dsh-context 0.49.3 → 0.49.4

package/lib/client.js

@@ -6680,7 +6680,7 @@ window.__ModuleLoader__.load({
 			return function PluginInfo() {
 				const [latest, setLatest] = (0, react.useState)(null);
 				(0, react.useEffect)(() => {
-					if ("0.49.3".includes("-dev")) return;
+					if ("0.49.4".includes("-dev")) return;
 					let on = true;
 					fetchLatestVersion().then((v) => {
 						if (on && v) setLatest(v);
@@ -6689,8 +6689,8 @@ window.__ModuleLoader__.load({
 						on = false;
 					};
 				}, []);
-				const update = latest !== null && isNewerVersion(latest, "0.49.3") ? latest : null;
-				const nameText = "dsh-context (v0.49.3)";
+				const update = latest !== null && isNewerVersion(latest, "0.49.4") ? latest : null;
+				const nameText = "dsh-context (v0.49.4)";
 				const nameValue = [nameText];
 				if (update) nameValue.push(/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 					className: "lc-pi-update",

package/lib/index.js

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, join, normalize } from "node:path";
+import { dirname, join, normalize, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { z } from "zod";
 import { deriveEventMessage } from "@deepseek-ai/dsh-session";
@@ -2009,7 +2009,7 @@ function watchDetailChannel(ctx, bounds) {
 * host probes and gates; the client displays what the wire record carries),
 * so this module must stay dependency-free.
 *
-* The baseline mirrors the support matrix (AGENTS.md "Compatibility" and the
+* The baseline mirrors the support matrix (docs/compatibility.md and the
 * package's `dsh.compatibility.dshReleases` declaration): the oldest dsh
 * release this plugin works on. A harness BELOW it gets the fallback units
 * (host/fallback.ts) instead of the real folds.
@@ -2712,35 +2712,72 @@ function watchStepIdentity(ctx) {
 * The probe never imports a harness package for its version; it reads
 * manifests through Node resolution from two anchors, in order:
 *
-*  1. The harness home's healed `profiles/node_modules` mirror (located via
-*     the app-boot `dshHomePath` service) — it symlinks/proxies the running
-*     installation's dependency closure, so it names the true release even
-*     when this plugin is a `link:`-installed dev checkout.
-*  2. This module itself — in a real profile install the plugin sits inside
-*     the profile's node_modules and walk-up resolution reaches the same
-*     mirror; this anchor also covers harnesses too old to provide the home
-*     service.
+*  1. This module's own ESM resolution of the library packages the Host half
+*     imports at runtime. That is the very pipeline the process resolves those
+*     imports through, so an embedding shell that redirects plugin imports —
+*     the packaged Desktop's ASAR resolver bridge does exactly this — redirects
+*     the probe identically, and the answer names the module instances the
+*     harness is actually running. A witness that lands inside this package's
+*     own tree is the plugin's dependency closure (a `link:`-installed dev
+*     checkout's pinned devDependencies), never the harness, so it is discarded
+*     for the home anchor.
+*  2. The harness home's healed `profiles/node_modules` mirror (located via
+*     the app-boot `dshHomePath` service). It names the installation that last
+*     healed it: authoritative for a dev checkout, whose own tree holds pinned
+*     devDependencies, but only as fresh as the last CLI profile boot. A
+*     packaged Desktop never heals it, so a stale global-CLI mirror can outlive
+*     the CLI and misname the running harness — that is why it answers only
+*     when the running anchor has nothing it can trust.
 *
 * The `@deepseek-ai/dsh` CLI package is probed ONLY through the home anchor:
-* the plugin never depends on it, so a hit from the module anchor can only
-* be an ambient install above the plugin's tree (e.g. a global copy under
+* the plugin never imports it, so a hit from the running anchor can only be an
+* ambient install above the plugin's tree (e.g. a global copy under
 * ~/node_modules) — not necessarily the RUNNING harness.
 *
 * Every step is guarded: any failure (absent service, unresolvable package,
-* unreadable/invalid manifest, non-string version) degrades to `undefined`,
-* and the gate treats an unknown version as SATISFIED — a probe misfire must
-* never blank a working deployment.
+* non-file URL, unreadable/invalid manifest, non-string version) degrades to
+* `undefined`, and the gate treats an unknown version as SATISFIED — a probe
+* misfire must never blank a working deployment.
 */
 /**
-* Library packages whose manifest version IS the harness release version
-* (the dsh monorepo versions every package in lockstep). From the plugin's
-* own tree they resolve to its pinned devDependencies in dev and to the
-* healed profiles mirror in real installs — both correct — so they are safe
-* to probe from either anchor.
+* Library packages whose manifest version IS the harness release version (the
+* dsh monorepo versions every package in lockstep). The home anchor probes
+* them after the CLI package; the running anchor probes the two first- and
+* second-ordered.
 */
 const LIBRARY_PROBE_PACKAGES = ["@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session"];
+/**
+* Running-anchor probe order: the package the Host half genuinely imports at
+* runtime first (host/fold.ts imports it, so it MUST resolve whenever this
+* plugin runs), then its co-versioned sibling.
+*/
+const RUNNING_PROBE_PACKAGES = ["@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-projection"];
 /** Home-anchor probe order: the user-facing CLI version first, then the libraries. */
 const HOME_PROBE_PACKAGES = ["@deepseek-ai/dsh", ...LIBRARY_PROBE_PACKAGES];
+/**
+* This package's root. A running-anchor witness under it belongs to the
+* plugin's own dependency closure, not to the harness.
+*
+* Located through the package's own `./package.json` self-reference: Node
+* resolves that against the nearest package.json, so the answer is the package
+* root in the source tree and in the bundled profile install alike — a fixed
+* number of `..` steps cannot be, since `src/host/` and `lib/` differ by a
+* level. A loader that cannot self-resolve (an exotic loader, or a fork renamed
+* without a matching `exports`) falls back to this module's own directory: the
+* guard then covers less of the package, but it still can never mistake the
+* plugin's own `node_modules` for the harness.
+*/
+function ownPackageRoot() {
+	try {
+		return dirname(fileURLToPath(import.meta.resolve("dsh-context/package.json")));
+	} catch {
+		/* v8 ignore next -- a loader that cannot resolve one of its own package's
+		published subpaths is out of the suite's reach; the fallback keeps one
+		probe path (an unanswered probe fails open either way). */
+		return dirname(fileURLToPath(import.meta.url));
+	}
+}
+const PLUGIN_ROOT = ownPackageRoot();
 /** One manifest's `version`, or undefined on any read/shape failure. */
 function versionOfManifest(manifestPath, expectedName) {
 	try {
@@ -2790,11 +2827,51 @@ function probeAnchor(resolve, packageNames) {
 	}
 }
 /**
+* Whether `candidate` lies inside `root`'s tree. A `..`-prefixed relative path
+* escapes it; a sibling such as `dsh-context-extra` is reached through `..` too,
+* so it never counts as a child. A pathological child literally named `..foo`
+* would degrade to the home anchor, which is the safe direction.
+*/
+function isInside(root, candidate) {
+	return !relative(root, candidate).startsWith("..");
+}
+/**
+* The running module tree's answer, or undefined when it cannot be trusted.
+* Each probe package is checked on its own: a witness inside the plugin's own
+* closure is the plugin's dependency, not the harness, and a trusted witness
+* whose manifest cannot be read is no answer either — the next package may
+* still resolve to one.
+*/
+function probeRunningTree(resolve, pluginRoot) {
+	for (const packageName of RUNNING_PROBE_PACKAGES) {
+		let witness;
+		try {
+			witness = resolve(packageName);
+		} catch {
+			continue;
+		}
+		if (isInside(pluginRoot, witness)) continue;
+		const version = versionViaManifest(resolve, packageName) ?? versionViaEntry(resolve, packageName);
+		if (version !== void 0) return version;
+	}
+}
+/** The default running anchor: this module's own ESM resolution. */
+function resolveRunningModule(specifier) {
+	return import.meta.resolve(specifier);
+}
+/**
 * The running harness's version string, or undefined when nothing answers
 * (the gate fails open on it — see the header note).
-* @param selfUrl - the module anchor (injectable for hermetic tests).
-*/
-function detectHarnessVersion(ctx, selfUrl = import.meta.url) {
+* @param resolveUrl - the running anchor's URL resolver (injectable for hermetic tests).
+* @param pluginRoot - this package's root for the own-closure check (injectable for hermetic tests).
+*/
+function detectHarnessVersion(ctx, resolveUrl = resolveRunningModule, pluginRoot = PLUGIN_ROOT) {
+	const running = probeRunningTree((specifier) => {
+		const url = resolveUrl(specifier);
+		if (!url.startsWith("file:")) throw new Error(`dsh-context: non-file module URL for ${specifier}`);
+		return fileURLToPath(url);
+	}, pluginRoot);
+	if (running !== void 0) return running;
 	try {
 		const homePath = ctx.get("dshHomePath");
 		if (typeof homePath === "function") {
@@ -2803,12 +2880,6 @@ function detectHarnessVersion(ctx, selfUrl = import.meta.url) {
 			if (home !== void 0) return home;
 		}
 	} catch {}
-	try {
-		const req = createRequire(selfUrl);
-		return probeAnchor((specifier) => req.resolve(specifier), LIBRARY_PROBE_PACKAGES);
-	} catch {
-		return;
-	}
 }
 //#endregion
 //#region src/host/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-context",
-  "version": "0.49.3",
+  "version": "0.49.4",
   "description": "A DeepSeek Harness plugin for context insight and management, with context dashboard and context command, for understanding how the context is made of, and how it evolves.",
   "author": "bowenliang123",
   "repository": {