dsh-aris-panel 0.2.6 → 0.2.8

package/README.md

@@ -100,7 +100,7 @@ This overlay is **not** equivalent to the installed bundle: it cannot restore Co
 ## Known limits
 
 - **Tracks a Harness window, declared as a peer dependency.** DeepSeek Harness is a developer preview; this bundle declares `@deepseek-ai/dsh >=0.1.7-rc.2 <0.3.0-0` as an optional peer. The transport test passes against `0.2.0-rc.2`; the `HostConnectionFetch` registry it uses is present and identical in `0.1.7-rc.2`, so the range covers both. The `dsh` peer-dependency gate reads that range: an incompatible runtime skips the whole bundle with a line in the boot log instead of loading a panel whose transport may have moved. On a newer runtime, re-run `node node_modules/dsh-aris-panel/test/transport-smoke.mjs`, then widen the range, or grant the exact-version exemption with `dsh plugin allow-version`.
-- **The panel's browser transport is HTTP, not an RPC channel.** dsh's generic channel registry (`connection.rpc.handle`) resolves `webServer` from Connection's own context, which shipped dsh builds do not inject, so an out-of-tree channel registration throws and every call dies as HTTP 405 from the SPA fallback. ARIS mounts exact Fetch routes on the `/api` prefix instead (documented as `HostConnectionFetch.register`), which dsh already serves behind its Host/Origin fence and browser-session cookie. `test/transport-smoke.mjs` pins both halves of that contract against the installed dsh.
+- **The panel's browser transport is HTTP, not an RPC channel.** dsh's generic channel registry (`connection.rpc.handle`) resolves `webServer` from Connection's own context, which dsh `0.1.7-rc.2` and `0.2.0-rc.2` do not inject there, so an out-of-tree channel registration throws and every call dies as HTTP 405 from the SPA fallback. ARIS mounts exact Fetch routes on the `/api` prefix instead (documented as `HostConnectionFetch.register`), which dsh already serves behind its Host/Origin fence and browser-session cookie. `test/transport-smoke.mjs` pins both halves of that contract against the installed dsh; it cannot cover the carrier's own auth path, so verify a live host with `POST /api/aris-run` and `/api/aris-wb` — 400 means mounted, 404 means not.
 - **No dsh packages are declared as npm dependencies.** In-box packages are host-provided and resolve from the Harness installation through the profile module fallback. The Harness's own rule keeps `@deepseek-ai/dsh-*` out of `dependencies`, and the packages version in lockstep with the CLI, so any range this bundle pinned would fight the version the user already has installed. The peer range above is a compatibility declaration, marked optional so it never pulls a second copy of the runtime.
 - **`web_fetch` is off.** Stock dsh ships it disabled and this bundle does not enable it, which would mean depending on a provider package. Skills that reach the web use `web_search`, or `bash` with `curl`.
 - **Reviewer thread continuity is process-local.** A Harness restart, or any MCP reconnect that replaces the Codex child, loses saved `threadId`s. Rounds after that start fresh; `review-stage/REVIEWER_MEMORY.md` remains the durable record either way.

package/README_CN.md

@@ -81,7 +81,7 @@ ARIS_REPO=/absolute/path/to/aris NODE_USE_ENV_PROXY=1 \
 ## 已知限制
 
 - **跟随一个 Harness 版本窗口，并以 peerDependency 声明。** DeepSeek Harness 处于技术预览；本 bundle 把 `@deepseek-ai/dsh >=0.1.7-rc.2 <0.3.0-0` 声明为 optional peerDependency。传输层测试在 `0.2.0-rc.2` 上通过；它所用的 `HostConnectionFetch` 注册表在 `0.1.7-rc.2` 里存在且一致，所以该范围覆盖两者。dsh 的 peerDependency 门禁会读这个范围：不兼容的运行时会在启动日志里**整体跳过本 bundle**，而不是加载一个传输层可能已经变了的面板。升到更新版本后：先跑 `node node_modules/dsh-aris-panel/test/transport-smoke.mjs`，再放宽范围，或用 `dsh plugin allow-version` 授予精确版本豁免。
-- **面板的浏览器传输走 HTTP，不再走 RPC channel。** dsh 的通用 channel 注册表（`connection.rpc.handle`）是从 Connection 自己的上下文里解析 `webServer` 的，而发行版 dsh 并不注入它，于是树外插件的 channel 注册直接抛错，每次调用都变成 SPA 兜底返回的 HTTP 405。ARIS 改为在 `/api` 前缀上挂精确 Fetch 路由（即文档中的 `HostConnectionFetch.register`），dsh 本来就为 `/api` 提供了 Host/Origin 信任围栏与浏览器会话 Cookie。`test/transport-smoke.mjs` 针对已安装的 dsh 把这两半事实都钉住。
+- **面板的浏览器传输走 HTTP，不再走 RPC channel。** dsh 的通用 channel 注册表（`connection.rpc.handle`）是从 Connection 自己的上下文里解析 `webServer` 的，而 dsh `0.1.7-rc.2` / `0.2.0-rc.2` 并不在那里注入它，于是树外插件的 channel 注册直接抛错，每次调用都变成 SPA 兜底返回的 HTTP 405。ARIS 改为在 `/api` 前缀上挂精确 Fetch 路由（即文档中的 `HostConnectionFetch.register`），dsh 本来就为 `/api` 提供了 Host/Origin 信任围栏与浏览器会话 Cookie。`test/transport-smoke.mjs` 针对已安装的 dsh 钉住这两半契约；它覆盖不到载体自身的鉴权链路，所以请用真实 host 复核：`POST /api/aris-run` 与 `/api/aris-wb` —— 400 = 已挂载，404 = 未挂载。
 - **不把任何 dsh 包声明为 npm 依赖。** 内置包由宿主提供，通过 profile 的模块回退从 Harness 安装目录解析。Harness 自己的规约就要求 `@deepseek-ai/dsh-*` 不进 `dependencies`；而且这些子包与 CLI **锁步发版**，本 bundle 无论钉哪个范围，都会和用户已装的版本打架。上面的 peer 范围只是兼容性声明，且标为 optional，因此永远不会拉进第二份运行时副本。
 - **`web_fetch` 关闭。** 原版 dsh 默认关闭它，本 bundle 也不打开——打开就意味着依赖一个 provider 包。需要联网的技能改用 `web_search`，或用 `bash` 跑 `curl`。
 - **审稿线程连续性是进程内的。** Harness 重启、或任何一次 MCP 重连替换了 Codex 子进程，已保存的 `threadId` 都会失效，之后的轮次从新线程开始；无论如何 `review-stage/REVIEWER_MEMORY.md` 都是持久记录。

package/dsh/client.js

@@ -1009,7 +1009,7 @@ function ArisWorkbenchView(props) {
       setError(String(cause))
       setData(undefined)
     }).finally(function () { if (!silent) setBusy(false) })
-  }, [connection, sessionId])
+  }, [sessionId])
 
   React.useEffect(function () { load() }, [load])
 

package/dsh/http-rpc.mjs

@@ -3,21 +3,27 @@
  *
  * dsh exposes two registries on the Connection service:
  *
- *   - `connection.rpc`  — generic channel registry. Its `handle()` resolves
- *     `webServer` from the Connection service's own context, so it only works
- *     when the shipped `dsh-client-connection` declares `webServer` in its
- *     inject list. Shipped builds declare `credentials` only, so every
- *     out-of-tree `connection.rpc.handle()` throws
- *     `cannot get property "webServer" without inject`, the channel never
- *     mounts, and the browser sees HTTP 405 from the SPA fallback. Repairing
- *     that means editing dsh's own package, which every dsh upgrade reverts.
+ *   - `connection.rpc` — generic channel registry. `handle()` calls
+ *     `owner.webServer.register(route)` where `owner` is the Connection
+ *     service's own context, not the caller's: Cordis resolves a service's
+ *     methods against the context that constructed it, so injecting
+ *     `webServer` on the *consumer* does not help. In dsh `0.1.7-rc.2` and
+ *     `0.2.0-rc.2` that context injects `credentials` only while `webServer` is
+ *     provided by a sibling plugin fiber, so the lookup walks past the
+ *     provider to the root and throws `cannot get property "webServer" without
+ *     inject`. The channel then never mounts and the browser gets HTTP 405 from
+ *     the SPA fallback. Making that path work from outside means editing dsh's
+ *     own package (the workaround this package used until 0.2.6), which every
+ *     dsh upgrade reverts; a build whose Connection context does inject
+ *     `webServer` would not need it.
  *
  *   - `connection.fetch` — exact-path Fetch registry under `/api`
  *     (documented as `HostConnectionFetch.register(ConnectionFetchRoute)`).
- *     It touches no other service, and dsh serves the whole `/api` prefix
- *     behind its Host/Origin trust fence plus the browser-session cookie, so
- *     an ARIS route mounted here carries exactly the authority the RPC channel
- *     used to have.
+ *     Registration resolves nothing beyond the Connection service itself, so it
+ *     mounts under whatever Connection context the host provides. Serving is
+ *     dsh's own `/api` prefix route, which applies the Host/Origin trust fence
+ *     and the browser-session cookie before dispatching to any exact fetch
+ *     route — the same authority the RPC channel used to carry.
  *
  * ARIS therefore mounts one JSON endpoint per view on the Fetch registry. The
  * wire contract is deliberately tiny and mirrored in `dsh/client.js`:
@@ -26,10 +32,13 @@
  *   200           {"ok": true,  "value": unknown}
  *   200           {"ok": false, "error": {"code": string, "message": string}}
  *   400           malformed envelope
- *   405           non-POST method
  *
  * Application failures travel as HTTP 200 with `ok: false`, so the view shows
  * the handler's own message instead of a transport error.
+ *
+ * The route also answers 405 to a direct non-POST dispatch, but dsh's carrier
+ * only hands over methods the route declares, so a browser request with another
+ * method is answered 404 by the carrier before this handler runs.
  */
 
 /** Method set every ARIS endpoint accepts. */
@@ -112,8 +121,9 @@ export function httpRpcRoute(path, handler) {
  *
  * The caller supplies the effect and the injected services, because the two
  * ARIS views need different ones (`sessions` for both, `agents` and
- * `workspaceRegistry` for the workbench only). Registering touches no
- * `webServer` lookup, so it works on every shipped dsh build.
+ * `workspaceRegistry` for the workbench only). Registration resolves no
+ * `webServer`, which is what keeps the mount independent of the Connection
+ * context's inject list.
  *
  * @param ctx - the ARIS plugin context, which must have `connection` injected.
  * @param path - exact `/api/<segment>` route path the browser POSTs to.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-aris-panel",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "ARIS research-workflow skills + interactive workbench panel for DeepSeek Harness (user fork of dsh-aris: 83 skills, bundled upstream dsh-aris 0.1.1 payload, ppt-master PPTX backend for the talk pipeline, cross-model Codex review, idea/workflow launcher, research status board).",
   "license": "MIT",
   "type": "module",
@@ -8,7 +8,7 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "scripts": {
-    "test": "node test/transport-smoke.mjs"
+    "test": "node test/transport-smoke.mjs && node test/client-render-smoke.mjs"
   },
   "keywords": [
     "dsh-plugin",

package/test/client-render-smoke.mjs

@@ -0,0 +1,131 @@
+/**
+ * ARIS browser-half render smoke test.
+ *
+ *   node test/client-render-smoke.mjs
+ *
+ * Why this exists: `test/transport-smoke.mjs` proves the host half mounts, but
+ * dsh/client.js is only ever executed by a browser, so a client-side error
+ * (an undefined identifier left behind by a refactor, say) reaches the user as
+ * "the panel does not open" with no failing test. This file executes the real
+ * bundle in Node against a minimal React/element renderer and walks every
+ * returned component, so ReferenceErrors and typos in component bodies or hook
+ * dependency arrays fail here instead.
+ *
+ * It is deliberately a stub renderer, not React: components are called and
+ * their element trees walked, hooks run eagerly, and network calls are answered
+ * with empty payloads. That catches crashes, not behaviour.
+ */
+
+import { pathToFileURL } from 'node:url'
+
+let failures = 0
+function check(label, condition, detail) {
+  if (condition) {
+    console.log(`  PASS  ${label}`)
+    return
+  }
+  failures += 1
+  console.log(`  FAIL  ${label}${detail === undefined ? '' : ` — ${detail}`}`)
+}
+
+/** Collect anything a hook or effect throws instead of letting it escape. */
+const crashes = []
+process.on('unhandledRejection', (reason) => { crashes.push(reason) })
+
+console.log('\n1. the bundle loads the way dsh client-modules loads it')
+let registration
+let documentState
+{
+  const styleNodes = []
+  documentState = { styleNodes }
+  globalThis.window = {
+    __ModuleLoader__: {
+      load(module) { registration = module },
+    },
+  }
+  globalThis.document = {
+    createElement() {
+      const node = { textContent: '', removed: false, remove() { node.removed = true } }
+      styleNodes.push(node)
+      return node
+    },
+    head: { append() {} },
+  }
+  // The views answer every call with an empty successful payload.
+  globalThis.fetch = async () => ({ status: 200, json: async () => ({ ok: true, value: {} }) })
+
+  await import(new URL('../dsh/client.js', import.meta.url).href)
+  check('the bundle registers one module', registration !== undefined && registration.id === 'dsh-aris-panel',
+    registration === undefined ? 'window.__ModuleLoader__.load was never called' : String(registration.id))
+}
+
+console.log('\n2. every component renders without crashing')
+let rendered
+{
+  /** Minimal React: enough for createElement + the hooks this bundle uses. */
+  const React = {
+    createElement(type, props, ...children) {
+      return { type, props: { ...(props ?? {}), children: children.flat() } }
+    },
+    useState(initial) { return [typeof initial === 'function' ? initial() : initial, () => {}] },
+    useEffect(run) { run() },
+    useCallback(fn) { return fn },
+    useRef(value) { return { current: value } },
+  }
+  const requireStub = (name) => {
+    if (name === 'react') return React
+    throw new Error(`client bundle required an unexpected module: ${name}`)
+  }
+
+  const plugin = registration.factory(requireStub)
+  check('the factory returns a plugin with an inject list', Array.isArray(plugin.inject), JSON.stringify(plugin.inject))
+  check('the plugin declares the slot service', plugin.inject.includes('slots'))
+
+  let render
+  const ctx = {
+    connection: {},
+    effect(run) { return run() },
+    slots: {
+      inject(name, registerCall) {
+        check('the plugin injects the conversation view slot', name === 'conversation.view', name)
+        registerCall()
+      },
+      register(spec, renderCall) {
+        check('the ARIS slot registers itself', spec.id === 'aris' && spec.name === 'conversation.view', JSON.stringify(spec))
+        render = renderCall
+      },
+    },
+  }
+  plugin.apply(ctx)
+  check('the slot exposes a render function', typeof render === 'function')
+
+  /** Call function components and walk host elements, like React would. */
+  let elements = 0
+  const walk = (node, depth = 0) => {
+    if (node === null || node === undefined || typeof node === 'boolean' || typeof node === 'string' || typeof node === 'number') return
+    if (Array.isArray(node)) { for (const child of node) walk(child, depth); return }
+    if (depth > 40) throw new Error('render tree did not settle')
+    elements += 1
+    if (typeof node.type === 'function') { walk(node.type(node.props ?? {}), depth + 1); return }
+    walk(node.props?.children, depth + 1)
+  }
+
+  try {
+    rendered = render({ sessionId: 'render-smoke', openView: undefined })
+    walk(rendered)
+    check('the ARIS tab renders a tree', elements > 5, `${elements} elements`)
+  } catch (error) {
+    check('the ARIS tab renders a tree', false, `${error.name}: ${error.message}`)
+  }
+}
+
+console.log('\n3. the stylesheet effect is wired')
+check('one style node was created', documentState.styleNodes.length === 1, String(documentState.styleNodes.length))
+
+const asyncCrashes = crashes.filter((reason) => reason !== undefined)
+check('no asynchronous crash escaped the views', asyncCrashes.length === 0, asyncCrashes.map(String).join('; '))
+check('the module left no uncaught error', rendered !== undefined)
+
+console.log(failures === 0 ? '\nOK — the browser half renders' : `\n${failures} check(s) failed`)
+await new Promise((resolve) => setTimeout(resolve, 20))
+process.exit(failures === 0 && crashes.length === 0 ? 0 : 1)

package/test/transport-smoke.mjs

@@ -9,15 +9,23 @@
  * It pins the two facts this package's transport choice rests on:
  *
  *   1. `connection.rpc.handle()` cannot mount a channel from an out-of-tree
- *      plugin on a shipped dsh build. `HostConnectionService.register()`
- *      resolves `webServer` from Connection's own context, and the shipped
- *      build injects `credentials` only, so the lookup walks past the plugin
- *      that provides it and throws. The channel then never mounts, and the
- *      browser gets HTTP 405 from the SPA fallback (the failure this package
- *      used to work around by editing dsh's own node_modules).
+ *      plugin against dsh `0.1.7-rc.2` / `0.2.0-rc.2`. `HostConnectionService
+ *      .register()` resolves `webServer` from Connection's own context, and
+ *      those builds inject `credentials` only, so the lookup walks past the
+ *      plugin that provides it and throws. The channel then never mounts, and
+ *      the browser gets HTTP 405 from the SPA fallback (the failure this
+ *      package used to work around by editing dsh's own node_modules).
  *   2. The Connection Fetch registry route this package uses instead mounts
  *      without any `webServer` lookup and round-trips every envelope shape the
- *      views depend on.
+ *      views depend on, including both real view registrations.
+ *
+ * What this test deliberately does NOT cover: the shipped Connection plugin's
+ * own `apply()` (so `/api` prefix mounting, the Host/Origin fence, cookie auth
+ * and the node↔fetch body bridge are assumed, not exercised), the browser half
+ * (`dsh/client.js` is never executed here), and effect disposal/reload. Those
+ * need a live host: POST `/api/aris-run` and `/api/aris-wb` with an
+ * authenticated browser session after a restart — 400 means the route is
+ * mounted and the envelope was rejected, 404 means it never mounted.
  *
  * Set DSH_ROOT to test another install.
  */
@@ -54,6 +62,8 @@ const cordisEntry = requireFromConnection.resolve('@deepseek-ai/cordis')
 const { Context } = await import(pathToFileURL(cordisEntry).href)
 const { HostConnectionService, API_PATH } = await import(pathToFileURL(connectionEntry).href)
 const { httpRpcRoute, registerHttpRpc } = await import(new URL('../dsh/http-rpc.mjs', import.meta.url).href)
+const { registerWorkbench } = await import(new URL('../dsh/workbench.mjs', import.meta.url).href)
+const { registerRunStatus } = await import(new URL('../dsh/run-status.mjs', import.meta.url).href)
 
 let failures = 0
 function check(label, condition, detail) {
@@ -198,6 +208,58 @@ console.log('\n2. the Fetch registry route ARIS mounts instead')
 
   const unknownPath = await handler.fetch(new Request('http://dsh.internal/api/not-aris', { method: 'POST' }))
   check('an unclaimed /api path is HTTP 404', unknownPath.status === 404)
+
+  console.log('\n3. the real ARIS view registrations, over the real carrier')
+  // The host halves inject these; stubs are enough because registration only
+  // stores a handler, and the two endpoints below read workspace state lazily.
+  await root.plugin({
+    name: 'fake-session-services',
+    apply(ctx) {
+      ctx.provide('sessions', { get: () => undefined })
+      ctx.provide('agents', { create: async () => undefined })
+      ctx.provide('workspaceRegistry', {})
+      ctx.provide('sessionPersistence', {})
+    },
+  })
+  await root.plugin({
+    name: 'aris-views',
+    apply(ctx) {
+      registerWorkbench(ctx)
+      registerRunStatus(ctx)
+    },
+  })
+
+  const view = (path, body) => handler.fetch(new Request('http://dsh.internal' + path, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  }))
+  // A nested `ctx.inject(...)` fiber activates asynchronously; a 400 (envelope
+  // rejected) means the route exists, a 404 means it never mounted.
+  const waitsForRoute = async (path) => {
+    const deadline = Date.now() + 3000
+    while (Date.now() < deadline) {
+      const probe = await view(path, {})
+      if (probe.status !== 404) return true
+      await new Promise(resolve => setTimeout(resolve, 25))
+    }
+    return false
+  }
+  check('/api/aris-wb mounts through the real registerWorkbench()', await waitsForRoute('/api/aris-wb'))
+  check('/api/aris-run mounts through the real registerRunStatus()', await waitsForRoute('/api/aris-run'))
+
+  const skills = await (await view('/api/aris-wb', { endpoint: 'skills', payload: {} })).json()
+  check('the workbench skills endpoint answers over HTTP',
+    skills.ok === true && Array.isArray(skills.value.skills) && skills.value.skills.length > 20,
+    JSON.stringify(skills).slice(0, 200))
+
+  const state = await (await view('/api/aris-run', { endpoint: 'state', payload: { sessionId: 'no-such-session' } })).json()
+  check('the run-status endpoint answers over HTTP',
+    state.ok === true && Array.isArray(state.value.artifacts), JSON.stringify(state).slice(0, 200))
+
+  const unknown = await (await view('/api/aris-run', { endpoint: 'nope', payload: {} })).json()
+  check('an unknown endpoint reports through the envelope',
+    unknown.ok === false && unknown.error.code === 'UNKNOWN_ENDPOINT', JSON.stringify(unknown).slice(0, 200))
 }
 
 console.log(failures === 0 ? '\nOK — transport contract holds' : `\n${failures} check(s) failed`)