dsh-git-badge 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -8,13 +8,46 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 Versions before 0.6.0 predate this file; their history is in `git log` and on
 npm. 0.6.0 is the first release recorded here.
 
+## [Unreleased]
+
+## [0.10.0] - 2026-09-14
+
+### Added
+
+- **The install flow now tells you about the one manual step, everywhere it can.**
+  A market install activates the input chip immediately, but the sidebar
+  session-row badges additionally need the seam patch — and nothing said so.
+  Now: the market-listing description names the step; the README leads with the
+  two-command install order; a guarded `postinstall` applies the seam at
+  install time **when pnpm allows it** (opt-in via `allowBuilds` — DSH's plugin
+  installer prints that instruction whenever pnpm blocks a build) and only ever
+  in the one safe state (pristine upstream, all anchors resolving — anything
+  else just prints, and the hook can never fail an install); and when the seam
+  is still absent ~5s after boot, every input chip gains a tooltip naming the
+  command — the first message visible in the product rather than the console.
+  Restart stays manual by design: an install script restarting the host that is
+  installing it is not safe to automate.
+
+## [0.9.1] - 2026-09-14
+
+### Fixed
+
+- **The shipped patcher is reachable with npx.** `peerDependencies` named
+  `@deepseek-ai/dsh-client-runtime`, a DSH-internal package that is not on the
+  npm registry, so every `npx` invocation of the patcher died resolving peers
+  (pnpm inside a DSH profile only tolerated it because DSH itself provides the
+  runtime). The peers are removed — DSH supplies the runtime through the
+  `dsh.client.inject` declaration regardless — and the documented command is
+  `npx dsh-git-badge <verb>`: npx runs a package's single bin under the
+  package's own name. The boot hint and all docs now say that.
+
 ## [0.9.0] - 2026-09-14
 
 ### Added
 
 - **The seam patcher ships in the package** as the `dsh-git-badge-seam` bin, so a
   market install can add the sidebar session-row badges without cloning the
-  repository: `npx dsh-git-badge-seam apply`, then restart. Pure Node (no
+  repository: `npx dsh-git-badge apply`, then restart. Pure Node (no
   python3), anchor-based like the repo tooling it replaces, with the same
   refusal semantics: it writes nothing unless every anchor resolves exactly
   once, upgrades its own older artifacts by marker revision, and reverts to the

package/lib/client.js

@@ -695,6 +695,14 @@ window.__ModuleLoader__.load({
 		 * always, `detail=1` on hover), because it is the only one that renders
 		 * them — see targetQuery.
 		 */
+		/**
+		 * Set LATE (see apply) — never at apply() time, because the workspace
+		 * browser may not have declared the seam yet and a hint set then would
+		 * lie to patched installs for the whole session. Every chip render reads
+		 * it, so it reaches the DOM on the next refresh after it is set.
+		 */
+		let seamHint = null;
+
 		function ComposerGitChip({ sessionId }) {
 			const target = sessionId === void 0 ? void 0 : { kind: "session", id: sessionId };
 			// the PR/CI token is always on the chip, so its fetch is not gated
@@ -730,6 +738,11 @@ window.__ModuleLoader__.load({
 					whiteSpace: "nowrap",
 					cursor: "default"
 				},
+				// the only in-product message a market user gets when the seam is
+				// absent: hover the chip you CAN see to learn the one command that
+				// turns on the rows you cannot. null until the delayed check in
+				// apply() proves the seam never appeared.
+				title: seamHint === null ? undefined : seamHint,
 				// the card is fetched for a pointer that RESTS here, not one that
 				// merely crosses the chip
 				onPointerEnter: () => setHovered(true),
@@ -849,8 +862,21 @@ window.__ModuleLoader__.load({
 						: // discoverability: the chip works everywhere, but the session rows
 							// need the seam patch, and on a market install nothing else says so.
 							// The patcher ships IN this package — no clone needed.
-							"off (seam absent) — run `npx dsh-git-badge-seam apply` to add them, then restart dsh web.")
+							"off (seam absent) — run `npx dsh-git-badge apply` to add them, then restart dsh web.")
 			);
+			// The chip tooltip can only be set LATE. At apply() time the workspace
+			// browser may not have declared the seam yet (the boot race documented
+			// above), so claiming absence here would lie to patched installs for the
+			// whole session — the exact mistake that made the old one-shot line
+			// claim "sidebar rows = off" while five row badges were rendering. Give
+			// the composed graph a beat to settle; only a seam that is STILL absent
+			// earns the hint, and every chip render after that carries it.
+			setTimeout(() => {
+				if (rowsReported) return; // seam present; badges rendered — nothing to hint about
+				if (ctx.slots.spec("sidebar.workspaces.sessionRow") !== void 0) return;
+				seamHint =
+					"Session-row badges are off: run `npx dsh-git-badge apply`, then restart dsh web. (Input-chip badges are unaffected.)";
+			}, 5000);
 			// The hover card depends on a primitive the SHELL seeds, not on anything
 			// this plugin declares. Report the outcome rather than letting a missing
 			// seed look like a missing feature: the try/catch above deliberately keeps

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-git-badge",
-  "version": "0.9.0",
-  "description": "Git status badges for DeepSeek Harness: sidebar session rows (via the sidebar.workspaces.sessionRow seam) and an input-row chip showing the current conversation's workspace git state. Event-driven freshness over SSE.",
+  "version": "0.10.0",
+  "description": "Git status badges for DeepSeek Harness: an input-row chip on every install, plus sidebar session-row badges (git status, PR/CI action tokens) after one manual step: `npx dsh-git-badge apply`, then restart dsh web. Event-driven freshness over SSE.",
   "type": "module",
   "main": "lib/index.js",
   "bin": {
@@ -13,7 +13,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test",
+    "postinstall": "node seam/postinstall.js"
   },
   "dsh": {
     "bundle": {
@@ -50,16 +51,12 @@
     "lib/client.js",
     "seam/apply.js",
     "seam/anchors.js",
+    "seam/postinstall.js",
     "seam/stub-index.js",
     "cordis.patch.yml",
     "package.json",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
-  ],
-  "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4",
-    "@deepseek-ai/dsh-client-runtime": ">=0.1",
-    "react": ">=18"
-  }
+  ]
 }

package/seam/apply.js

@@ -10,7 +10,7 @@
  * install needs no clone:
  *
  *     dsh plugin --profile web add dsh-git-badge
- *     npx dsh-git-badge-seam apply        # then restart the dsh web process
+ *     npx dsh-git-badge apply        # then restart the dsh web process
  *
  * HOW PATCHING WORKS — anchors, not hashes. The patch is defined once in
  * anchors.js as [name, old, new] triples. `apply` locates each `old` block in

package/seam/postinstall.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+/**
+ * postinstall hook — best-effort seam apply at plugin-install time.
+ *
+ * WHY THIS EXISTS: a market install activates the input chip immediately, but
+ * the sidebar session-row badges additionally need the seam patch on the DSH
+ * package itself, and nothing in the install flow told the user so. When pnpm
+ * allows this script (the user approves it under `allowBuilds` — DSH's plugin
+ * installer prints exactly that instruction when pnpm blocks it), the seam is
+ * applied right here; otherwise the plugin's boot log and the chip tooltip name
+ * the same one manual command.
+ *
+ * GUARDRAILS — this script may never break an install:
+ *   - it runs ONLY when the installed DSH client.js is pristine upstream AND
+ *     every anchor resolves exactly once (`patchable`); any other state —
+ *     already patched, drifted, upstream-landed, DSH not found — just prints
+ *   - it never throws: every failure path prints the manual command and exits 0
+ *   - it cannot restart dsh web; the printed message says to
+ *
+ * The restart is deliberately manual: the running dsh web process rebuilds its
+ * client bundle at boot, and an install script restarting the host that is
+ * installing it is not safe to automate.
+ */
+import { execSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { applyPatch, firstFailure, isOurs, seamPresent } from "./anchors.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const HINT = "Sidebar session-row badges need one manual step: `npx dsh-git-badge apply`, then restart dsh web.";
+
+function dshClientPath() {
+	try {
+		const root = process.env.DSH_INSTALL || join(execSync("npm root -g", { encoding: "utf8" }).trim(), "@deepseek-ai", "dsh");
+		return join(root, "node_modules", "@deepseek-ai", "dsh-client-ui-workspace", "lib", "client.js");
+	} catch {
+		return null;
+	}
+}
+
+function main() {
+	const client = dshClientPath();
+	if (client === null || !existsSync(client)) {
+		console.log(`[dsh-git-badge] DSH install not found; skipping seam setup. ${HINT}`);
+		return;
+	}
+	// the index stub is copied with the client on apply (see apply.js)
+	const index = join(dirname(client), "index.js");
+	const text = readFileSync(client, "utf8");
+
+	// Already ours (any rev): nothing to do here; apply.js upgrade rules govern.
+	if (isOurs(text)) {
+		console.log("[dsh-git-badge] seam already applied — sidebar session-row badges active after restart.");
+		return;
+	}
+	// Upstream landed the seam: the patch is retired.
+	if (seamPresent(text)) {
+		console.log("[dsh-git-badge] DSH declares the seam itself — no patch needed.");
+		return;
+	}
+	// Pristine, but the anchors no longer resolve: a DSH update moved anchored
+	// code. Never patch half of anything — print, and let a patched anchors.js
+	// do it.
+	const fail = firstFailure(text);
+	if (fail !== null) {
+		console.log(`[dsh-git-badge] DSH build drifted from the patch anchors (${fail.name}); skipping. ${HINT}`);
+		return;
+	}
+	// The one state we act on: pristine upstream, anchors resolve.
+	mkdirSync(HERE, { recursive: true });
+	copyFileSync(client, join(HERE, "backup-client.js"));
+	copyFileSync(index, join(HERE, "backup-index.js"));
+	writeFileSync(client, applyPatch(text));
+	copyFileSync(join(HERE, "stub-index.js"), index);
+	console.log("[dsh-git-badge] seam applied — RESTART dsh web to get sidebar session-row badges.");
+}
+
+try {
+	main();
+} catch (error) {
+	// An install hook must never fail the install over the seam.
+	console.log(`[dsh-git-badge] seam setup skipped (${String(error && error.message ? error.message : error)}). ${HINT}`);
+}
+process.exit(0);