dsh-git-badge 0.17.4 → 0.19.0

package/CHANGELOG.md

@@ -10,6 +10,81 @@ npm. 0.6.0 is the first release recorded here.
 
 ## [Unreleased]
 
+## [0.19.0] - 2026-10-12
+
+### Fixed
+
+- **`revert` refuses a backup from a different upstream generation.** `apply`
+  patches whichever `SEAM_DATA_DIR` it is pointed at, so the shipped default
+  (`$DSH_HOME/git-badge-seam`) and this repo's wrapper (`seam/`) each keep their
+  own backup — and applying through one leaves the other's behind. After a DSH
+  update that stale backup holds an OLDER upstream, and `revert` used to restore
+  it blindly: a silent downgrade of the installed package. `revert` now validates
+  the backup before restoring it — the current anchors must resolve against it —
+  and refuses with a clear message, changing nothing.
+- **`status` reports what `revert` would do**, under a `revert:` line: restore,
+  no-op, or REFUSE and why. SEAM.md had documented that line from the beginning;
+  it was never implemented, so the refusal could arrive as a surprise at the one
+  moment it was least welcome.
+- **A worktree registration that cannot be written now says WHY.** The store
+  swallowed the cause, so `npx dsh-git-badge checkout <path>` reported only
+  "could not write the registration" — no path, no reason, no recovery — and the
+  next reader had to rediscover that a file sandbox or a read-only home can
+  refuse the write. It now names the target file, the real errno, and the three
+  ways out.
+
+### Added
+
+- **The chip's hover card names the linked worktrees a session is NOT
+  following.** That state used to be invisible: a registration the sandbox
+  refused left a badge describing the session's own checkout, which looks exactly
+  like a session with nothing to follow, while the agent's work sat in a tree the
+  UI never mentioned. The card now reads
+  `2 linked · none registered — npx dsh-git-badge checkout <path>`. It rides
+  `detail=1` like the rest of the card's extras, so nothing at rest pays for the
+  extra `git worktree list`.
+
+## [0.18.0] - 2026-10-12
+
+### Fixed
+
+- **The sidebar seam patch works again on DSH 0.2.0-rc.2.** That release rewrote
+  `dsh-client-ui-workspace/lib/client.js` (2821 → 4425 lines) and moved 8 of the
+  9 anchors the patcher pinned, so `npx dsh-git-badge status` reported `drift`
+  and `apply` refused to write. The anchor set is rewritten for the new upstream:
+  the patch is three anchors and **+48/−0** (was nine anchors and +74/−5).
+
+### Changed
+
+- **The session-row action token is a pill now.** It was grey text beside the
+  relative time, which made `push` — the one row that wants a decision — read as
+  metadata. It is now a severity-tinted pill with a leading glyph and a heavier
+  weight: `↑ push`, `↓ pull`, `✓ merge`, `✗ fix CI`, `! resolve`, `◆ review`.
+  Routine sync also moved off grey onto the app's business-blue token, so the
+  severity ramp is four steps (red, amber, green, blue) rather than three plus
+  silence. The glyph is `aria-hidden`, so a screen reader still reads the word
+  alone.
+- **The patch is one seam now, not two.** DSH 0.2.0-rc.2 threads `renderSlot`
+  into `SessionNodeItem` and `SessionHoverContent` itself and declares
+  `sidebar.session.row.hover`, so the hover card's provenance line rides that
+  upstream seat. The patched `sidebar.workspaces.sessionRow.detail` seam, the
+  `SessionTree`/`SessionNodeItem` `renderSlot` threading, and the `workspaceId`
+  owner-share field are all retired. The one remaining patched seam is
+  `sidebar.workspaces.sessionRow`: the always-visible row token after the title,
+  which no upstream seat can host (`sidebar.workspaces.session.row.action` is
+  `display:none` until hover, and `sidebar.session.row.leading` is a 16px cell
+  that renders only while the row is idle).
+- **The row token now shows in the flat grouping too.** The old patch passed
+  `workspaceId` from the tree call site only, which kept flat rows bare. Upstream
+  no longer passes a workspace id to `SessionNodeItem`, so the token renders
+  wherever a session row does. Search results are unaffected.
+- **The hover-card provenance line works on an unpatched install.** It no longer
+  depends on this package's seam patch.
+- `PATCH_REV` is now `3`, so an installed rev-2 artifact is recognised as stale
+  rather than skipped. Because the anchors moved with upstream's rewrite, a rev-2
+  install cannot be re-patched in place: `apply` refuses and tells you to
+  reinstall the DSH package first.
+
 ## [0.17.4] - 2026-09-18
 
 ### Fixed

package/README.md

@@ -6,7 +6,7 @@ Git status badges for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek
 - **Hover card** — rest a pointer on the chip for what won't fit: the file breakdown (`✎3` split into staged / unstaged / untracked), the last ten commits, and the stash. Fetched only on hover, so the everyday badge pays nothing for it. Works on every install.
 - **PR / CI token** — `● main ↑0 ↓2 PR#142 ✗` when the branch has a GitHub pull request, read through your own `gh` CLI (the plugin never handles a credential). The token **links to the PR** — it opens in a new tab, and underlines when you hover or focus it. Invisible when `gh` cannot answer: not installed, not logged in, no GitHub remote, offline or rate-limited all render the unchanged chip, and a token with no URL to link to stays plain text.
 - **Worktree-aware** — a conversation's directory is fixed when it is created, so a conversation that does its work in a linked `git worktree` would otherwise keep reporting the main checkout. The session registers its checkout (`npx dsh-git-badge checkout <path>`, run by the git-worktree and `/gh checkout` paths), and the badge describes **that worktree** instead — its branch, counts, tree mark and PR/CI token (`🌳 chore/global-skills-tiering ↑0 ↓2 PR#391 ✓` rather than `● main`). The hover card names the tree in a `worktree` row and adds a `checkout` row with the conversation's own directory, so the main checkout's branch and dirty state stay one hover away. Registrations are advisory: git's own worktree list validates the path, entries expire after 24h, and a workspace-targeted row always reports the checkout the registry owns.
-- **Sidebar session-row action token** — each session row shows the ONE thing that conversation needs from you, or nothing at all: `merge`, `fix CI`, `review`, `resolve`, `pull`, `push`. It is triage rather than status: `merge` appears only when GitHub itself reports `mergeStateStatus: CLEAN`, and every waiting state (draft, blocked, behind, checks still running) stays silent. Hovering the row adds a line naming the checkout and the pull request the action refers to. The token floats to the right of the row, is set heavier than the timestamp beside it, and is coloured by how much it needs you — red for a conflict or a failing build, amber for a requested review, green for `merge`, quiet grey for routine sync. It appears only when the session is **idle** — while a turn is running the row stays quiet, because the checkout is still moving and a suggestion would describe a state that is about to change. Requires the `sidebar.workspaces.sessionRow` seam; without it the plugin degrades to chip-only and logs what's active to the browser console.
+- **Sidebar session-row action token** — each session row shows the ONE thing that conversation needs from you, or nothing at all: `merge`, `fix CI`, `review`, `resolve`, `pull`, `push`. It is triage rather than status: `merge` appears only when GitHub itself reports `mergeStateStatus: CLEAN`, and every waiting state (draft, blocked, behind, checks still running) stays silent. Hovering the row adds a line naming the checkout and the pull request the action refers to. The token floats to the right of the row, is set heavier than the timestamp beside it, and is coloured by how much it needs you — red for a conflict or a failing build, amber for a requested review, green for `merge`, quiet grey for routine sync. It appears only when the session is **idle** — while a turn is running the row stays quiet, because the checkout is still moving and a suggestion would describe a state that is about to change. Requires the `sidebar.workspaces.sessionRow` seam for the row token itself; without it the row stays bare and the plugin logs what's active to the browser console. The hover-card line does **not** need the patch — it renders through upstream's own `sidebar.session.row.hover` seat.
 - **Nothing on workspace rows.** A workspace cannot know which worktree its conversations are using, so a per-workspace badge could only guess or report the main checkout. The seam is on the session row for that reason.
 
 The leading **mark** belongs to the input chip: a circle filled with the status colour, or a **tree** when the checkout is a linked `git worktree`. The sidebar row deliberately carries no mark — see the row bullet above, where one word does the job a colour cannot. (`●`/`🌳` stand in for it here — it is a drawn SVG so that it can take the theme's status colours.)

package/lib/client.js

@@ -10,9 +10,9 @@
  *    and the PR/CI token, immediately after the session title. Deliberately shows
  *    NO branch and no worktree name: the row lists conversations, and which
  *    checkout the badge describes is the hover card's business.
- *  - sidebar.workspaces.sessionRow.detail (seam): the hover-card line that names
- *    that checkout, rendered inside the card upstream ALREADY shows for a session
- *    row rather than in a tooltip nested inside it.
+ *  - sidebar.session.row.hover (upstream, no patch): the hover-card line that
+ *    names that checkout, rendered inside the card upstream ALREADY shows for a
+ *    session row rather than in a tooltip nested inside it.
  *  - conversation.input.left (upstream): chip — status mark + branch + a
  *    worktree's name + in-progress operation token + sync/dirty suffix + the
  *    PR/CI token, with a HOVER CARD carrying the breakdown the chip has no room
@@ -536,18 +536,35 @@ window.__ModuleLoader__.load({
 		/**
 		 * Action -> colour. Colour here means SEVERITY — how much this needs you —
 		 * rather than identity: a broken build and a conflict are the loud ones, a
-		 * requested review is a nudge, `merge` is the all-clear, and routine sync
-		 * stays quiet so the loud rows keep meaning something. The WORD remains the
-		 * channel (colour only reinforces it), and the tokens are the app's own, so
-		 * both themes work.
+		 * requested review is a nudge, `merge` is the all-clear, and routine sync is
+		 * the quiet end of the same ramp rather than outside it. That last move is
+		 * deliberate: grey put `push` below the threshold of notice, so the one row
+		 * that wanted a decision read as a timestamp. The WORD remains the channel
+		 * (colour only reinforces it), and the tokens are the app's own, so both
+		 * themes work.
 		 */
 		const ACTION_COLOUR = {
 			resolve: "var(--dsw-alias-state-error-primary, #e5484d)",
 			"fix CI": "var(--dsw-alias-state-error-primary, #e5484d)",
 			review: "var(--dsw-alias-state-warn-primary, #d29922)",
 			merge: "var(--dsw-alias-state-success-primary, #30a46c)",
-			pull: "var(--dsw-alias-label-secondary, #5b6570)",
-			push: "var(--dsw-alias-label-secondary, #5b6570)"
+			pull: "var(--dsw-alias-state-business-primary, #3b82f6)",
+			push: "var(--dsw-alias-state-business-primary, #3b82f6)"
+		};
+
+		/**
+		 * Action -> glyph. The SHAPE channel, beside the colour: a glyph makes the
+		 * row readable before the word is parsed, and it survives a monochrome or
+		 * colour-blind view where the tint alone would not. Keys mirror
+		 * ACTION_COLOUR exactly; a missing entry degrades to the bare word.
+		 */
+		const ACTION_GLYPH = {
+			resolve: "!",
+			"fix CI": "\u2717",
+			review: "\u25C6",
+			merge: "\u2713",
+			pull: "\u2193",
+			push: "\u2191"
 		};
 
 		/**
@@ -556,10 +573,21 @@ window.__ModuleLoader__.load({
 		 *    the sidebar — that alignment is what makes the list scannable;
 		 *  - `marginRight` keeps it clear of the relative time beside it (the first cut
 		 *    sat flush and read `merge11m`);
-		 *  - weight 500 rather than the timestamp's own treatment, because an action
-		 *    rendered in tertiary grey reads as metadata.
+		 *  - weight 600 plus a little padding make it a PILL, so the token reads as a
+		 *    tag rather than as loose text the eye can skip;
+		 *  - the radius is the app's own small one, so the pill belongs to the shell.
+		 *
+		 * The FILL is not set here: it is the action's own colour at low alpha, which
+		 * only SessionGitBadge can build.
 		 */
-		const ACTION_STYLE = { flex: "none", marginLeft: "auto", marginRight: "8px", fontWeight: 500 };
+		const ACTION_STYLE = {
+			flex: "none",
+			marginLeft: "auto",
+			marginRight: "8px",
+			fontWeight: 600,
+			padding: "0 6px",
+			borderRadius: "var(--dsw-radius-sm, 4px)"
+		};
 
 		/**
 		 * The row's own run state, from the shell's standard kit.
@@ -598,9 +626,9 @@ window.__ModuleLoader__.load({
 		}
 
 		/**
-		 * The action badge: floated, weighted, and coloured by severity — and shown
-		 * only when the session is IDLE. A turn in flight is precisely when a git
-		 * suggestion is noise: the checkout is still moving and the agent has not
+		 * The action badge: a severity-tinted pill carrying a glyph and the word — and
+		 * shown only when the session is IDLE. A turn in flight is precisely when a
+		 * git suggestion is noise: the checkout is still moving and the agent has not
 		 * finished, so the action describes a state that is about to change. Nothing
 		 * about the action itself changes; the gate is the whole feature.
 		 *
@@ -616,17 +644,33 @@ window.__ModuleLoader__.load({
 			const action = actionToken(info);
 			if (action === "") return null;
 			const colour = ACTION_COLOUR[action];
-			return react_jsx_runtime.jsx("span", {
-				style: colour === void 0 ? { ...META_STYLE, ...ACTION_STYLE } : { ...META_STYLE, ...ACTION_STYLE, color: colour },
-				children: action
+			const style = { ...META_STYLE, ...ACTION_STYLE };
+			if (colour !== void 0) {
+				style.color = colour;
+				// The pill's fill is the action's own colour at low alpha, so severity is
+				// a wash a row can carry rather than a shout. color-mix is a current-browser
+				// feature: where it is unsupported the pill keeps its geometry, colour,
+				// glyph and weight, and only the tint is lost.
+				style.background = `color-mix(in srgb, ${colour} 18%, transparent)`;
+			}
+			// The glyph is DECORATION: `aria-hidden` keeps the accessible name the bare
+			// word, and the trailing space in its own text separates the two on screen
+			// without a margin. A missing glyph entry degrades to the word alone.
+			const glyph = ACTION_GLYPH[action];
+			return react_jsx_runtime.jsxs("span", {
+				style,
+				children:
+					glyph === void 0
+						? action
+						: [react_jsx_runtime.jsx("span", { "aria-hidden": true, children: `${glyph} ` }, "glyph"), action]
 			});
 		}
 
 		/**
 		 * Session-row hover-card line — everything the action word cannot say: which
 		 * checkout the row's status describes, and which pull request the action
-		 * refers to. It renders through the sessionRow.detail seam, inside the card
-		 * upstream already opens for a row.
+		 * refers to. It renders through the upstream sidebar.session.row.hover
+		 * seat, inside the card upstream already opens for a row.
 		 *
 		 * This matters MORE now that the row shows only an imperative: `merge` with no
 		 * way to see merge WHAT would be a nag rather than a hint, so the line appears
@@ -716,6 +760,24 @@ window.__ModuleLoader__.load({
 			return name;
 		}
 
+		/**
+		 * The `worktrees` row: how many LINKED worktrees this repository has while
+		 * the badge follows none of them.
+		 *
+		 * It earns its place on one thing only — the failure it makes visible. A
+		 * registration is written outside the repository, so a file sandbox or a
+		 * read-only home can refuse it. When that happens the badge silently keeps
+		 * describing the session's own checkout, and the agent's work sits in a tree
+		 * the UI never names. That state is indistinguishable from a session with
+		 * nothing to follow, so the card is the only place it can be said. The node
+		 * half computes it under `detail=1` only, so nothing at rest pays for it.
+		 */
+		function linkedWorktreesDetail(info) {
+			const linked = info?.linkedWorktrees;
+			if (typeof linked !== "number" || linked <= 0) return void 0;
+			return linked + " linked \u00B7 none registered \u2014 npx dsh-git-badge checkout <path>";
+		}
+
 		/**
 		 * ONE commit line, shared by the branch hover and the PR token's hover so
 		 * the two cannot drift apart again: a fixed-width monospace hash cell, so
@@ -1032,6 +1094,11 @@ window.__ModuleLoader__.load({
 			// WHICH checkout the badge describes, when it is a worktree. The chip shows
 			// the branch alone, so this row is the only place the tree is named.
 			add("worktree", worktreeDetail(data));
+			// The linked-but-unregistered state — the on-screen difference between
+			// "nothing to follow" and "the registration could not be written". Rides
+			// the detail payload, so it appears once the hover has fetched, exactly
+			// like the `checkout` row below it.
+			add("worktrees", linkedWorktreesDetail(data));
 			// The conversation's OWN directory, present only when the badge is
 			// describing a followed worktree — the chip's branch and counts are the
 			// tree's in that case, so this is where the checkout's own state stays
@@ -1765,11 +1832,13 @@ window.__ModuleLoader__.load({
 				}, SessionGitBadge);
 			});
 			// The row is ALREADY a HoverCard anchor upstream, so a badge that opened
-			// its own tooltip would nest two cards. This additive slot renders the
-			// provenance line inside that card instead — the same pattern the
-			// workspace-row detail slot used. It issues no request of its own.
-			ctx.slots.inject("sidebar.workspaces.sessionRow.detail", () => ctx.slots.register({
-				name: "sidebar.workspaces.sessionRow.detail",
+			// its own tooltip would nest two cards. This renders the provenance line
+			// inside that card instead, through the hover seat upstream declares
+			// itself (sidebar.session.row.hover) — no seam patch and no request of
+			// its own. Upstream 0.2.0-rc.2 threads renderSlot into the card and adds
+			// the seat; before that this needed a patched sessionRow.detail seam.
+			ctx.slots.inject("sidebar.session.row.hover", () => ctx.slots.register({
+				name: "sidebar.session.row.hover",
 				id: "git-badge-row-detail"
 			}, SessionGitDetail));
 			// Input-row chip: upstream additive slot rendered in the input bar's
@@ -1824,7 +1893,7 @@ window.__ModuleLoader__.load({
 		// Additive; the host reads apply/inject and ignores the rest. The suite
 		// drives these to assert the REQUEST contract — which surface asks for the
 		// expensive extras — without a browser, a fetch or a network.
-		exports.__internals = { targetQuery, formatPrToken, formatFileBreakdown, formatPrDetail, formatCheckoutDetail, worktreeDetail, actionToken, ghSkillActions, cleanGate, moveCategory };
+		exports.__internals = { targetQuery, formatPrToken, formatFileBreakdown, formatPrDetail, formatCheckoutDetail, worktreeDetail, linkedWorktreesDetail, actionToken, ghSkillActions, cleanGate, moveCategory };
 		return module.exports;
 	}
 });

package/lib/index.js

@@ -1686,6 +1686,17 @@ function apply(ctx) {
 						}
 					}
 				}
+				if (detail && info.git === true && session !== null && effective.worktree === void 0) {
+					// No registration is in effect, so the badge describes the session's OWN
+					// checkout. When this repository also has LINKED worktrees, that is the one
+					// state worth naming: a registration write that failed (a file sandbox, a
+					// read-only home) looks exactly like a session with nothing to follow, and
+					// the agent's work then sits in a tree the badge never mentions. Gated on
+					// detail=1 (a pointer resting on the chip), so nothing at rest pays for the
+					// extra `git worktree list`.
+					const { worktrees } = await worktreesFor(target.path);
+					if (worktrees.length > 1) body.linkedWorktrees = worktrees.length - 1;
+				}
 				// Echo the resolved workspace id. SSE events identify the workspace,
 				// not the session, so a session-targeted client has no other way to
 				// tell whether an event belongs to it — without this the input chip

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-badge",
-  "version": "0.17.4",
+  "version": "0.19.0",
   "description": "Git status badges for DeepSeek Harness: an input-row chip on every install, plus sidebar session-row badges (git status, PR/CI action tokens) after one manual step: `npx dsh-git-badge apply`, then restart dsh web. Event-driven freshness over SSE.",
   "type": "module",
   "main": "lib/index.js",

package/seam/anchors.js

@@ -12,6 +12,12 @@
  * that moves one of the anchors does — and the failure names the anchor that
  * moved instead of reporting an opaque hash mismatch.
  *
+ * ONE seam, not two (rev 3). Upstream 0.2.0-rc.2 threads `renderSlot` into
+ * SessionNodeItem and SessionHoverContent itself and declares its own
+ * `sidebar.session.row.hover` hover-card seat, so the badge's provenance line
+ * rides that upstream seat and needs no patch. The seat upstream still lacks is
+ * the always-visible row token after the title: these three anchors add it.
+ *
  * Tabs matter: the target is a bundled, tab-indented file. The strings below
  * use \t escapes so a reader cannot mistake them for spaces. When upstream
  * moves an anchor, edit that entry's `old` (and `new`, if the insertion point
@@ -22,7 +28,7 @@ export const MARKER = "dsh-git-badge:seam-patch";
 // Bumped whenever the anchor set changes shape. An installed file carrying the
 // MARKER without this revision is OUR older artifact: apply restores its backup
 // and re-patches rather than refusing.
-export const PATCH_REV = "2";
+export const PATCH_REV = "3";
 export const REV_COMMENT = `${MARKER} rev ${PATCH_REV}`;
 
 // The seam strings upstream would declare if the patch were merged. Present in
@@ -37,59 +43,20 @@ export const PATCHES = [
 	// --- 1. Session-row seam helper, inserted with the row component's props ---
 	[
 		"SessionNodeItem header + seam helpers",
-		"\t\tfunction SessionNodeItem({ node, currentId, now, onOpen, onRename, onFork, onArchive, onReveal, drag, flat = false, t }) {",
-		"\t\t/* dsh-git-badge:seam-patch rev 2 — seam/apply.sh recognises its own artifact by this\n\t\t * marker, which upstream would never carry. */\n\t\t/**\n\t\t* Seam entry boundary. The host wraps each registered ENTRY in its own error\n\t\t* boundary, but the outlet a row renders is NOT covered by it, so a throw\n\t\t* anywhere in an occupant's render path would propagate into the workspace\n\t\t* browser itself — and the shell ABDICATES that browser entry, blanking the\n\t\t* whole sidebar. A seam must not be able to do that: this keeps the blast\n\t\t* radius at \"no badge\", and logs what happened instead of swallowing it.\n\t\t*/\n\t\tclass SeamBoundary extends react.Component {\n\t\t\tconstructor(props) {\n\t\t\t\tsuper(props);\n\t\t\t\tthis.state = { failed: false };\n\t\t\t}\n\t\t\tstatic getDerivedStateFromError() {\n\t\t\t\treturn { failed: true };\n\t\t\t}\n\t\t\tcomponentDidCatch(error) {\n\t\t\t\tconsole.error(\"[dsh-git-badge] seam entry failed; badge omitted:\", error);\n\t\t\t}\n\t\t\trender() {\n\t\t\t\treturn this.state.failed ? null : this.props.children;\n\t\t\t}\n\t\t}\n\t\t/** Seam entry bodies, so the boundary above ENCLOSES the renderSlot call. */\n\t\tfunction SessionRowSeam({ renderSlot, sessionId, workspaceId, label }) {\n\t\t\treturn renderSlot(\"sidebar.workspaces.sessionRow\", { sessionId, workspaceId, label });\n\t\t}\n\t\tfunction SessionRowDetailSeam({ renderSlot, sessionId, workspaceId, label }) {\n\t\t\treturn renderSlot(\"sidebar.workspaces.sessionRow.detail\", { sessionId, workspaceId, label });\n\t\t}\n\t\t/**\n\t\t* Session-row seam (sidebar.workspaces.sessionRow): renders the additive\n\t\t* list-slot entries for one session row with the row owner share\n\t\t* ({ sessionId, workspaceId, label }).\n\t\t*\n\t\t* Returns null — not a fallback element — when no plugin occupies the seam,\n\t\t* so a pristine install renders exactly as upstream. `workspaceId` is only\n\t\t* ever passed from the TREE call site: the flat \"all sessions\" list and the\n\t\t* search-result list render this component without it, which is what keeps\n\t\t* badges off those lists without either of them needing a guard.\n\t\t*/\n\t\tfunction renderSessionRowSeam(renderSlot, sessionId, workspaceId, label) {\n\t\t\tif (renderSlot === void 0 || workspaceId === void 0) return null;\n\t\t\treturn (0, react_jsx_runtime.jsx)(SeamBoundary, {\n\t\t\t\tchildren: (0, react_jsx_runtime.jsx)(SessionRowSeam, { renderSlot, sessionId, workspaceId, label })\n\t\t\t});\n\t\t}\n\t\tfunction SessionNodeItem({ node, currentId, now, onOpen, onRename, onFork, onArchive, onReveal, drag, flat = false, t, renderSlot, workspaceId }) {",
+		"\t\tfunction SessionNodeItem({ node, currentId, now, onOpen, onRenameRequest, renderSlot, onReveal, drag, t }) {",
+		"\t\t/* dsh-git-badge:seam-patch rev 3 — seam/apply.sh recognises its own artifact by this\n\t\t * marker, which upstream would never carry. */\n\t\t/**\n\t\t* Seam entry boundary. The host wraps each registered ENTRY in its own error\n\t\t* boundary, but the outlet a row renders is NOT covered by it, so a throw\n\t\t* anywhere in an occupant's render path would propagate into the workspace\n\t\t* browser itself — and the shell ABDICATES that browser entry, blanking the\n\t\t* whole sidebar. A seam must not be able to do that: this keeps the blast\n\t\t* radius at \"no badge\", and logs what happened instead of swallowing it.\n\t\t*/\n\t\tclass SeamBoundary extends react.Component {\n\t\t\tconstructor(props) {\n\t\t\t\tsuper(props);\n\t\t\t\tthis.state = { failed: false };\n\t\t\t}\n\t\t\tstatic getDerivedStateFromError() {\n\t\t\t\treturn { failed: true };\n\t\t\t}\n\t\t\tcomponentDidCatch(error) {\n\t\t\t\tconsole.error(\"[dsh-git-badge] seam entry failed; badge omitted:\", error);\n\t\t\t}\n\t\t\trender() {\n\t\t\t\treturn this.state.failed ? null : this.props.children;\n\t\t\t}\n\t\t}\n\t\t/** Seam entry body, so the boundary above ENCLOSES the renderSlot call. */\n\t\tfunction SessionRowSeam({ renderSlot, sessionId, label }) {\n\t\t\treturn renderSlot(\"sidebar.workspaces.sessionRow\", { sessionId, label });\n\t\t}\n\t\t/**\n\t\t* Session-row seam (sidebar.workspaces.sessionRow): renders the additive\n\t\t* list-slot entries for one session row with the row owner share\n\t\t* ({ sessionId, label }).\n\t\t*\n\t\t* Returns null — not a fallback element — when no plugin occupies the seam,\n\t\t* so a pristine install renders exactly as upstream.\n\t\t*/\n\t\tfunction renderSessionRowSeam(renderSlot, sessionId, label) {\n\t\t\tif (renderSlot === void 0) return null;\n\t\t\treturn (0, react_jsx_runtime.jsx)(SeamBoundary, {\n\t\t\t\tchildren: (0, react_jsx_runtime.jsx)(SessionRowSeam, { renderSlot, sessionId, label })\n\t\t\t});\n\t\t}\n\t\tfunction SessionNodeItem({ node, currentId, now, onOpen, onRenameRequest, renderSlot, onReveal, drag, t }) {"
 	],
-	// --- 2. The badge sits with the title, before the schedule/time cluster ---
+	// --- 2. The token sits with the title, before the time cluster ---
 	[
 		"title span + badge render",
-		'\t\t\t\t\t\t(0, react_jsx_runtime.jsx)("span", {\n\t\t\t\t\t\t\tclassName: Rows_module_css_default.title,\n\t\t\t\t\t\t\tchildren: title\n\t\t\t\t\t\t}),',
-		'\t\t\t\t\t\t(0, react_jsx_runtime.jsx)("span", {\n\t\t\t\t\t\t\tclassName: Rows_module_css_default.title,\n\t\t\t\t\t\t\tchildren: title\n\t\t\t\t\t\t}),\n\t\t\t\t\t\trenderSessionRowSeam(renderSlot, node.id, workspaceId, title),',
-	],
-	// --- 3. The hover card gains the detail seam ---
-	[
-		"SessionHoverContent call-site props",
-		'\t\t\t\tcontent: (0, react_jsx_runtime.jsx)(SessionHoverContent, {\n\t\t\t\t\tnode,\n\t\t\t\t\tnow,\n\t\t\t\t\tt\n\t\t\t\t}),',
-		'\t\t\t\tcontent: (0, react_jsx_runtime.jsx)(SessionHoverContent, {\n\t\t\t\t\tnode,\n\t\t\t\t\tnow,\n\t\t\t\t\tt,\n\t\t\t\t\trenderSlot,\n\t\t\t\t\tworkspaceId\n\t\t\t\t}),',
-	],
-	[
-		"SessionHoverContent header",
-		"\t\tfunction SessionHoverContent({ node, now, t }) {",
-		"\t\tfunction SessionHoverContent({ node, now, t, renderSlot, workspaceId }) {",
-	],
-	[
-		"hover card detail row",
-		"\t\t\t\t\t}, status.label))\n\t\t\t\t]\n\t\t\t});\n\t\t}",
-		'\t\t\t\t\t}, status.label)),\n\t\t\t\t\trenderSlot !== void 0 && workspaceId !== void 0 ? (0, react_jsx_runtime.jsx)("div", {\n\t\t\t\t\t\tclassName: Rows_module_css_default.hoverStatus,\n\t\t\t\t\t\tchildren: (0, react_jsx_runtime.jsx)(SeamBoundary, {\n\t\t\t\t\t\t\tchildren: (0, react_jsx_runtime.jsx)(SessionRowDetailSeam, { renderSlot, sessionId: node.id, workspaceId, label: displayTitle(node, t) })\n\t\t\t\t\t\t})\n\t\t\t\t\t}) : null\n\t\t\t\t]\n\t\t\t});\n\t\t}',
-	],
-	// --- 4. Thread renderSlot: WorkspaceBrowser -> SessionTree ---
-	// A bare `renderSlot` at the SessionNodeItem call site resolves in THIS scope.
-	// The first cut of this patch threaded it into SessionNodeItem but not into
-	// SessionTree, so the row render threw `ReferenceError: renderSlot is not
-	// defined` the moment sessions appeared — and the shell abdicated the whole
-	// sidebar with it. Any prop a patched call site reads by shorthand must arrive
-	// through every intermediate scope.
-	[
-		"SessionTree header",
-		"\t\tfunction SessionTree({ useSessions, useSessionPendingInteraction, startSession, open, forkSession, workspaces, archivedSessionIds, workspaceReady, usePanelInfo, onRenameRequest, onDeleteRequest, onSessionRename, onSessionArchive, insertWorkspaceBefore, insertSessionBefore, orderBy, groupExpansion, setGroupExpanded, sessionOrderByAccount, sessionUpdatedAtByAccount, syncSessionOrderAccount, setSessionOrder, home, t, revealSessionId, onSessionRevealed }) {",
-		"\t\tfunction SessionTree({ useSessions, useSessionPendingInteraction, startSession, open, forkSession, workspaces, archivedSessionIds, workspaceReady, usePanelInfo, onRenameRequest, onDeleteRequest, onSessionRename, onSessionArchive, insertWorkspaceBefore, insertSessionBefore, orderBy, groupExpansion, setGroupExpanded, sessionOrderByAccount, sessionUpdatedAtByAccount, syncSessionOrderAccount, setSessionOrder, home, t, renderSlot, revealSessionId, onSessionRevealed }) {",
-	],
-	[
-		"SessionTree call site",
-		"(0, react_jsx_runtime.jsx)(SessionTree, {\n\t\t\t\t\t\t\tusePanelInfo,",
-		"(0, react_jsx_runtime.jsx)(SessionTree, {\n\t\t\t\t\t\t\trenderSlot,\n\t\t\t\t\t\t\tusePanelInfo,",
-	],
-	// --- 5. Thread renderSlot + the owning workspace id from the TREE call site only ---
-	[
-		"SessionNodeItem call site",
-		"\t\t\t\t\t\t\t\t\t\treturn (0, react_jsx_runtime.jsx)(SessionNodeItem, {\n\t\t\t\t\t\t\t\t\t\t\tnode,\n\t\t\t\t\t\t\t\t\t\t\tcurrentId: current,",
-		"\t\t\t\t\t\t\t\t\t\treturn (0, react_jsx_runtime.jsx)(SessionNodeItem, {\n\t\t\t\t\t\t\t\t\t\t\tnode,\n\t\t\t\t\t\t\t\t\t\t\tcurrentId: current,\n\t\t\t\t\t\t\t\t\t\t\trenderSlot,\n\t\t\t\t\t\t\t\t\t\t\t// only the tree knows which workspace a row belongs to; the\n\t\t\t\t\t\t\t\t\t\t\t// flat and search lists pass neither prop, so they stay bare\n\t\t\t\t\t\t\t\t\t\t\tworkspaceId: group.workspaceId,",
+		"\t\t\t\t\t\t(0, react_jsx_runtime.jsx)(\"span\", {\n\t\t\t\t\t\t\tref: titleRef,\n\t\t\t\t\t\t\tclassName: Rows_module_css_default.title,\n\t\t\t\t\t\t\tonDoubleClick: row.blank ? void 0 : (e) => {\n\t\t\t\t\t\t\t\te.stopPropagation();\n\t\t\t\t\t\t\t\tonRenameRequest(node.id, row.title);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tchildren: title\n\t\t\t\t\t\t}),",
+		"\t\t\t\t\t\t(0, react_jsx_runtime.jsx)(\"span\", {\n\t\t\t\t\t\t\tref: titleRef,\n\t\t\t\t\t\t\tclassName: Rows_module_css_default.title,\n\t\t\t\t\t\t\tonDoubleClick: row.blank ? void 0 : (e) => {\n\t\t\t\t\t\t\t\te.stopPropagation();\n\t\t\t\t\t\t\t\tonRenameRequest(node.id, row.title);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tchildren: title\n\t\t\t\t\t\t}),\n\t\t\t\t\t\trenderSessionRowSeam(renderSlot, node.id, title),"
 	],
-	// --- 6. Declare the two seam children on the sidebar.workspaces registration ---
+	// --- 3. Declare the one seam child on the sidebar.workspaces registration ---
 	[
 		"seam children registration",
-		'\t\t\t\tchildren: { "sidebar.workspaces.directoryFlow": {\n\t\t\t\t\tkind: "single",\n\t\t\t\t\tscope: "root"\n\t\t\t\t} },',
-		'\t\t\t\tchildren: { "sidebar.workspaces.directoryFlow": {\n\t\t\t\t\tkind: "single",\n\t\t\t\t\tscope: "root"\n\t\t\t\t}, "sidebar.workspaces.sessionRow": {\n\t\t\t\t\tkind: "list",\n\t\t\t\t\tscope: "root"\n\t\t\t\t}, "sidebar.workspaces.sessionRow.detail": {\n\t\t\t\t\tkind: "list",\n\t\t\t\t\tscope: "root"\n\t\t\t\t} },',
+		"\t\t\t\t\t\"sidebar.workspaces.directoryFlow\": {\n\t\t\t\t\t\tkind: \"single\",\n\t\t\t\t\t\tscope: \"root\"\n\t\t\t\t\t},",
+		"\t\t\t\t\t\"sidebar.workspaces.directoryFlow\": {\n\t\t\t\t\t\tkind: \"single\",\n\t\t\t\t\t\tscope: \"root\"\n\t\t\t\t\t},\n\t\t\t\t\t\"sidebar.workspaces.sessionRow\": {\n\t\t\t\t\t\tkind: \"list\",\n\t\t\t\t\t\tscope: \"root\"\n\t\t\t\t\t},"
 	],
 ];
 

package/seam/apply.js

@@ -47,9 +47,9 @@
  * Usage: npx dsh-git-badge apply | revert | status | checkout <path|--clear>
  *        (equivalently apply.js <verb>; checkout delegates to checkout.js)
  */
-import { copyFileSync, existsSync, readFileSync } from "node:fs";
+import { copyFileSync, existsSync } from "node:fs";
 import { MARKER } from "./anchors.js";
-import { backupState, doPatch, doRestore, installPaths, inspect, KNOWN_GOOD_HASH, sha256 } from "./patch.js";
+import { backupState, doPatch, doRestore, installPaths, inspect, KNOWN_GOOD_HASH, revertPlan } from "./patch.js";
 import { installSkill } from "./skill.js";
 import { writeRestartMarker } from "./store.js";
 
@@ -115,6 +115,17 @@ if (verb === "status") {
 		default:
 			console.log(`verdict:    ${r.state.toUpperCase()} — see error above.`);
 	}
+	// Whether `revert` would act or refuse, reported BEFORE anyone needs it. The
+	// refusal can be about a backup that lives in a different store than the one
+	// being inspected, so revert time is the wrong moment to learn about it.
+	const plan = revertPlan(paths);
+	const revertLine =
+		plan.action === "refuse"
+			? `would REFUSE — ${plan.reason}`
+			: plan.action === "noop"
+				? `nothing to do — ${plan.reason}`
+				: `would restore the bytes as found — ${plan.reason}`;
+	console.log(`revert:     ${revertLine}`);
 	process.exit(VERDICT_EXIT_1.has(r.state) ? 1 : 0);
 }
 
@@ -182,40 +193,48 @@ if (verb === "apply") {
 	}
 	console.log(`now install the plugin:  dsh plugin --profile web add dsh-git-badge`);
 } else {
-	// revert
-	if (existsSync(paths.backupClient)) {
-		const r = inspect(paths);
-		const installedHash = r.hash;
-		const backupHash = sha256(readFileSync(paths.backupClient, "utf8"));
-		if (installedHash === backupHash) {
-			// Idempotent re-run: the installed bytes already ARE the backup.
-			console.log("already reverted — installed client.js matches the backup; nothing to do.");
-		} else if (r.state === "ours-current" || r.state === "ours-stale" || r.state === "ours-corrupt") {
-			doRestore(paths);
-			console.log("reverted client.js/index.js to the bytes as found before patching.");
-			// A revert also changes bytes the running bundles were composed from.
-			writeRestartMarker("revert");
-		} else {
-			// Installed file is not ours => upstream replaced it since patching.
-			console.error("REFUSING to revert: the installed client.js is not this repo's");
-			console.error(`artifact (state: ${r.state}), so upstream replaced it since the patch was`);
-			console.error("applied. Restoring the backup would DOWNGRADE the package.");
-			console.error("Nothing was changed. If the downgrade is really what you want, restore");
-			console.error(`${paths.backupClient} by hand.`);
-			process.exit(1);
-		}
+	// revert — ONE decision (revertPlan), shared with the `status` report, so the
+	// refusal a user is warned about is the refusal they actually get.
+	const plan = revertPlan(paths);
+	const r = inspect(paths);
+	const ours = r.state === "ours-current" || r.state === "ours-stale" || r.state === "ours-corrupt";
+	const hasBackup = existsSync(paths.backupClient);
+
+	if (plan.action === "restore") {
+		doRestore(paths);
+		console.log("reverted client.js/index.js to the bytes as found before patching.");
+		// A revert also changes bytes the running bundles were composed from.
+		writeRestartMarker("revert");
+	} else if (plan.action === "noop") {
+		// Idempotent re-run: the installed bytes already ARE the backup.
+		console.log(`already reverted — ${plan.reason}; nothing to do.`);
+	} else if (hasBackup && ours) {
+		// The dangerous case: WE patched this build, but the backup beside it is
+		// from another upstream generation. Restoring it downgrades the package.
+		console.error("REFUSING to revert: the backup in this store is not a build this patch");
+		console.error(`targets — ${plan.reason}.`);
+		console.error("Restoring it would replace the installed build with an older upstream that the");
+		console.error("current anchors cannot re-apply. Nothing was changed.");
+		console.error("Revert from the store that patched this build instead — its `status` prints");
+		console.error("`revert:     would restore ...` — or reinstall the DSH package.");
+		process.exit(1);
+	} else if (hasBackup) {
+		// Installed file is not ours => upstream replaced it since patching.
+		console.error("REFUSING to revert: the installed client.js is not this repo's");
+		console.error(`artifact (state: ${r.state}). Restoring the backup would DOWNGRADE the`);
+		console.error("package. Nothing was changed. If the downgrade is really what you want,");
+		console.error(`restore ${paths.backupClient} by hand.`);
+		process.exit(1);
+	} else if (ours) {
+		console.error("REFUSING: the installed file is patched but no backup exists in");
+		console.error("the seam data dir, so the original bytes are unknown here. Options:");
+		console.error("  1. If you applied from a clone of the plugin's repository, run its");
+		console.error("     wrapper instead — it keeps its own backup:");
+		console.error("       <clone>/seam/apply.sh revert");
+		console.error("  2. Otherwise reinstall the package — pristine files, guaranteed:");
+		console.error("       npm i -g @deepseek-ai/dsh@latest");
+		process.exit(1);
 	} else {
-		const r = inspect(paths);
-		if (r.state === "ours-current" || r.state === "ours-stale" || r.state === "ours-corrupt") {
-			console.error("REFUSING: the installed file is patched but no backup exists in");
-			console.error("the seam data dir, so the original bytes are unknown here. Options:");
-			console.error("  1. If you applied from a clone of the plugin's repository, run its");
-			console.error("     wrapper instead — it keeps its own backup:");
-			console.error("       <clone>/seam/apply.sh revert");
-			console.error("  2. Otherwise reinstall the package — pristine files, guaranteed:");
-			console.error("       npm i -g @deepseek-ai/dsh@latest");
-			process.exit(1);
-		}
 		console.log("no backup present and nothing of ours installed; client.js left untouched.");
 	}
 	// restore the no-op host half if no backup of the original exists

package/seam/checkout.js

@@ -77,8 +77,19 @@ if (!paths.includes(path)) {
 	process.exit(1);
 }
 
-if (!writeSessionCheckout(sessionId, path)) {
-	console.error("[dsh-git-badge] could not write the registration; the badge keeps its inferred checkout.");
+const written = writeSessionCheckout(sessionId, path);
+if (written.ok !== true) {
+	// The failure the badge cannot show. Say the CAUSE and the three ways out, so
+	// this never reads as "the worktree has no changes" — which is exactly what a
+	// failed registration looks like from the UI.
+	console.error(`[dsh-git-badge] could not write the registration to ${written.file}`);
+	console.error(`  reason: ${written.error}${written.code === "" ? "" : ` (${written.code})`}`);
+	console.error("  The badge therefore keeps describing THIS session's own checkout, so the");
+	console.error("  worktree's state will not appear. Pick one:");
+	console.error("    1. give this process write access to that directory, then re-run this command;");
+	console.error("    2. run this command from a shell that already has it;");
+	console.error("    3. add the worktree as its own dsh workspace — a session opened there needs no");
+	console.error("       registration at all, because its working directory IS the worktree.");
 	process.exit(1);
 }
 console.log(`[dsh-git-badge] this session's checkout is now ${basename(path)} (${branchOf(path)}).`);

package/seam/patch.js

@@ -22,7 +22,7 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 
 // sha256 of the upstream build the anchors were last verified against. ADVISORY:
 // status prints it for orientation; apply does NOT require it.
-export const KNOWN_GOOD_HASH = "383b9ef779366c13d818500b6488896328b189f156addbaa480c835e902edd5f";
+export const KNOWN_GOOD_HASH = "e784543780fb8ac7c38c853afd26b9b1713c6907eec2b07eff37461e07bd3be9";
 
 /** Locate the installed DSH package root; null when it cannot be found. */
 export function dshRoot() {
@@ -120,6 +120,45 @@ export function backupState(paths) {
 				: "drift";
 }
 
+/**
+ * What `revert` WOULD do, without doing it — the ONE decision the `status`
+ * report and the revert branch both read, so they cannot drift apart. They did:
+ * `revert: would REFUSE` was documented in SEAM.md and never implemented, which
+ * is the same shape of bug as the hole this closes.
+ *
+ * A legitimate backup is the bytes as found before patching, so the CURRENT
+ * anchors must still resolve against it (`backupState` is "patchable"). A store
+ * whose backup predates a DSH update satisfies neither condition: it holds an
+ * OLDER upstream, so restoring it would downgrade the package AND leave a build
+ * this patch cannot re-apply.
+ *
+ * That store is easy to acquire by accident, because `apply` patches whichever
+ * store it is pointed at: the shipped patcher defaults to
+ * `$DSH_HOME/git-badge-seam` while this repo's wrapper keeps its own under
+ * `seam/`. Apply through one and the other's backup stays behind.
+ *
+ * @returns {{ action: "restore" | "noop" | "refuse", reason: string }}
+ */
+export function revertPlan(paths) {
+	if (!existsSync(paths.backupClient))
+		return { action: "refuse", reason: "no backup in this store, so the original bytes are unknown" };
+	const r = inspect(paths);
+	if (r.hash === sha256(readText(paths.backupClient)))
+		return { action: "noop", reason: "installed client.js already matches the backup" };
+	if (r.state !== "ours-current" && r.state !== "ours-stale" && r.state !== "ours-corrupt")
+		return {
+			action: "refuse",
+			reason: `the installed client.js is not this repo's artifact (state: ${r.state})`
+		};
+	const bstate = backupState(paths);
+	if (bstate !== "patchable")
+		return {
+			action: "refuse",
+			reason: `the backup is '${bstate}' — a different upstream generation, not a build this patch targets`
+		};
+	return { action: "restore", reason: "the backup is a build this patch targets" };
+}
+
 /**
  * Backup the bytes AS FOUND, patch client.js in place, install the no-op host
  * half, and record the restart marker (`reason` names the actor: apply |

package/seam/store.js

@@ -105,20 +105,24 @@ export function readSessionCheckouts(file = sessionCheckoutsPath()) {
 /**
  * Register the checkout a session is working in. Written by the agent (the
  * git-worktree and /gh checkout paths), read by the node half.
+ *
+ * Returns the OUTCOME rather than a boolean, because the reason matters here more
+ * than anywhere else in this file. A registration that cannot be written is the
+ * one failure the badge CANNOT show: the session quietly keeps its inferred
+ * checkout, which looks identical to a session with nothing to follow. The caller
+ * gets `error`/`code` so it can say what went wrong and where, instead of
+ * reporting a bare failure that the next reader has to rediscover the hard way.
  */
 export function writeSessionCheckout(sessionId, path) {
+	const file = sessionCheckoutsPath();
 	try {
 		mkdirSync(dataDir(), { recursive: true });
 		const sessions = readSessionCheckouts();
 		sessions[sessionId] = { path, at: new Date().toISOString() };
-		writeFileSync(
-			sessionCheckoutsPath(),
-			JSON.stringify({ schema: "dsh-git-badge/session-checkout/v1", sessions }),
-			"utf8",
-		);
-		return true;
-	} catch {
-		return false;
+		writeFileSync(file, JSON.stringify({ schema: "dsh-git-badge/session-checkout/v1", sessions }), "utf8");
+		return { ok: true, file };
+	} catch (error) {
+		return { ok: false, file, error: String(error?.message ?? error), code: String(error?.code ?? "") };
 	}
 }