dsh-deja 0.22.1 → 0.22.2

package/README.md

@@ -8,7 +8,7 @@ DeepSeek Harness can already search its own sessions — that is what the built-
 `session-query` subsystem does. This plugin answers the other question: what you
 did in the *other* agents on this machine.
 
-deja indexes the session files that forty other coding agents — Claude Code,
+deja indexes the session files that forty-one other coding agents — Claude Code,
 Codex, Cursor, opencode, Antigravity, Grok Build, Kimi, Cline and Zed among
 them — already write to disk. Nothing has to have been recorded ahead of time: the history is already
 there, including the months before deja was installed. If you moved to dsh last
@@ -64,6 +64,16 @@ command that failed it gets what this machine ran after the same error before,
 a compaction keeps what the session was in the middle of, and a session that
 ends drops its live stamp.
 
+In `dsh web` you also see the lines deja prints for the person in Claude Code:
+the "you have been here" receipt when a prompt was answered from history, and
+at session start what was recalled, the first-build note and the weekly note.
+They sit in a small panel above the input until the next prompt, or until you
+close it. The model gets exactly what it got before; these lines never reach
+it. tui, headless and sdk profiles have no page, so nothing changes there:
+the notes still come with the reply to `/deja`. A line that waits more than
+ten minutes for the page is dropped. `deja install dsh-auto` writes the same
+panel from these files; with both installed you get one panel.
+
 ```yaml
 - insert:
     - id: deja
@@ -81,6 +91,13 @@ model: a later listener in that waterfall rebuilds its answer from the payload
 and the added message is dropped with nothing reported. This was settled by
 reading the requests dsh 0.1.1-rc.2 actually sent.
 
+The person's lines take one deja call with the recall, not two: where dsh
+serves the page, the plugin asks for the hook's JSON reply, hands `additionalContext` to the model and keeps
+`systemMessage` on the host until the page asks for it at `/api/deja-notes`,
+behind dsh's own login. Anywhere else it keeps asking for `--plain`, because
+deja marks a note shown when it prints it. The browser half is `client.js`,
+plain JS in dsh's module wrapper, so the package has no build step.
+
 ## What it does not do
 
 No LLM, no embeddings. The index is a local BM25 store over files

package/client.js

@@ -0,0 +1,304 @@
+// dsh-deja, browser half: the lines deja writes for the person.
+//
+// The host half hands the model its recall and keeps deja's own lines for the
+// person — the "you have been here" receipt, the build and week notes — on a
+// board behind /api/deja-notes. This draws them in a small card just above the
+// input, the way Claude Code prints a hook's systemMessage. Plain JS in dsh's
+// module wrapper, so the package needs no build step: React comes from the
+// shell's module table, colours and sizes from dsh's own theme variables, so
+// light and dark both follow the app.
+//
+// Nothing here may break the page. A host without the route answers 404, a
+// page without a session draws nothing, and any failure leaves the dock empty.
+// Text is always inserted as text, and a link is only drawn for an http(s)
+// address.
+window.__ModuleLoader__.load({
+  id: "dsh-deja",
+  factory: (require) => {
+    var module = { exports: {} };
+    const React = require("react");
+    const h = React.createElement;
+
+    // The panels above the input — dsh's queue and todo docks sit here.
+    const SLOT = "conversation.input.dock";
+    // Lines shown above the footer before "more": the receipt and one note.
+    // With the footer that is three lines at most.
+    const VISIBLE = 2;
+
+    // ---- what the lines say ----------------------------------------------
+
+    // The card's header already names deja, so the name in front of each line
+    // is dropped when it is drawn. The server's text is not changed.
+    function stripName(line) {
+      const rest = String(line).replace(/^deja(?:-vu)?(?:\s+—\s+|\s*:\s+|\s+)/i, "");
+      if (rest === line || !rest) return line;
+      return rest.charAt(0).toUpperCase() + rest.slice(1);
+    }
+
+    // safeHref accepts an http(s) address, with or without its scheme, and
+    // nothing else: no javascript:, no data:, no relative path.
+    function safeHref(raw) {
+      let text = String(raw || "").trim();
+      if (!text || /\s/.test(text)) return null;
+      if (!/^[a-z][a-z0-9+.-]*:/i.test(text)) text = "https://" + text;
+      let url;
+      try {
+        url = new URL(text);
+      } catch {
+        return null;
+      }
+      if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+      if (!url.hostname || !url.hostname.includes(".")) return null;
+      return url.href;
+    }
+
+    const RECEIPT = /^deja-vu\s+—\s+(you have been here|this was done on another machine):\s+"(.+)"\s+\((.+)\)$/;
+    // "label: address · label: address", every part a link.
+    const LINK_PART = /^([A-Za-z][\w ]{0,20}):\s+(\S+)$/;
+    // A sentence that ends on its address: " — github.com/…".
+    const TRAILING_LINK = /^(.*\S)\s+—\s+(\S+)$/;
+
+    // parseNotes sorts the board's lines into what the card draws: the
+    // receipt, plain notes, a row of links and a sentence that is a link.
+    function parseNotes(lines) {
+      const out = { receipt: null, notes: [], links: [], linked: [] };
+      for (const raw of lines || []) {
+        const line = String(raw || "").trim();
+        if (!line) continue;
+        const r = RECEIPT.exec(line);
+        if (r) {
+          // Only the brand goes; the lead says what the quote is.
+          out.receipt = { lead: r[1].charAt(0).toUpperCase() + r[1].slice(1) + ":", topic: r[2], meta: r[3].replace(/\bvia:\s+/, "via ") };
+          continue;
+        }
+        const parts = line.split(/\s+·\s+/);
+        const links = parts.map((p) => {
+          const m = LINK_PART.exec(p);
+          const href = m && safeHref(m[2]);
+          return href ? { label: m[1].charAt(0).toUpperCase() + m[1].slice(1), href } : null;
+        });
+        // Link parts at the end of a line ("… · docs: address") go to the
+        // link row; a line of nothing but links is all link row.
+        let keep = parts.length;
+        while (keep > 0 && links[keep - 1]) keep--;
+        out.links.push(...links.slice(keep));
+        if (keep === 0) continue;
+        const rest = keep < parts.length ? parts.slice(0, keep).join(" · ") : line;
+        const t = TRAILING_LINK.exec(rest);
+        const href = t && safeHref(t[2]);
+        if (href) {
+          out.linked.push({ text: t[1], href });
+          continue;
+        }
+        out.notes.push(stripName(rest));
+      }
+      return out;
+    }
+
+    // ---- fetching ----------------------------------------------------------
+
+    function notesUrl(sessionId) {
+      // Relative, as dsh's own /api calls are: the page may be mounted below
+      // the server root.
+      return "api/deja-notes?session=" + encodeURIComponent(String(sessionId));
+    }
+
+    function pull(sessionId) {
+      return fetch(notesUrl(sessionId), {
+        headers: { accept: "application/json" },
+        credentials: "same-origin",
+        cache: "no-store",
+      })
+        .then((res) => (res.ok ? res.json() : null))
+        .then((body) => (body && Array.isArray(body.notes) ? body.notes.filter((n) => typeof n === "string") : []))
+        .catch(() => []);
+    }
+
+    // ---- drawing -----------------------------------------------------------
+
+    // Styled with dsh's theme variables, as its own todo and queue docks are,
+    // so the card follows light and dark. Fallbacks only matter on a host that
+    // defines none of them.
+    const STYLES = `
+.deja-card {
+  box-sizing: border-box;
+  width: calc(100% - 2 * var(--dsh-composer-side-clearance, 16px) - 4 * var(--dsh-composer-dock-inset, 8px));
+  max-width: calc(var(--dsh-composer-card-max-width, 780px) - 4 * var(--dsh-composer-dock-inset, 8px));
+  max-height: 40vh;
+  overflow-y: auto;
+  margin: 0 auto;
+  padding: 6px 12px 8px;
+  border-radius: var(--dsw-radius-lg, 10px);
+  background: var(--dsw-specific-menu, Canvas);
+  backdrop-filter: var(--dsw-menu-backdrop-filter, none);
+  box-shadow: var(--dsw-elevation-panel, none);
+  color: var(--dsw-alias-label-secondary, GrayText);
+  font-size: 12px;
+  line-height: 18px;
+  overflow-wrap: anywhere;
+  animation: deja-card-in 160ms ease-out;
+}
+@keyframes deja-card-in { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: none; } }
+@media (prefers-reduced-motion: reduce) { .deja-card { animation: none; } }
+.deja-head { display: flex; align-items: center; gap: 8px; height: 20px; }
+.deja-name { flex: 1 1 auto; color: var(--dsw-alias-label-caption, GrayText); font-size: 11px; font-weight: 500; letter-spacing: .02em; }
+.deja-close {
+  flex: none; display: grid; place-items: center; width: 20px; height: 20px; margin-right: -6px;
+  padding: 0; border: 0; border-radius: 999px; background: transparent; cursor: pointer;
+  color: var(--dsw-alias-label-tertiary, GrayText); font: inherit; font-size: 14px; line-height: 1;
+}
+.deja-close:hover { background: var(--dsw-alias-interactive-bg-hover, transparent); }
+.deja-close:focus-visible, .deja-more:focus-visible, .deja-card a:focus-visible {
+  outline: var(--dsw-focus-ring-width, 2px) solid var(--dsw-focus-ring-color, var(--dsw-alias-state-business-primary, Highlight));
+  outline-offset: 1px;
+}
+.deja-receipt { margin-top: 2px; font-size: 13px; line-height: 20px; }
+.deja-topic { color: var(--dsw-alias-label-primary, CanvasText); }
+.deja-lead { color: var(--dsw-alias-label-tertiary, GrayText); }
+.deja-meta { color: var(--dsw-alias-label-tertiary, GrayText); font-size: 12px; margin-left: 8px; white-space: nowrap; }
+.deja-note { color: var(--dsw-alias-label-secondary, GrayText); margin-top: 2px; }
+.deja-detail { color: var(--dsw-alias-label-caption, GrayText); }
+.deja-foot { display: flex; flex-wrap: wrap; align-items: baseline; gap: 2px 12px; margin-top: 4px; font-size: 12px; }
+.deja-card a { color: var(--dsw-alias-link, var(--dsw-alias-state-business-primary, LinkText)); text-decoration: none; }
+.deja-card a:hover { text-decoration: underline; }
+.deja-linked a { color: var(--dsw-alias-label-tertiary, GrayText); }
+.deja-more {
+  padding: 0; border: 0; background: transparent; cursor: pointer; font: inherit;
+  color: var(--dsw-alias-label-tertiary, GrayText); text-decoration: underline; text-underline-offset: 2px;
+}
+`;
+
+    function installStyles() {
+      const style = document.createElement("style");
+      style.dataset.plugin = "dsh-deja";
+      style.textContent = STYLES;
+      document.head.appendChild(style);
+      return () => style.remove();
+    }
+
+    function link(href, label, key) {
+      return h("a", { key, href, target: "_blank", rel: "noopener noreferrer" }, label);
+    }
+
+    // A note reads as its claim and then its detail: the part after the first
+    // " — " or " · " is the detail ("today: memory arrived 3 times"), drawn quieter.
+    function noteRow(text, key) {
+      const cut = /\s+(—|·)\s+/.exec(text);
+      if (!cut) return h("div", { key, className: "deja-note" }, text);
+      return h(
+        "div",
+        { key, className: "deja-note" },
+        text.slice(0, cut.index),
+        h("span", { className: "deja-detail" }, " " + text.slice(cut.index).trim()),
+      );
+    }
+
+    function Card({ lines, onClose }) {
+      const [open, setOpen] = React.useState(false);
+      const parsed = parseNotes(lines);
+      const body = [];
+      if (parsed.receipt) {
+        const r = parsed.receipt;
+        body.push(
+          h(
+            "div",
+            { key: "receipt", className: "deja-receipt" },
+            h("span", { className: "deja-lead" }, r.lead + " "),
+            h("span", { className: "deja-topic" }, "“" + r.topic + "”"),
+            h("span", { className: "deja-meta" }, r.meta),
+          ),
+        );
+      }
+      parsed.notes.forEach((n, i) => body.push(noteRow(n, "n" + i)));
+      // Links stay in view: the docs, the tracker and the one-time sentence
+      // share one small footer row rather than queueing behind "more".
+      const footer = [
+        ...parsed.links.map((l, i) => link(l.href, l.label, "a" + i)),
+        ...parsed.linked.map((l, i) => h("span", { key: "s" + i, className: "deja-linked" }, link(l.href, l.text))),
+      ];
+      if (body.length === 0 && footer.length === 0) return null;
+      const hidden = open ? 0 : Math.max(0, body.length - VISIBLE);
+      if (hidden > 0) {
+        footer.unshift(h("button", { key: "more", type: "button", className: "deja-more", onClick: () => setOpen(true) }, hidden + " more"));
+      }
+      return h(
+        "div",
+        { className: "deja-card", "data-deja-notes": "", role: "status" },
+        h(
+          "div",
+          { className: "deja-head" },
+          h("span", { className: "deja-name" }, "deja-vu"),
+          h("button", { type: "button", className: "deja-close", title: "Dismiss", "aria-label": "Dismiss deja-vu notes", onClick: onClose }, "×"),
+        ),
+        hidden > 0 ? body.slice(0, VISIBLE) : body,
+        footer.length > 0 ? h("div", { className: "deja-foot" }, footer) : null,
+      );
+    }
+
+    function DejaNotes(props) {
+      const sessionId = props && props.sessionId;
+      const useSession = props && typeof props.useSession === "function" ? props.useSession : null;
+      const running = useSession ? useSession((s) => Boolean(s && s.running)) : null;
+      const [lines, setLines] = React.useState([]);
+
+      // A new session or a new turn starts clean: a receipt answers the prompt
+      // it came with, and left standing under the next one it would name the
+      // wrong question. The session check stands on its own, because dsh may
+      // keep this component and hand it another idle session.
+      React.useEffect(() => {
+        setLines([]);
+      }, [sessionId]);
+      React.useEffect(() => {
+        if (running === true) setLines([]);
+      }, [running]);
+
+      React.useEffect(() => {
+        if (!sessionId) return undefined;
+        let alive = true;
+        const ask = () =>
+          pull(sessionId).then((notes) => {
+            if (alive && notes.length > 0) setLines((held) => [...held, ...notes].slice(-8));
+          });
+        ask();
+        // The recall runs while the turn's context is assembled, which may be
+        // a moment after the page sees the turn start; the end of the turn
+        // asks again. A host without useSession gets a slow poll instead.
+        const timers = [];
+        if (running === true) timers.push(setTimeout(ask, 800), setTimeout(ask, 2500));
+        const poll = running === null ? setInterval(ask, 4000) : null;
+        return () => {
+          alive = false;
+          timers.forEach(clearTimeout);
+          if (poll) clearInterval(poll);
+        };
+      }, [sessionId, running]);
+
+      if (lines.length === 0) return null;
+      return h(Card, { lines, onClose: () => setLines([]) });
+    }
+
+    function apply(ctx) {
+      try {
+        if (typeof ctx.effect === "function") ctx.effect(installStyles, "dsh-deja: styles");
+        else installStyles();
+      } catch {}
+      try {
+        ctx.slots.inject(SLOT, () => {
+          try {
+            return ctx.slots.register({ name: SLOT, id: "deja-notes", order: 900 }, DejaNotes);
+          } catch {
+            return () => {};
+          }
+        });
+      } catch {}
+    }
+
+    module.exports.inject = ["slots"];
+    module.exports.apply = apply;
+    // For the tests; the host reads only inject and apply.
+    module.exports.parseNotes = parseNotes;
+    module.exports.stripName = stripName;
+    module.exports.safeHref = safeHref;
+    return module.exports;
+  },
+});

package/docs/zh.md

@@ -6,7 +6,7 @@
 
 DeepSeek Harness 自带的 `session-query` 已经可以检索它自己的会话。这个插件回答的是另一个问题：你在这台机器上**其他**智能体里做过什么。
 
-deja 索引 Claude Code、Codex、Cursor、opencode、Antigravity、Grok Build、Kimi、Cline、Zed 等其他四十个智能体本来就写在磁盘上的会话文件。不需要提前录制：历史已经在那里，包括安装 deja 之前的那些月份。如果你上周才转到 dsh，上周之前做过的事仍然可以在 dsh 里查到。
+deja 索引 Claude Code、Codex、Cursor、opencode、Antigravity、Grok Build、Kimi、Cline、Zed 等其他四十一个智能体本来就写在磁盘上的会话文件。不需要提前录制：历史已经在那里，包括安装 deja 之前的那些月份。如果你上周才转到 dsh，上周之前做过的事仍然可以在 dsh 里查到。
 
 ## 安装
 
@@ -44,6 +44,8 @@ dsh plugin --profile web add github:vshulcz/deja-vu#path:extensions/dsh
 
 同一套召回也接上了 `deja install dsh-auto` 接的那些：读、改、写一个文件之后，模型会拿到以前的会话对这个文件说过什么；命令失败之后，会拿到这台机器上次遇到同样错误后跑过的命令；压缩时保留会话正在做的事；会话结束时撤掉它的在线标记。
 
+在 `dsh web` 里，你也能看到 deja 在 Claude Code 里给人看的那几行：某个提问由历史回答时的 “you have been here” 回执，以及会话开始时召回了什么、首次建索引的说明和每周小结。它们显示在输入框上方的小面板里，直到下一次提问或你手动关闭。模型收到的内容与之前完全相同，这几行不会进入模型上下文。tui、headless 和 sdk 配置没有页面，因此没有变化：这些说明仍然随 `/deja` 的回复一起显示。等待页面超过十分钟的行会被丢弃。`deja install dsh-auto` 用同一份文件写出同一个面板；两者都装时也只有一个面板。
+
 ```yaml
 - insert:
     - id: deja

package/index.js

@@ -2,7 +2,7 @@
 //
 // dsh answers questions about its own sessions through the built-in
 // session-query subsystem. This plugin answers the other question: what you did
-// in Claude Code, Codex, Cursor, opencode and thirty-seven more agents, on this
+// in Claude Code, Codex, Cursor, opencode and thirty-eight more agents, on this
 // machine, before dsh existed. The index is deja's; this file is the seam.
 
 import { createRequire } from "node:module";
@@ -12,7 +12,7 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-import { argv, contributions, exitStatus, guarded, resultText } from "./lib.js";
+import { argv, contributions, exitStatus, guarded, newestEvents, noteBoard, resultText, splitHookReply } from "./lib.js";
 
 const require = createRequire(import.meta.url);
 
@@ -95,7 +95,9 @@ function tools(ctx) {
   if (!defineTool) return;
 
   // Every tool here answers with the text deja printed, so one output
-  // declaration serves them all. The schema is plain JSON Schema — a
+  // declaration serves them all. Printed with --framed: search, ctx, blame,
+  // fix and how write for a person, and without the frame a tag planted in a
+  // transcript reached the model as though deja had closed its own block. The schema is plain JSON Schema — a
   // schemastery instance is rejected as "schema must be a value schema object",
   // because the host validates that this is an ordinary JSON record.
   const TEXT_OUTPUT = {
@@ -124,7 +126,7 @@ function tools(ctx) {
       // spend the model's context on a tail nobody reads.
       const asked = Number.isFinite(args.limit) ? Math.trunc(args.limit) : 5;
       const limit = String(Math.min(20, Math.max(1, asked)));
-      return Promise.resolve(answer(run(argv("search", ["--json", "--limit", limit], args.query))));
+      return Promise.resolve(answer(run(["--framed", ...argv("search", ["--json", "--limit", limit], args.query)])));
     },
   })));
 
@@ -141,7 +143,7 @@ function tools(ctx) {
     },
     output: TEXT_OUTPUT,
     execute(args) {
-      return Promise.resolve(answer(run(argv("ctx", [], args.query))));
+      return Promise.resolve(answer(run(["--framed", ...argv("ctx", [], args.query)])));
     },
   })));
 
@@ -158,7 +160,7 @@ function tools(ctx) {
     },
     output: TEXT_OUTPUT,
     execute(args) {
-      return Promise.resolve(answer(run(argv("blame", ["--json"], args.path))));
+      return Promise.resolve(answer(run(["--framed", ...argv("blame", ["--json"], args.path)])));
     },
   })));
 
@@ -175,7 +177,7 @@ function tools(ctx) {
     },
     output: TEXT_OUTPUT,
     execute(args) {
-      return Promise.resolve(answer(run(argv("fix", [], args.error))));
+      return Promise.resolve(answer(run(["--framed", ...argv("fix", [], args.error)])));
     },
   })));
 
@@ -192,7 +194,7 @@ function tools(ctx) {
     },
     output: TEXT_OUTPUT,
     execute(args) {
-      return Promise.resolve(answer(run(argv("how", [], args.what))));
+      return Promise.resolve(answer(run(["--framed", ...argv("how", [], args.what)])));
     },
   })));
 
@@ -216,7 +218,7 @@ function tools(ctx) {
   })));
 }
 
-function command(ctx) {
+function command(ctx, board) {
   guarded(() => ctx.commands.register({
     name: "deja",
     description: "Search this machine's past AI coding sessions",
@@ -232,9 +234,12 @@ function command(ctx) {
       // of the words people most want history about is `install`.
       const out = run(argv("search", [], query));
       if (!INSTALLED) return { kind: "error", text: MISSING };
-      // dsh shows a person nothing the hooks print — the digest goes to the
-      // model — so the reply to /deja is where deja's own notes reach them.
-      const notes = run(["hook-context", "--notes"]);
+      // Outside dsh web a person sees nothing the hooks print — the digest
+      // goes to the model — so the reply to /deja is where deja's own notes
+      // reach them. In dsh web the session's lines may still be waiting on the
+      // board for a page that has not asked; they go here, once, instead.
+      const waiting = board ? board.take(sessionId(invocation && invocation.agent)) : [];
+      const notes = [...waiting, run(["hook-context", "--notes"])].filter(Boolean).join("\n");
       return { kind: "success", text: notes ? answer(out) + "\n\n" + notes : answer(out) };
     },
   }));
@@ -270,7 +275,7 @@ function userText(message) {
 // one-shot on the session id in deja's ledger, which survives a resume in a new
 // process; the Set is the in-process guard that keeps the long-lived web and
 // tui profiles from spawning deja on every assembly of a session already shown.
-function autoDigest(ctx) {
+function autoDigest(ctx, board) {
   const seen = new Set();
 
   guarded(() =>
@@ -283,9 +288,12 @@ function autoDigest(ctx) {
         const sid = sessionId(agent);
         if (sid && seen.has(sid)) return "";
         if (sid) seen.add(sid);
-        return run(
+        return askHook(
           ["hook-context", "--plain"],
+          ["hook-context"],
           JSON.stringify({ session_id: sid, cwd: sessionCwd(agent), source: "startup", deja_once: true }),
+          sid,
+          board,
         );
       },
     }),
@@ -311,7 +319,20 @@ function sessionCwd(agent) {
   return (header && header.cwd) || process.cwd();
 }
 
-function autoRecall(ctx) {
+// askHook runs a hook once for both readers. Where a page will show the
+// person's lines, deja is asked for its JSON reply: additionalContext, the
+// text --plain prints, goes to the model and systemMessage waits on the board.
+// Anywhere else — tui, headless, sdk — it stays --plain. deja marks a note
+// shown when it prints it, so asking for notes nobody will read spends them,
+// and `/deja` and the next Claude Code session would not see them either.
+function askHook(plain, json, payload, sid, board) {
+  if (!board.hasReader()) return run(plain, payload);
+  const reply = splitHookReply(run(json, payload));
+  board.push(sid, reply.notes);
+  return reply.context;
+}
+
+function autoRecall(ctx, board) {
   let asked = "";
   let askedIn = "";
   let askedBy = "";
@@ -339,7 +360,13 @@ function autoRecall(ctx) {
           asked = prompt;
           askedIn = cwd;
           askedBy = sid;
-          recalled = run(["hook-prompt", "--plain"], JSON.stringify({ prompt, cwd, session_id: sid }));
+          recalled = askHook(
+            ["hook-prompt", "--plain"],
+            ["hook-prompt"],
+            JSON.stringify({ prompt, cwd, session_id: sid }),
+            sid,
+            board,
+          );
         }
         // Silence is the common case: this speaks only when the history answers.
         return recalled;
@@ -348,6 +375,39 @@ function autoRecall(ctx) {
   );
 }
 
+// The person's half. dsh shows nobody what a plugin hands the model, and has
+// no notice channel a host plugin can write to, so deja's lines wait on a board
+// and the browser half (client.js) asks for them under the composer. The route
+// rides dsh's own /api mount, which applies the same Host/Origin fence and
+// browser login as every other call the page makes. Only a profile that serves
+// that page — the connection service and a web server both — registers it;
+// headless, tui, sdk and an older dsh never do, and keep asking deja for
+// --plain. A second copy of the plugin finds the path taken and stands down.
+const NOTES_PATH = "/api/deja-notes";
+
+function notesRoute(ctx, board) {
+  if (typeof ctx.inject !== "function") return;
+  try {
+    ctx.inject(["connection", "webServer"], (c) => {
+      const registered = guarded(() =>
+        c.connection.fetch.register({
+          path: NOTES_PATH,
+          methods: ["GET"],
+          requestBody: "buffered",
+          fetch: async (request) => {
+            let sid = "";
+            try {
+              sid = bareSessionId(new URL(request.url).searchParams.get("session"));
+            } catch {}
+            return Response.json({ notes: sid ? board.take(sid) : [] }, { headers: { "cache-control": "no-store" } });
+          },
+        }),
+      );
+      if (registered) board.setReader();
+    });
+  } catch {}
+}
+
 // runAsync is run for a seam dsh awaits, so the event loop goes on while deja
 // answers. It never rejects.
 function runAsync(args, input) {
@@ -519,10 +579,7 @@ function noteMessage(text) {
 // carried it in, so both are read. Anything a plugin contributed is skipped:
 // those carry a source of their own.
 function lastHumanText(agent) {
-  const events = agent && agent.session && agent.session.events;
-  if (!Array.isArray(events)) return "";
-  for (let i = events.length - 1; i >= 0; i--) {
-    const event = events[i];
+  for (const event of newestEvents(agent && agent.session)) {
     if (!event) continue;
     if (event.type === "user/message" && isHuman(event.data)) return userText(event.data);
     if (event.type === "agent/inbox/spliced") {
@@ -568,11 +625,13 @@ function apply(ctx, config) {
     { command: installedByCLI("command.js"), auto: installedByCLI("auto.js") },
     config,
   );
+  const board = noteBoard();
   if (adds.tools) tools(ctx);
-  if (adds.command) command(ctx);
+  if (adds.command) command(ctx, board);
   if (adds.recall) {
-    autoDigest(ctx);
-    autoRecall(ctx);
+    autoDigest(ctx, board);
+    autoRecall(ctx, board);
+    notesRoute(ctx, board);
     toolNotes(ctx);
     sessionEnds(ctx);
   }

package/lib.js

@@ -80,3 +80,108 @@ export function contributions(wiring, config) {
     recall: settings.autoRecall !== false && !wired.auto,
   };
 }
+
+// newestEvents walks a dsh session's log from the end, whichever shape the
+// host gives it. 0.1.x exposes the log as session.events; 0.2.0 made the array
+// private and reads one event at a time with eventAt(seq), seq being the next
+// free position. Reading only session.events found nothing on 0.2.0, so the
+// per-prompt recall never ran there.
+export function* newestEvents(session) {
+  if (!session) return;
+  if (Array.isArray(session.events)) {
+    for (let i = session.events.length - 1; i >= 0; i--) yield session.events[i];
+    return;
+  }
+  if (typeof session.eventAt !== "function") return;
+  let top;
+  try {
+    top = Number(session.seq);
+  } catch {
+    return;
+  }
+  if (!Number.isSafeInteger(top)) return;
+  for (let i = top - 1; i >= 0; i--) {
+    let event;
+    try {
+      event = session.eventAt(i);
+    } catch {
+      return;
+    }
+    yield event;
+  }
+}
+
+// splitHookReply reads what `deja hook-prompt` or `deja hook-context` printed
+// in its JSON form and splits it by reader: additionalContext is for the model,
+// the same text --plain prints, and systemMessage is the line Claude Code
+// shows the person. One spawn answers both.
+//
+// The envelope is the last line that parses as one, so a stray line printed
+// ahead of it does not carry the person's line into the model's context with
+// it. Output with no envelope at all is all context, so a deja that printed
+// plain text still reaches the model.
+export function splitHookReply(stdout) {
+  const text = String(stdout || "").trim();
+  if (!text) return { context: "", notes: "" };
+  const lines = text.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i].trim();
+    if (!line.startsWith("{")) continue;
+    let reply;
+    try {
+      reply = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!reply || typeof reply !== "object" || Array.isArray(reply)) continue;
+    if (!("hookSpecificOutput" in reply) && !("systemMessage" in reply)) continue;
+    const out = reply.hookSpecificOutput;
+    const context = out && typeof out.additionalContext === "string" ? out.additionalContext.trim() : "";
+    const notes = typeof reply.systemMessage === "string" ? reply.systemMessage.trim() : "";
+    return { context, notes };
+  }
+  return { context: text, notes: "" };
+}
+
+// noteBoard holds deja's lines for the person until the page asks for them.
+// The recall runs in the host and the person reads a browser, so each
+// session's lines wait here and are handed over once: take() empties the
+// session's list. Two tabs on one session race for them, and the first to ask
+// gets them; the other shows nothing, which is the same once rule deja keeps.
+//
+// Bounded three ways, because a page that never asks must not grow the host's
+// memory, and a session reopened tomorrow must not open on yesterday's receipt:
+// lines per session, sessions held, and how long a line waits.
+export function noteBoard({ perSession = 8, sessions = 64, ttlMs = 10 * 60 * 1000, now = Date.now } = {}) {
+  const board = new Map();
+  let reader = false;
+  return {
+    push(sid, text) {
+      const at = now();
+      const lines = String(text || "")
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .map((line) => ({ line, at }));
+      if (!sid || lines.length === 0) return;
+      const held = board.get(sid) || [];
+      board.delete(sid);
+      board.set(sid, [...held, ...lines].slice(-perSession));
+      while (board.size > sessions) board.delete(board.keys().next().value);
+    },
+    take(sid) {
+      const held = board.get(sid) || [];
+      board.delete(sid);
+      const fresh = now() - ttlMs;
+      return held.filter((n) => n.at >= fresh).map((n) => n.line);
+    },
+    // Whether anything will ever read the board. deja marks its notes shown
+    // when it prints them, so asking for them with no page to show them on
+    // spends them: `/deja` and the next Claude Code session would not see
+    // them either.
+    hasReader: () => reader,
+    setReader: () => {
+      reader = true;
+    },
+  };
+}

package/package.json

@@ -1,16 +1,18 @@
 {
   "name": "dsh-deja",
-  "version": "0.22.1",
-  "description": "deja-vu memory for DeepSeek Harness: the session history of forty other coding agents, searchable and recalled before each step — a local index, no LLM.",
+  "version": "0.22.2",
+  "description": "deja-vu memory for DeepSeek Harness: the session history of forty-one other coding agents, searchable and recalled before each step — a local index, no LLM.",
   "type": "module",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
+    "./client": "./client.js",
     "./package.json": "./package.json"
   },
   "files": [
     "index.js",
     "lib.js",
+    "client.js",
     "cordis.patch.yml",
     "README.md",
     "docs/zh.md",
@@ -54,15 +56,19 @@
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
+    "client": {
+      "platform": "web"
+    },
     "compatibility": {
-      "dsh": "0.1.1-rc.2",
+      "dsh": "0.2.0-rc.2",
       "dshReleases": {
-        "0.1.1-rc.2": "compatible"
+        "0.1.1-rc.2": "compatible",
+        "0.2.0-rc.2": "compatible"
       }
     }
   },
   "dependencies": {
-    "@vshulcz/deja-vu": "^0.22.1"
+    "@vshulcz/deja-vu": "^0.22.2"
   },
   "scripts": {
     "test": "node --test test/*.test.js"