dsh-claude-style 0.6.0 → 0.6.4

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to `dsh-claude-style` are documented here, newest first.
 
+## [0.6.4] - 2026-09-24
+
+[中文](#cn-0.6.4) | [English](#en-0.6.4)
+
+<h3 id="cn-0.6.4">问题修复</h3>
+
+- 修复 **刚启动、账号抽屉还没展开过时，页脚里的插件条目一直留在账户行旁边**：隐藏页脚条目与把条目镜像进抽屉原本挤在同一次调用里，而抽屉没打开时这次调用会提前返回，于是宿主重新渲染出来的插件图标继续画在侧栏底部、紧挨账户行，直到抽屉被展开过一次才被标记隐藏——这正是该现象只在首次启动后出现的原因。现在隐藏条目每次同步都跑，只有镜像需要抽屉容器。
+- 修复 **底栏统计弹层偶尔只剩一段（只显示会话统计，或只显示 Token 用量）**：皮肤按标签文字区分宿主的两颗药丸，读取窗口又只有 300 毫秒，而宿主的两个面板按它自己的提交节奏挂载，晚到一步就丢掉那一段。现在按面板自身的标记判定类型，等待拉长到 800 毫秒、读失败时重试一次；药丸按钮每一步都从 DOM 重新取，窗口内还会再按一次——宿主重渲染换掉节点时，按旧节点等于没按；首次只读到一段时安排一次补读把缺的那段补上，卡片只增不减，已经打开的卡片不会被一次失败的读取改小。会话本身没有计时数据时宿主也不渲染计时面板，此时只有 Token 用量是正确的。
+- 修复 **0.1.7-rc.2 里工作区会话行的状态圈消失**：新宿主把会话行的前导座位交给槽位出口渲染，座位里因此始终有一个 `div[data-slot]` 包裹层（`display: contents`），座位不再是空元素，画在 `:empty` 上的圆圈就不再出现。圆圈现在也挂在空的槽位出口上；座位里带运行状态点时仍由状态点自己绘制。
+- 修复 **账户抽屉收起时它的行与图标停在账户行上方**：自建抽屉的内容要在收起状态下预先对账（镜像行只在收起时同步、展开时冻结），所以收起时面板连同齿轮图标一直挂在账户行正上方，此前只用透明度隐藏，内容仍留在绘制与命中树里。收起状态改用 `visibility` 隐藏（保留布局，关闭的淡出照常），展开时恢复可见。
+
+<h3 id="en-0.6.4">Bug Fixes</h3>
+
+- Fix **the footer's plugin entries staying beside the account row after a fresh start until the drawer has been opened once**: hiding the entries and mirroring them into the drawer shared one call that returned early while no drawer was up, so the plugin icons the host re-rendered stayed painted at the sidebar's bottom next to the account row until the drawer had been opened once — which is why the symptom only appeared after a fresh start. The hiding now runs on every sync; only the mirroring needs the drawer's container.
+- Fix **the stats card occasionally showing only one section (session statistics alone, or Token usage alone)**: the skin told the host's two pills apart by their label text and read with a 300 ms window, while the host mounts its panels on its own commit — one late panel lost that section. The read now identifies each panel by its own marker, waits up to 800 ms and retries once; it re-resolves the pill from the DOM at every step and presses the live node again while the window lasts, because a press on a node the host has since re-rendered goes nowhere; and a card that did come up short schedules one late re-read that fills the missing section in, so the card only ever grows and a failed read never shrinks a card already on screen. A session with no timing data renders no timing panel in the host either, where Token usage alone is correct.
+- Fix **the workspace session rows' status circle disappearing on 0.1.7-rc.2**: the newer host renders the row's leading seat through a slot outlet, so the seat always carries a `div[data-slot]` anchor (`display: contents`) and is never empty — the circle drawn on `:empty` stopped appearing. The circle now hangs on the empty outlet anchor as well; a seat carrying the running status dot still keeps the dot's own paint.
+- Fix **the account drawer's rows and icons parked above the account row while it is closed**: the self-built drawer's content is reconciled while closed by design (the mirror sync only runs then and freezes while open), so the panel and its gear icon sit right above the account row; opacity alone left that content in the paint and hit-test tree. The closed state now hides it with `visibility` (layout kept, closing fade intact) and the open state restores it.
+
+**Full Changelog**: [v0.6.1...v0.6.4](https://github.com/Nwflower/dsh-claude-style/compare/v0.6.1...v0.6.4)
+
+## [0.6.1] - 2026-09-24
+
+[中文](#cn-0.6.1) | [English](#en-0.6.1)
+
+<h3 id="cn-0.6.1">新增功能</h3>
+
+- **适配 DSH 0.1.7 内置自动审查（Auto review）**：分段控件与权限菜单增加审查模式，分段控件显示为 `Auto`、弹层与当前状态显示为 `Auto review`；原 `Auto`（完全权限）更名为 `Yolo`；选择审查模式或完全权限时均正常调起宿主风险确认对话框。审查档位跟随宿主的权限目录：只有宿主的 `permissionPresets` 目录携带 `auto`（内置自动审查已启用）时才显示，目录变化时随之增减；目录读不到时整个权限控件交还宿主的访问模式按钮。
+- **已归档会话的删除按钮恢复可用**：宿主没有给浏览器半边提供删除会话的接口（工作区控制器只有归档与取消归档，agent 协议里的会话删除由宿主委托给持有存储的 ACP agent），插件此前调用第三方插件的路由，该插件不在环境里时点下去没有任何反应。现在由插件的宿主半边新增私有路由 `POST /dsh-claude-style/session-delete` 删除本机会话目录：只接受 POST 与同源请求，id 必须匹配宿主自身的会话 id 形状，正在打开的会话拒绝删除，目录解析后必须留在会话根目录内。
+
+<h3 id="en-0.6.1">New Features</h3>
+
+- **Support DSH 0.1.7 built-in Auto review**: add review mode to the permission segmented control and popover, displayed as `Auto` in segments and `Auto review` in the menu and current status; rename the former `Auto` (Full access) segment to `Yolo`; selecting either review mode or Full access drives the host's risk confirmation dialog. The review tier follows the host's permission catalog: it appears only while the host's `permissionPresets` catalog carries `auto` (the built-in auto review is enabled), and tracks catalog changes; when the catalog cannot be read, the whole permission control hands the host's access-mode button back.
+- **The archived rows' delete button works again**: the host gives the browser half no way to delete a session (the workspace controller only archives and unarchives, and the agent protocol's session delete is the host delegating to an ACP agent that owns the storage), so the skin used to call a third-party plugin's route and did nothing when that plugin was absent. The plugin's host half now serves a private route, `POST /dsh-claude-style/session-delete`, which removes the local session directory: POST and same-origin requests only, the id must match the host's own session id shape, an open session is refused, and the resolved directory must stay inside the sessions root.
+
+**Full Changelog**: [v0.6.0...v0.6.1](https://github.com/Nwflower/dsh-claude-style/compare/v0.6.0...v0.6.1)
+
 ## [0.6.0] - 2026-09-24
 
 [中文](#cn-0.6.0) | [English](#en-0.6.0)

package/README.en.md

@@ -63,7 +63,7 @@ Keep only one theme enabled at a time. After installation, **restart `dsh web`**
 ## Features
 
 1. **Theme** — applies globally the moment it is installed, with nothing to configure. Light mode uses ivory `#FCFCFB`, dark mode warm black `#141413`, and both share the same ember orange `#D97757` action accent; light/dark follows the system color mode.
-2. **Composer** — the input box is rebuilt from the ground up: a permission segmented control (Full access / Read only / …), a model trigger carrying the vendor lockup, and the toolbar and status stats laid out on a single line, with the send and stop buttons unified into 7px rounded rectangles. The stats sentence and the model trigger share the same font size and color.
+2. **Composer** — the input box is rebuilt from the ground up: a permission segmented control (Read / Edit / Auto / Yolo — the Auto tier appears only when the host has the built-in auto review enabled), a model trigger carrying the vendor lockup, and the toolbar and status stats laid out on a single line, with the send and stop buttons unified into 7px rounded rectangles. The stats sentence and the model trigger share the same font size and color.
 3. **Model picker** — a new two-level popover. The first level lists the official service plus the quick providers selected in settings; "More models" opens a second level grouped by provider. Every row carries its vendor lockup and a description, and the footer holds the reasoning-effort slider (stepless — it snaps to the nearest level on release) together with the "More models" entry. The second level aligns its bottom edge with the first, providers already shown on the first level are not repeated, and models without thinking support get no slider. Hovering opens the popover after a 50 ms dwell and closes it after 150 ms; the gap between the two cards does not count as leaving.
 4. **Workspace** — the sidebar's "Workspace" heading becomes an **Active / Archived** segmented control. Active keeps the host's session tree, while Archived is the skin's own flat list (title, time, and per-row unarchive and delete icon buttons). Rows match the host's session rows measurement for measurement (row x=12 / width 251 / height 28 / title x=36).
 5. **Sidebar** — the New session and Plugins rows take Claude's real shape: no background at rest, a background on hover, the "＋" of New session set inside a circular chip, and both icons rotating 90° clockwise on hover (four-fold symmetric glyphs, so they land back on themselves). The account drawer and the ban-screen easter egg remain as they were.

package/README.md

@@ -63,7 +63,7 @@ dsh plugin --profile web add Nwflower/dsh-claude-style         # GitHub 源
 ## 特点
 
 1. **主题** —— 安装即全局生效，无需配置。亮色象牙白 `#FCFCFB`、暗色暖黑 `#141413`，两套画布共用同一个操作强调色陶烬橙 `#D97757`；亮暗跟随系统颜色模式切换。
-2. **输入框** —— 输入框整块重做：权限分段控件（完全权限 / 只读 / …）、带品牌锁定标的模型触发器、工具栏与状态统计同一行排版，发送键与停止键统一成 7px 圆角。统计句与模型触发器共用一套字号与颜色。
+2. **输入框** —— 输入框整块重做：权限分段控件（只读 / 工作区 / 自动审查 / Yolo，自动审查档位仅在宿主启用内置自动审查时出现）、带品牌锁定标的模型触发器、工具栏与状态统计同一行排版，发送键与停止键统一成 7px 圆角。统计句与模型触发器共用一套字号与颜色。
 3. **模型选择器** —— 全新的两级弹层：一级列官方服务与设置页勾选的快捷供应商，「更多模型」二级按供应商分组；每行带厂商锁定标与说明文案，底部是推理等级推条（无极滑动，松手对齐最近档位）与「更多模型」入口。二级底边与一级对齐，一级已显示的供应商不再重复；模型不支持思考时不画推条。悬停停留 50ms 打开、离开 150ms 关闭，两卡之间的空隙不算离开。
 4. **工作区** —— 侧栏「工作区」标题改成 **进行中 / 已归档** 分段控件：进行中沿用宿主的会话树，已归档是皮肤自己的平铺列表（标题、时间、每行「取消归档」与「删除」两个图标按钮）。行排版与宿主的会话行逐项一致（行 x=12 / 宽 251 / 高 28 / 标题起点 x=36）。
 5. **侧栏** —— 新会话与插件两行取 Claude 真机形状：默认无底色、hover 才有底色，新会话的「＋」套一枚圆形底，两行图标 hover 顺时针转 90°（四重对称图形，转回原位）；底部账户抽屉、封号彩蛋一并保留。

package/docs/architecture.md

@@ -84,7 +84,7 @@
 ## D11. 插件自有路由借宿主的请求栅栏；宿主/用户来源的字符串只以文本上屏
 
 - **背景**：`webServer.register()` 交给插件的是裸请求。宿主自己的 `/api` 挂在 Host/Origin 栅栏与浏览器会话 cookie 之后（`connection.requestRejection()`），插件路由不在其内。本插件的 `/username`（读系统用户名）因此曾经完全无鉴权：`dsh web` 绑定 `0.0.0.0` 时局域网里任何人都能直接读。读到的用户名又被客户端拼进 `innerHTML`——实测在 GUI 页面里执行了脚本，而这个页面能驱动执行 shell 命令的智能体。
-- **决定**：宿主半边 `/username` 处理前先调 `ctx.get('connection').requestRejection(req)`，拒绝即回 401/403。宿主没有该服务时，插件自带的替身只服务回环（回环 Host、无跨站标记、Origin 与 Host 一致）。模型文案与字体等静态资产保持公开。客户端：一切来自设置、账号服务、系统或第三方插件的字符串只用 `textContent` / 元素属性写入，图标复制节点而非重新解析 markup。
+- **决定**：宿主半边 `/username` 处理前先调 `ctx.get('connection').requestRejection(req)`，拒绝即回 401/403。宿主没有该服务时，插件自带的替身只服务回环（回环 Host、无跨站标记、Origin 与 Host 一致）。模型文案与字体等静态资产保持公开。删除会话的私有路由 `POST /dsh-claude-style/session-delete` 同样先过栅栏，另加四道：只接受 POST，id 必须匹配宿主自身的会话 id 形状，正在打开的会话拒绝，目录解析后必须留在会话根目录内（删除发生在宿主半边，浏览器半边只提交一个 id）。客户端：一切来自设置、账号服务、系统或第三方插件的字符串只用 `textContent` / 元素属性写入，图标复制节点而非重新解析 markup。
 - **代价**：路由依赖宿主的 connection 服务。已核对两种壳都能通过：浏览器同源请求带会话 cookie；0.1.7 桌面壳经 `forwardWebRequest` 转发到回环 Host、剥掉页面 Origin 并自带 cookie（宿主真实的 `isTrustedApiRequest` 对这两种请求放行，对跨站与 DNS 重绑定请求拒绝）。
 - **重审条件**：宿主为插件提供自带鉴权的路由注册（如 `connection.fetch.register`）时，迁移过去并删掉本地替身。
 

package/lib/client.js

@@ -199,7 +199,8 @@ window.__ModuleLoader__.load({
     var PERMISSION_SEGMENTS = [
       { label: 'Read', preset: 'read-only' },
       { label: 'Edit', preset: 'workspace-write' },
-      { label: 'Auto', preset: 'danger-full-access' },
+      { label: 'Auto', preset: 'auto' },
+      { label: 'Yolo', preset: 'danger-full-access' },
     ]
 
     /** In-conversation permission popover options matching Claude Code desktop style. */
@@ -214,6 +215,11 @@ window.__ModuleLoader__.load({
         label: 'Accept edits',
         desc: '允许编辑工作区文件'
       },
+      {
+        preset: 'auto',
+        label: 'Auto review',
+        desc: '无沙箱运行，调用前由模型审查'
+      },
       {
         preset: 'danger-full-access',
         label: 'Full access',
@@ -221,12 +227,15 @@ window.__ModuleLoader__.load({
       }
     ]
 
-    /** The one preset the shipped UI gates behind its risk-confirmation dialog. */
+    /** The presets the shipped UI gates behind its risk-confirmation dialog. */
     var GATED_PRESET = 'danger-full-access'
-    /** Shipped full-access row labels, used to find that row in the shipped menu. */
+    var AUTO_REVIEW_PRESET = 'auto'
+    /** Shipped risk-gated row labels, used to find those rows in the shipped menu. */
     var FULL_ACCESS_LABELS = ['完全权限', 'Full access']
-    /** Fallback prompt, used only when the shipped menu cannot be reached. */
-    var GATED_PROMPT = '启用完全权限（Auto）？\n\n智能体将减少确认步骤，可直接执行敏感操作、文件修改或外部命令。仅建议在你信任当前任务时使用。'
+    var AUTO_REVIEW_LABELS = ['Auto review', 'Auto review EXP']
+    /** Fallback prompts, used only when the shipped menu cannot be reached. */
+    var GATED_PROMPT = '启用完全权限（Yolo）？\n\n智能体将减少确认步骤，可直接执行敏感操作、文件修改或外部命令。仅建议在你信任当前任务时使用。'
+    var AUTO_REVIEW_PROMPT = '启用 Auto review（实验）？\n\nAuto review 不使用沙箱。每次原生工具调用和 PTC 内层调用前，都会由与当前 agent 相同的模型进行审查。此功能仍属实验性，可能误放行或误拒绝，并会消耗额外 token。'
 
     /** Skin-owned class names, so nothing couples to hashed CSS-module classes. */
     var SEGMENTS_CLASS = 'dsh-claude-segments'
@@ -307,6 +316,14 @@ window.__ModuleLoader__.load({
      * document and the stylesheet switches on this attribute.
      */
     var WINDOW_BLUR_ATTR = 'data-dsh-window-blur'
+    /**
+     * The host half's session-deletion route (lib/index.js, SESSION_DELETE_PATH).
+     * The harness gives the browser half no deletion API of its own, so the
+     * archived row's delete button posts the session id here and the host half
+     * removes the stored session directory. Keep the path in step with the host
+     * half.
+     */
+    var SESSION_DELETE_ROUTE = '/dsh-claude-style/session-delete'
     /** Composer surfaces the restyle may cover, in settings order. */
     var COMPOSER_SCOPES = ['off', 'hero', 'conversation', 'all']
     /**
@@ -2903,7 +2920,12 @@ window.__ModuleLoader__.load({
       "body[data-dsh-claude-style] [class*=\"projectRow\"][aria-expanded=\"false\"] [class*=\"chevron\"]::after {",
       "  transform: rotate(-90deg);",
       "}",
-      "/* Session status circle indicator (matching Claude style) */",
+      "/* Session status circle indicator (matching Claude style). The host's newer",
+      "   sidebar renders the leading seat through a slot outlet, whose anchor",
+      "   (`div[data-slot]`, display:contents) is a child of the seat even when nothing",
+      "   is registered — an idle row's seat is therefore no longer :empty, so the",
+      "   circle hangs on the empty anchor as well. A seat carrying status dots or",
+      "   another plugin's content keeps its own paint and gets no circle. */",
       "body[data-dsh-claude-style] [class*=\"sessionRow\"] [class*=\"slot\"] {",
       "  width: 14px !important;",
       "  height: 16px !important;",
@@ -2911,7 +2933,8 @@ window.__ModuleLoader__.load({
       "  align-items: center !important;",
       "  justify-content: center !important;",
       "}",
-      "body[data-dsh-claude-style] [class*=\"sessionRow\"] [class*=\"slot\"]:empty::after {",
+      "body[data-dsh-claude-style] [class*=\"sessionRow\"] [class*=\"slot\"]:empty::after,",
+      "body[data-dsh-claude-style] [class*=\"sessionRow\"] [class*=\"slot\"] > [data-slot]:empty::after {",
       "  content: \"\";",
       "  display: inline-block;",
       "  width: 5px;",
@@ -2988,7 +3011,7 @@ window.__ModuleLoader__.load({
       "/* --- 2.4 Custom Components (Segments & Account Popover) --- */",
       "/* ---------- Claude Code layout: permission segments ---------- */",
       "/* The shipped access control is one popup-select button; it is replaced by",
-      "   a Read | Edit | Auto segmented control over the same three presets — for",
+      "   a Read | Edit | Auto | Yolo segmented control over presets — for",
       "   as long as the permission control is installed to stand in for it. */",
       "body[data-dsh-claude-style][data-dsh-claude-composer-active][data-dsh-claude-permissions] button[aria-label^=\"访问模式\"],",
       "body[data-dsh-claude-style][data-dsh-claude-composer-active][data-dsh-claude-permissions] button[aria-label^=\"Access mode\"] {",
@@ -3039,6 +3062,14 @@ window.__ModuleLoader__.load({
       "  box-shadow: 0 1px 2px rgba(20, 20, 19, 0.08);",
       "}",
       "",
+      "/* Rows whose preset the host's permission catalog does not carry (the Auto",
+      "   review tier without the auto-review integration) are taken out of the",
+      "   control entirely. */",
+      "body[data-dsh-claude-style] .dsh-claude-segment[data-hidden],",
+      "body[data-dsh-claude-style] .dsh-claude-perm-popover .dsh-claude-popover-item[data-hidden] {",
+      "  display: none !important;",
+      "}",
+      "",
       "/* ---------- Claude Code layout: in-conversation permission popover ---------- */",
       "body[data-dsh-claude-style] .dsh-claude-perm-container {",
       "  position: relative !important;",
@@ -3230,15 +3261,24 @@ window.__ModuleLoader__.load({
       "  flex-direction: column !important;",
       "  gap: 6px !important;",
       "  opacity: 0 !important;",
+      "  /* The drawer's rows are built and reconciled while it is closed (the mirror",
+      "     sync only runs then), so the panel sits right above the account row with",
+      "     its icons in it. opacity alone leaves that content in the paint and",
+      "     hit-test tree; visibility takes it out of both, and the delayed transition",
+      "     keeps the closing fade. Layout is untouched, so the closed drawer's box is",
+      "     still measurable. */",
+      "  visibility: hidden !important;",
       "  pointer-events: none !important;",
       "  transform: translateY(6px) scale(0.98) !important;",
       "  transform-origin: bottom left !important;",
-      "  transition: opacity 0.15s ease, transform 0.15s ease !important;",
+      "  transition: opacity 0.15s ease, transform 0.15s ease, visibility 0s linear 0.15s !important;",
       "}",
       "body[data-dsh-claude-style] .dsh-claude-account-popover[data-open=\"true\"] {",
       "  opacity: 1 !important;",
+      "  visibility: visible !important;",
       "  pointer-events: auto !important;",
       "  transform: translateY(0) scale(1) !important;",
+      "  transition: opacity 0.15s ease, transform 0.15s ease, visibility 0s !important;",
       "}",
       "body[data-dsh-claude-style][data-ds-dark-theme] .dsh-claude-account-popover {",
       "  background: #1e1e1d !important;",
@@ -6706,49 +6746,114 @@ window.__ModuleLoader__.load({
           return rows
         }
 
-        function statsPanelData(selector) {
-          var panel = document.querySelector(selector)
-          return {
-            title: panel === null ? '' : (panel.getAttribute('aria-label') || ''),
-            rows: statsRowsFrom(panel),
+        /** How long one pill's panel may take to mount (the host commits on its own schedule). */
+        var STATS_PANEL_POLL_MS = 25
+        var STATS_PANEL_ATTEMPTS = 32
+        /** When a click is repeated inside that window, and how often. */
+        var STATS_PANEL_REPRESS_AT = 12
+        var STATS_PANEL_REPRESS_MAX = 2
+        /** How often a read that could not open a panel is retried, and after what delay. */
+        var STATS_READ_RETRIES = 1
+        var STATS_RETRY_MS = 120
+        /** How long after a short card the one late re-read runs. */
+        var STATS_FILL_MS = 700
+
+        /** The stats panel that is open right now, with the kind its own marker names. */
+        function openStatsPanel() {
+          var details = document.querySelector('[data-session-stats-details]')
+          if (details !== null) {
+            var detailsDialog = details.closest('[role="dialog"]')
+            if (detailsDialog !== null) return { kind: 'details', panel: detailsDialog }
+          }
+          var usage = document.querySelector('[data-session-stats-usage]')
+          if (usage !== null) {
+            var usageDialog = usage.closest('[role="dialog"]')
+            if (usageDialog !== null) return { kind: 'usage', panel: usageDialog }
           }
+          return null
         }
 
-        function withStatsPanel(button, selector, done) {
-          if (button === null) { done({ title: '', rows: [] }); return }
-          if (button.getAttribute('aria-expanded') !== 'true') button.click()
+        /** The row's pill buttons as they are right now (the host replaces them on re-render). */
+        function statsPillAt(index) {
+          var root = statsRoot()
+          if (root === null) return null
+          var buttons = root.querySelectorAll('button')
+          return index < buttons.length ? buttons[index] : null
+        }
+
+        /**
+         * Open one pill, read whichever stats panel it shows, and close it again.
+         *
+         * The read is kind-agnostic on purpose: which panel appears is the host's
+         * own answer, so a pill is never mislabelled by its label text (the timing
+         * pill's label carries a tok/s reading as well, and the timing pill is a
+         * plain span — no trigger at all — while the session has no timing yet).
+         * The panel counts only while that pill reports itself expanded, so a
+         * sibling's panel that has not unmounted yet is never read as this one's.
+         * The pill is re-resolved from the DOM at every step and pressed again
+         * while the window lasts: the host re-renders the row on its own schedule,
+         * and a click on a node it has since replaced goes nowhere. `null` means
+         * the row has no such pill; a pill that shows no panel inside the window
+         * reports a failure, which is not an absent section.
+         */
+        function readStatsPill(index, done) {
+          var presses = 0
+          function press() {
+            var pill = statsPillAt(index)
+            if (pill === null) return false
+            if (pill.getAttribute('aria-expanded') !== 'true') pill.click()
+            return true
+          }
+          if (!press()) { done(null); return }
           var attempts = 0
           function read() {
-            var panel = document.querySelector(selector)
-            if (panel === null && attempts < 15) {
+            var pill = statsPillAt(index)
+            if (pill === null) { done({ failed: true, rows: [] }); return }
+            var open = pill.getAttribute('aria-expanded') === 'true' ? openStatsPanel() : null
+            if (open === null && attempts < STATS_PANEL_ATTEMPTS) {
               attempts += 1
-              setTimeout(read, 20)
+              if (attempts === STATS_PANEL_REPRESS_AT && presses < STATS_PANEL_REPRESS_MAX) {
+                presses += 1
+                press()
+              }
+              setTimeout(read, STATS_PANEL_POLL_MS)
               return
             }
-            var data = statsPanelData(selector)
-            if (button.getAttribute('aria-expanded') === 'true') button.click()
-            done(data)
+            if (pill.getAttribute('aria-expanded') === 'true') pill.click()
+            if (open === null) { done({ failed: true, rows: [] }); return }
+            done({ kind: open.kind, title: open.panel.getAttribute('aria-label') || '', rows: statsRowsFrom(open.panel) })
           }
-          setTimeout(read, 20)
+          setTimeout(read, STATS_PANEL_POLL_MS)
         }
 
+        /**
+         * Read both of the host's pills.
+         *
+         * `done(sections, incomplete)`: the sections in the host's own order
+         * (session statistics, then token usage), and `incomplete` true when a
+         * pill the row carries could not be read — the caller must not mistake
+         * that for a section the host does not have.
+         */
         function collectStatsData(done) {
-          var root = statsRoot()
-          if (root === null) { done([]); return }
-          var buttons = root.querySelectorAll('button')
-          var timeBtn = null
-          var usageBtn = null
-          for (var i = 0; i < buttons.length; i++) {
-            var aria = buttons[i].getAttribute('aria-label') || ''
-            if (/轮|步|turns?|steps?/i.test(aria)) timeBtn = buttons[i]
-            else usageBtn = buttons[i]
-          }
-          withStatsPanel(timeBtn, '[role="dialog"]:has([data-session-stats-details])', function (timeData) {
-            withStatsPanel(usageBtn, '[role="dialog"]:has([data-session-stats-usage])', function (usageData) {
+          if (statsRoot() === null) { done([], false); return }
+          readStatsPill(0, function (first) {
+            readStatsPill(1, function (second) {
+              var reads = [first, second]
               var sections = []
-              if (timeData.rows.length > 0) sections.push(timeData)
-              if (usageData.rows.length > 0) sections.push(usageData)
-              done(sections)
+              var incomplete = false
+              for (var i = 0; i < reads.length; i++) {
+                var read = reads[i]
+                if (read === null) continue
+                if (read.failed === true || read.rows.length === 0) {
+                  incomplete = true
+                  continue
+                }
+                sections.push(read)
+              }
+              sections.sort(function (a, b) {
+                return (a.kind === 'details' ? 0 : 1) - (b.kind === 'details' ? 0 : 1)
+              })
+              done(sections, incomplete)
             })
           })
         }
@@ -6816,12 +6921,34 @@ window.__ModuleLoader__.load({
           pop.innerHTML = html
         }
 
-        /** The last full read; a thinner one never replaces it while the card is up. */
+        /** Whether the card is up, so a failed re-read can leave its content alone. */
+        function isStatsPopoverOpen() {
+          return statsPopover !== null && statsPopover.getAttribute('data-open') === 'true'
+        }
 
-        var statsSections = null
+        /** How many sections the card currently shows. */
+        var renderedSections = 0
 
-        var statsSectionsAt = 0
+        /** Place the card above the stats row, clamped to the viewport. */
+        function placeStatsPopover(anchor) {
+          var pop = ensureStatsPopover()
+          var live = statsRoot() || anchor
+          if (live === null) return
+          var rect = live.getBoundingClientRect()
+          var width = pop.offsetWidth
+          var height = pop.offsetHeight
+          var left = Math.max(8, Math.min(rect.left + rect.width / 2 - width / 2, window.innerWidth - width - 8))
+          var top = Math.max(8, rect.top - height - 8)
+          pop.style.left = left + 'px'
+          pop.style.top = top + 'px'
+        }
 
+        function showStatsSections(anchor, sections) {
+          renderStatsPopover(sections)
+          renderedSections = sections.length
+          ensureStatsPopover().setAttribute('data-open', 'true')
+          placeStatsPopover(anchor)
+        }
 
         function showStatsPopover(anchor) {
           // The card reads the host's two dialogs, which only the detailed row
@@ -6833,29 +6960,40 @@ window.__ModuleLoader__.load({
             clearTimeout(statsHideTimer)
             statsHideTimer = null
           }
-          collectStatsData(function (sections) {
+          readStatsCard(anchor, 0)
+        }
+
+        /**
+         * Collect the host's panels and render the card.
+         *
+         * A read that could not open one of the panels is retried, and one that
+         * still comes back short while the card is already up leaves the card as
+         * it is: the host's panels mount on its own commit, so a read that lost
+         * the race must never read as a section the host does not have — that was
+         * the 'click and it drops to Token usage only' card. A card that did come
+         * up short schedules one late re-read, which fills it in and never
+         * shrinks it.
+         */
+        function readStatsCard(anchor, attempt) {
+          collectStatsData(function (sections, incomplete) {
             if (sections.length === 0) return
-            // A click re-collects, and the host's two pills can be mid-flight then: a read
-            // that comes back with fewer sections than the card already shows must not
-            // shrink it — that is the 'click and it drops to Token usage only' bug.
-            var fresh = Date.now() - statsSectionsAt < 180000
-            if (statsSections !== null && fresh && sections.length < statsSections.length) {
-              sections = statsSections
-            } else {
-              statsSections = sections
-              statsSectionsAt = Date.now()
+            if (incomplete && attempt < STATS_READ_RETRIES) {
+              setTimeout(function () { readStatsCard(anchor, attempt + 1) }, STATS_RETRY_MS)
+              return
             }
-            renderStatsPopover(sections)
-            var pop = ensureStatsPopover()
-            pop.setAttribute('data-open', 'true')
-            var live = statsRoot() || anchor
-            var rect = live.getBoundingClientRect()
-            var width = pop.offsetWidth
-            var height = pop.offsetHeight
-            var left = Math.max(8, Math.min(rect.left + rect.width / 2 - width / 2, window.innerWidth - width - 8))
-            var top = Math.max(8, rect.top - height - 8)
-            pop.style.left = left + 'px'
-            pop.style.top = top + 'px'
+            if (incomplete && isStatsPopoverOpen()) return
+            showStatsSections(anchor, sections)
+            if (incomplete) setTimeout(function () { fillStatsCard(anchor) }, STATS_FILL_MS)
+          })
+        }
+
+        /** One late re-read for a card that came up short; it only ever adds. */
+        function fillStatsCard(anchor) {
+          collectStatsData(function (sections, incomplete) {
+            if (incomplete || sections.length === 0) return
+            if (!isStatsPopoverOpen()) return
+            if (sections.length <= renderedSections) return
+            showStatsSections(anchor, sections)
           })
         }
 
@@ -7015,6 +7153,134 @@ window.__ModuleLoader__.load({
       var permPopover = null
       var permHoverIntent = null
 
+      /**
+       * Whether the host's permission catalog carries the live Auto review
+       * preset (`auto`, registered by the auto-review plugin): true or false
+       * once a catalog read settled, null until then. While unknown the rows
+       * stay hidden, the way the shipped picker renders nothing before its
+       * first catalog read.
+       */
+      var autoPresetLive = null
+      /** The first catalog failure; thrown on the next sync to retire the feature. */
+      var autoPresetError = null
+      var catalogFiber = null
+      var catalogChangedDisposer = null
+
+      /** The Auto review rows are only offered while the host's catalog carries the preset. */
+      function rowVisible(preset) {
+        return preset !== AUTO_REVIEW_PRESET || autoPresetLive === true
+      }
+
+      /**
+       * Mirror the availability onto a row as data-hidden; the stylesheet turns
+       * that into display:none (an inline style would lose to the popover
+       * item's own `display: flex !important`).
+       */
+      function syncRowVisibility(row, preset) {
+        if (rowVisible(preset)) {
+          if (row.hasAttribute('data-hidden')) row.removeAttribute('data-hidden')
+        } else if (!row.hasAttribute('data-hidden')) {
+          row.setAttribute('data-hidden', '')
+        }
+      }
+
+      /**
+       * Read the host's permission catalog and record whether it carries the
+       * live Auto review preset. The shipped picker builds its rows from the
+       * same catalog, so it is the authority on what is switchable. A rejected
+       * read retries like the account profile's reads (the client connection
+       * may still be coming up at install); once the retries are exhausted the
+       * failure is remembered and thrown on the next sync, which retires this
+       * feature and hands the shipped access button back (D12).
+       */
+      var AUTO_PRESET_RETRY_MS = [1000, 5000]
+      var autoPresetRetries = 0
+      var autoPresetRead = 0
+      var autoPresetRetry = null
+
+      /** Invalidate the read in flight and drop any retry still waiting. */
+      function dropAutoPresetRead() {
+        autoPresetRead++
+        if (autoPresetRetry !== null) {
+          clearTimeout(autoPresetRetry)
+          autoPresetRetry = null
+        }
+      }
+
+      function probeAutoPreset() {
+        var namespace = null
+        try { namespace = ctx.get('remote.permissionPresets') } catch (error) { namespace = null }
+        if (namespace === null || namespace === void 0 || typeof namespace.catalog !== 'function') {
+          if (typeof ctx.inject !== 'function') {
+            autoPresetError = new Error('permission: the host exposes no remote.permissionPresets catalog')
+            ui.schedule()
+          }
+          return
+        }
+        dropAutoPresetRead()
+        var read = autoPresetRead
+        namespace.catalog().then(function (result) {
+          if (read !== autoPresetRead) return
+          if (result === null || typeof result !== 'object' || result.ok !== true ||
+              result.value === null || typeof result.value !== 'object' ||
+              !Array.isArray(result.value.options)) {
+            autoPresetError = new Error('permission: unexpected permissionPresets catalog shape')
+            ui.schedule()
+            return
+          }
+          autoPresetRetries = 0
+          autoPresetError = null
+          var live = false
+          for (var i = 0; i < result.value.options.length; i++) {
+            var option = result.value.options[i]
+            if (option !== null && typeof option === 'object' && option.value === AUTO_REVIEW_PRESET) {
+              live = true
+              break
+            }
+          }
+          autoPresetLive = live
+          ui.schedule()
+        }, function () {
+          if (read !== autoPresetRead) return
+          if (autoPresetRetries >= AUTO_PRESET_RETRY_MS.length) {
+            autoPresetError = new Error('permission: the permissionPresets catalog read failed ' + (AUTO_PRESET_RETRY_MS.length + 1) + ' times')
+            ui.schedule()
+            return
+          }
+          autoPresetRetry = setTimeout(function () {
+            autoPresetRetry = null
+            probeAutoPreset()
+          }, AUTO_PRESET_RETRY_MS[autoPresetRetries++])
+        })
+      }
+
+      /**
+       * The namespace may register after this plugin (the host registers each
+       * remote namespace as its package loads), so wait for it the way the
+       * account row waits for remote.account; a host without inject gets one
+       * read now. The catalog-changed event re-reads when the auto-review
+       * integration is registered or dropped while the page stays open.
+       */
+      function startAutoPresetProbe() {
+        if (typeof ctx.inject === 'function') {
+          catalogFiber = ctx.inject(['remote.permissionPresets'], function (scope) {
+            scope.effect(function () {
+              probeAutoPreset()
+              return function () {}
+            }, 'dsh-claude-style: permission catalog')
+          })
+        } else {
+          probeAutoPreset()
+        }
+        var remoteRoot = null
+        try { remoteRoot = ctx.get('remote') } catch (error) { remoteRoot = null }
+        if (remoteRoot !== null && remoteRoot !== void 0 && typeof remoteRoot.$on === 'function') {
+          catalogChangedDisposer = remoteRoot.$on('permission-presets/catalog-changed', function () {
+            probeAutoPreset()
+          })
+        }
+      }
+
       function buildSegments(onPick) {
         var group = document.createElement('div')
         group.className = SEGMENTS_CLASS
@@ -7183,7 +7449,9 @@ window.__ModuleLoader__.load({
 
       function updatePermState(preset) {
         if (!permLabel || !permPopover) return
-        var matchedLabel = 'Accept edits'
+        // A preset our option list does not carry (the host's `custom`, or a
+        // row this host's catalog does not offer) shows its machine value.
+        var matchedLabel = preset === null ? 'Accept edits' : preset
         for (var i = 0; i < PERMISSION_OPTIONS.length; i++) {
           if (PERMISSION_OPTIONS[i].preset === preset) {
             matchedLabel = PERMISSION_OPTIONS[i].label
@@ -7198,7 +7466,8 @@ window.__ModuleLoader__.load({
         var items = permPopover.querySelectorAll('[data-preset]')
         for (var j = 0; j < items.length; j++) {
           var it = items[j]
-          var isCurrent = it.getAttribute('data-preset') === preset
+          var rowPreset = it.getAttribute('data-preset')
+          var isCurrent = rowPreset === preset
           var check = it.querySelector('.dsh-claude-perm-check')
           if (check) {
             check.style.display = isCurrent ? 'inline' : 'none'
@@ -7208,6 +7477,7 @@ window.__ModuleLoader__.load({
           } else {
             it.removeAttribute('data-active')
           }
+          syncRowVisibility(it, rowPreset)
         }
       }
 
@@ -7219,29 +7489,42 @@ window.__ModuleLoader__.load({
       }
 
       /**
-       * Drive the shipped access menu to its full-access row, so the switch
-       * runs through the shipped risk-confirmation dialog rather than a
+       * Drive the shipped access menu to its risk-gated row (Full access or Auto review),
+       * so the switch runs through the shipped risk-confirmation dialog rather than a
        * skin-owned prompt. The trigger is hidden by this skin but still in
        * the tree, so a synthetic click still opens the menu; the row is then
        * picked by its label. A plain confirm stands in only when that menu
        * cannot be reached, which keeps the switch behind an explicit
        * acknowledgement either way.
        */
-      function openShippedGate() {
+      var gateInFlight = false
+
+      function openShippedGate(preset) {
+        if (gateInFlight) return
+        var isAuto = preset === AUTO_REVIEW_PRESET
+        var targetLabels = isAuto ? AUTO_REVIEW_LABELS : FULL_ACCESS_LABELS
+        var prompt = isAuto ? AUTO_REVIEW_PROMPT : GATED_PROMPT
         var trigger = findAccessTrigger()
         if (trigger === null) {
-          if (window.confirm(GATED_PROMPT)) submitPreset(GATED_PRESET)
+          if (window.confirm(prompt)) submitPreset(preset)
           return
         }
+        gateInFlight = true
         trigger.click()
         var attempts = 0
         function seek() {
-          var items = document.querySelectorAll('[role="menu"] button[role="menuitem"]')
+          // The skin's own popover is itself a role=menu whose row texts start
+          // with the same labels, so it must stay out of this search — matching
+          // it would click back into pick() and toggle the shipped menu every
+          // frame. The shipped Auto review row concatenates its EXP badge into
+          // the text ("Auto reviewEXP"), so the label matches as a prefix.
+          var items = document.querySelectorAll('[role="menu"]:not(.dsh-claude-perm-popover) button[role="menuitem"]')
           for (var i = 0; i < items.length; i++) {
             var text = (items[i].textContent || '').trim()
-            for (var j = 0; j < FULL_ACCESS_LABELS.length; j++) {
-              if (text === FULL_ACCESS_LABELS[j]) {
+            for (var j = 0; j < targetLabels.length; j++) {
+              if (text.indexOf(targetLabels[j]) === 0) {
                 items[i].click()
+                gateInFlight = false
                 return
               }
             }
@@ -7251,8 +7534,9 @@ window.__ModuleLoader__.load({
             requestAnimationFrame(seek)
             return
           }
+          gateInFlight = false
           trigger.click()
-          if (window.confirm(GATED_PROMPT)) submitPreset(GATED_PRESET)
+          if (window.confirm(prompt)) submitPreset(preset)
         }
         requestAnimationFrame(seek)
       }
@@ -7261,8 +7545,8 @@ window.__ModuleLoader__.load({
         var session = currentSession(ctx)
         if (session === null || preset === null) return
         if (preset === currentPreset(session)) return
-        if (preset === GATED_PRESET) {
-          openShippedGate()
+        if (preset === GATED_PRESET || preset === AUTO_REVIEW_PRESET) {
+          openShippedGate(preset)
           return
         }
         submitPreset(preset)
@@ -7327,6 +7611,7 @@ window.__ModuleLoader__.load({
           }
           for (var j = 0; j < segments.children.length; j++) {
             var item = segments.children[j]
+            syncRowVisibility(item, item.getAttribute('data-preset'))
             if (item.getAttribute('data-preset') === preset) {
               item.setAttribute('data-active', '')
               item.setAttribute('aria-checked', 'true')
@@ -7366,6 +7651,7 @@ window.__ModuleLoader__.load({
 
       ui.permissions = {
         sync: function () {
+          if (autoPresetError !== null) throw autoPresetError
           stats.sync()
           syncSegments()
         },
@@ -7383,10 +7669,20 @@ window.__ModuleLoader__.load({
       // The composer restyle hides the host's access button and statistics
       // dialogs only while this says their replacement is installed.
       document.body.setAttribute(PERMISSIONS_ATTR, '')
+      startAutoPresetProbe()
 
       return function () {
         stats.teardown()
         if (permHoverIntent) permHoverIntent.cancel()
+        dropAutoPresetRead()
+        if (catalogFiber !== null && typeof catalogFiber.dispose === 'function') {
+          try { catalogFiber.dispose() } catch (error) { /* the fiber may already be gone */ }
+          catalogFiber = null
+        }
+        if (catalogChangedDisposer !== null) {
+          catalogChangedDisposer()
+          catalogChangedDisposer = null
+        }
         if (permDocPointerListener) {
           document.removeEventListener('pointerdown', permDocPointerListener)
           permDocPointerListener = null
@@ -7398,6 +7694,7 @@ window.__ModuleLoader__.load({
         }
         removeStrayNodes(document, '.' + SEGMENTS_CLASS + '[data-composer-segments], .dsh-claude-perm-container', [])
         segments = null
+        gateInFlight = false
         if (permPopover !== null && permPopover.parentElement !== null) permPopover.parentElement.removeChild(permPopover)
         permPopover = null
         permBtn = null
@@ -10872,6 +11169,12 @@ window.__ModuleLoader__.load({
         var footerEntries = syncFooterActionVisibility(footerActions)
         var body = options.body()
 
+        // A closed host drawer has no container to mirror into, but the entries
+        // above are hidden in place all the same: the host re-renders them, and a
+        // pass that skips this leaves their icons painted in the sidebar until the
+        // drawer is opened once.
+        if (body === null) return
+
         // While the popover is open, its mirrors must stay completely static:
         // a content rewrite, reorder, or embedded-clone replacement under the
         // pointer cancels the browser's :hover state and can swallow the click
@@ -11562,10 +11865,15 @@ window.__ModuleLoader__.load({
         syncAccountRowBox(entryRow, footArea)
         if (hostTrigger !== null) bindHostRowHover(hostTrigger)
 
+        // The host's footer entries are hidden in place on every pass, drawer or
+        // no drawer: the host re-renders them, and a pass that skipped this left
+        // their icons painted beside the account row until the drawer had been
+        // opened once. Only the mirroring needs a container to write into.
+        mirror.sync(footArea)
+
         var root = surface.mode() === 'host' ? surface.container() : accountPopover
         if (root === null) return
         rows.syncHeader(root, hostTrigger)
-        mirror.sync(footArea)
         // The rail toggle (and any reflow) moves the anchor without a window
         // resize or a page scroll, so an open drawer re-resolves its position at
         // the end of its own pass.
@@ -12278,11 +12586,26 @@ window.__ModuleLoader__.load({
         if (sessions !== undefined && sessions !== null && typeof sessions.open === 'function') sessions.open(id)
       }
 
+      /**
+       * Delete one stored session through the host half's own route.
+       *
+       * The harness gives the browser half no deletion API of its own (the
+       * workspace controller archives and unarchives; the agent protocol's
+       * session delete is the host delegating to an ACP agent that owns the
+       * storage), so the skin's host half removes the session's stored directory
+       * and answers here. The row stays on any refusal — the host refuses a live
+       * session, and the next read tells the truth.
+       */
       function removeArchived(id) {
-        var registry = service('remote.workspaceRegistry')
-        if (registry === undefined || registry === null || typeof registry.deleteSession !== 'function') return
-        registry.deleteSession(id).then(function (result) {
-          if (!result || result.ok !== true) return
+        fetch(SESSION_DELETE_ROUTE, {
+          method: 'POST',
+          credentials: 'same-origin',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ sessionId: id }),
+        }).then(function (response) {
+          return response.ok ? response.json() : null
+        }).then(function (result) {
+          if (result === null || result.ok !== true) return
           if (items !== null) items = items.filter(function (row) { return row.id !== id })
           renderList()
         }).catch(function () { /* the row stays; the next read tells the truth */ })

package/lib/index.js

@@ -28,9 +28,9 @@
  * the module graph and the whole skin with it. The browser half falls back to
  * its defaults when either surface is missing.
  */
-import { readFileSync } from 'node:fs'
-import { userInfo } from 'node:os'
-import { dirname, join } from 'node:path'
+import { readFileSync, readdirSync, rmSync, statSync } from 'node:fs'
+import { homedir, userInfo } from 'node:os'
+import { dirname, join, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 export const name = 'dsh-claude-style'
@@ -56,6 +56,22 @@ const FONT_FILES = {
 }
 /** One-shot host OS user route; the browser half caches the response. */
 const USERNAME_PATH = `${ROUTE_PREFIX}/username`
+/**
+ * Session deletion.
+ *
+ * The harness gives the browser half no deletion API of its own: the workspace
+ * controller archives and unarchives, and the agent protocol's session delete is
+ * the host delegating to an ACP agent that owns the storage. The archived row's
+ * delete button therefore comes here, where the stored session directory under
+ * the harness home can be removed. The path is also spelled in
+ * src/constants.js (SESSION_DELETE_ROUTE) for the browser half; keep the two in
+ * step.
+ */
+const SESSION_DELETE_PATH = `${ROUTE_PREFIX}/session-delete`
+/** Session ids are the harness's own shape; anything else is refused before it reaches a path. */
+const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/
+/** Largest deletion request body read; a real one carries one id. */
+const DELETE_BODY_MAX = 4096
 
 /** The namespace an older host knows this plugin's preferences by. */
 const LEGACY_SETTINGS_NAMESPACE = 'claude-style'
@@ -269,6 +285,129 @@ function sendJson(res, status, payload) {
   res.end(body)
 }
 
+/** The harness sessions root: `<DSH home>/sessions`, resolved the host's own way. */
+function sessionsRoot(ctx) {
+  try {
+    const dshHomePath = ctx.get('dshHomePath')
+    if (typeof dshHomePath === 'function') return dshHomePath('sessions')
+  } catch { /* no home-path service: fall back to the environment */ }
+  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+  return join(home, 'sessions')
+}
+
+/**
+ * Whether the host holds this session open right now.
+ *
+ * A live session's log is open and being appended to, so its directory must not
+ * be removed under the writer. When the live set cannot be read, the answer is
+ * "live": an unreadable set cannot authorize the deletion.
+ */
+function sessionIsLive(ctx, sessionId) {
+  let sessions = null
+  try {
+    sessions = ctx.get('sessions')
+  } catch {
+    sessions = null
+  }
+  if (sessions === null || sessions === undefined) return false
+  try {
+    if (typeof sessions.get === 'function') {
+      const found = sessions.get(sessionId)
+      return found !== undefined && found !== null
+    }
+    if (typeof sessions.list === 'function') {
+      const listed = sessions.list()
+      if (Array.isArray(listed)) {
+        return listed.some((item) => (typeof item === 'string' ? item : item?.id ?? item?.sessionId) === sessionId)
+      }
+    }
+  } catch {
+    return true
+  }
+  return true
+}
+
+/** One bounded request body, or null when it is oversized or unreadable. */
+function readRequestBody(req, limit) {
+  return new Promise((settle) => {
+    const chunks = []
+    let size = 0
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > limit) {
+        settle(null)
+        req.destroy()
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => settle(Buffer.concat(chunks).toString('utf8')))
+    req.on('error', () => settle(null))
+  })
+}
+
+/**
+ * Delete one stored session: the directory named by the id under one of the
+ * sessions root's working-directory directories.
+ *
+ * The id never reaches a path unchecked — it must match the harness's own
+ * shape, the lookup is by exact name, and the resolved directory must stay
+ * inside the sessions root.
+ */
+async function deleteSession(ctx, req, res) {
+  const refused = refusalOf(ctx, req)
+  if (refused !== undefined) {
+    sendJson(res, refused, { ok: false, error: refused === 401 ? 'unauthorized' : 'forbidden' })
+    return
+  }
+  const raw = await readRequestBody(req, DELETE_BODY_MAX)
+  let request = null
+  try {
+    request = raw === null ? null : JSON.parse(raw)
+  } catch {
+    request = null
+  }
+  const sessionId = request !== null && typeof request.sessionId === 'string' ? request.sessionId : ''
+  if (!SESSION_ID_RE.test(sessionId)) {
+    sendJson(res, 400, { ok: false, error: 'invalid session id' })
+    return
+  }
+  if (sessionIsLive(ctx, sessionId)) {
+    sendJson(res, 409, { ok: false, error: 'session is open' })
+    return
+  }
+  const root = resolve(sessionsRoot(ctx))
+  let dir = null
+  try {
+    for (const entry of readdirSync(root)) {
+      const candidate = join(root, entry, sessionId)
+      let stat
+      try {
+        stat = statSync(candidate)
+      } catch {
+        continue
+      }
+      if (stat.isDirectory()) {
+        dir = candidate
+        break
+      }
+    }
+  } catch {
+    dir = null
+  }
+  if (dir === null || !resolve(dir).startsWith(root + sep)) {
+    sendJson(res, 404, { ok: false, error: 'session not found' })
+    return
+  }
+  try {
+    rmSync(dir, { recursive: true, force: true })
+  } catch (error) {
+    sendJson(res, 500, { ok: false, error: String(error?.message ?? error) })
+    return
+  }
+  sendJson(res, 200, { ok: true })
+}
+
 /**
  * Register the plugin's host surfaces.
  * @param ctx - host plugin context.
@@ -379,6 +518,29 @@ export function apply(ctx) {
         warn(`username route unavailable: ${error?.message ?? error}`)
       }
 
+      try {
+        // The archived row's delete button. POST only: the browser half sends
+        // one id, and a GET must never reach the filesystem.
+        disposers.push(scope.webServer.register({
+          kind: 'exact',
+          path: SESSION_DELETE_PATH,
+          handler: (req, res) => {
+            if (req.method !== 'POST') {
+              res.writeHead(405, { allow: 'POST' })
+              res.end()
+              return
+            }
+            void deleteSession(ctx, req, res).catch((error) => {
+              try {
+                sendJson(res, 500, { ok: false, error: String(error?.message ?? error) })
+              } catch { /* the response may already be gone */ }
+            })
+          },
+        }))
+      } catch (error) {
+        warn(`session delete route unavailable: ${error?.message ?? error}`)
+      }
+
       return () => {
         for (const dispose of disposers) {
           try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-claude-style",
   "description": "Claude Code Desktop theme for DeepSeek Harness (dsh) web GUI — visual & interaction overhaul",
-  "version": "0.6.0",
+  "version": "0.6.4",
   "type": "module",
   "main": "lib/index.js",
   "icon": "lib/claude-mark.svg",