@ybbmm/dsh-session-delete 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 deepseek-harness-session-delete contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,169 @@
-# Temporary Holding Version
+# @ybbmm/dsh-session-delete
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Permanently delete a conversation from the DeepSeek Harness sidebar.**
+**在 DeepSeek Harness 侧边栏永久删除对话。**
+
+DeepSeek Harness can archive a conversation but never delete one — the session
+log accumulates on disk forever. This plugin adds the missing action.
+
+> [中文说明](#中文说明) 在下方。
+
+---
+
+## What it adds
+
+| Where | What |
+|---|---|
+| Session **"…" menu** | A red **Delete conversation** row, after the shipped pin / rename / fork / archive rows |
+| Session **row hover** | A trash button beside the shipped archive and pin buttons |
+| **Confirmation dialog** | Shows the conversation title, states that deletion is permanent, then reports the outcome in place |
+
+Deleting the conversation that is currently open reopens a new session in the
+same workspace; the dialog stays open just long enough to acknowledge the
+result.
+
+## What exactly is removed
+
+| Artifact | Effect |
+|---|---|
+| Session log artifact (`~/.dsh/sessions/<project-key>/<session-id>/`, log + lock file) | removed |
+| Projection cache record (`~/.dsh/storages/session_projcache/sessions/<id>.json`) | dropped, then re-checked against a late checkpoint write |
+| Workspace accounting — membership, saved order, pin, archive mark | released |
+| Live session and agent store entries | detached *before* the files are removed, so no writer re-creates the log |
+| Attachments (`~/.dsh/attachments`) | **kept** — content-addressed and shared between sessions |
+| Temp spill files | not touched (the host sweeps them by age) |
+| Conversations forked *from* this one | **kept**; the dialog names how many still point at the deleted parent |
+
+## Safety
+
+Deletion is a transaction with one irreversible step, and that step runs
+before anything becomes user-visible:
+
+1. resolve the target (live or stored), 2. refuse while work is running,
+3. stop and detach a live session, 4. **remove the log artifact**, 5. release
+workspace accounting, 6. drop the projection cache, 7. announce the removal.
+
+- **A failed removal changes nothing.** If the log cannot be removed (typically
+  a writer still closing), the request fails with `session-delete/io` *before*
+  accounting and cache are touched, so the row is still listed and retrying is
+  meaningful.
+- **Retries only transient failures.** `EBUSY` / `EPERM` / `EACCES` /
+  `ENOTEMPTY` are retried with back-off (8 attempts, ~1.8 s); anything else
+  fails immediately instead of burning the budget.
+- **Permanent.** There is no undo and no trash. Archiving is still the
+  reversible option and is untouched by this plugin.
+- **Refuses while the conversation is busy.** A running turn, subagent,
+  background job or scheduled reminder makes the Host reject the request, and
+  the dialog says why.
+- **No double deletion.** A repeated click joins the deletion already in
+  flight instead of interleaving two runs.
+
+## Error codes
+
+The Host answers with stable codes; the dialog localizes them.
+
+| Code | Meaning |
+|---|---|
+| `session-delete/active` | The conversation still owns running work |
+| `session-delete/not-found` | It was already deleted (or never existed) |
+| `session-delete/io` | The log could not be removed; nothing was changed |
+| `session-delete/unsupported-store` | This build's store cannot name the artifact; nothing was changed |
+| `session-delete/invalid-request` | Malformed request (defensive) |
+
+## Install
+
+From the plugin market: search for **Session Delete**.
+
+Manually:
+
+```bash
+dsh plugin add @ybbmm/dsh-session-delete
+```
+
+From a local directory (development):
+
+```bash
+dsh plugin add ./session-delete
+```
+
+Restart the Harness if your profile does not hot-reload plugin bundles.
+
+## Compatibility
+
+- Built and verified against DeepSeek Harness **0.2.1-rc.2** (Desktop/Web GUI,
+  Windows, Chinese and English UI).
+- **No runtime dependencies.** The bundle imports only `node:fs/promises` and
+  `node:path`, and loads nothing from `@deepseek-ai/*` at runtime.
+- It deliberately builds on a few host internals: the session store and
+  persistence services, the workspace registry, the storage-domain projection
+  cache, and the API Gateway's runtime *SRC* dispatch for services that carry a
+  `typertRemote` binding plus Remote method markers. A host release that
+  reshapes those may need a plugin update — pin your host version if you depend
+  on this.
+
+## How it works
+
+- **Host half** (`index.js`) registers a `sessionDelete` service with a
+  `typertRemote` binding and a hand-written Remote method marker, which makes
+  `sessionDelete/delete` reachable through the Gateway without generated
+  Typert artifacts. The method implements the ordering above; the log is
+  located through the store's own `locate()`, which names the session directory
+  for the shipped JSONL backend and is honoured as-is for other layouts.
+- **Browser half** (`client.js`) registers into
+  `sidebar.workspaces.session.menu.item`,
+  `sidebar.workspaces.session.row.action` and `shell.overlay`, and calls the
+  endpoint over the shared connection RPC. The dialog is keyed by the Session
+  it deletes, so one request's in-flight/error/success state never leaks into
+  the next.
+- Styles copy the host's own geometry, renamed under a plugin prefix, and use
+  only `--dsw-alias-*` theme tokens, so light/dark and theme switching follow
+  the app.
+
+## Known limitations
+
+- **No toast.** The workspace toast slot's key domain is closed to third-party
+  plugins; the dialog's in-place acknowledgement is the confirmation instead.
+- **UI copy is English and Chinese only.**
+- Deleting a conversation does not delete files the conversation *produced* in
+  your workspace — only the conversation itself.
+- A conversation created but never written to disk has no artifact; deleting it
+  releases the row and reports `removed: false`, but the empty slot can linger
+  in the Host's in-memory pending list until the next restart.
+- The search index (`dsh-session-query-sqlite`) reconciles against the
+  persistence listing on every query, so it drops the deleted conversation on
+  the next search rather than eagerly.
+
+## Development
+
+```bash
+npm test        # node --test: host ordering/retry/error tests + browser dialog tests
+```
+
+The tests run against the real modules with fake Cordis contexts and a minimal
+React stand-in; they need no Harness installation.
+
+## 中文说明
+
+DeepSeek Harness 只能归档会话、无法真正删除，日志会一直堆积在磁盘上。这个插件补上了缺失的删除能力。
+
+**新增内容**：会话「…」菜单里的**红色「删除对话」**、会话行悬停时的垃圾桶按钮，以及一个显示对话标题、写明"永久删除"的确认框；删除后确认框会原地显示"已删除"以及保留的分叉会话数量。删除当前正在看的对话后，会在同一工作区重新打开一个新会话。
+
+**删除顺序是事务式的**：解析目标 → 拒绝运行中的工作 → 停并将活跃会话摘除 → **删除日志文件** → 释放工作区记账 → 删除投影缓存 → 广播移除事件。日志删除失败时会**先失败、不动记账和缓存**，所以侧边栏行仍在、可以直接重试。
+
+**会被删掉的**：会话日志目录（日志 + 锁文件）、投影缓存记录、工作区记账（成员关系/排序/置顶/归档标记）。
+
+**不会删的**：附件目录（按内容寻址、被多个会话共享）、临时 spill 文件、由该对话分叉出的子会话（确认框会提示数量）。
+
+**错误码**：`active`（仍有运行中的工作）、`not-found`（已删除或不存在）、`io`（文件无法删除，未做任何改动）、`unsupported-store`（当前版本无法定位文件）、`invalid-request`（请求非法）。
+
+**重试策略**：只对 `EBUSY`/`EPERM`/`EACCES`/`ENOTEMPTY` 这类"句柄还没关"的瞬时错误做退避重试（8 次，约 1.8 秒），其他错误立即报错，不会把时间耗在无效重试上。
+
+**安全性**：永久删除，无回收站、不可撤销——归档依然是可逆选项。同一会话的重复点击会合并为一次删除，不会交叉执行。
+
+**兼容性**：在 DeepSeek Harness `0.2.1-rc.2`（Desktop/Web，Windows，中英文界面）上验证；零运行时依赖。实现依赖少量宿主内部机制（会话存储/持久化服务、工作区注册表、投影缓存域、以及 API Gateway 对带 `typertRemote` 绑定的服务的运行时派发），宿主大版本变更时可能需要跟进更新。
+
+**已知限制**：没有全局 toast（插件无法使用该槽位），确认框内的原地提示即反馈；界面文案仅中英文；从未落盘的空白会话删除后，宿主内存里的 pending 条目可能要等重启才彻底消失。
+
+## License
+
+[MIT](LICENSE)

package/client.js

@@ -0,0 +1,416 @@
+/**
+ * Browser half of the @ybbmm/dsh-session-delete bundle.
+ *
+ * Adds a "Delete conversation" entry to the sidebar session list: one row in
+ * the Session "..." menu, one hover button, and one confirmation dialog. The
+ * deletion itself runs on the Host through the `sessionDelete/delete` Remote
+ * endpoint; this half collects the request and shows the outcome.
+ *
+ * The dialog follows the shipped archive action's shape: a thin entry that
+ * reads the pending request, and one inner form keyed by the Session id that
+ * owns the in-flight, error and success state. Keying it means one request's
+ * outcome can never leak into the next one.
+ */
+window.__ModuleLoader__.load({
+  id: '@ybbmm/dsh-session-delete',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+    const { Button, IconTrashOutlineRegular, MenuItemButton, Modal, Tooltip } =
+      require('@deepseek-ai/dsh-client-ui-primitives')
+
+    const NS = 'ybbmm.dsh-session-delete'
+    const PLUGIN = '@ybbmm/dsh-session-delete'
+
+    const en = {
+      'menu.delete': 'Delete conversation',
+      'actions.delete': 'Delete conversation',
+      'dialog.title': 'Delete conversation?',
+      'dialog.description':
+        '“{title}” will be permanently deleted. Its messages cannot be recovered.',
+      'dialog.confirm': 'Delete',
+      'dialog.cancel': 'Cancel',
+      'dialog.close': 'Close',
+      'dialog.pending': 'Deleting…',
+      'dialog.done': 'Deleted. The conversation is gone from this device.',
+      'dialog.children':
+        '{count} conversation(s) forked from this one remain and still point at the deleted parent.',
+      'error.offline': 'The Harness is not connected to its Host.',
+      'error.active': 'This conversation is still running work. Stop it, then delete it.',
+      'error.notFound': 'This conversation no longer exists.',
+      'error.io': 'The conversation could not be removed from disk. Nothing was deleted — please try again.',
+      'error.unsupported': 'This build cannot locate conversation files, so nothing was deleted.',
+      'error.unreadable': 'This conversation log cannot be read by this build, so nothing was deleted.',
+      'error.unknown': 'The conversation could not be deleted.',
+    }
+    const zh = {
+      'menu.delete': '删除对话',
+      'actions.delete': '删除对话',
+      'dialog.title': '删除对话？',
+      'dialog.description': '“{title}” 将被永久删除，其中的消息无法恢复。',
+      'dialog.confirm': '删除',
+      'dialog.cancel': '取消',
+      'dialog.close': '关闭',
+      'dialog.pending': '正在删除…',
+      'dialog.done': '已删除，该对话已从本机移除。',
+      'dialog.children': '由该对话分叉出的 {count} 个会话会保留，并仍指向一个已删除的父对话。',
+      'error.offline': 'Harness 尚未连接到宿主。',
+      'error.active': '该对话仍有正在运行的工作，请先停止再删除。',
+      'error.notFound': '该对话已不存在。',
+      'error.io': '无法从磁盘移除该对话，本次未删除任何内容，请重试。',
+      'error.unsupported': '当前版本无法定位对话文件，本次未删除任何内容。',
+      'error.unreadable': '当前版本无法读取该对话的日志，本次未删除任何内容。',
+      'error.unknown': '该对话未能删除。',
+    }
+
+    // The hover button and the dialog copy the host's own geometry, renamed
+    // under this plugin's prefix and keeping only theme-token references.
+    const css = '.dshSessionDelete_iconButton{border-radius:var(--dsw-radius-xs);cursor:pointer;width:16px;height:16px;color:var(--dsw-alias-label-tertiary);background:0 0;border:none;flex:none;justify-content:center;align-items:center;padding:0;display:inline-flex}.dshSessionDelete_iconButton:hover{color:var(--dsw-alias-label-primary)}.dshSessionDelete_deleteAction:not(:disabled){color:var(--dsw-alias-state-error-primary)}.dshSessionDelete_status{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}.dshSessionDelete_error{color:var(--dsw-alias-state-error-primary);margin-top:8px;font-size:12px;line-height:18px}.dshSessionDelete_note{margin-top:8px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary)}'
+    const cssTagId = `${PLUGIN}/session-delete.css`
+    if (typeof document !== 'undefined' && document.querySelector(`style[data-plugin-css=${JSON.stringify(cssTagId)}]`) === null) {
+      const tag = document.createElement('style')
+      tag.dataset.plugin = PLUGIN
+      tag.dataset.pluginCss = cssTagId
+      tag.textContent = css
+      document.head.appendChild(tag)
+    }
+
+    /** One minimal observable the slot renderer turns into a selector hook. */
+    function createObservable(initial) {
+      let value = initial
+      const listeners = new Set()
+      return {
+        getSnapshot: () => value,
+        subscribe(listener) {
+          listeners.add(listener)
+          return () => {
+            listeners.delete(listener)
+          }
+        },
+        set(next) {
+          if (Object.is(next, value)) return
+          value = next
+          for (const listener of [...listeners]) listener()
+        },
+      }
+    }
+
+    /** Read an optional client service without failing when it is absent. */
+    function optionalService(ctx, name) {
+      try {
+        return ctx.get(name)
+      } catch {
+        return undefined
+      }
+    }
+
+    /** The Session the main view currently shows, when there is one. */
+    function currentSessionId(ctx) {
+      const uiSession = optionalService(ctx, 'uiSession')
+      const key = uiSession?.current?.value?.key
+      return typeof key === 'string' && key.length > 0 ? key : undefined
+    }
+
+    /** The workspace that accounts for one Session, when it is listed. */
+    function workspaceOf(ctx, sessionId) {
+      const uiWorkspace = optionalService(ctx, 'uiWorkspace')
+      const items = uiWorkspace?.workspaces?.list?.getSnapshot?.()?.items
+      if (!Array.isArray(items)) return undefined
+      for (const item of items) {
+        if (Array.isArray(item?.sessionIds) && item.sessionIds.includes(sessionId)) return item.workspaceId
+      }
+      return undefined
+    }
+
+    /**
+     * Map one Remote failure onto a localized sentence.
+     *
+     * The Host sends a stable code for every deletion refusal; anything else
+     * (a carrier failure, or a host older than this bundle) falls back to the
+     * diagnostic the Host attached, then to generic copy.
+     * @param t - the slot's locale function.
+     * @param failure - the rejection raised by the RPC call.
+     * @returns the sentence to show in the dialog.
+     */
+    function describeFailure(t, failure) {
+      const known = {
+        'client/offline': 'error.offline',
+        'session-delete/active': 'error.active',
+        'session-delete/not-found': 'error.notFound',
+        'session-delete/io': 'error.io',
+        'session-delete/unsupported-store': 'error.unsupported',
+        'session-delete/unreadable': 'error.unreadable',
+        'session-delete/invalid-request': 'error.unknown',
+      }
+      const code = typeof failure?.code === 'string' ? failure.code : undefined
+      if (code !== undefined && known[code] !== undefined) return t(known[code])
+      const message = failure instanceof Error ? failure.message : typeof failure === 'string' ? failure : ''
+      return message.length > 0 ? message : t('error.unknown')
+    }
+
+    /** Ask the Host to delete one conversation. */
+    async function requestDeletion(ctx, sessionId) {
+      const connection = optionalService(ctx, 'connection')
+      if (!connection) {
+        const failure = new Error('The Harness is not connected to its Host.')
+        failure.code = 'client/offline'
+        throw failure
+      }
+      const result = await connection.rpc.call('/api', 'sessionDelete/delete', { args: { sessionId } })
+      if (!result?.ok) {
+        const failure = new Error(result?.error?.message ?? 'The conversation could not be deleted.')
+        failure.code = result?.error?.code
+        failure.details = result?.error?.details
+        throw failure
+      }
+      return result.value
+    }
+
+    /** The "..." menu row: ask for the confirmation. */
+    function DeleteSessionMenuItem({ sessionId, displayTitle, useMenuOpenState, requestDelete, t }) {
+      const [, setMenuOpen] = useMenuOpenState()
+      return h(
+        MenuItemButton,
+        {
+          danger: true,
+          separatorBefore: true,
+          icon: h(IconTrashOutlineRegular, { size: 14 }),
+          onSelect: () => {
+            setMenuOpen(false)
+            requestDelete(sessionId, displayTitle)
+          },
+        },
+        t('menu.delete'),
+      )
+    }
+
+    /** The hover button: ask for the confirmation. */
+    function DeleteSessionRowButton({ sessionId, displayTitle, requestDelete, t }) {
+      return h(
+        Tooltip,
+        { label: t('actions.delete'), side: 'bottom', align: 'end', delayMs: 500, portal: true },
+        h(
+          'button',
+          {
+            type: 'button',
+            className: 'dshSessionDelete_iconButton',
+            'aria-label': t('menu.delete'),
+            onClick: () => {
+              requestDelete(sessionId, displayTitle)
+            },
+          },
+          h(IconTrashOutlineRegular, { size: 14 }),
+        ),
+      )
+    }
+
+    /**
+     * One request's dialog: confirming deletes, and the dialog then reports the
+     * outcome instead of closing silently, so the user gets an acknowledgement.
+     * @param props - the request in flight and its settlement callbacks.
+     * @returns the dialog.
+     */
+    function DeleteConfirmForm({ request, settleDelete, confirmDelete, t }) {
+      const [deleting, setDeleting] = React.useState(false)
+      const [error, setError] = React.useState(undefined)
+      const [done, setDone] = React.useState(undefined)
+
+      const close = () => {
+        if (deleting) return
+        settleDelete()
+      }
+
+      const confirm = () => {
+        if (deleting || done !== undefined) return
+        setDeleting(true)
+        setError(undefined)
+        confirmDelete(request).then(
+          (outcome) => {
+            setDeleting(false)
+            const children = Array.isArray(outcome?.children) ? outcome.children.length : 0
+            setDone({ children })
+          },
+          (failure) => {
+            setDeleting(false)
+            setError(describeFailure(t, failure))
+          },
+        )
+      }
+
+      const body = []
+      if (deleting) {
+        body.push(
+          h(
+            'div',
+            { role: 'status', className: 'dshSessionDelete_status', key: 'pending' },
+            t('dialog.pending'),
+          ),
+        )
+      }
+      if (error !== undefined) {
+        body.push(
+          h('div', { role: 'alert', className: 'dshSessionDelete_error', key: 'error' }, error),
+        )
+      }
+      if (done !== undefined) {
+        body.push(
+          h(
+            'div',
+            { role: 'status', className: 'dshSessionDelete_status', key: 'done' },
+            t('dialog.done'),
+          ),
+        )
+        if (done.children > 0) {
+          body.push(
+            h(
+              'div',
+              { className: 'dshSessionDelete_note', key: 'children' },
+              t('dialog.children', { count: done.children }),
+            ),
+          )
+        }
+      }
+
+      const footer =
+        done !== undefined
+          ? h(Button, { variant: 'outline', onClick: close }, t('dialog.close'))
+          : h(
+              React.Fragment,
+              null,
+              h(
+                Button,
+                { variant: 'outline', disabled: deleting, onClick: close },
+                t('dialog.cancel'),
+              ),
+              h(
+                Button,
+                {
+                  variant: 'outline',
+                  className: 'dshSessionDelete_deleteAction',
+                  disabled: deleting,
+                  onClick: confirm,
+                },
+                t('dialog.confirm'),
+              ),
+            )
+
+      return h(Modal, {
+        open: true,
+        onClose: close,
+        closeLabel: t('dialog.close'),
+        title: t('dialog.title'),
+        description: t('dialog.description', { title: request.displayTitle }),
+        footer,
+        children: body,
+      })
+    }
+
+    /**
+     * The `shell.overlay` entry: nothing while no confirmation is pending,
+     * otherwise one dialog per request, keyed by the Session it targets.
+     * @param props - the request hook, its settlement, and the deletion hop.
+     * @returns the open dialog, or null.
+     */
+    function DeleteSessionDialog({ useDeleteRequest, settleDelete, confirmDelete, t }) {
+      const request = useDeleteRequest((pending) => pending)
+      if (!request) return null
+      // `key` (not a child) so a new request remounts the form: its in-flight,
+      // error and success state belong to exactly one request.
+      return h(DeleteConfirmForm, {
+        key: request.sessionId,
+        request,
+        settleDelete,
+        confirmDelete,
+        t,
+      })
+    }
+
+    return {
+      inject: ['slots', 'locale'],
+      apply(ctx) {
+        ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'ybbmm.dsh-session-delete: dictionaries')
+
+        const pending = createObservable(null)
+
+        const requestDelete = (sessionId, displayTitle) => {
+          pending.set({
+            sessionId,
+            displayTitle,
+            workspaceId: workspaceOf(ctx, sessionId),
+          })
+        }
+        const settleDelete = () => {
+          pending.set(null)
+        }
+
+        /**
+         * Delete one requested conversation and, when the main view showed it,
+         * open a fresh session in the same workspace.
+         *
+         * The pending request stays set so the dialog can report the outcome;
+         * the user closes it.
+         * @param request - the pending request being confirmed.
+         * @returns the Host outcome.
+         * @throws the Host failure, for the dialog to localize.
+         */
+        const confirmDelete = async (request) => {
+          const outcome = await requestDeletion(ctx, request.sessionId)
+          if (currentSessionId(ctx) === request.sessionId) {
+            const uiWorkspace = optionalService(ctx, 'uiWorkspace')
+            try {
+              // Reopen inside the same workspace, reusing its blank session
+              // exactly like the sidebar's own New Session action.
+              uiWorkspace?.startSession(request.workspaceId)
+            } catch (failure) {
+              console.warn('ybbmm.dsh-session-delete: could not open a new session:', failure)
+            }
+          }
+          return outcome
+        }
+
+        const actionInjected = () => ({ requestDelete })
+        const dialogInjected = () => ({
+          hooks: { deleteRequest: pending },
+          settleDelete,
+          confirmDelete,
+        })
+
+        ctx.slots.inject('sidebar.workspaces.session.menu.item', function* () {
+          yield ctx.slots.register(
+            {
+              name: 'sidebar.workspaces.session.menu.item',
+              id: 'ybbmm.dsh-session-delete',
+              order: 500,
+              locale: NS,
+              inject: actionInjected,
+            },
+            DeleteSessionMenuItem,
+          )
+        })
+        ctx.slots.inject('sidebar.workspaces.session.row.action', function* () {
+          yield ctx.slots.register(
+            {
+              name: 'sidebar.workspaces.session.row.action',
+              id: 'ybbmm.dsh-session-delete',
+              order: 300,
+              locale: NS,
+              inject: actionInjected,
+            },
+            DeleteSessionRowButton,
+          )
+        })
+        ctx.slots.inject('shell.overlay', function* () {
+          yield ctx.slots.register(
+            {
+              name: 'shell.overlay',
+              id: 'ybbmm.dsh-session-delete',
+              locale: NS,
+              inject: dialogInjected,
+            },
+            DeleteSessionDialog,
+          )
+        })
+      },
+    }
+  },
+})

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+- insert:
+    - id: ybbmm-dsh-session-delete
+      name: '@ybbmm/dsh-session-delete'
+      inject:
+        - sessions
+        - sessionPersistence
+        - workspaceRegistry

package/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" role="img" aria-label="Delete conversation">
+  <path d="M4 7h16" />
+  <path d="M10 11v6" />
+  <path d="M14 11v6" />
+  <path d="M6 7l1 12a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2l1-12" />
+  <path d="M9 7V5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2" />
+</svg>

package/index.js

@@ -0,0 +1,482 @@
+/**
+ * Host half of the session-delete bundle.
+ *
+ * Owns one operation: permanently delete a stored conversation. The session's
+ * durable log artifact goes away, its workspace accounting (membership, pin,
+ * archive) is released, its projection-cache record is dropped, and the
+ * browser is told the row is gone.
+ *
+ * The browser half calls `sessionDelete/delete` over the shared Remote
+ * carrier. The endpoint is reachable through the API Gateway's runtime "SRC"
+ * dispatch: the Gateway looks for a live Service that carries a
+ * `typertRemote` binding plus Remote method markers, so this bundle needs no
+ * generated Typert artifact.
+ *
+ * Ordering is transactional on purpose: every step before the log removal can
+ * still be abandoned without leaving a user-visible inconsistency, so the one
+ * irreversible step runs first among the mutating steps and everything after
+ * it is fail-soft. A failed deletion therefore leaves the conversation exactly
+ * as it was, and retrying is meaningful.
+ *
+ * The bundle deliberately has no package dependencies: a bundle installed from
+ * a local directory resolves its imports from that directory, so every import
+ * would have to be a Node built-in.
+ */
+import { rm, stat } from 'node:fs/promises'
+import { dirname } from 'node:path'
+
+/** Cordis service key of this plugin's service. */
+const SERVICE_KEY = 'sessionDelete'
+/** Wire namespace the API Gateway exposes for this service. */
+const NAMESPACE = 'sessionDelete'
+/** Property the Typert protocol stores Remote method markers under. */
+const REMOTE_METHODS = '@deepseek-ai/dsh-typert-protocol/remote-methods'
+/** Shared symbol Cordis uses to bind a service value to its owning context. */
+const TRACKER = Symbol.for('cordis.tracker')
+/** Bounded retries for a removal a closing writer may still be holding open. */
+const REMOVE_ATTEMPTS = 8
+/** First back-off delay; doubled per attempt up to the ceiling. */
+const REMOVE_RETRY_BASE_MS = 40
+/** Ceiling of the removal back-off delay. */
+const REMOVE_RETRY_MAX_MS = 400
+/** How many times the projection-cache row is re-checked after a delete. */
+const CACHE_ATTEMPTS = 4
+/** Pause between projection-cache checks. */
+const CACHE_RETRY_MS = 60
+/** Errors that mean "a handle is still open", not "this will never work". */
+const RETRYABLE_REMOVE_CODES = new Set([
+  'EBUSY',
+  'EPERM',
+  'EACCES',
+  'ENOTEMPTY',
+  'EEXIST',
+  'EMFILE',
+  'ENFILE',
+])
+
+/**
+ * One deletion failure with a stable code and caller-facing message.
+ *
+ * The Gateway forwards any thrown value carrying the protocol's structural
+ * Remote marker unchanged, so `code` crosses the wire instead of folding into
+ * `gateway/internal`; a plain Error would lose it.
+ */
+class SessionDeleteError extends Error {
+  /**
+   * @param code - stable failure code the browser localizes.
+   * @param message - diagnostic text, also the browser's fallback copy.
+   * @param details - structured payload for the dialog.
+   */
+  constructor(code, message, details = {}) {
+    super(message)
+    this.name = 'SessionDeleteError'
+    this.code = code
+    this.details = details
+    // Cross-bundle identification: the Gateway tests this marker rather than
+    // `instanceof`, because the protocol package resolves separately.
+    this.isDSHRemoteError = true
+  }
+}
+
+/** Read an optional service without failing when the composition lacks it. */
+function optionalService(ctx, name) {
+  try {
+    return ctx.get(name)
+  } catch {
+    return undefined
+  }
+}
+
+/** Pause for `ms` milliseconds. */
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+/** Whether a filesystem failure is worth retrying while the writer settles. */
+function isRetryableRemoveFailure(error) {
+  const code = error?.code
+  return typeof code === 'string' && RETRYABLE_REMOVE_CODES.has(code)
+}
+
+/** The back-off delay before attempt `attempt` (0-based). */
+function removeRetryDelay(attempt) {
+  return Math.min(REMOVE_RETRY_BASE_MS * 2 ** attempt, REMOVE_RETRY_MAX_MS)
+}
+
+class SessionDeleteService {
+  /**
+   * @param ctx - the owning plugin context.
+   */
+  constructor(ctx) {
+    this.ctx = ctx
+    this.name = SERVICE_KEY
+    /** Deletions in flight, so two clicks cannot interleave their steps. */
+    this.inflight = new Map()
+    this.typertRemote = Object.freeze({
+      service: this,
+      serviceKey: SERVICE_KEY,
+      namespace: NAMESPACE,
+    })
+  }
+
+  /**
+   * Delete one conversation.
+   *
+   * Steps run in an order where only the log removal is irreversible, and it
+   * runs before the accounting release: a failure there aborts with the row
+   * still listed and retryable.
+   * @param sessionId - durable Session identity.
+   * @returns the deleted identity, what was removed, and surviving children.
+   */
+  async delete(sessionId) {
+    if (typeof sessionId !== 'string' || sessionId.length === 0) {
+      throw new SessionDeleteError(
+        'session-delete/invalid-request',
+        'sessionDelete: a session id is required',
+      )
+    }
+    const running = this.inflight.get(sessionId)
+    if (running !== undefined) return running
+    const task = this.runDelete(sessionId)
+    this.inflight.set(sessionId, task)
+    try {
+      return await task
+    } finally {
+      if (this.inflight.get(sessionId) === task) this.inflight.delete(sessionId)
+    }
+  }
+
+  /**
+   * The deletion proper; see {@link delete} for the ordering contract.
+   * @param sessionId - durable Session identity.
+   * @returns the deletion outcome.
+   */
+  async runDelete(sessionId) {
+    const ctx = this.ctx
+
+    // 1. Resolve the target: a live session, otherwise a stored one.
+    const live = ctx.sessions.get(sessionId)
+    let header = live?.header
+    let stored = false
+    if (!header) {
+      let snapshot
+      try {
+        snapshot = await ctx.sessionPersistence.stat(sessionId)
+      } catch (error) {
+        // A log this build cannot interpret is not a missing log; refuse with
+        // its own code so the dialog does not claim the conversation is gone.
+        throw new SessionDeleteError(
+          'session-delete/unreadable',
+          `sessionDelete: session "${sessionId}" could not be read: ${error instanceof Error ? error.message : String(error)}`,
+          { sessionId },
+        )
+      }
+      if (!snapshot?.header) {
+        throw new SessionDeleteError(
+          'session-delete/not-found',
+          `sessionDelete: session "${sessionId}" was not found`,
+          { sessionId },
+        )
+      }
+      header = snapshot.header
+      stored = true
+    }
+
+    // 2. Refuse while the conversation still owns running work. The same gate
+    //    the shipped archive action uses, so the answer matches the UI's own.
+    const activity = await ctx.waterfall(
+      'workspace/session-activity',
+      { sessionId },
+      () => Promise.resolve([]),
+    )
+    const reported = Array.isArray(activity) ? activity : []
+    if (reported.length > 0) {
+      throw new SessionDeleteError(
+        'session-delete/active',
+        `sessionDelete: session "${sessionId}" is still running work; stop it before deleting`,
+        {
+          sessionId,
+          activity: reported.map((entry) => (typeof entry?.kind === 'string' ? entry.kind : 'unknown')),
+        },
+      )
+    }
+
+    // 3. Children survive their parent: name them so the browser can say so.
+    const children = await this.listChildren(sessionId)
+
+    // 4. Stop what is left, then let a live session leave the stores so its
+    //    writer closes. The writer itself removes its handle on
+    //    `session/disposed`; the removal below retries through that delay.
+    await ctx.parallel('workspace/session-stop', { sessionId }).catch(() => {})
+    if (live) {
+      await ctx.sessions.flush(live).catch(() => {})
+      this.detach(sessionId)
+    }
+
+    // 5. Remove the stored conversation. This is the irreversible step; a
+    //    session that never materialized has no artifact, which counts as
+    //    success rather than failure.
+    const removed = await this.removeStoredLog(header, sessionId)
+
+    // 6. Release the durable workspace accounting. Fail-soft: the log is
+    //    already gone, so a stale membership must not fail the deletion.
+    await this.releaseWorkspaceAccounting(sessionId)
+
+    // 7. Drop the projection-cache record so no stale hint survives. A live
+    //    session's disposal checkpoint may land after this call, so the row is
+    //    re-checked before the deletion reports success.
+    await this.removeProjectionCache(sessionId)
+
+    // 8. A live session announces its own removal through `session/disposed`;
+    //    a stored one has no such event, so announce it here.
+    if (!live) ctx.emit('api-session/removed', sessionId)
+
+    return {
+      sessionId,
+      removed,
+      wasLive: live !== undefined,
+      stored,
+      children,
+    }
+  }
+
+  /**
+   * Remove one session from the live session and agent stores.
+   * @param sessionId - durable Session identity.
+   */
+  detach(sessionId) {
+    const ctx = this.ctx
+    const sessions = optionalService(ctx, 'sessions')
+    const entry = sessions?.store?.get(sessionId)
+    if (entry && typeof sessions.detachEntered === 'function') {
+      try {
+        sessions.detachEntered(entry)
+      } catch (error) {
+        ctx.logger?.warn(`sessionDelete: detaching session "${sessionId}" failed: ${String(error)}`)
+      }
+    }
+    const agents = optionalService(ctx, 'agents')
+    const agentEntry = agents?.store?.get(sessionId)
+    if (agentEntry && typeof agents.detachEntered === 'function') {
+      try {
+        agents.detachEntered(agentEntry)
+      } catch (error) {
+        ctx.logger?.warn(`sessionDelete: detaching agent "${sessionId}" failed: ${String(error)}`)
+      }
+    }
+  }
+
+  /**
+   * Release membership, saved order, pin and archive mark for one session.
+   *
+   * Every call is fail-soft and in a stable order: membership first, so the
+   * row leaves the sidebar even when a later step throws.
+   * @param sessionId - durable Session identity.
+   */
+  async releaseWorkspaceAccounting(sessionId) {
+    const ctx = this.ctx
+    const registry = optionalService(ctx, 'workspaceRegistry')
+    if (!registry) return
+    const attempt = async (label, run) => {
+      try {
+        await run()
+      } catch (error) {
+        ctx.logger?.warn(`sessionDelete: releasing ${label} for "${sessionId}" failed: ${String(error)}`)
+      }
+    }
+    for (const workspace of registry.list()) {
+      if (workspace.record?.sessionIds?.includes(sessionId)) {
+        await attempt('workspace membership', () => workspace.detachSession(sessionId))
+      }
+    }
+    await attempt('pin', () => registry.unpinSession(sessionId))
+    await attempt('archive mark', () => registry.unarchiveSession(sessionId))
+  }
+
+  /**
+   * Remove the session's stored log artifact.
+   *
+   * The store owns the on-disk layout, so its own locator names the artifact.
+   * The shipped JSONL backend keeps one directory per session (holding the
+   * log, its kernel lock file and any future session-local artifact), so the
+   * removal targets that directory; a backend that names a session-owned
+   * directory directly, or a single file, is honoured as-is. A writer that is
+   * still closing can recreate the artifact, so transient failures are
+   * retried with back-off instead of failing the whole deletion.
+   * @param header - the stored session header.
+   * @param sessionId - durable Session identity, for diagnostics.
+   * @returns whether a stored artifact was removed.
+   */
+  async removeStoredLog(header, sessionId) {
+    const persistence = this.ctx.sessionPersistence
+    const locate = persistence?.locate
+    if (typeof locate !== 'function') {
+      throw new SessionDeleteError(
+        'session-delete/unsupported-store',
+        'sessionDelete: this session store does not expose its on-disk layout',
+        { sessionId },
+      )
+    }
+    const location = locate.call(persistence, header)
+    if (!location?.path) return false
+    const target =
+      location.kind === 'dir' ? location.path : location.kind === 'file' ? location.path : dirname(location.path)
+    // A session created but never materialized has no artifact; `rm` would
+    // report success for a path that never existed, which would overstate the
+    // outcome. Nothing on disk is still a successful deletion.
+    if (!(await this.pathExists(target))) return false
+
+    let lastFailure
+    for (let attempt = 0; attempt < REMOVE_ATTEMPTS; attempt++) {
+      try {
+        await this.removeArtifact(target)
+        return true
+      } catch (error) {
+        lastFailure = error
+        // `force: true` already ignores ENOENT, so a non-transient failure
+        // means retrying cannot help: report it instead of burning the budget.
+        if (!isRetryableRemoveFailure(error)) break
+        if (attempt < REMOVE_ATTEMPTS - 1) await delay(removeRetryDelay(attempt))
+      }
+    }
+    const reason = lastFailure instanceof Error ? lastFailure.message : String(lastFailure)
+    throw new SessionDeleteError(
+      'session-delete/io',
+      `sessionDelete: removing the log of session "${sessionId}" failed: ${reason}`,
+      { sessionId, path: target, attempts: REMOVE_ATTEMPTS },
+    )
+  }
+
+  /**
+   * Remove one artifact path.
+   *
+   * The single filesystem call the deletion makes, kept as its own method so
+   * the retry loop above stays testable without provoking real Windows sharing
+   * violations.
+   * @param target - absolute artifact path (session directory or file).
+   * @returns resolution once the artifact is absent.
+   */
+  removeArtifact(target) {
+    return rm(target, { recursive: true, force: true })
+  }
+
+  /**
+   * Whether a path still exists.
+   *
+   * A non-ENOENT failure counts as present: the caller then attempts the
+   * removal and reports its real outcome instead of silently skipping it.
+   * @param target - absolute artifact path.
+   * @returns whether the path exists.
+   */
+  async pathExists(target) {
+    try {
+      await stat(target)
+      return true
+    } catch (error) {
+      return error?.code === 'ENOENT' ? false : true
+    }
+  }
+
+  /**
+   * Drop the stored projection-cache record of one session.
+   *
+   * A live session's disposal checkpoint is written asynchronously right after
+   * the detach, so one delete can be followed by the row reappearing. The row
+   * is re-checked until it stays gone; a row that survives the whole budget is
+   * only logged, because the log is already deleted and every reader
+   * re-validates a cached row against the header — a stale hint must not turn
+   * a successful deletion into a failure.
+   * @param sessionId - durable Session identity.
+   */
+  async removeProjectionCache(sessionId) {
+    const storageDomain = optionalService(this.ctx, 'storageDomain')
+    if (!storageDomain || typeof storageDomain.get !== 'function') return
+    let table
+    try {
+      const domain = storageDomain.get('session_projcache')
+      if (!domain || typeof domain.table !== 'function') return
+      table = domain.table('sessions')
+    } catch {
+      return
+    }
+    for (let attempt = 0; attempt < CACHE_ATTEMPTS; attempt++) {
+      try {
+        if (table.get(sessionId) === undefined) return
+        await table.delete(sessionId)
+      } catch (error) {
+        this.ctx.logger?.warn(
+          `sessionDelete: dropping the projection cache of "${sessionId}" failed: ${String(error)}`,
+        )
+        return
+      }
+      if (attempt < CACHE_ATTEMPTS - 1) await delay(CACHE_RETRY_MS)
+    }
+    try {
+      if (table.get(sessionId) !== undefined) {
+        this.ctx.logger?.warn(
+          `sessionDelete: projection cache row for "${sessionId}" survived deletion; it is re-validated on the next read`,
+        )
+      }
+    } catch {
+      // A closed domain cannot hold a stale row for the browser either.
+    }
+  }
+
+  /**
+   * Stored sessions whose header names `sessionId` as their parent.
+   *
+   * Deleting a parent does not delete its forks; naming them lets the browser
+   * say so instead of leaving a silently orphaned lineage.
+   * @param sessionId - durable Session identity being deleted.
+   * @returns child session ids, or an empty list when the store cannot list.
+   */
+  async listChildren(sessionId) {
+    const persistence = this.ctx.sessionPersistence
+    if (!persistence || typeof persistence.list !== 'function') return []
+    try {
+      const snapshots = await persistence.list()
+      return snapshots
+        .map((snapshot) => snapshot?.header)
+        .filter((header) => header && header.id !== sessionId && header.parentSession === sessionId)
+        .map((header) => header.id)
+    } catch {
+      return []
+    }
+  }
+}
+
+// Declare the Remote method for the API Gateway's runtime dispatch. The
+// marker format is the Typert protocol's public, versioned descriptor: a
+// frozen record on the class prototype naming the exported methods. The
+// `resources` reader is called with the method's positional arguments
+// (`read(reader, positional)` in the Gateway), so for this one-parameter
+// method the reader receives the id string itself.
+Object.defineProperty(SessionDeleteService.prototype, REMOTE_METHODS, {
+  configurable: true,
+  value: Object.freeze({
+    version: 1,
+    methods: Object.freeze([
+      Object.freeze({
+        method: 'delete',
+        invocation: Object.freeze({ kind: 'direct' }),
+        resources: Object.freeze({
+          session: (sessionId) => (typeof sessionId === 'string' ? sessionId : undefined),
+        }),
+      }),
+    ]),
+  }),
+})
+
+/**
+ * Register the deletion service and let the browser reach it.
+ * @param ctx - the owning plugin context.
+ */
+export function apply(ctx) {
+  const service = new SessionDeleteService(ctx)
+  // Bind the service to the calling context the way a Cordis Service does, so
+  // the API Gateway reaches it through the same traced proxy.
+  Object.defineProperty(service, TRACKER, {
+    value: { associate: SERVICE_KEY, property: 'ctx' },
+  })
+  ctx.reflect.provide(SERVICE_KEY, service, undefined)
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Session Delete",
+    "description": "Adds a Delete conversation action to the sidebar session menu and permanently removes the conversation from disk."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "删除会话",
+    "description": "在侧边栏会话菜单中新增「删除对话」，永久清除该对话的本地记录。"
+  }
+}

package/package.json

@@ -1,6 +1,65 @@
 {
   "name": "@ybbmm/dsh-session-delete",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "type": "module",
+  "description": "Permanently delete a DeepSeek Harness conversation from the sidebar session menu: removes the session log, its projection cache and its workspace accounting. | 在 DeepSeek Harness 侧边栏永久删除对话，清除会话日志、投影缓存与工作区记账。",
+  "license": "MIT",
+  "author": "jack-001-a",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jack-001-a/deepseek-harness-session-delete.git"
+  },
+  "homepage": "https://github.com/jack-001-a/deepseek-harness-session-delete#readme",
+  "bugs": {
+    "url": "https://github.com/jack-001-a/deepseek-harness-session-delete/issues"
+  },
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "dsh",
+    "session",
+    "conversation",
+    "delete",
+    "sidebar",
+    "plugin"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-workspace",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-primitives",
+        "@deepseek-ai/dsh-client-locale"
+      ]
+    }
+  }
+}