dsh-claude-style 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to `dsh-claude-style` are documented here, newest first.
 
+## [0.6.1] - 2026-09-24
+
+[中文](#cn-0.6.1) | [English](#en-0.6.1)
+
+<h3 id="cn-0.6.1">新增功能</h3>
+
+- **适配 DSH 0.1.7 内置自动审查（Auto review）**：分段控件与权限菜单增加审查模式，分段控件显示为 `Auto`、弹层与当前状态显示为 `Auto review`；原 `Auto`（完全权限）更名为 `Yolo`；选择审查模式或完全权限时均正常调起宿主风险确认对话框。审查档位跟随宿主的权限目录：只有宿主的 `permissionPresets` 目录携带 `auto`（内置自动审查已启用）时才显示，目录变化时随之增减；目录读不到时整个权限控件交还宿主的访问模式按钮。
+- **已归档会话的删除按钮恢复可用**：宿主没有给浏览器半边提供删除会话的接口（工作区控制器只有归档与取消归档，agent 协议里的会话删除由宿主委托给持有存储的 ACP agent），插件此前调用第三方插件的路由，该插件不在环境里时点下去没有任何反应。现在由插件的宿主半边新增私有路由 `POST /dsh-claude-style/session-delete` 删除本机会话目录：只接受 POST 与同源请求，id 必须匹配宿主自身的会话 id 形状，正在打开的会话拒绝删除，目录解析后必须留在会话根目录内。
+
+<h3 id="en-0.6.1">New Features</h3>
+
+- **Support DSH 0.1.7 built-in Auto review**: add review mode to the permission segmented control and popover, displayed as `Auto` in segments and `Auto review` in the menu and current status; rename the former `Auto` (Full access) segment to `Yolo`; selecting either review mode or Full access drives the host's risk confirmation dialog. The review tier follows the host's permission catalog: it appears only while the host's `permissionPresets` catalog carries `auto` (the built-in auto review is enabled), and tracks catalog changes; when the catalog cannot be read, the whole permission control hands the host's access-mode button back.
+- **The archived rows' delete button works again**: the host gives the browser half no way to delete a session (the workspace controller only archives and unarchives, and the agent protocol's session delete is the host delegating to an ACP agent that owns the storage), so the skin used to call a third-party plugin's route and did nothing when that plugin was absent. The plugin's host half now serves a private route, `POST /dsh-claude-style/session-delete`, which removes the local session directory: POST and same-origin requests only, the id must match the host's own session id shape, an open session is refused, and the resolved directory must stay inside the sessions root.
+
+**Full Changelog**: [v0.6.0...v0.6.1](https://github.com/Nwflower/dsh-claude-style/compare/v0.6.0...v0.6.1)
+
 ## [0.6.0] - 2026-09-24
 
 [中文](#cn-0.6.0) | [English](#en-0.6.0)

package/README.en.md

@@ -63,7 +63,7 @@ Keep only one theme enabled at a time. After installation, **restart `dsh web`**
 ## Features
 
 1. **Theme** — applies globally the moment it is installed, with nothing to configure. Light mode uses ivory `#FCFCFB`, dark mode warm black `#141413`, and both share the same ember orange `#D97757` action accent; light/dark follows the system color mode.
-2. **Composer** — the input box is rebuilt from the ground up: a permission segmented control (Full access / Read only / …), a model trigger carrying the vendor lockup, and the toolbar and status stats laid out on a single line, with the send and stop buttons unified into 7px rounded rectangles. The stats sentence and the model trigger share the same font size and color.
+2. **Composer** — the input box is rebuilt from the ground up: a permission segmented control (Read / Edit / Auto / Yolo — the Auto tier appears only when the host has the built-in auto review enabled), a model trigger carrying the vendor lockup, and the toolbar and status stats laid out on a single line, with the send and stop buttons unified into 7px rounded rectangles. The stats sentence and the model trigger share the same font size and color.
 3. **Model picker** — a new two-level popover. The first level lists the official service plus the quick providers selected in settings; "More models" opens a second level grouped by provider. Every row carries its vendor lockup and a description, and the footer holds the reasoning-effort slider (stepless — it snaps to the nearest level on release) together with the "More models" entry. The second level aligns its bottom edge with the first, providers already shown on the first level are not repeated, and models without thinking support get no slider. Hovering opens the popover after a 50 ms dwell and closes it after 150 ms; the gap between the two cards does not count as leaving.
 4. **Workspace** — the sidebar's "Workspace" heading becomes an **Active / Archived** segmented control. Active keeps the host's session tree, while Archived is the skin's own flat list (title, time, and per-row unarchive and delete icon buttons). Rows match the host's session rows measurement for measurement (row x=12 / width 251 / height 28 / title x=36).
 5. **Sidebar** — the New session and Plugins rows take Claude's real shape: no background at rest, a background on hover, the "＋" of New session set inside a circular chip, and both icons rotating 90° clockwise on hover (four-fold symmetric glyphs, so they land back on themselves). The account drawer and the ban-screen easter egg remain as they were.

package/README.md

@@ -63,7 +63,7 @@ dsh plugin --profile web add Nwflower/dsh-claude-style         # GitHub 源
 ## 特点
 
 1. **主题** —— 安装即全局生效，无需配置。亮色象牙白 `#FCFCFB`、暗色暖黑 `#141413`，两套画布共用同一个操作强调色陶烬橙 `#D97757`；亮暗跟随系统颜色模式切换。
-2. **输入框** —— 输入框整块重做：权限分段控件（完全权限 / 只读 / …）、带品牌锁定标的模型触发器、工具栏与状态统计同一行排版，发送键与停止键统一成 7px 圆角。统计句与模型触发器共用一套字号与颜色。
+2. **输入框** —— 输入框整块重做：权限分段控件（只读 / 工作区 / 自动审查 / Yolo，自动审查档位仅在宿主启用内置自动审查时出现）、带品牌锁定标的模型触发器、工具栏与状态统计同一行排版，发送键与停止键统一成 7px 圆角。统计句与模型触发器共用一套字号与颜色。
 3. **模型选择器** —— 全新的两级弹层：一级列官方服务与设置页勾选的快捷供应商，「更多模型」二级按供应商分组；每行带厂商锁定标与说明文案，底部是推理等级推条（无极滑动，松手对齐最近档位）与「更多模型」入口。二级底边与一级对齐，一级已显示的供应商不再重复；模型不支持思考时不画推条。悬停停留 50ms 打开、离开 150ms 关闭，两卡之间的空隙不算离开。
 4. **工作区** —— 侧栏「工作区」标题改成 **进行中 / 已归档** 分段控件：进行中沿用宿主的会话树，已归档是皮肤自己的平铺列表（标题、时间、每行「取消归档」与「删除」两个图标按钮）。行排版与宿主的会话行逐项一致（行 x=12 / 宽 251 / 高 28 / 标题起点 x=36）。
 5. **侧栏** —— 新会话与插件两行取 Claude 真机形状：默认无底色、hover 才有底色，新会话的「＋」套一枚圆形底，两行图标 hover 顺时针转 90°（四重对称图形，转回原位）；底部账户抽屉、封号彩蛋一并保留。

package/docs/architecture.md

@@ -84,7 +84,7 @@
 ## D11. 插件自有路由借宿主的请求栅栏；宿主/用户来源的字符串只以文本上屏
 
 - **背景**：`webServer.register()` 交给插件的是裸请求。宿主自己的 `/api` 挂在 Host/Origin 栅栏与浏览器会话 cookie 之后（`connection.requestRejection()`），插件路由不在其内。本插件的 `/username`（读系统用户名）因此曾经完全无鉴权：`dsh web` 绑定 `0.0.0.0` 时局域网里任何人都能直接读。读到的用户名又被客户端拼进 `innerHTML`——实测在 GUI 页面里执行了脚本，而这个页面能驱动执行 shell 命令的智能体。
-- **决定**：宿主半边 `/username` 处理前先调 `ctx.get('connection').requestRejection(req)`，拒绝即回 401/403。宿主没有该服务时，插件自带的替身只服务回环（回环 Host、无跨站标记、Origin 与 Host 一致）。模型文案与字体等静态资产保持公开。客户端：一切来自设置、账号服务、系统或第三方插件的字符串只用 `textContent` / 元素属性写入，图标复制节点而非重新解析 markup。
+- **决定**：宿主半边 `/username` 处理前先调 `ctx.get('connection').requestRejection(req)`，拒绝即回 401/403。宿主没有该服务时，插件自带的替身只服务回环（回环 Host、无跨站标记、Origin 与 Host 一致）。模型文案与字体等静态资产保持公开。删除会话的私有路由 `POST /dsh-claude-style/session-delete` 同样先过栅栏，另加四道：只接受 POST，id 必须匹配宿主自身的会话 id 形状，正在打开的会话拒绝，目录解析后必须留在会话根目录内（删除发生在宿主半边，浏览器半边只提交一个 id）。客户端：一切来自设置、账号服务、系统或第三方插件的字符串只用 `textContent` / 元素属性写入，图标复制节点而非重新解析 markup。
 - **代价**：路由依赖宿主的 connection 服务。已核对两种壳都能通过：浏览器同源请求带会话 cookie；0.1.7 桌面壳经 `forwardWebRequest` 转发到回环 Host、剥掉页面 Origin 并自带 cookie（宿主真实的 `isTrustedApiRequest` 对这两种请求放行，对跨站与 DNS 重绑定请求拒绝）。
 - **重审条件**：宿主为插件提供自带鉴权的路由注册（如 `connection.fetch.register`）时，迁移过去并删掉本地替身。
 

package/lib/client.js

@@ -199,7 +199,8 @@ window.__ModuleLoader__.load({
     var PERMISSION_SEGMENTS = [
       { label: 'Read', preset: 'read-only' },
       { label: 'Edit', preset: 'workspace-write' },
-      { label: 'Auto', preset: 'danger-full-access' },
+      { label: 'Auto', preset: 'auto' },
+      { label: 'Yolo', preset: 'danger-full-access' },
     ]
 
     /** In-conversation permission popover options matching Claude Code desktop style. */
@@ -214,6 +215,11 @@ window.__ModuleLoader__.load({
         label: 'Accept edits',
         desc: '允许编辑工作区文件'
       },
+      {
+        preset: 'auto',
+        label: 'Auto review',
+        desc: '无沙箱运行，调用前由模型审查'
+      },
       {
         preset: 'danger-full-access',
         label: 'Full access',
@@ -221,12 +227,15 @@ window.__ModuleLoader__.load({
       }
     ]
 
-    /** The one preset the shipped UI gates behind its risk-confirmation dialog. */
+    /** The presets the shipped UI gates behind its risk-confirmation dialog. */
     var GATED_PRESET = 'danger-full-access'
-    /** Shipped full-access row labels, used to find that row in the shipped menu. */
+    var AUTO_REVIEW_PRESET = 'auto'
+    /** Shipped risk-gated row labels, used to find those rows in the shipped menu. */
     var FULL_ACCESS_LABELS = ['完全权限', 'Full access']
-    /** Fallback prompt, used only when the shipped menu cannot be reached. */
-    var GATED_PROMPT = '启用完全权限（Auto）？\n\n智能体将减少确认步骤，可直接执行敏感操作、文件修改或外部命令。仅建议在你信任当前任务时使用。'
+    var AUTO_REVIEW_LABELS = ['Auto review', 'Auto review EXP']
+    /** Fallback prompts, used only when the shipped menu cannot be reached. */
+    var GATED_PROMPT = '启用完全权限（Yolo）？\n\n智能体将减少确认步骤，可直接执行敏感操作、文件修改或外部命令。仅建议在你信任当前任务时使用。'
+    var AUTO_REVIEW_PROMPT = '启用 Auto review（实验）？\n\nAuto review 不使用沙箱。每次原生工具调用和 PTC 内层调用前，都会由与当前 agent 相同的模型进行审查。此功能仍属实验性，可能误放行或误拒绝，并会消耗额外 token。'
 
     /** Skin-owned class names, so nothing couples to hashed CSS-module classes. */
     var SEGMENTS_CLASS = 'dsh-claude-segments'
@@ -307,6 +316,14 @@ window.__ModuleLoader__.load({
      * document and the stylesheet switches on this attribute.
      */
     var WINDOW_BLUR_ATTR = 'data-dsh-window-blur'
+    /**
+     * The host half's session-deletion route (lib/index.js, SESSION_DELETE_PATH).
+     * The harness gives the browser half no deletion API of its own, so the
+     * archived row's delete button posts the session id here and the host half
+     * removes the stored session directory. Keep the path in step with the host
+     * half.
+     */
+    var SESSION_DELETE_ROUTE = '/dsh-claude-style/session-delete'
     /** Composer surfaces the restyle may cover, in settings order. */
     var COMPOSER_SCOPES = ['off', 'hero', 'conversation', 'all']
     /**
@@ -2988,7 +3005,7 @@ window.__ModuleLoader__.load({
       "/* --- 2.4 Custom Components (Segments & Account Popover) --- */",
       "/* ---------- Claude Code layout: permission segments ---------- */",
       "/* The shipped access control is one popup-select button; it is replaced by",
-      "   a Read | Edit | Auto segmented control over the same three presets — for",
+      "   a Read | Edit | Auto | Yolo segmented control over presets — for",
       "   as long as the permission control is installed to stand in for it. */",
       "body[data-dsh-claude-style][data-dsh-claude-composer-active][data-dsh-claude-permissions] button[aria-label^=\"访问模式\"],",
       "body[data-dsh-claude-style][data-dsh-claude-composer-active][data-dsh-claude-permissions] button[aria-label^=\"Access mode\"] {",
@@ -3039,6 +3056,14 @@ window.__ModuleLoader__.load({
       "  box-shadow: 0 1px 2px rgba(20, 20, 19, 0.08);",
       "}",
       "",
+      "/* Rows whose preset the host's permission catalog does not carry (the Auto",
+      "   review tier without the auto-review integration) are taken out of the",
+      "   control entirely. */",
+      "body[data-dsh-claude-style] .dsh-claude-segment[data-hidden],",
+      "body[data-dsh-claude-style] .dsh-claude-perm-popover .dsh-claude-popover-item[data-hidden] {",
+      "  display: none !important;",
+      "}",
+      "",
       "/* ---------- Claude Code layout: in-conversation permission popover ---------- */",
       "body[data-dsh-claude-style] .dsh-claude-perm-container {",
       "  position: relative !important;",
@@ -7015,6 +7040,134 @@ window.__ModuleLoader__.load({
       var permPopover = null
       var permHoverIntent = null
 
+      /**
+       * Whether the host's permission catalog carries the live Auto review
+       * preset (`auto`, registered by the auto-review plugin): true or false
+       * once a catalog read settled, null until then. While unknown the rows
+       * stay hidden, the way the shipped picker renders nothing before its
+       * first catalog read.
+       */
+      var autoPresetLive = null
+      /** The first catalog failure; thrown on the next sync to retire the feature. */
+      var autoPresetError = null
+      var catalogFiber = null
+      var catalogChangedDisposer = null
+
+      /** The Auto review rows are only offered while the host's catalog carries the preset. */
+      function rowVisible(preset) {
+        return preset !== AUTO_REVIEW_PRESET || autoPresetLive === true
+      }
+
+      /**
+       * Mirror the availability onto a row as data-hidden; the stylesheet turns
+       * that into display:none (an inline style would lose to the popover
+       * item's own `display: flex !important`).
+       */
+      function syncRowVisibility(row, preset) {
+        if (rowVisible(preset)) {
+          if (row.hasAttribute('data-hidden')) row.removeAttribute('data-hidden')
+        } else if (!row.hasAttribute('data-hidden')) {
+          row.setAttribute('data-hidden', '')
+        }
+      }
+
+      /**
+       * Read the host's permission catalog and record whether it carries the
+       * live Auto review preset. The shipped picker builds its rows from the
+       * same catalog, so it is the authority on what is switchable. A rejected
+       * read retries like the account profile's reads (the client connection
+       * may still be coming up at install); once the retries are exhausted the
+       * failure is remembered and thrown on the next sync, which retires this
+       * feature and hands the shipped access button back (D12).
+       */
+      var AUTO_PRESET_RETRY_MS = [1000, 5000]
+      var autoPresetRetries = 0
+      var autoPresetRead = 0
+      var autoPresetRetry = null
+
+      /** Invalidate the read in flight and drop any retry still waiting. */
+      function dropAutoPresetRead() {
+        autoPresetRead++
+        if (autoPresetRetry !== null) {
+          clearTimeout(autoPresetRetry)
+          autoPresetRetry = null
+        }
+      }
+
+      function probeAutoPreset() {
+        var namespace = null
+        try { namespace = ctx.get('remote.permissionPresets') } catch (error) { namespace = null }
+        if (namespace === null || namespace === void 0 || typeof namespace.catalog !== 'function') {
+          if (typeof ctx.inject !== 'function') {
+            autoPresetError = new Error('permission: the host exposes no remote.permissionPresets catalog')
+            ui.schedule()
+          }
+          return
+        }
+        dropAutoPresetRead()
+        var read = autoPresetRead
+        namespace.catalog().then(function (result) {
+          if (read !== autoPresetRead) return
+          if (result === null || typeof result !== 'object' || result.ok !== true ||
+              result.value === null || typeof result.value !== 'object' ||
+              !Array.isArray(result.value.options)) {
+            autoPresetError = new Error('permission: unexpected permissionPresets catalog shape')
+            ui.schedule()
+            return
+          }
+          autoPresetRetries = 0
+          autoPresetError = null
+          var live = false
+          for (var i = 0; i < result.value.options.length; i++) {
+            var option = result.value.options[i]
+            if (option !== null && typeof option === 'object' && option.value === AUTO_REVIEW_PRESET) {
+              live = true
+              break
+            }
+          }
+          autoPresetLive = live
+          ui.schedule()
+        }, function () {
+          if (read !== autoPresetRead) return
+          if (autoPresetRetries >= AUTO_PRESET_RETRY_MS.length) {
+            autoPresetError = new Error('permission: the permissionPresets catalog read failed ' + (AUTO_PRESET_RETRY_MS.length + 1) + ' times')
+            ui.schedule()
+            return
+          }
+          autoPresetRetry = setTimeout(function () {
+            autoPresetRetry = null
+            probeAutoPreset()
+          }, AUTO_PRESET_RETRY_MS[autoPresetRetries++])
+        })
+      }
+
+      /**
+       * The namespace may register after this plugin (the host registers each
+       * remote namespace as its package loads), so wait for it the way the
+       * account row waits for remote.account; a host without inject gets one
+       * read now. The catalog-changed event re-reads when the auto-review
+       * integration is registered or dropped while the page stays open.
+       */
+      function startAutoPresetProbe() {
+        if (typeof ctx.inject === 'function') {
+          catalogFiber = ctx.inject(['remote.permissionPresets'], function (scope) {
+            scope.effect(function () {
+              probeAutoPreset()
+              return function () {}
+            }, 'dsh-claude-style: permission catalog')
+          })
+        } else {
+          probeAutoPreset()
+        }
+        var remoteRoot = null
+        try { remoteRoot = ctx.get('remote') } catch (error) { remoteRoot = null }
+        if (remoteRoot !== null && remoteRoot !== void 0 && typeof remoteRoot.$on === 'function') {
+          catalogChangedDisposer = remoteRoot.$on('permission-presets/catalog-changed', function () {
+            probeAutoPreset()
+          })
+        }
+      }
+
       function buildSegments(onPick) {
         var group = document.createElement('div')
         group.className = SEGMENTS_CLASS
@@ -7183,7 +7336,9 @@ window.__ModuleLoader__.load({
 
       function updatePermState(preset) {
         if (!permLabel || !permPopover) return
-        var matchedLabel = 'Accept edits'
+        // A preset our option list does not carry (the host's `custom`, or a
+        // row this host's catalog does not offer) shows its machine value.
+        var matchedLabel = preset === null ? 'Accept edits' : preset
         for (var i = 0; i < PERMISSION_OPTIONS.length; i++) {
           if (PERMISSION_OPTIONS[i].preset === preset) {
             matchedLabel = PERMISSION_OPTIONS[i].label
@@ -7198,7 +7353,8 @@ window.__ModuleLoader__.load({
         var items = permPopover.querySelectorAll('[data-preset]')
         for (var j = 0; j < items.length; j++) {
           var it = items[j]
-          var isCurrent = it.getAttribute('data-preset') === preset
+          var rowPreset = it.getAttribute('data-preset')
+          var isCurrent = rowPreset === preset
           var check = it.querySelector('.dsh-claude-perm-check')
           if (check) {
             check.style.display = isCurrent ? 'inline' : 'none'
@@ -7208,6 +7364,7 @@ window.__ModuleLoader__.load({
           } else {
             it.removeAttribute('data-active')
           }
+          syncRowVisibility(it, rowPreset)
         }
       }
 
@@ -7219,29 +7376,42 @@ window.__ModuleLoader__.load({
       }
 
       /**
-       * Drive the shipped access menu to its full-access row, so the switch
-       * runs through the shipped risk-confirmation dialog rather than a
+       * Drive the shipped access menu to its risk-gated row (Full access or Auto review),
+       * so the switch runs through the shipped risk-confirmation dialog rather than a
        * skin-owned prompt. The trigger is hidden by this skin but still in
        * the tree, so a synthetic click still opens the menu; the row is then
        * picked by its label. A plain confirm stands in only when that menu
        * cannot be reached, which keeps the switch behind an explicit
        * acknowledgement either way.
        */
-      function openShippedGate() {
+      var gateInFlight = false
+
+      function openShippedGate(preset) {
+        if (gateInFlight) return
+        var isAuto = preset === AUTO_REVIEW_PRESET
+        var targetLabels = isAuto ? AUTO_REVIEW_LABELS : FULL_ACCESS_LABELS
+        var prompt = isAuto ? AUTO_REVIEW_PROMPT : GATED_PROMPT
         var trigger = findAccessTrigger()
         if (trigger === null) {
-          if (window.confirm(GATED_PROMPT)) submitPreset(GATED_PRESET)
+          if (window.confirm(prompt)) submitPreset(preset)
           return
         }
+        gateInFlight = true
         trigger.click()
         var attempts = 0
         function seek() {
-          var items = document.querySelectorAll('[role="menu"] button[role="menuitem"]')
+          // The skin's own popover is itself a role=menu whose row texts start
+          // with the same labels, so it must stay out of this search — matching
+          // it would click back into pick() and toggle the shipped menu every
+          // frame. The shipped Auto review row concatenates its EXP badge into
+          // the text ("Auto reviewEXP"), so the label matches as a prefix.
+          var items = document.querySelectorAll('[role="menu"]:not(.dsh-claude-perm-popover) button[role="menuitem"]')
           for (var i = 0; i < items.length; i++) {
             var text = (items[i].textContent || '').trim()
-            for (var j = 0; j < FULL_ACCESS_LABELS.length; j++) {
-              if (text === FULL_ACCESS_LABELS[j]) {
+            for (var j = 0; j < targetLabels.length; j++) {
+              if (text.indexOf(targetLabels[j]) === 0) {
                 items[i].click()
+                gateInFlight = false
                 return
               }
             }
@@ -7251,8 +7421,9 @@ window.__ModuleLoader__.load({
             requestAnimationFrame(seek)
             return
           }
+          gateInFlight = false
           trigger.click()
-          if (window.confirm(GATED_PROMPT)) submitPreset(GATED_PRESET)
+          if (window.confirm(prompt)) submitPreset(preset)
         }
         requestAnimationFrame(seek)
       }
@@ -7261,8 +7432,8 @@ window.__ModuleLoader__.load({
         var session = currentSession(ctx)
         if (session === null || preset === null) return
         if (preset === currentPreset(session)) return
-        if (preset === GATED_PRESET) {
-          openShippedGate()
+        if (preset === GATED_PRESET || preset === AUTO_REVIEW_PRESET) {
+          openShippedGate(preset)
           return
         }
         submitPreset(preset)
@@ -7327,6 +7498,7 @@ window.__ModuleLoader__.load({
           }
           for (var j = 0; j < segments.children.length; j++) {
             var item = segments.children[j]
+            syncRowVisibility(item, item.getAttribute('data-preset'))
             if (item.getAttribute('data-preset') === preset) {
               item.setAttribute('data-active', '')
               item.setAttribute('aria-checked', 'true')
@@ -7366,6 +7538,7 @@ window.__ModuleLoader__.load({
 
       ui.permissions = {
         sync: function () {
+          if (autoPresetError !== null) throw autoPresetError
           stats.sync()
           syncSegments()
         },
@@ -7383,10 +7556,20 @@ window.__ModuleLoader__.load({
       // The composer restyle hides the host's access button and statistics
       // dialogs only while this says their replacement is installed.
       document.body.setAttribute(PERMISSIONS_ATTR, '')
+      startAutoPresetProbe()
 
       return function () {
         stats.teardown()
         if (permHoverIntent) permHoverIntent.cancel()
+        dropAutoPresetRead()
+        if (catalogFiber !== null && typeof catalogFiber.dispose === 'function') {
+          try { catalogFiber.dispose() } catch (error) { /* the fiber may already be gone */ }
+          catalogFiber = null
+        }
+        if (catalogChangedDisposer !== null) {
+          catalogChangedDisposer()
+          catalogChangedDisposer = null
+        }
         if (permDocPointerListener) {
           document.removeEventListener('pointerdown', permDocPointerListener)
           permDocPointerListener = null
@@ -7398,6 +7581,7 @@ window.__ModuleLoader__.load({
         }
         removeStrayNodes(document, '.' + SEGMENTS_CLASS + '[data-composer-segments], .dsh-claude-perm-container', [])
         segments = null
+        gateInFlight = false
         if (permPopover !== null && permPopover.parentElement !== null) permPopover.parentElement.removeChild(permPopover)
         permPopover = null
         permBtn = null
@@ -12278,11 +12462,26 @@ window.__ModuleLoader__.load({
         if (sessions !== undefined && sessions !== null && typeof sessions.open === 'function') sessions.open(id)
       }
 
+      /**
+       * Delete one stored session through the host half's own route.
+       *
+       * The harness gives the browser half no deletion API of its own (the
+       * workspace controller archives and unarchives; the agent protocol's
+       * session delete is the host delegating to an ACP agent that owns the
+       * storage), so the skin's host half removes the session's stored directory
+       * and answers here. The row stays on any refusal — the host refuses a live
+       * session, and the next read tells the truth.
+       */
       function removeArchived(id) {
-        var registry = service('remote.workspaceRegistry')
-        if (registry === undefined || registry === null || typeof registry.deleteSession !== 'function') return
-        registry.deleteSession(id).then(function (result) {
-          if (!result || result.ok !== true) return
+        fetch(SESSION_DELETE_ROUTE, {
+          method: 'POST',
+          credentials: 'same-origin',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ sessionId: id }),
+        }).then(function (response) {
+          return response.ok ? response.json() : null
+        }).then(function (result) {
+          if (result === null || result.ok !== true) return
           if (items !== null) items = items.filter(function (row) { return row.id !== id })
           renderList()
         }).catch(function () { /* the row stays; the next read tells the truth */ })

package/lib/index.js

@@ -28,9 +28,9 @@
  * the module graph and the whole skin with it. The browser half falls back to
  * its defaults when either surface is missing.
  */
-import { readFileSync } from 'node:fs'
-import { userInfo } from 'node:os'
-import { dirname, join } from 'node:path'
+import { readFileSync, readdirSync, rmSync, statSync } from 'node:fs'
+import { homedir, userInfo } from 'node:os'
+import { dirname, join, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 export const name = 'dsh-claude-style'
@@ -56,6 +56,22 @@ const FONT_FILES = {
 }
 /** One-shot host OS user route; the browser half caches the response. */
 const USERNAME_PATH = `${ROUTE_PREFIX}/username`
+/**
+ * Session deletion.
+ *
+ * The harness gives the browser half no deletion API of its own: the workspace
+ * controller archives and unarchives, and the agent protocol's session delete is
+ * the host delegating to an ACP agent that owns the storage. The archived row's
+ * delete button therefore comes here, where the stored session directory under
+ * the harness home can be removed. The path is also spelled in
+ * src/constants.js (SESSION_DELETE_ROUTE) for the browser half; keep the two in
+ * step.
+ */
+const SESSION_DELETE_PATH = `${ROUTE_PREFIX}/session-delete`
+/** Session ids are the harness's own shape; anything else is refused before it reaches a path. */
+const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/
+/** Largest deletion request body read; a real one carries one id. */
+const DELETE_BODY_MAX = 4096
 
 /** The namespace an older host knows this plugin's preferences by. */
 const LEGACY_SETTINGS_NAMESPACE = 'claude-style'
@@ -269,6 +285,129 @@ function sendJson(res, status, payload) {
   res.end(body)
 }
 
+/** The harness sessions root: `<DSH home>/sessions`, resolved the host's own way. */
+function sessionsRoot(ctx) {
+  try {
+    const dshHomePath = ctx.get('dshHomePath')
+    if (typeof dshHomePath === 'function') return dshHomePath('sessions')
+  } catch { /* no home-path service: fall back to the environment */ }
+  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+  return join(home, 'sessions')
+}
+
+/**
+ * Whether the host holds this session open right now.
+ *
+ * A live session's log is open and being appended to, so its directory must not
+ * be removed under the writer. When the live set cannot be read, the answer is
+ * "live": an unreadable set cannot authorize the deletion.
+ */
+function sessionIsLive(ctx, sessionId) {
+  let sessions = null
+  try {
+    sessions = ctx.get('sessions')
+  } catch {
+    sessions = null
+  }
+  if (sessions === null || sessions === undefined) return false
+  try {
+    if (typeof sessions.get === 'function') {
+      const found = sessions.get(sessionId)
+      return found !== undefined && found !== null
+    }
+    if (typeof sessions.list === 'function') {
+      const listed = sessions.list()
+      if (Array.isArray(listed)) {
+        return listed.some((item) => (typeof item === 'string' ? item : item?.id ?? item?.sessionId) === sessionId)
+      }
+    }
+  } catch {
+    return true
+  }
+  return true
+}
+
+/** One bounded request body, or null when it is oversized or unreadable. */
+function readRequestBody(req, limit) {
+  return new Promise((settle) => {
+    const chunks = []
+    let size = 0
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > limit) {
+        settle(null)
+        req.destroy()
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => settle(Buffer.concat(chunks).toString('utf8')))
+    req.on('error', () => settle(null))
+  })
+}
+
+/**
+ * Delete one stored session: the directory named by the id under one of the
+ * sessions root's working-directory directories.
+ *
+ * The id never reaches a path unchecked — it must match the harness's own
+ * shape, the lookup is by exact name, and the resolved directory must stay
+ * inside the sessions root.
+ */
+async function deleteSession(ctx, req, res) {
+  const refused = refusalOf(ctx, req)
+  if (refused !== undefined) {
+    sendJson(res, refused, { ok: false, error: refused === 401 ? 'unauthorized' : 'forbidden' })
+    return
+  }
+  const raw = await readRequestBody(req, DELETE_BODY_MAX)
+  let request = null
+  try {
+    request = raw === null ? null : JSON.parse(raw)
+  } catch {
+    request = null
+  }
+  const sessionId = request !== null && typeof request.sessionId === 'string' ? request.sessionId : ''
+  if (!SESSION_ID_RE.test(sessionId)) {
+    sendJson(res, 400, { ok: false, error: 'invalid session id' })
+    return
+  }
+  if (sessionIsLive(ctx, sessionId)) {
+    sendJson(res, 409, { ok: false, error: 'session is open' })
+    return
+  }
+  const root = resolve(sessionsRoot(ctx))
+  let dir = null
+  try {
+    for (const entry of readdirSync(root)) {
+      const candidate = join(root, entry, sessionId)
+      let stat
+      try {
+        stat = statSync(candidate)
+      } catch {
+        continue
+      }
+      if (stat.isDirectory()) {
+        dir = candidate
+        break
+      }
+    }
+  } catch {
+    dir = null
+  }
+  if (dir === null || !resolve(dir).startsWith(root + sep)) {
+    sendJson(res, 404, { ok: false, error: 'session not found' })
+    return
+  }
+  try {
+    rmSync(dir, { recursive: true, force: true })
+  } catch (error) {
+    sendJson(res, 500, { ok: false, error: String(error?.message ?? error) })
+    return
+  }
+  sendJson(res, 200, { ok: true })
+}
+
 /**
  * Register the plugin's host surfaces.
  * @param ctx - host plugin context.
@@ -379,6 +518,29 @@ export function apply(ctx) {
         warn(`username route unavailable: ${error?.message ?? error}`)
       }
 
+      try {
+        // The archived row's delete button. POST only: the browser half sends
+        // one id, and a GET must never reach the filesystem.
+        disposers.push(scope.webServer.register({
+          kind: 'exact',
+          path: SESSION_DELETE_PATH,
+          handler: (req, res) => {
+            if (req.method !== 'POST') {
+              res.writeHead(405, { allow: 'POST' })
+              res.end()
+              return
+            }
+            void deleteSession(ctx, req, res).catch((error) => {
+              try {
+                sendJson(res, 500, { ok: false, error: String(error?.message ?? error) })
+              } catch { /* the response may already be gone */ }
+            })
+          },
+        }))
+      } catch (error) {
+        warn(`session delete route unavailable: ${error?.message ?? error}`)
+      }
+
       return () => {
         for (const dispose of disposers) {
           try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-claude-style",
   "description": "Claude Code Desktop theme for DeepSeek Harness (dsh) web GUI — visual & interaction overhaul",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "main": "lib/index.js",
   "icon": "lib/claude-mark.svg",