || url.hostname !== "chat.deepseek.com") return void 0;
-				if (url.username !== "" || url.password !== "") return void 0;
+				if (url.username !== "" || url.password !== "" || url.port !== "") return void 0;
 				return url;
 			} catch {
 				return void 0;
 			}
 		}
 
+		/**
+		 * Destinations a guest popup may open. The chat site and the Platform
+		 * login pages are the only hosts this panel deliberately navigates to;
+		 * an arbitrary URL from the open-request bridge is never loaded.
+		 * @param value - candidate URL.
+		 * @returns the normalized URL, or undefined.
+		 */
+		function parsePopupUrl(value) {
+			if (typeof value !== "string" || value.length === 0 || value.length > 4096) return void 0;
+			try {
+				const url = new URL(value);
+				if (url.protocol !== "https:") return void 0;
+				if (url.username !== "" || url.password !== "" || url.port !== "") return void 0;
+				if (url.hostname !== "chat.deepseek.com" && url.hostname !== "platform.deepseek.com") return void 0;
+				return url.toString();
+			} catch {
+				return void 0;
+			}
+		}
+
 		/**
 		 * Whether a URL deep enough to be a conversation page.
 		 * @param url - parsed chat URL, possibly undefined.
@@ -96,12 +190,13 @@ window.__ModuleLoader__.load({
 		}
 
 		/**
-		 * Read the conversation remembered from the last visit.
+		 * Read the conversation remembered from the last visit for one account.
+		 * @param storageKey - account-scoped storage key.
 		 * @returns the URL to open; the site root when nothing usable is remembered.
 		 */
-		function rememberedTarget() {
+		function rememberedTarget(storageKey) {
 			try {
-				const saved = parseChatUrl(window.localStorage.getItem(STORAGE_KEY));
+				const saved = parseChatUrl(window.localStorage.getItem(storageKey));
 				return isConversation(saved) ? saved.toString() : CHAT_URL;
 			} catch {
 				return CHAT_URL;
@@ -114,19 +209,230 @@ window.__ModuleLoader__.load({
 		 * A brand-new chat clears the memory so the next visit starts clean. An auth
 		 * page never overwrites it, so a login detour does not lose the conversation.
 		 * @param raw - current page URL reported by the guest.
+		 * @param storageKey - account-scoped storage key.
 		 */
-		function rememberTarget(raw) {
+		function rememberTarget(raw, storageKey) {
 			const url = parseChatUrl(raw);
 			if (url === void 0) return;
 			try {
 				const path = url.pathname.replace(/\/+$/u, "") || "/";
-				if (isConversation(url)) window.localStorage.setItem(STORAGE_KEY, url.toString());
-				else if (path === "/") window.localStorage.removeItem(STORAGE_KEY);
+				if (isConversation(url)) window.localStorage.setItem(storageKey, url.toString());
+				else if (path === "/") window.localStorage.removeItem(storageKey);
 			} catch {
 				/* storage unavailable: the panel still works, it just forgets */
 			}
 		}
 
+		// ── account sync store ────────────────────────────────────────────────
+		/**
+		 * One module-level snapshot shared by every mounted panel. The account
+		 * Remote is display/awareness only; it never feeds the lease identity or
+		 * the guest lifecycle, so a flaky probe can never recreate the webview.
+		 */
+		let accountSnapshot = { status: ACCOUNT_UNKNOWN, label: "", probed: false };
+		const accountListeners = new Set();
+
+		function notifyAccount() {
+			for (const listener of [...accountListeners]) {
+				try {
+					listener(accountSnapshot);
+				} catch {
+					/* a dead panel must not break another one */
+				}
+			}
+		}
+
+		/** Subscribe a mounted panel; returns its disposer. */
+		function subscribeAccount(listener) {
+			accountListeners.add(listener);
+			return () => {
+				accountListeners.delete(listener);
+			};
+		}
+
+		/**
+		 * Publish a probed account state. This ONLY updates the account strip:
+		 * it never bumps an epoch and never rebuilds the guest. A transient
+		 * "unknown" during reconnect is deliberately ignored so the displayed
+		 * state does not flicker; a confirmed sign-out is shown immediately.
+		 * @param status - normalized account state.
+		 */
+		function publishAccount(status) {
+			const previous = accountSnapshot;
+			// Ignore a transient unknown once we know a real state: it is usually
+			// a reconnect, not a sign-out, and must not disturb the panel.
+			const settled = status === ACCOUNT_UNKNOWN && previous.probed && previous.status !== ACCOUNT_UNKNOWN
+				? previous.status
+				: status;
+			accountSnapshot = {
+				status: settled,
+				// Preserve the name through a transient unknown; clear it only on a
+				// confirmed sign-out when the display explicitly publishes "".
+				label: settled === ACCOUNT_SIGNED_OUT ? "" : previous.label,
+				probed: true
+			};
+			notifyAccount();
+		}
+
+		/** Publish a display name; a stale result from an older probe is dropped. */
+		function publishAccountLabel(label) {
+			if (accountSnapshot.label === label) return;
+			accountSnapshot = { ...accountSnapshot, label };
+			notifyAccount();
+		}
+
+		/**
+		 * Read one generated `ctx.remote.account` method. Generated Remotes answer
+		 * with an `{ ok, value, error }` envelope, so a bare payload is never
+		 * assumed; an absent namespace or a refused call degrades to undefined.
+		 * @param ctx - client plugin context.
+		 * @param method - generated account method name.
+		 * @param args - method arguments.
+		 * @returns the envelope's `value`, or undefined when unavailable.
+		 */
+		async function callAccount(ctx, method, args = []) {
+			let remote;
+			try {
+				remote = typeof ctx.get === "function" ? ctx.get("remote") : ctx.remote;
+			} catch {
+				remote = void 0;
+			}
+			const account = remote?.account;
+			const call = account?.[method];
+			if (typeof call !== "function") return void 0;
+			const result = await call.apply(account, args);
+			if (result === null || typeof result !== "object" || result.ok !== true) return void 0;
+			return result.value;
+		}
+
+		/** Platform client identity headers, read at call time as the UI does. */
+		function accountClient(ctx) {
+			return {
+				version: globalThis.__DSH_BOOT__?.release?.version || HOST_VERSION_FALLBACK,
+				locale: typeof navigator !== "undefined" ? navigator.language || "en-US" : "en-US",
+				timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60
+			};
+		}
+
+		/**
+		 * Read the live DSH account state and display name. This is awareness
+		 * ONLY: no value here may ever feed the guest lease or rebuild the
+		 * webview, or a transient Remote failure would drop the chat session.
+		 * @param ctx - client plugin context.
+		 * @returns `{ status, label }`.
+		 */
+		async function probeAccount(ctx) {
+			let state;
+			try {
+				state = await callAccount(ctx, "getState");
+			} catch {
+				state = void 0;
+			}
+			if (state?.status !== "credential-stored") {
+				return {
+					status: state?.status === "signed-out" ? ACCOUNT_SIGNED_OUT : ACCOUNT_UNKNOWN,
+					label: ""
+				};
+			}
+			const probe = { status: ACCOUNT_SIGNED_IN, label: "" };
+			try {
+				const outcome = await callAccount(ctx, "getProfile", [accountClient(ctx)]);
+				const value = outcome?.status === "ready" ? outcome.value : void 0;
+				probe.label = [value?.name, value?.contact, value?.id]
+					.find((item) => typeof item === "string" && item.length > 0) ?? "";
+			} catch {
+				/* profile is display-only: failure keeps the bare state */
+			}
+			return probe;
+		}
+
+		/**
+		 * Start the account watcher once per plugin activation. A 5-second poll
+		 * plus `connection/reset` gives self-heal without depending on the exact
+		 * Client shape of the account `watch` stream, and every resource is
+		 * released through the plugin's own ctx effect.
+		 * @param ctx - client plugin context.
+		 */
+		let accountSyncStarted = false;
+		function startAccountSync(ctx) {
+			if (accountSyncStarted) return;
+			accountSyncStarted = true;
+			let stopped = false;
+			let timer;
+
+			const refresh = async () => {
+				if (stopped) return;
+				let probe = { status: ACCOUNT_UNKNOWN, label: "" };
+				try {
+					probe = await probeAccount(ctx);
+				} catch {
+					/* Remote unavailable: publishAccount ignores a transient unknown */
+					probe = { status: ACCOUNT_UNKNOWN, label: "" };
+				}
+				if (stopped) return;
+				publishAccount(probe.status);
+				if (probe.label !== "") publishAccountLabel(probe.label);
+			};
+
+			const schedule = () => {
+				if (stopped) return;
+				timer = setTimeout(() => {
+					void refresh().finally(schedule);
+				}, 5000);
+				// A long-lived page keeps the poll; a minimal context (or a Node
+				// self-check) must not be held open by its timer alone.
+				try {
+					if (typeof timer.unref === "function") timer.unref();
+				} catch {
+					/* not a Node timer */
+				}
+			};
+
+			void refresh().finally(schedule);
+
+			let offReset;
+			try {
+				if (typeof ctx.on === "function") offReset = ctx.on("connection/reset", () => {
+					void refresh();
+				});
+			} catch {
+				/* optional: the poll still self-heals */
+			}
+
+			let hasDisposal = false;
+			try {
+				if (typeof ctx.effect === "function") {
+					ctx.effect(() => () => {
+						stopped = true;
+						if (timer !== void 0) clearTimeout(timer);
+						try {
+							if (typeof offReset === "function") offReset();
+						} catch {
+							/* already detached */
+						}
+						accountListeners.clear();
+						accountSyncStarted = false;
+					}, "deepseek-chat: account sync");
+					hasDisposal = true;
+				}
+			} catch {
+				/* fall through to the no-disposal path */
+			}
+			if (!hasDisposal) {
+				stopped = true;
+				if (timer !== void 0) clearTimeout(timer);
+				try {
+					if (typeof offReset === "function") offReset();
+				} catch {
+					/* already detached */
+				}
+				// Without a real ctx effect there is no teardown to stop the poll;
+				// keep the first probe but never leave a repeating timer behind.
+				accountSyncStarted = false;
+			}
+		}
+
+		// ── guest helpers ─────────────────────────────────────────────────────
 		/**
 		 * Whether the guest element is still in the document. Electron's webview
 		 * methods throw once it is detached, so this gates every guest call.
@@ -141,13 +447,7 @@ window.__ModuleLoader__.load({
 			}
 		}
 
-		/**
-		 * Guest URL, or undefined when the element cannot report one. This is the
-		 * call that used to escape: React cleans up effects after removing the DOM,
-		 * and Electron then throws from `getURL()`.
-		 * @param element - webview element.
-		 * @returns the URL string, or undefined.
-		 */
+		/** Guest URL, or undefined when the element cannot report one. */
 		function readUrl(element) {
 			if (!attached(element)) return void 0;
 			try {
@@ -160,8 +460,6 @@ window.__ModuleLoader__.load({
 
 		/**
 		 * Navigate the guest without ever throwing.
-		 * @param element - webview element.
-		 * @param url - target URL.
 		 * @returns false when the guest is gone, so the caller can report it.
 		 */
 		function navigate(element, url) {
@@ -178,8 +476,6 @@ window.__ModuleLoader__.load({
 		/**
 		 * Panel-list glyph, drawn on currentColor so the sidebar's active state owns
 		 * the ink. Matches the sidebar's 16/18px icon seat.
-		 * @param props - size passed by the sidebar panel list.
-		 * @returns the glyph element.
 		 */
 		function ChatGlyph({ size = 18 }) {
 			return react.createElement("svg", {
@@ -211,6 +507,24 @@ window.__ModuleLoader__.load({
 				background: "var(--dsw-alias-bg-base)",
 				color: "var(--dsw-alias-label-primary)"
 			},
+			accountBar: {
+				flex: "none",
+				display: "flex",
+				alignItems: "center",
+				gap: "6px",
+				minHeight: "24px",
+				padding: "3px 10px",
+				borderBottom: ".5px solid var(--dsw-alias-border-l3)",
+				color: "var(--dsw-alias-label-tertiary)",
+				font: "var(--dsw-font-xxxs-11)"
+			},
+			accountDot: {
+				width: "6px",
+				height: "6px",
+				borderRadius: "50%",
+				background: "currentColor",
+				flex: "none"
+			},
 			host: {
 				position: "relative",
 				flex: "1",
@@ -249,6 +563,17 @@ window.__ModuleLoader__.load({
 			}
 		};
 
+		/** Copy for the account strip; the dot's opacity encodes the state. */
+		function accountCopy(account) {
+			if (account.status === ACCOUNT_SIGNED_IN) return {
+				text: account.label ? COPY.syncedAs(account.label) : COPY.synced,
+				opacity: "1"
+			};
+			if (account.status === ACCOUNT_SIGNED_OUT) return { text: COPY.unsigned, opacity: ".45" };
+			if (!account.probed) return { text: COPY.probing, opacity: ".3" };
+			return { text: COPY.unknown, opacity: ".3" };
+		}
+
 		/**
 		 * Keeps a rendering failure inside this panel. DSH has no boundary of its own
 		 * around slot entries: an escaping error unmounts the root slot, which is the
@@ -283,24 +608,32 @@ window.__ModuleLoader__.load({
 		}
 
 		/**
-		 * The global chat panel: a guest webview filling the main column.
+		 * The global chat panel: an account strip and a guest webview filling the
+		 * main column.
 		 *
 		 * The guest is created only after the lease resolves, and it is mounted with
 		 * `name`/`partition`/`src` already set, because the main process inspects
-		 * exactly that bootstrap src when it approves the attachment. The first load
-		 * goes to the remembered conversation; navigation events keep that memory
-		 * current. A dead guest (crash, destroy, failed start) turns into a retry card
-		 * inside the panel; cleanup releases the lease and never calls into a detached
-		 * element.
-		 * @returns the panel element tree.
+		 * exactly that bootstrap src when it approves the attachment. The identity
+		 * and the conversation memory are both scoped to the current DSH account;
+		 * an account transition bumps `epoch`, which tears down the old guest and
+		 * re-acquires a lease for the new identity.
 		 */
 		function ChatPanel() {
 			const hostRef = react.useRef(null);
 			const lastUrlRef = react.useRef(void 0);
+			const [account, setAccount] = react.useState(accountSnapshot);
 			const [failure, setFailure] = react.useState(void 0);
 			const [loading, setLoading] = react.useState(true);
 			const [attempt, setAttempt] = react.useState(0);
 
+			react.useEffect(() => subscribeAccount((next) => {
+				try {
+					setAccount(next);
+				} catch {
+					/* the panel is gone */
+				}
+			}), []);
+
 			const retry = react.useCallback(() => {
 				try {
 					setFailure(void 0);
@@ -325,20 +658,41 @@ window.__ModuleLoader__.load({
 					return;
 				}
 
+				// Both identities are constants. The desktop shell caches one
+				// session per workspace string; keeping them fixed is what makes
+				// switching panels/sessions preserve the chat login.
+				const storageKey = storageKeyFor();
+				const partitionKey = partitionKeyFor();
 				let disposed = false;
+				let failed = false;
 				let unsubscribeOpen;
 				let lease;
 				let watchdog;
 				const element = document.createElement("webview");
-				const initialTarget = rememberedTarget();
+				const initialTarget = rememberedTarget(storageKey);
 				let restoring = initialTarget !== CHAT_URL;
 
 				Object.assign(element.style, styles.guest);
 				element.setAttribute("allowpopups", "");
 
-				/** Report a guest failure inside the panel; never throw. */
+				/**
+				 * Report a guest failure inside the panel; never throw. The dead
+				 * guest element is removed immediately so a Retry cannot stack a
+				 * second webview, and later events are suppressed. The lease is
+				 * still released by the effect cleanup, exactly once.
+				 */
 				const fail = (error) => {
-					if (disposed) return;
+					if (disposed || failed) return;
+					failed = true;
+					try {
+						element.remove();
+					} catch {
+						/* already detached */
+					}
+					if (watchdog !== void 0) {
+						clearTimeout(watchdog);
+						watchdog = void 0;
+					}
 					try {
 						setLoading(false);
 						setFailure(String((error && error.message) || error));
@@ -351,11 +705,11 @@ window.__ModuleLoader__.load({
 				const remember = (raw) => {
 					if (raw === void 0) return;
 					lastUrlRef.current = raw;
-					rememberTarget(raw);
+					rememberTarget(raw, storageKey);
 				};
 
 				const onDomReady = () => {
-					if (disposed) return;
+					if (disposed || failed) return;
 					if (watchdog !== void 0) {
 						clearTimeout(watchdog);
 						watchdog = void 0;
@@ -364,7 +718,7 @@ window.__ModuleLoader__.load({
 					else remember(initialTarget);
 				};
 				const onStopLoading = () => {
-					if (disposed) return;
+					if (disposed || failed) return;
 					const raw = readUrl(element);
 					if (raw === void 0) return;
 					remember(raw);
@@ -376,15 +730,15 @@ window.__ModuleLoader__.load({
 					}
 				};
 				const onNavigate = () => {
-					if (disposed) return;
+					if (disposed || failed) return;
 					remember(readUrl(element));
 				};
 				const onNavigateInPage = (event) => {
-					if (disposed || event?.isMainFrame !== true) return;
+					if (disposed || failed || event?.isMainFrame !== true) return;
 					onNavigate();
 				};
 				const onFailLoad = (event) => {
-					if (disposed || event?.isMainFrame !== true) return;
+					if (disposed || failed || event?.isMainFrame !== true) return;
 					// -3 is ERR_ABORTED: a superseded navigation, not a failure.
 					if (event.errorCode === -3) return;
 					if (restoring) {
@@ -398,7 +752,7 @@ window.__ModuleLoader__.load({
 				};
 				/** The guest process exited or the guest was torn down underneath us. */
 				const onGuestGone = () => {
-					if (disposed) return;
+					if (disposed || failed) return;
 					fail(new Error(COPY.crashed));
 				};
 
@@ -412,18 +766,22 @@ window.__ModuleLoader__.load({
 					["destroyed", onGuestGone]
 				];
 
+				// A listener that cannot be attached leaves a guest nobody can
+				// drive; abort the start instead of mounting a silent webview.
+				let listenersReady = false;
 				try {
 					for (const [name, handler] of listeners) {
 						element.addEventListener(name, handler, name === "dom-ready" ? { once: true } : void 0);
 					}
+					listenersReady = true;
 				} catch (error) {
 					fail(error);
 				}
 
 				const start = async () => {
 					try {
-						const reservation = await bridge.acquire(PARTITION_KEY);
-						if (disposed) {
+						const reservation = await bridge.acquire(partitionKey);
+						if (disposed || failed) {
 							try {
 								Promise.resolve(bridge.release(reservation.lease)).catch(() => {});
 							} catch {
@@ -436,8 +794,10 @@ window.__ModuleLoader__.load({
 						element.setAttribute("partition", reservation.partition);
 						element.setAttribute("src", `about:blank#${reservation.lease}`);
 						try {
-							unsubscribeOpen = bridge.onOpenRequested(reservation.lease, (url) => {
-								if (!disposed && typeof url === "string") navigate(element, url);
+							unsubscribeOpen = bridge.onOpenRequested(reservation.lease, (raw) => {
+								if (disposed || failed || typeof raw !== "string") return;
+								const target = parsePopupUrl(raw);
+								if (target !== void 0) navigate(element, target);
 							});
 						} catch {
 							/* popup bridge unavailable: the guest still works */
@@ -445,14 +805,14 @@ window.__ModuleLoader__.load({
 						host.append(element);
 						watchdog = setTimeout(() => {
 							watchdog = void 0;
-							if (disposed) return;
+							if (disposed || failed) return;
 							if (readUrl(element) === void 0) fail(new Error(COPY.timeout));
 						}, 15000);
 					} catch (error) {
 						fail(error);
 					}
 				};
-				void start();
+				if (listenersReady) void start();
 
 				return () => {
 					disposed = true;
@@ -492,7 +852,12 @@ window.__ModuleLoader__.load({
 				};
 			}, [attempt]);
 
+			const copy = accountCopy(account);
+
 			return react.createElement("div", { style: styles.root },
+				react.createElement("div", { style: styles.accountBar },
+					react.createElement("span", { style: { ...styles.accountDot, opacity: copy.opacity }, "aria-hidden": "true" }),
+					react.createElement("span", null, copy.text)),
 				react.createElement("div", { style: styles.host, ref: hostRef },
 					failure === void 0 && loading
 						? react.createElement("div", { style: styles.notice }, COPY.loading)
@@ -521,7 +886,21 @@ window.__ModuleLoader__.load({
 				// The panel needs the desktop guest bridge; on the Web surface an iframe
 				// cannot carry the site, so the plugin stays inert there.
 				if (globalThis.dshDesktop?.browser === void 0) return;
+			} catch {
+				return;
+			}
 
+			try {
+				startAccountSync(ctx);
+			} catch (error) {
+				try {
+					console.error("dsh-plugin-deepseek-chat: account sync failed", error);
+				} catch {
+					/* console unavailable */
+				}
+			}
+
+			try {
 				ctx.slots.inject("main", () => ctx.slots.register({
 					name: "main",
 					key: PANEL_ID
@@ -544,6 +923,26 @@ window.__ModuleLoader__.load({
 
 		exports.apply = apply;
 		exports.inject = inject;
+		exports.__test__ = {
+			ACCOUNT_UNKNOWN,
+			ACCOUNT_SIGNED_IN,
+			ACCOUNT_SIGNED_OUT,
+			CHAT_URL,
+			STORAGE_BASE,
+			accountCopy,
+			getSnapshot: () => accountSnapshot,
+			partitionKeyFor,
+			storageKeyFor,
+			publishAccount,
+			publishAccountLabel,
+			probeAccount,
+			callAccount,
+			resetAccountSync() {
+				accountSnapshot = { status: ACCOUNT_UNKNOWN, label: "", probed: false };
+				accountListeners.clear();
+				accountSyncStarted = false;
+			}
+		};
 		return module.exports;
 	}
 });