dsh-as-aistudio 0.5.8 → 0.5.10

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ## 中文
 
+**0.5.10** —— 开机扫描不再把宿主按住（会话列表变空的那个 bug）。
+
+- 整轮扫描搬进 worker（`src/vendor/host/dsh-log-trim.worker.mjs`），主线程只等一份摘要。本机实测：162 个会话、12 个大会话，旧版按住事件循环 **117 秒**，新版全程最大停顿 **43 ms**。
+- 解压/压缩分片让出事件循环（`readLogAsync` / `encodeLogAsync`），会话之间也 `setImmediate` 一次。
+- 修 `keepLastWindows` 的两处浪费：`events.find()` 套在可见事件的 `map` 里是 O(n²)；被裁掉的事件也照样 `structuredClone` 了一遍。18 MB 日志 6.3 s → 1.6 s。
+- 开机扫描延后 3 秒再起，把首屏让开。
+
+**0.5.9** —— 修复内嵌 dsh-log-trim 的校验器副本缺失。
+
+- `dsh-log-trim.js` / `lossless.js` 动态导入 `dsh-log-trim.vendor.verify-session-log.mjs`，但 0.5.8 只带了一份 `dsh-log-trim.verify-session-log.mjs`（少了 `.vendor.`），且那份内部还指向不存在的 `dsh-log-trim.compact-session.mjs`。任何走到「裁剪前用宿主校验器验日志」的路径都会抛 `Cannot find module`，表现为扫描失败、`last:null`。现在补齐命名正确的副本，并对齐两份文件内部的相对导入。
+- 新增 `test/vendor-imports.test.js`：扫描 `src/vendor/host/` 下全部相对导入，发布前拦住悬空引用。
+
 **0.5.8** —— 跟进 dsh-log-trim 0.6.1（扫描崩溃修复、`/run` 后台执行）。
 
 **0.5.7** —— 跟进 dsh-delete-turn 0.2.4（多选条「取消」）。
@@ -137,6 +149,18 @@
 
 ## English
 
+**0.5.10** — the boot scan no longer freezes the host (the bug that left the session list empty).
+
+- The whole scan now runs in a worker (`src/vendor/host/dsh-log-trim.worker.mjs`); the main thread only receives a summary. Measured here: 162 sessions with 12 large ones went from **117 s of blocked event loop** to a **43 ms worst stall**.
+- Decompression, parsing and re-compression yield between slices (`readLogAsync` / `encodeLogAsync`), and between sessions.
+- Two wasteful passes in `keepLastWindows`: `events.find()` inside a map over visible events was O(n²), and events that were about to be dropped were still `structuredClone`d. 18 MB log: 6.3 s → 1.6 s.
+- The boot scan starts 3 s after mount so the first screen loads first.
+
+**0.5.9** — fix a missing vendored verifier.
+
+- `dsh-log-trim.js` / `lossless.js` dynamically import `dsh-log-trim.vendor.verify-session-log.mjs`, but 0.5.8 shipped only `dsh-log-trim.verify-session-log.mjs`, whose own import pointed at a non-existent `dsh-log-trim.compact-session.mjs`. Any trim reaching pre-write verification threw `Cannot find module`. Both names now exist and every internal import resolves.
+- New `test/vendor-imports.test.js` scans all relative imports under `src/vendor/host/` so a dangling copy cannot ship again.
+
 **0.3.0** — the settings page moved to this plugin's own row, and the component cards are the components' own.
 
 - **A row surface instead of a settings tab**: registered under `plugins.row.config` with the `dsh-as-aistudio#dsh-as-aistudio` key (`<package name>#<row id>`), so OUR row in the plugin manager gains the configure arrow every other plugin in this profile already has.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 DDDMUC
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 DDDMUC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,124 +1,124 @@
-# dsh-as-aistudio
-
-**把 DeepSeek Harness 用成 Google AI Studio —— 一轮对话就是一个可以反复打磨的 prompt playground，而且插件列表里只占一行。** 改一句提示词并重跑、原位重跑某条回复、把不该留下的那一轮从模型上下文里删掉、让发出的提示词按 Markdown 渲染。
-
-[中文](#中文) · [English](#english)
-
----
-
-## 中文
-
-### 为什么需要它
-
-AI Studio 的好用之处不在模型，在于一轮对话中的每一步都能回头改。DSH 官方只提供整段压缩（/compact），没有轮次级的编辑、重跑与删除。
-
-五个组件（四个动作 + 一个维护）补上了这一层，而这个包负责让它们装得下、合得来、看得见：
-
-- **装得下** —— 自包含安装，一次装完；
-- **合得来** —— 五个组件各自独立、任意子集共存，互操作契约由本包固化并测试；
-- **看得见** —— 设置 → 插件 → AI Studio 面板如实报告哪几个真的活着。
-
-### 特性
-
-- **一行搞定** —— 插件列表里只有 AI Studio 一行。五个组件的**界面与后台都内置在本包里**，由本包的五个补丁行 `dsh-as-aistudio/edit` 等挂载（详情页因此能列出这 5 个组件），不再各自占一行。**装本包不会再装任何别的东西。**
-- **组件仍是独立包** —— 每个都有自己的仓库与 cordis.patch.yml，单独安装照样工作；本包不复制任何组件逻辑：宿主半侧（路由、回滚、重放）就是组件自己，浏览器 factory 由 tools/vendor.mjs 从组件源码逐字剥离生成。
-- **副本不会漂移** —— npm run vendor 重新生成内联包，npm run build 重新生成大 bundle，verify:vendor / verify:build 是只读校验；测试里 vendor-sync / build-sync 会在副本过期时失败。
-- **一个挂了不影响其余** —— 五个 vendored factory 各自带 guard 挂载，一个抛错不会带走另外四个。
-- **互操作契约可验证** —— slot order 分配、行隐藏归属、兄弟探测协议写在 docs/INTEROP.md，并由组合矩阵测试断言。
-- **web 与桌面端同构** —— 同一份 dsh.client.platform: web bundle；没有 location.origin / window.open / navigator.* / dialog / popover。
-
-### 安装
-
-```sh
-dsh plugin --profile web add dsh-as-aistudio
-```
-
-桌面端把 --profile web 换成 --profile desktop。五个组件已经内置在本包里，不需要再装任何东西。
-
-### 使用
-
-装好后动作条就在消息行上：
-
-1. 悬停你发出的那条消息 → 铅笔（编辑并重跑）；
-2. 悬停模型的回复 → 重跑 / 删除；
-3. 设置 → 插件 多出一个 AI Studio 标签页，列出每个组件的实时状态、版本、占用的槽位，以及互操作契约分配表。
-
-### 工作原理
-
-- **五个组件行**（cordis.patch.yml + src/shell.js）：每个组件一条 `dsh-as-aistudio/<后缀>` 行，行名经本包 `exports` 全部指向同一个壳文件，壳读行配置里的 `config.plugin` 并 `import` + `ctx.plugin` 挂真正的组件包 —— 组件的 loopback 路由与回滚/重放服务因此就位。缺哪个报哪个，绝不致命；宿主半侧自己一个组件都不挂（再挂一次就是挂两遍，路由必冲突）。
-- **浏览器半侧**（src/client.js，由 tools/build.mjs 生成）：单一大 bundle —— studio 自己的浏览器半侧 + 五个组件的 factory（各自 var module / var exports / const react，靠 var 提升共处一个 scope）。bundle 是按 Loader 行下发的，所以这是它们到达页面的唯一方式。
-- **为什么宿主半侧不内联**：宿主代码对插件列表不可见，复制它只会凭空多出一份要维护的东西。
-- **状态面板**：读 GET /api/dsh-as-aistudio/status，对每个组件报告 installed / hostMounted / version / ownRows（ownRows 大于 0 表示它还被独立安装着）。hostMounted 不是自报，是从 Loader 读那一条行的 fiber 状态（只有 state === 2 才算活着），所以关掉的行、没装好的包、起失败的组件都会如实显示成因。
-- **挂载门**：浏览器半侧挂载前先读一次这道状态，只画 hostMounted 为真的组件 —— 宿主没挂起来就没有路由，按钮画出来也点不动。宿主答不上来时按「未知」处理，五个都挂（保持旧行为）。
-
-### 已知限制
-
-- 五个组件的 browser factory 是生成副本。改了组件必须 npm run vendor && npm run build 再发本包；verify:vendor / verify:build 会拦住过期副本。
-- 组件被关掉（插件页里把 `dsh-as-aistudio/<组件>` 那行停用）时，它的界面与后台都不挂载，面板显示「已安装，宿主未挂载」。
-- 宿主版本常量只在进程启动时读一次：改了本包要重启宿主 + 硬刷新。
-
-### 兼容性
-
-- DSH >=0.1.6-alpha.2（0.2.0-rc.1 实测通过）；
-- profile：web、desktop；
-- 五个组件都可单独安装，也可以任意子集和本包共存。
-
-### License
-
-MIT
-
----
-
-## English
-
-### Why you need it
-
-What makes AI Studio pleasant is not the model: it is that every step of a turn can be revisited. DSH offers whole-transcript compaction only. Four components add turn-level edit, re-run and delete; this package makes them installable, compatible and visible.
-
-### Features
-
-- **One row** — the plugin list shows only AI Studio. Both halves of the five components travel inside this package and are mounted by its five patch rows (`dsh-as-aistudio/edit` and friends, which is why the detail page can list all five). Installing the studio installs nothing else.
-- **Components stay independent packages** — each keeps its own repo and its own cordis.patch.yml and works alone. This package copies no component logic: the host halves ARE the components, and the browser factories are lifted verbatim from their sources by tools/vendor.mjs.
-- **The vendored copy cannot drift** — npm run vendor regenerates it, npm run build regenerates the bundle, and verify:vendor / verify:build are read-only gates; the test suite fails on a stale copy.
-- **One failure does not take the rest** — each vendored factory mounts behind its own guard.
-- **A verifiable interop contract** — slot orders, row-hide ownership and the sibling probe protocol live in docs/INTEROP.md and are asserted by the combination matrix.
-- **Web and desktop are one implementation** — the same dsh.client.platform: web bundle; no location.origin, window.open, navigator.*, dialog or popover.
-
-### Install
-
-```sh
-dsh plugin --profile web add dsh-as-aistudio
-```
-
-Use --profile desktop on the desktop app. The five components are already inside this package; there is nothing else to install.
-
-### Usage
-
-1. Hover a message you sent → the pencil (edit and re-run);
-2. Hover a model reply → re-run / delete;
-3. Settings → Plugins gains an AI Studio tab listing each component's live state, version, the slot it claims, and the interop allocation.
-
-### How it works
-
-- **The five component rows** (cordis.patch.yml + src/shell.js): one row per component, named `dsh-as-aistudio/<suffix>`; every one of those names maps through this package's exports to the same shell, which reads `config.plugin` from the row and imports + applies the real component package — that is what puts its loopback routes and its rollback / replay services in place. A missing one is reported, never fatal. The host half itself mounts nothing: mounting here too would run every component twice and collide on its routes.
-- **Browser half** (src/client.js, generated by tools/build.mjs): one bundle — the studio's own browser half plus the four component factories, each with its own var module / var exports / const react in one scope via hoisting. A bundle is served per Loader row, so this is the only way they can reach the page.
-- **Why the host halves are not vendored**: host code is invisible to the plugin list, so copying it would only create a second thing to fix.
-- **The panel** reads GET /api/dsh-as-aistudio/status and reports installed / hostMounted / version / ownRows per component (ownRows greater than 0 means it is also installed standalone). hostMounted is not self-reported: it is read from the Loader row's fiber state (only state === 2 counts as live), so a disabled row, a missing package and a failed start each show their own reason.
-- **The mount gate**: before mounting anything, the browser half reads that status once and draws only the components it calls mounted — a component whose host half is not up has no routes, so its buttons would do nothing. A host that cannot answer is treated as unknown and all five mount, which is the pre-gate behaviour.
-
-### Known limitations
-
-- The five browser factories are a generated copy. After changing a component, run npm run vendor && npm run build before releasing this package; the verify gates block a stale copy.
-- A component that is somehow absent is not mounted and the panel says so.
-- The host version constant is read once at process start: after changing this package, restart the host and hard-refresh.
-
-### Compatibility
-
-- DSH >=0.1.6-alpha.2 (verified on 0.2.0-rc.1);
-- Profiles: web, desktop;
-- Every component installs alone, and any subset coexists with this package.
-
-### License
-
-MIT
-
+# dsh-as-aistudio
+
+**把 DeepSeek Harness 用成 Google AI Studio —— 一轮对话就是一个可以反复打磨的 prompt playground，而且插件列表里只占一行。** 改一句提示词并重跑、原位重跑某条回复、把不该留下的那一轮从模型上下文里删掉、让发出的提示词按 Markdown 渲染。
+
+[中文](#中文) · [English](#english)
+
+---
+
+## 中文
+
+### 为什么需要它
+
+AI Studio 的好用之处不在模型，在于一轮对话中的每一步都能回头改。DSH 官方只提供整段压缩（/compact），没有轮次级的编辑、重跑与删除。
+
+五个组件（四个动作 + 一个维护）补上了这一层，而这个包负责让它们装得下、合得来、看得见：
+
+- **装得下** —— 自包含安装，一次装完；
+- **合得来** —— 五个组件各自独立、任意子集共存，互操作契约由本包固化并测试；
+- **看得见** —— 设置 → 插件 → AI Studio 面板如实报告哪几个真的活着。
+
+### 特性
+
+- **一行搞定** —— 插件列表里只有 AI Studio 一行。五个组件的**界面与后台都内置在本包里**，由本包的五个补丁行 `dsh-as-aistudio/edit` 等挂载（详情页因此能列出这 5 个组件），不再各自占一行。**装本包不会再装任何别的东西。**
+- **组件仍是独立包** —— 每个都有自己的仓库与 cordis.patch.yml，单独安装照样工作；本包不复制任何组件逻辑：宿主半侧（路由、回滚、重放）就是组件自己，浏览器 factory 由 tools/vendor.mjs 从组件源码逐字剥离生成。
+- **副本不会漂移** —— npm run vendor 重新生成内联包，npm run build 重新生成大 bundle，verify:vendor / verify:build 是只读校验；测试里 vendor-sync / build-sync 会在副本过期时失败。
+- **一个挂了不影响其余** —— 五个 vendored factory 各自带 guard 挂载，一个抛错不会带走另外四个。
+- **互操作契约可验证** —— slot order 分配、行隐藏归属、兄弟探测协议写在 docs/INTEROP.md，并由组合矩阵测试断言。
+- **web 与桌面端同构** —— 同一份 dsh.client.platform: web bundle；没有 location.origin / window.open / navigator.* / dialog / popover。
+
+### 安装
+
+```sh
+dsh plugin --profile web add dsh-as-aistudio
+```
+
+桌面端把 --profile web 换成 --profile desktop。五个组件已经内置在本包里，不需要再装任何东西。
+
+### 使用
+
+装好后动作条就在消息行上：
+
+1. 悬停你发出的那条消息 → 铅笔（编辑并重跑）；
+2. 悬停模型的回复 → 重跑 / 删除；
+3. 设置 → 插件 多出一个 AI Studio 标签页，列出每个组件的实时状态、版本、占用的槽位，以及互操作契约分配表。
+
+### 工作原理
+
+- **五个组件行**（cordis.patch.yml + src/shell.js）：每个组件一条 `dsh-as-aistudio/<后缀>` 行，行名经本包 `exports` 全部指向同一个壳文件，壳读行配置里的 `config.plugin` 并 `import` + `ctx.plugin` 挂真正的组件包 —— 组件的 loopback 路由与回滚/重放服务因此就位。缺哪个报哪个，绝不致命；宿主半侧自己一个组件都不挂（再挂一次就是挂两遍，路由必冲突）。
+- **浏览器半侧**（src/client.js，由 tools/build.mjs 生成）：单一大 bundle —— studio 自己的浏览器半侧 + 五个组件的 factory（各自 var module / var exports / const react，靠 var 提升共处一个 scope）。bundle 是按 Loader 行下发的，所以这是它们到达页面的唯一方式。
+- **为什么宿主半侧不内联**：宿主代码对插件列表不可见，复制它只会凭空多出一份要维护的东西。
+- **状态面板**：读 GET /api/dsh-as-aistudio/status，对每个组件报告 installed / hostMounted / version / ownRows（ownRows 大于 0 表示它还被独立安装着）。hostMounted 不是自报，是从 Loader 读那一条行的 fiber 状态（只有 state === 2 才算活着），所以关掉的行、没装好的包、起失败的组件都会如实显示成因。
+- **挂载门**：浏览器半侧挂载前先读一次这道状态，只画 hostMounted 为真的组件 —— 宿主没挂起来就没有路由，按钮画出来也点不动。宿主答不上来时按「未知」处理，五个都挂（保持旧行为）。
+
+### 已知限制
+
+- 五个组件的 browser factory 是生成副本。改了组件必须 npm run vendor && npm run build 再发本包；verify:vendor / verify:build 会拦住过期副本。
+- 组件被关掉（插件页里把 `dsh-as-aistudio/<组件>` 那行停用）时，它的界面与后台都不挂载，面板显示「已安装，宿主未挂载」。
+- 宿主版本常量只在进程启动时读一次：改了本包要重启宿主 + 硬刷新。
+
+### 兼容性
+
+- DSH >=0.1.6-alpha.2（0.2.0-rc.1 实测通过）；
+- profile：web、desktop；
+- 五个组件都可单独安装，也可以任意子集和本包共存。
+
+### License
+
+MIT
+
+---
+
+## English
+
+### Why you need it
+
+What makes AI Studio pleasant is not the model: it is that every step of a turn can be revisited. DSH offers whole-transcript compaction only. Four components add turn-level edit, re-run and delete; this package makes them installable, compatible and visible.
+
+### Features
+
+- **One row** — the plugin list shows only AI Studio. Both halves of the five components travel inside this package and are mounted by its five patch rows (`dsh-as-aistudio/edit` and friends, which is why the detail page can list all five). Installing the studio installs nothing else.
+- **Components stay independent packages** — each keeps its own repo and its own cordis.patch.yml and works alone. This package copies no component logic: the host halves ARE the components, and the browser factories are lifted verbatim from their sources by tools/vendor.mjs.
+- **The vendored copy cannot drift** — npm run vendor regenerates it, npm run build regenerates the bundle, and verify:vendor / verify:build are read-only gates; the test suite fails on a stale copy.
+- **One failure does not take the rest** — each vendored factory mounts behind its own guard.
+- **A verifiable interop contract** — slot orders, row-hide ownership and the sibling probe protocol live in docs/INTEROP.md and are asserted by the combination matrix.
+- **Web and desktop are one implementation** — the same dsh.client.platform: web bundle; no location.origin, window.open, navigator.*, dialog or popover.
+
+### Install
+
+```sh
+dsh plugin --profile web add dsh-as-aistudio
+```
+
+Use --profile desktop on the desktop app. The five components are already inside this package; there is nothing else to install.
+
+### Usage
+
+1. Hover a message you sent → the pencil (edit and re-run);
+2. Hover a model reply → re-run / delete;
+3. Settings → Plugins gains an AI Studio tab listing each component's live state, version, the slot it claims, and the interop allocation.
+
+### How it works
+
+- **The five component rows** (cordis.patch.yml + src/shell.js): one row per component, named `dsh-as-aistudio/<suffix>`; every one of those names maps through this package's exports to the same shell, which reads `config.plugin` from the row and imports + applies the real component package — that is what puts its loopback routes and its rollback / replay services in place. A missing one is reported, never fatal. The host half itself mounts nothing: mounting here too would run every component twice and collide on its routes.
+- **Browser half** (src/client.js, generated by tools/build.mjs): one bundle — the studio's own browser half plus the four component factories, each with its own var module / var exports / const react in one scope via hoisting. A bundle is served per Loader row, so this is the only way they can reach the page.
+- **Why the host halves are not vendored**: host code is invisible to the plugin list, so copying it would only create a second thing to fix.
+- **The panel** reads GET /api/dsh-as-aistudio/status and reports installed / hostMounted / version / ownRows per component (ownRows greater than 0 means it is also installed standalone). hostMounted is not self-reported: it is read from the Loader row's fiber state (only state === 2 counts as live), so a disabled row, a missing package and a failed start each show their own reason.
+- **The mount gate**: before mounting anything, the browser half reads that status once and draws only the components it calls mounted — a component whose host half is not up has no routes, so its buttons would do nothing. A host that cannot answer is treated as unknown and all five mount, which is the pre-gate behaviour.
+
+### Known limitations
+
+- The five browser factories are a generated copy. After changing a component, run npm run vendor && npm run build before releasing this package; the verify gates block a stale copy.
+- A component that is somehow absent is not mounted and the panel says so.
+- The host version constant is read once at process start: after changing this package, restart the host and hard-refresh.
+
+### Compatibility
+
+- DSH >=0.1.6-alpha.2 (verified on 0.2.0-rc.1);
+- Profiles: web, desktop;
+- Every component installs alone, and any subset coexists with this package.
+
+### License
+
+MIT
+

package/cordis.patch.yml

@@ -1,66 +1,66 @@
-# dsh-as-aistudio bundle patch: the AI Studio composition, ONE row in the plugin list.
-#
-# Self-contained: the plugin list shows exactly this package. The four components
-# are ordinary npm dependencies of this package (see package.json), not profile
-# bundles, so they have no rows of their own and never appear in that list.
-#
-# Five rows are inserted here, and they are what "包含的组件" lists:
-#
-#   1. this package's own row. Its name is the BARE package name on purpose: the
-#      client-module scanner treats an exact package specifier as a package and
-#      resolves <name>/package.json for the dsh.client declaration. That is the
-#      row the single browser bundle (src/client.js, which carries the studio's
-#      own half and all four vendored component factories) is served for.
-#
-#   2-5. one row per component, named <this package>/<suffix>. Every one of those
-#      names resolves through package.json exports to src/shell.js, and the shell
-#      mounts the component named in config.plugin. Two properties ride on that
-#      name, both load-bearing:
-#
-#        * the plugin list is a deduplicated set of package identities, and a
-#          subpath of this package resolves to this package's identity - so the
-#          four extra rows cost exactly zero extra rows in that list;
-#        * the client-module scanner accepts only an exact package specifier, so a
-#          subpath row never becomes a second browser source. The components'
-#          browser halves keep travelling inside this package's bundle, and the
-#          scanner's negative verdict for these specifiers is what keeps the boot
-#          graph from growing a second entry per component.
-#
-# The component host halves (loopback routes, rollback / replay services) are not
-# copied anywhere: each row imports the real package, so host logic stays in the
-# components and there is exactly one copy of it. Each component also keeps its
-# own cordis.patch.yml, so installing one standalone mounts it through its own
-# row.
-#
-# A component that is not installed is not fatal: every row fails in isolation
-# (the Loader reports the missing module and the other entries still start), and
-# /api/dsh-as-aistudio/status reports hostMounted: false with the reason - which
-# is also what keeps its buttons off the page.
-- insert:
-    - id: dsh-as-aistudio
-      name: 'dsh-as-aistudio'
-- insert:
-    - id: dsh-as-aistudio-edit
-      name: 'dsh-as-aistudio/edit'
-      config:
-        plugin: 'dsh-edit-turn'
-- insert:
-    - id: dsh-as-aistudio-rerun
-      name: 'dsh-as-aistudio/rerun'
-      config:
-        plugin: 'dsh-rerun-turn'
-- insert:
-    - id: dsh-as-aistudio-delete
-      name: 'dsh-as-aistudio/delete'
-      config:
-        plugin: 'dsh-delete-turn'
-- insert:
-    - id: dsh-as-aistudio-markdown
-      name: 'dsh-as-aistudio/markdown'
-      config:
-        plugin: 'dsh-markdown-bubble'
-- insert:
-    - id: dsh-as-aistudio-trim
-      name: 'dsh-as-aistudio/trim'
-      config:
-        plugin: 'dsh-log-trim'
+# dsh-as-aistudio bundle patch: the AI Studio composition, ONE row in the plugin list.
+#
+# Self-contained: the plugin list shows exactly this package. The four components
+# are ordinary npm dependencies of this package (see package.json), not profile
+# bundles, so they have no rows of their own and never appear in that list.
+#
+# Five rows are inserted here, and they are what "包含的组件" lists:
+#
+#   1. this package's own row. Its name is the BARE package name on purpose: the
+#      client-module scanner treats an exact package specifier as a package and
+#      resolves <name>/package.json for the dsh.client declaration. That is the
+#      row the single browser bundle (src/client.js, which carries the studio's
+#      own half and all four vendored component factories) is served for.
+#
+#   2-5. one row per component, named <this package>/<suffix>. Every one of those
+#      names resolves through package.json exports to src/shell.js, and the shell
+#      mounts the component named in config.plugin. Two properties ride on that
+#      name, both load-bearing:
+#
+#        * the plugin list is a deduplicated set of package identities, and a
+#          subpath of this package resolves to this package's identity - so the
+#          four extra rows cost exactly zero extra rows in that list;
+#        * the client-module scanner accepts only an exact package specifier, so a
+#          subpath row never becomes a second browser source. The components'
+#          browser halves keep travelling inside this package's bundle, and the
+#          scanner's negative verdict for these specifiers is what keeps the boot
+#          graph from growing a second entry per component.
+#
+# The component host halves (loopback routes, rollback / replay services) are not
+# copied anywhere: each row imports the real package, so host logic stays in the
+# components and there is exactly one copy of it. Each component also keeps its
+# own cordis.patch.yml, so installing one standalone mounts it through its own
+# row.
+#
+# A component that is not installed is not fatal: every row fails in isolation
+# (the Loader reports the missing module and the other entries still start), and
+# /api/dsh-as-aistudio/status reports hostMounted: false with the reason - which
+# is also what keeps its buttons off the page.
+- insert:
+    - id: dsh-as-aistudio
+      name: 'dsh-as-aistudio'
+- insert:
+    - id: dsh-as-aistudio-edit
+      name: 'dsh-as-aistudio/edit'
+      config:
+        plugin: 'dsh-edit-turn'
+- insert:
+    - id: dsh-as-aistudio-rerun
+      name: 'dsh-as-aistudio/rerun'
+      config:
+        plugin: 'dsh-rerun-turn'
+- insert:
+    - id: dsh-as-aistudio-delete
+      name: 'dsh-as-aistudio/delete'
+      config:
+        plugin: 'dsh-delete-turn'
+- insert:
+    - id: dsh-as-aistudio-markdown
+      name: 'dsh-as-aistudio/markdown'
+      config:
+        plugin: 'dsh-markdown-bubble'
+- insert:
+    - id: dsh-as-aistudio-trim
+      name: 'dsh-as-aistudio/trim'
+      config:
+        plugin: 'dsh-log-trim'