better-dsh 0.2.3-b → 0.2.3-d

package/docs/50_test-reports/upstream-dsh-0.1.5-rc.2-local-test-report.md

@@ -0,0 +1,79 @@
+# upstream dsh 0.1.5-rc.2 本地对齐实测报告（Dev/Test 1 · 4988 实例）
+
+> 日期：2026-09-11（HKT）
+> 执行：对齐轮 S1–S7（runbook：`docs/60_exploration-and-research/05-dashr-dev/upstream-alignment.md`）
+> 目标 tag：`dsh-v0.1.5-rc.2`（npm dist-tag `next`，最高版本；`latest` 停在 rc.1）
+> 前置版本对账报告：`docs/upstream-dsh-0.1.5-rc.2-report.md`（846 commits / 3170 files / ~104k 行）
+
+---
+
+## 一、实测范围与结果表
+
+| # | 步骤 | 结果 |
+|---|---|---|
+| S1 | patch 载体 tag 间 diff + dashr 56 个 `@deepseek-ai/*` 引用名对新 tag 包集全数命中 | ✅ |
+| S2 | checkout `dsh-v0.1.5-rc.2` + 三 patch 手工重放（pnpm-workspace.yaml 冲突按新 allowBuilds 手解） | ✅ |
+| S3 | rsync 副本 + stale peerDep 复查（absent）+ **新增 devDeps 手术**（见瑕疵 F2） | ✅ |
+| S4 | `pnpm install`（36s，供应链策略 1543 entries 过）+ `pnpm run build`（234 client artifacts）+ 副本 tsdown/client 半 | ✅ |
+| S5 | 插件契约对齐：**4 处真实语义漂移移植**（见 §三） | ✅ |
+| S6 | `tsc --noEmit` **0 errors**；`vitest --run` **493/493**（37 files，128s） | ✅ |
+| S7 | 4998 实例 systemd-run 冒烟 **8/8 探针全绿**（见 §四） | ✅ |
+
+红线遵守：未 npm publish、未动 prod 3080、未动 Caddyfile。
+
+## 二、环境事实
+
+- monorepo：`upstream/deepseek-harness` @ `dsh-v0.1.5-rc.2`（detached），本地 patch 三件套在场（unrun devDep / storeDir+verifyDepsBeforeRun+zeromq / tsdown resolveRepositoryRoot）。
+- allowBuilds 冲突解：采纳上游新集（**fs-ext 移除**——flock 改走 node-addon-system 预编译；新增 `electron-winstaller: false`、`msgpackr-extract: false`），保留本地 `zeromq: true` 与两条 `dsh-subprocess-local`。
+- 副本 `packages/better-dsh/better-dsh/` = canonical 0.2.3-b + devDeps 手术（14 个 `workspace:*`）。
+- 实例：unit `dsh-4988-test`，`DSH_HOME=~/.dsh-test`，`DSH_TRUSTED_HOSTS=test.pc.randomhash.app pc.randomhash.app 192.168.31.130`，`UnsetEnvironment=DISPLAY WAYLAND_DISPLAY`，**端口 4988**（4997–4999 被 superd PoC 占用，见瑕疵 F4）。
+- 残留实验文件未动：`packages/boot/app-boot/bun-registry/`、`bun-internal-bridge.ts`（2026-09-06 bun compile 实验，构建容忍，untracked 不碍 checkout）。
+
+## 三、契约漂移与移植（本轮核心工作）
+
+对 0.1.5-rc.2 的 **4 处真实漂移**全部移植，canonical 已同步（src/test 与副本 diff = 空）：
+
+1. **会话事件改名**（Session V3「PTC durable vocabulary」）：`tool/code-dispatch(-start)` → `tool/ptc-dispatch(-start)`。`src/index.ts` 2 处 append + 3 处注释；测试 3 文件的字符串断言同步。
+2. **subagents 统一消息缝**：`followup`/`reportFrom` 两方法合并为 `sendMessage(sender, targetId, content, {signal})`（上行 = targetId 命中 sender 的 `parentSession` 自动走 send-to-parent；`source`/`delivery` 选项 knobs 已删，runtime 自盖章）。移植面：`src/subagents-surface.ts` 接口重述、`src/bridges/index.ts` 两调用点（parent 方向新增 root-agent 本地护栏，语义等价旧 UNAUTHORIZED）、`delegation.spec`/`bridges.spec`/`helpers.ts` 全部 fake 与断言。
+3. **持久化读路径**：`SessionPersistence.inspect` 消失（接口只剩 create/open/flush/stat/list）；读 = `open(id,'read')` → `handle.read(offset?,length?,opts)` + `close()`，元数据 = `stat(id).header.createdAt`。移植面：`src/url-schema/handlers/agent.ts` 的 surface 接口重述 + 3 调用点收敛为 `persistedEventsOf` helper。
+4. **SessionSeq 品牌化**：裸 `number` 不再可赋值，需 `SessionSeq(n)` 构造（`dsh-session` 导出）；`assistant/message` 事件 data 新增必填 `stream: AssistantStreamRecord[]`（V3 in-history stream 内嵌）——测试 fixture 两处补 `stream: []`。
+
+另有两处**行形状查表结论**（runbook S7.5/S7.8，全绿）：
+- `connection` 行（web-app cordis.patch.yml）tag 间**逐字节同形**（仅注释位移）——fence 腿整行重述继续有效；
+- `__DSH_TRANSPORT__`/ownsHost 消费点、`data-sidebar-collapsed`（AppFrame.tsx:210 仍在）、`conversation.session.header` 与 `settings.general.item` slot、`apps/web/index.html` viewport meta、`webserver injections.ts` head splice——**全部原样存活**。
+
+## 四、S7 冒烟明细（unit dsh-4988-test）
+
+| 探针 | 结果 |
+|---|---|
+| `web --dump-config` → dashr-repl 行 + `DASHR_KERNEL_PYTHON` 注入 | ✅ |
+| fence：trusted Host `/api` = **401**（过栅栏卡认证）；evil Host = **403** | ✅ |
+| token 鉴权根页 200 + `__DSH_TRANSPORT__` boot script 在页 | ✅ |
+| boot graph `"id":"better-dsh"` + `/plugins/??better-dsh/client.js&rev=…` | ✅ |
+| client bundle：200，**17824B 与本地逐字节一致**（+84B = 服务端 sourceMappingURL 追加，符合已知行为） | ✅ |
+| mobile 锚点：layout 模块含 `data-sidebar-collapsed` + `SIDEBAR_AUTO_COLLAPSE = 1024` | ✅ |
+| hashline 中央库 `$DSH_HOME/storages/dsh-better-edit/hash-store.sqlite` 在位 | ✅ |
+| 0.1.5 新组合在场：ui-sidebar-right/documentpreview/files、client-resources、api-workspace-files、ui-deliverables 均入 module batch | ✅ |
+
+实例**保持运行**供 user 验收：`http://127.0.0.1:4988/?token=<redacted>`（token 每次重启轮换）。
+
+## 五、发现的瑕疵（定性 + 去向）
+
+- **F1（流程/runbook 漂移）**：`packages/node_modules` 在新 tag 安装布局下不再生成 → runbook 的 `../../node_modules/.bin/tsx`（build-client）失效，正确为 `../../../node_modules/.bin/tsx`。→ 已回写 AGENTS.md §二。
+- **F2（工具链坑，重要）**：canonical 的 npm-range optional peerDeps（`>=0.1.2-alpha.1 <0.2.0-0`）在 pnpm 11 严格预发布 semver 下**不匹配 workspace `0.1.5-rc.2`**（元组规则），autoInstallPeers 落到 registry **0.1.2-rc.1**（唯一满足该 range 的 registry 版本）→ 副本 node_modules 双身份，tsc 品牌类型互斥报错。**解法（S3 新增手术）**：副本 package.json devDependencies 注入 14 个 `workspace:*`（dashr 实际 import 的 dsh-* 名单），每次 rsync 后重打。→ 已回写 AGENTS.md §二；canonical 不动（npm 发布语义保持）。
+- **F3（上游观察，非阻塞）**：rc.2 的 `test`/`build:bench` scripts 前置 `build:native-system`；主 `build` 已含（scripts/build.ts:44），无额外步骤。`native/system/packages/linux-x64/bin/glibc/system.node` 已产出。
+- **F4（环境冲突）**：4997（127.0.0.1）、4998、4999（0.0.0.0）被 superd multi-context PoC 占用（`~/workspaces/superd/.scratch/multi-context-poc/poc4-v3-e2e.mjs`，pid 2233871 + 1393092，Sep 10 19:41 起，独立 DSH_HOME）——不可杀（user 的在跑实验），本轮实例改 **4988**。**注意：若 Caddy test.pc.randomhash.app 后端指 4999，域名叫到的将是 superd 实例**——user 域名验收前需先对齐端口或等 PoC 结束（Caddyfile 红线未动）。
+- **F5（上游观察）**：`pnpm peers check` 有 WARN（副本 npm-range peers vs workspace 版本）——F2 的同一根源，运行期无影响（profile symlink 直连 monorepo）。
+
+## 六、流程化产出
+
+- 本报告 + AGENTS.md §二 write-back（tag 对齐记录、tsx 路径、devDeps 手术、端口事实）。
+- `.scratch/dsh-v0.1.3-alpha.2-local-patches-backup.patch`（旧 patch 备份，切换前快照）。
+
+## 七、Open items
+
+1. **user 验收**（第一人称）：127.0.0.1:4988 实例（域名词见 F4 注意）；重点 = dashr-repl 真跑一轮（kernel 三级供给在新 runtime 下）、better-edit 读改写、mobile 手势/zoomGuard 真机。
+2. canonical 改动（4 文件 src + 6 文件 test）**未 commit**——等 user 指令（上轮有 commit 前 "Wait" 先例）。
+3. Caddy test.pc → 4999 端口归属与 superd PoC 的冲突排查（user 裁决）。
+4. 既有遗留：v0.2.5 zoomGuard standalone 双形态 CDP 复验（AGENTS.md 已记）。
+5. prod（3080）**维持 0.1.3-alpha.2 不动**；升 0.1.5 需另行裁决（对账报告 §六建议先行）。

package/docs/upstream-dsh-0.1.5-rc.2-report.md

@@ -0,0 +1,156 @@
+# upstream dsh npm 版本对账：prod 0.1.3-alpha.2 → 0.1.5-rc.2
+
+> 生成时间：2026-09-10（本地时区）
+> 数据源：npm registry（`@deepseek-ai/dsh`）元数据 + `upstream/deepseek-harness` git tag 对账
+> 目标：回答「npm 上比 prod 更高的版本是什么、diff 有多大、对 prod 意味着什么」
+
+---
+
+## 〇、一句话结论
+
+prod 当前跑 **`@deepseek-ai/dsh@0.1.3-alpha.2`**。npm 上比它高的版本是整条 **0.1.5 线**（`alpha.1 / alpha.2 / rc.1 / rc.2`，**0.1.4 从未发布，直接跳号**）。最高版本是 **`0.1.5-rc.2`**（挂在 `next` dist-tag，而 `latest` 还停在 `0.1.5-rc.1`）。
+
+这条 0.1.5 线是**大版本级聚合**：846 commits、3170 文件、约 10.4 万行新增。核心是 **Session 格式 v3 重写**（会话持久化契约变更，对 prod 是**破坏性升级，不可 drop-in**），外加 Electron 桌面打包、Sidebar/dockkit 重构、文件交付「present」工具、图渲染预览、模型默认值切换（DeepSeek V41 Flash）等一批功能。**升级 prod 前必须按 AGENTS.md §一/§二 走对齐轮，不能只换版本号。**
+
+---
+
+## 一、版本全景
+
+npm registry 当前 dist-tags：
+
+| dist-tag | 指向版本 |
+|---|---|
+| `latest` | 0.1.5-rc.1 |
+| `next` | **0.1.5-rc.2**（最高） |
+| `alpha` | 0.1.5-alpha.2 |
+
+比 prod（0.1.3-alpha.2）更高的版本，按发布顺序：
+
+| 版本 | npm 发布时间 (UTC) | dist-tag |
+|---|---|---|
+| 0.1.5-alpha.1 | 2026-09-08 15:57 | — |
+| 0.1.5-alpha.2 | 2026-09-09 14:41 | `alpha` |
+| 0.1.5-rc.1 | 2026-09-10 03:12 | `latest` |
+| **0.1.5-rc.2** | **2026-09-10 14:57** | `next` |
+
+> 注意点：`latest` 并不指向最高版本（rc.1 vs rc.2）；「最高版本」= `next` 上的 **0.1.5-rc.2**。0.1.4 未在 npm 出现过。
+
+对应 git tag（本地 `upstream/deepseek-harness`，已 fetch）：
+
+```
+dsh-v0.1.3-alpha.2  2026-09-07 19:45 +0800   ← prod 当前
+dsh-v0.1.5-alpha.1  2026-09-08 23:25 +0800
+dsh-v0.1.5-alpha.2  2026-09-09 22:13 +0800
+dsh-v0.1.5-rc.1     2026-09-10 09:36 +0800
+dsh-v0.1.5-rc.2     2026-09-10 21:50 +0800
+```
+
+---
+
+## 二、diff 规模
+
+`dsh-v0.1.3-alpha.2 .. dsh-v0.1.5-rc.2`：
+
+| 指标 | 值 |
+|---|---|
+| commits | **846** |
+| 文件 | 3170 changed |
+| 行 | +103,990 / −17,687 |
+| 源码侧（排除 snapshots/tests） | 2474 文件，+68,818 / −13,973 |
+
+分段 commit 分布：
+
+| 区间 | commits |
+|---|---|
+| 0.1.3-alpha.2 → 0.1.5-alpha.1 | 563（大头，聚合了 Session V3 与一堆 feature） |
+| 0.1.5-alpha.1 → 0.1.5-alpha.2 | 262 |
+| 0.1.5-alpha.2 → 0.1.5-rc.1 | 17 |
+| 0.1.5-rc.1 → 0.1.5-rc.2 | 4（收尾/backport） |
+
+---
+
+## 三、依赖面变化（对 prod 直接可见）
+
+prod 0.1.3-alpha.2 有 **71 个 dependencies**，0.1.5-rc.2 有 **72 个**。差异：
+
+1. **新增运行期包 `@deepseek-ai/dsh-tool-present`**（`packages/fs/tool-present`）——新「present」工具：把 agent 产出的文件以不可变交付卡片（download card）呈现，是文件交付特性的宿主半。
+2. `apps/cli` devDeps 新增 `@deepseek-ai/dsh-agent-loop`、`@deepseek-ai/dsh-agent-loop-testkit`（内部，不影响 prod 运行面）。
+3. 新增 client 包 `ui-deliverables`（`PresentRow` / `PresentedFileCard` / `present-open`），属 web shell 交付卡片 UI。
+4. 其余全部 `@deepseek-ai/*` 依赖整体从 `^0.1.3-alpha.2` 抬到 `^0.1.5-rc.2`（同版本号齐步，无个别漂移）。
+5. 底层 `cordis` / `schemastery` / `commander` / `js-yaml` 等版本**未变**（`cordis ^4.0.2`、`schemastery ^3.18.2` 等，与 0.1.3-alpha.2 相同）。
+
+---
+
+## 四、主要变更主题（按 prod 相关度排序）
+
+### 1. Session 格式 v3 重写（⚠ 破坏性，最高风险）
+`session-log-v3` 工作线，是本次最大的变更块。要点：
+
+- 会话身份 **V2 → V3 迁移**（`feat(session): add identity V2-to-V3 migration and writer skeleton`）。
+- system prompt 表示为 **surface node zero**（`refactor(session): represent the system prompt as surface node zero`）。
+- **canonical envelopes**、PTC durable vocabulary、in-history system prompt 表示、JSONL 跨进程写所有权（lease）。
+- 大量 `session.v3.jsonl` 快照与 V2/V3 迁移覆盖面单测。
+
+> **对 prod 的含义**：会话持久化契约改变。上一轮（0.1.3-alpha.2 对齐）已实测：上游 tag diff 会打到 `session-persistence-omp.ts` / `replay.ts` / store 的 handle+lease 契约（见 2026-09-08 对齐报告）。**0.1.5 的 V3 比 0.1.3 的 V2 更进一步，破坏面更大**，`better-dsh` / `omp-web` 这类桥接会话数据的插件必须重新对齐，不能 drop-in。
+
+### 2. Electron 桌面打包（对 3080 web 无直接作用）
+Windows/macOS/Linux 构建、mac 签名+公证、Windows 签名、auto-update、IPC 性能优化。纯桌面宿主线，与本机 `dsh web`（3080）部署无关，但意味着上游发布面从此多一个桌面产物。
+
+### 3. Sidebar / dockkit 重构
+- `dockkit` 可逆停靠引擎、pointer 交互。
+- 全局 sidebar panel、tab 导航、live tab 标题 + 文件类型图标、末 tab 关闭规则、响应式右栏、全屏 shell。
+- session-log 控制移入 header「更多」菜单。
+
+### 4. 文件交付「present」工具 + 文档预览
+- 新 `dsh-tool-present` 包：不可变文件交付下载卡片、artifact 卡原生文件动作、workspace 文件操作。
+- 可扩展文档预览、文本预览分页 tab、文件类型图标集、`ui-deliverables` client 卡。
+- `feat(fs)`：bounded byte-range reads（fs-local / fs-e2b）、dual-face 文件 API。
+
+### 5. 图表 / Markdown 预览
+Chat 代码块内预览 Mermaid / Graphviz / SVG / HTML fence，适配应用主题。
+
+### 6. LLM 模型默认值切换（⚠ 影响 prod 行为）
+- Chat Completions 默认切到 **DeepSeek V41 Flash**（`feat(llm): default Chat Completions to DeepSeek V41 Flash`）。
+- 保留 V4 模型、恢复 V4 Flash Vision Exp catalog 条目。
+> prod 若升级，默认模型会跟着变；需确认是否期望。
+
+### 7. Feedback 对话框
+`/feedback` 与 Dislike 统一为一个带分类的对话框 + toast。
+
+### 8. Subagent catalog
+记录并观察 parent-owned child catalog（子代理目录）。
+
+### 9. native system / node-addon-system
+包族改名 `node-addon-system`，预编译 Node-API flock、Landlock capability 子路径。**新增原生依赖面，升级安装需留意 prod 机上的原生构建/预编译匹配**（本机已有一处 zeromq allowBuilds 特例，见 AGENTS.md §二）。
+
+### 10. minimal profile 行为调整
+- `str_replace_editor` 从 minimal profiles 移除。
+- persistent bash 输出与 one-shot shell 契约对齐。
+> 只影响 minimal profile，不影响 prod `web` profile 的默认工具集。
+
+### 11. 其它
+- CLI：从 shipped 模板创建 profile。
+- skills：Playwright 视频录制 GIF。
+- 内部 CI/审查自动化（weighted PR approval、review owner 排名等）——与 prod 运行无关。
+
+---
+
+## 五、对 prod 升级的风险评估（简要）
+
+| 风险项 | 级别 | 说明 |
+|---|---|---|
+| Session V3 格式迁移 | 🔴 高 | 会话持久化契约变更；`better-dsh`/`omp-web` 会话桥接面需重新对齐，先例（0.1.3 V2）已证实非 drop-in |
+| 模型默认切 V41 Flash | 🟠 中 | 默认行为变化，需 user 确认是否接受 |
+| 新原生依赖（node-addon-system） | 🟡 中低 | 安装面原生构建/预编译匹配；本机 pnpm strictDepBuilds/allowBuilds 需复核 |
+| 新工具 `dsh-tool-present` | 🟡 中低 | 新工具进入 agent 运行时，需确认与现有工具/插件无 id 冲突 |
+| Sidebar/dockkit UI 重构 | 🟢 低（功能面） | 纯增量 UI，但 better-dsh 的 mobile 手势/侧栏 patch 需复测是否仍对齐 |
+| Electron 桌面 | ⚪ 无关 | 不影响 web 部署 |
+
+---
+
+## 六、建议
+
+1. 本次**只做对账、不做升级**：0.1.5 是聚合大版本，且含 Session V3 破坏性契约变更，不能当「换版本号」处理。
+2. 若后续要升级，按 AGENTS.md §一/§二走 **Dev/Test 1（4999 源码级）对齐轮**：切 `dsh-v0.1.5-rc.2` → 重放三处本地 patch（storeDir / unrun devDep / resolveRepositoryRoot）→ install/build → 插件契约对齐（重点 `session-persistence-omp.ts`/`replay.ts`/store 的 V3 handle+lease）→ tsc/单测 → 4999 第一人称实测 → 报告落 `docs/50_test-reports/` → user 确认 → 才动 prod 3080。
+3. 升级目标版本**首选 `0.1.5-rc.2`（`next`）而非 `latest`（rc.1）**，因为 rc.2 才是最高版本；但 rc 阶段仍建议等上游正式 stable 后再定。
+4. 升级前单独确认模型默认值（V41 Flash）是否要在 prod 生效。

package/eval-description.md

@@ -0,0 +1,33 @@
+Run one Python cell on a session-persistent scripting pad. One `eval` call = one cell; the pad's state persists across calls and turns — variables, imports, and definitions from earlier cells stay alive.
+
+Work incrementally: imports → define → test → use, each its own cell. Re-run setup only after `reset` or a crash.
+
+## Arguments
+
+- `cell` (required): one Python program body. Top-level `await` works; top-level `return` is a SyntaxError — the cell runs in module scope (REPL semantics, not a function body).
+- `description` (required): a short summary of what the cell does — shown as the call's title in the UI.
+- `timeout` (optional): wall-clock budget in seconds; the cell is interrupted (then force-stopped) when exceeded. Omit for the runtime default.
+- `reset` (optional): restart the pad EMPTY first — earlier state is discarded.
+
+## Direct calls vs cells
+
+Payload-shaped work (one long read, one edit, one command) → direct tool call. Logic-shaped work (loops, conditions, fan-out, composing many tool results into one step) → an `eval` cell. Only what the cell prints or returns comes back — curate it.
+
+Delegation: `agent` is the unified agent-spawn entry; `subagent` is its native alias — both delegate through the same runtime, so call either.
+
+## Calling tools from a cell
+
+Every session tool is callable from a cell as `await tool.<name>(args)` with ONE positional argument: `args` is the tool's parameter object written as a Python dict literal, same field names (`true`/`false`/`null` become `True`/`False`/`None`). A failed call raises `ToolCallError` with `.toolName` naming the tool. Tool names that are not plain identifiers (e.g. contain hyphens) have no `tool.<name>` member — call those as direct tool calls.
+
+```python
+print(await tool.read({"path": "docs/README.md", "limit": 5}))
+
+r = await tool.bash({"command": "ls -la src/", "description": "List source directory"})
+print(r["stdout"]["text"])
+
+import asyncio
+matches, files = await asyncio.gather(
+    tool.grep({"pattern": "TODO", "path": "src"}),
+    tool.glob({"pattern": "**/*.ts", "path": "src"}),
+)
+```

package/lib/client/index.js

@@ -185,14 +185,12 @@ function FailoverRow({ catalog, loadConfig, save, t }) {
 
 //#endregion
 //#region src/mobile/gesture.ts
-/**
-* Resolved defaults — the `1706b81` constants (120 / viewport÷4 / 40 / 1.3 /
-* 768) plus the one addition, the velocity gate. A slow text-selection drag
-* runs ~0.13 px/ms; 0.15 px/ms filters those while any comfortable sweep
-* (0.4 px/ms and up) passes.
+/** Resolved defaults — the `1706b81` constants (120 / viewport÷4 / 40 / 1.3)
+* plus the one addition, the velocity gate. A slow text-selection drag runs
+* ~0.13 px/ms; 0.15 px/ms filters those while any comfortable sweep (0.4
+* px/ms and up) passes.
 */
 const DEFAULT_SWIPE_THRESHOLDS = {
-	breakpoint: 768,
 	swipeDistancePx: 40,
 	dominanceRatio: 1.3,
 	leftEdgeBandPx: 120,
@@ -200,16 +198,6 @@ const DEFAULT_SWIPE_THRESHOLDS = {
 	swipeVelocityPxPerMs: .15
 };
 /**
-* Whether one completed gesture's viewport is in the gesture band.
-*
-* @param viewportWidth - viewport width at gesture time (px).
-* @param thresholds - resolved recognition thresholds (`.breakpoint`).
-* @returns `true` when `viewportWidth` is strictly below the breakpoint.
-*/
-function isNarrowViewport(viewportWidth, thresholds) {
-	return viewportWidth < thresholds.breakpoint;
-}
-/**
 * Whether a pointerdown may START a gesture — the source's pointerdown
 * gate, verbatim: with both panels closed, only the left band (X120) or
 * the right three quarters of the screen admit; with a panel open, any
@@ -275,7 +263,6 @@ function resolveMobileConfig(pageConfig) {
 	const v = (value, fallback) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : fallback;
 	return {
 		enabled: true,
-		breakpoint: n(pageConfig.breakpoint, DEFAULT_SWIPE_THRESHOLDS.breakpoint),
 		swipeDistancePx: n(pageConfig.swipeDistancePx, DEFAULT_SWIPE_THRESHOLDS.swipeDistancePx),
 		dominanceRatio: n(pageConfig.dominanceRatio, DEFAULT_SWIPE_THRESHOLDS.dominanceRatio),
 		leftEdgeBandPx: n(pageConfig.leftEdgeBandPx, DEFAULT_SWIPE_THRESHOLDS.leftEdgeBandPx),
@@ -291,19 +278,32 @@ function readLeftCollapsed() {
 	return document.querySelector("[data-sidebar-collapsed]") !== null;
 }
 /**
-* Better Sidebar's right-panel state, live off the body attribute the
-* plugin itself publishes (collapsed = closed). Read SYNCHRONOUSLY in the
-* handlers — a cached mirror lags the panel's own DOM write by a render,
-* and a close-swipe issued right after an open-swipe would misroute.
+* The OFFICIAL right sidebar's state (0.1.5 ui-sidebar-right), read from
+* AppFrame's TWO presentation facets, synchronously (a cached mirror lags
+* the panel's own DOM write by a render, and a close-swipe issued right
+* after an open-swipe would misroute):
+*
+* - `[data-rightbar-collapsed]` — the reserved GRID TRACK facet (present =
+*   zero-width right column). On phones (<768) the panel presents FULLSCREEN
+*   WITHOUT a track (`autoFullscreen` in SidebarRight), so this attribute
+*   alone misreads a panel that covers the whole frame as "closed" — the
+*   2026-09-11 field bug: every close-swipe misrouted to open-left.
+* - `[data-rightbar-fullscreen]` — the overlay facet (present = fullscreen
+*   presentation active, open by definition).
+*
+* Open = track reserved OR fullscreen overlay. On hosts before 0.1.5 both
+* attributes never appear: closed, permanently — left gestures unaffected.
 */
 function readRightOpen() {
-	return !document.body.hasAttribute("data-dsh-sidebar-collapsed");
+	const fullscreen = document.querySelector("[data-rightbar-fullscreen]") !== null;
+	const trackless = document.querySelector("[data-rightbar-collapsed]") !== null;
+	return fullscreen || !trackless;
 }
 /**
 * Whether a session is current — the plugin-side stand-in for the source's
-* `detailsSession !== undefined` guard (the right panel opens in a session
-* only). Better Sidebar's own shipped CSS keys off the same slot selector,
-* so it is load-bearing beyond this feature.
+* `detailsSession !== undefined` guard (the right panel is a
+* session-scoped surface; without a session its expand button is not
+* rendered, so opening would be a no-op anyway).
 */
 function readSessionLive() {
 	return document.querySelector("[data-slot=\"conversation.session.header\"]") !== null;
@@ -316,32 +316,38 @@ function readPanelState() {
 	};
 }
 /**
-* Toggle Better Sidebar's right panel through its persistent DOM: the
-* plugin exposes no JS toggle on its client service (its open/close
-* reducer is store-internal), so the swipe reaches it the same way the
-* source did — clicking the LAST button of its always-rendered
-* `[data-dsh-toggle-cluster]` (the bottom-panel button precedes it and is
-* absent below the plugin's 768px narrow breakpoint). Absent cluster or
-* buttons: a no-op, never a crash.
+* Drive the OFFICIAL right sidebar through its own controls (0.1.5
+* ui-sidebar-right): opening clicks `[data-sidebar-right-expand]` (the
+* conversation header corner button — the panel's own documented "way
+* into a hidden panel", rendered exactly while collapsed with a session);
+* closing clicks `[data-sidebar-right-toggle]` (the dock chrome toggle).
+* The store action behind them (`setExpanded`/`toggleExpanded`) is
+* slot-store-internal — cross-plugin imports are the hard boundary, so
+* the native buttons ARE the sanctioned entry. Absent button (pre-0.1.5
+* host, no session, or already in the target state): a no-op, never a
+* crash.
 */
-function toggleBetterSidebar() {
-	const buttons = document.querySelector("[data-dsh-toggle-cluster]")?.querySelectorAll("button");
-	(buttons?.[buttons.length - 1])?.click();
+function openRightPanel() {
+	document.querySelector("[data-sidebar-right-expand]")?.click();
+}
+function closeRightPanel() {
+	document.querySelector("[data-sidebar-right-toggle]")?.click();
 }
 /**
-* The narrow-viewport CSS: zero-width sidebar track under the breakpoint,
-* keyed to AppFrame's semantic attribute (survives class-hash churn).
-* Rendered with the breakpoint baked in (media queries cannot read JS
-* config); the tag carries the plugin-owned dataset so the loader's
-* style-claim machinery removes it on unload, like module CSS.
+* The responsive CSS: zero-width sidebar track whenever upstream's layout
+* has collapsed the sidebar, keyed PURELY to AppFrame's semantic
+* attribute (survives class-hash churn). No width media query of our own
+* (2026-09-11 ruling): upstream owns the auto-collapse threshold (1024
+* today), and this rule simply takes the 56px rail they leave behind to
+* zero. If upstream renames the attribute the rule stops matching and
+* their native rail renders (benign degradation). The tag carries the
+* plugin-owned dataset so the loader's style-claim machinery removes it
+* on unload, like module CSS.
 */
-function mobileCss(breakpointPx) {
-	const wide = Math.max(1, Math.floor(breakpointPx) - .02);
+function mobileCss() {
 	return [
-		`@media (max-width: ${String(wide)}px) {`,
-		`  [data-sidebar-collapsed] {`,
-		`    grid-template-columns: 0px minmax(0, 1fr) 0px !important;`,
-		`  }`,
+		`[data-sidebar-collapsed] {`,
+		`  grid-template-columns: 0px minmax(0, 1fr) 0px !important;`,
 		`}`
 	].join("\n");
 }
@@ -361,7 +367,7 @@ function setupMobileLayout(ctx) {
 		const tag = document.createElement("style");
 		tag.dataset.plugin = "better-dsh";
 		tag.dataset.pluginCss = styleTagId;
-		tag.textContent = mobileCss(config.breakpoint);
+		tag.textContent = mobileCss();
 		document.head.append(tag);
 		const offLayout = ctx.inject(["layout"], (layoutCtx) => {
 			const layout = layoutCtx.get("layout");
@@ -370,8 +376,10 @@ function setupMobileLayout(ctx) {
 			const onPointerDown = (event) => {
 				start = void 0;
 				const viewport = window.innerWidth;
-				if (!isNarrowViewport(viewport, config)) return;
-				if (!admitsSwipeStart(event.clientX, viewport, readPanelState(), config)) return;
+				const coarsePointer = window.matchMedia?.("(pointer: coarse)").matches === true;
+				const panels = readPanelState();
+				if (!coarsePointer && !panels.leftCollapsed && !panels.rightOpen) return;
+				if (!admitsSwipeStart(event.clientX, viewport, panels, config)) return;
 				start = {
 					x: event.clientX,
 					y: event.clientY,
@@ -389,7 +397,8 @@ function setupMobileLayout(ctx) {
 				if (action === null) return;
 				start = void 0;
 				if (action === "open-left" || action === "close-left") layout.toggleSidebar();
-				else toggleBetterSidebar();
+				else if (action === "open-right") openRightPanel();
+				else closeRightPanel();
 			};
 			const onPointerEnd = () => {
 				start = void 0;

package/lib/index.d.ts

@@ -1,9 +1,8 @@
-import { t as DASHRSdkSchema } from "./py-sdk-BCaOGYz7.js";
 import { Context, Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 import { ToolDefinition, ToolExecutionInput, ToolRunContext, ToolRuntime } from "@deepseek-ai/dsh-tools";
 import { ContentBlock, HarnessError } from "@deepseek-ai/dsh-llm";
-import { ScopeKey, Scoped } from "@deepseek-ai/dsh-scope";
+import { Scoped } from "@deepseek-ai/dsh-scope";
 import { Agent } from "@deepseek-ai/dsh-agent";
 
 //#region src/vendored/types.d.ts
@@ -549,7 +548,6 @@ interface WebTrustConfig {
   trustedPageAuthorities?: readonly string[];
   mobile?: {
     enabled?: boolean;
-    breakpoint?: number;
     swipeDistancePx?: number;
     dominanceRatio?: number;
     leftEdgeBandPx?: number;
@@ -617,10 +615,6 @@ declare const MASKED_TOOL_NAMES: ReadonlySet<string>;
  * bridges that read captured definitions.
  */
 declare const WIRE_MASKED_NAMES: ReadonlySet<string>;
-/** The `dashr:control-prompt` section order: the FIRST section in the 100–199 tool-guidance band, so the cell paradigm is taught before the Tool Catalog renders its signatures. */
-declare const CONTROL_SECTION_ORDER = 100;
-/** The `dashr:tool-catalog` section order: the 100–199 tool-guidance band's SDK position, matching upstream `tools:sdk`. */
-declare const SDK_SECTION_ORDER = 150;
 /**
  * The `dashr:escalation-guidance` CONTEXT order: sits inside the runtime-context snapshot
  * band between upstream `approval:policy` (115) and `subagent:delegation` (120) — the
@@ -671,7 +665,7 @@ declare module '@deepseek-ai/cordis' {
     /**
      * Allow a listener to replace content in the DURABLE LOG COPY of one
      * `eval` sub-dispatch outcome before the bridge appends its
-     * `tool/code-dispatch` event. `next()` keeps the content unchanged; a
+     * `tool/ptc-dispatch` event. `next()` keeps the content unchanged; a
      * listener may return replacement blocks (e.g. the spill policy's preview
      * + locator for an oversized text result). Scope-filtered dispatch
      * (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that
@@ -714,7 +708,7 @@ interface RunCellBridgeOptions {
  * in the module doc. Sub-calls ride the registry's exported staged scheduler
  * (`prepare`/`dispatch`/`finalize`/`finish`) under the native concurrency
  * contract; each sub-dispatch is logged for reconstruction
- * (`tool/code-dispatch-start` / `tool/code-dispatch`) while only the outer
+ * (`tool/ptc-dispatch-start` / `tool/ptc-dispatch`) while only the outer
  * curated result enters model history.
  * @param registry - the host tool registry (sub-calls go through its staged
  *   scheduler, bindings cover its registered tools).
@@ -722,17 +716,6 @@ interface RunCellBridgeOptions {
  * @returns the registry-ready definition.
  */
 declare function createRunCellTool(registry: ToolRuntime, options: RunCellBridgeOptions): ToolDefinition;
-/**
- * Collect one calling scope's bridge-declaration schemas through the
- * registry's public projection APIs: `schemas(scope)` for the model-facing
- * view (scoped tools join, restrictions apply — the wire mask is a
- * registry-level restriction installed at session-start, so every masked
- * name is ALREADY absent from this projection; no second name filter
- * exists to drift), `get(name, scope)` for the canonical output schema,
- * snapshotted so a live definition cannot mutate under the render. `eval`
- * itself is excluded — it is the transport, not a binding.
- */
-declare function collectSdkSchemas(registry: ToolRuntime, scope?: ScopeKey): DASHRSdkSchema[];
 declare function apply(ctx: Context, config: Config): void;
 declare const _default: {
   name: string;
@@ -741,4 +724,4 @@ declare const _default: {
   apply: typeof apply;
 };
 //#endregion
-export { CONTROL_SECTION_ORDER, Config, DASHRRunFailedError, DashrRuntime, ESCALATION_GUIDANCE_ORDER, EVAL_NAME, MASKED_TOOL_NAMES, ReplDispatchLog, ReplRuntime, RunCellBridgeOptions, type Config$1 as RuntimeConfig, SDK_SECTION_ORDER, WIRE_MASKED_NAMES, apply, collectSdkSchemas, createRunCellTool, _default as default, inject, name, resolveMaxParallelSubCalls };
+export { Config, DASHRRunFailedError, DashrRuntime, ESCALATION_GUIDANCE_ORDER, EVAL_NAME, MASKED_TOOL_NAMES, ReplDispatchLog, ReplRuntime, RunCellBridgeOptions, type Config$1 as RuntimeConfig, WIRE_MASKED_NAMES, apply, createRunCellTool, _default as default, inject, name, resolveMaxParallelSubCalls };