dsh-git-badge 0.9.1 → 0.10.1

package/CHANGELOG.md

@@ -8,6 +8,42 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 Versions before 0.6.0 predate this file; their history is in `git log` and on
 npm. 0.6.0 is the first release recorded here.
 
+## [Unreleased]
+
+## [0.10.1] - 2026-09-14
+
+### Fixed
+
+- **Revert backups now live in a stable, user-level store.** They defaulted to
+  the patcher's own directory — which for `npx dsh-git-badge` is a cache entry
+  keyed by package version, so a backup written by one `apply` was invisible to
+  the next `revert`, which then had to refuse ("patched but no backup exists")
+  even though the bytes were on disk somewhere. The default is now
+  `$DSH_HOME/git-badge-seam` (else `~/.dsh/git-badge-seam`), shared by npx
+  runs, the profile bin, the repo wrapper and the postinstall hook;
+  `SEAM_DATA_DIR` still overrides. Backups written by older versions to their
+  install directories are not migrated — the no-backup refusal now says so and
+  names both remaining routes (the repo wrapper's backup, or reinstalling the
+  DSH package).
+
+## [0.10.0] - 2026-09-14
+
+### Added
+
+- **The install flow now tells you about the one manual step, everywhere it can.**
+  A market install activates the input chip immediately, but the sidebar
+  session-row badges additionally need the seam patch — and nothing said so.
+  Now: the market-listing description names the step; the README leads with the
+  two-command install order; a guarded `postinstall` applies the seam at
+  install time **when pnpm allows it** (opt-in via `allowBuilds` — DSH's plugin
+  installer prints that instruction whenever pnpm blocks a build) and only ever
+  in the one safe state (pristine upstream, all anchors resolving — anything
+  else just prints, and the hook can never fail an install); and when the seam
+  is still absent ~5s after boot, every input chip gains a tooltip naming the
+  command — the first message visible in the product rather than the console.
+  Restart stays manual by design: an install script restarting the host that is
+  installing it is not safe to automate.
+
 ## [0.9.1] - 2026-09-14
 
 ### Fixed

package/lib/client.js

@@ -695,6 +695,14 @@ window.__ModuleLoader__.load({
 		 * always, `detail=1` on hover), because it is the only one that renders
 		 * them — see targetQuery.
 		 */
+		/**
+		 * Set LATE (see apply) — never at apply() time, because the workspace
+		 * browser may not have declared the seam yet and a hint set then would
+		 * lie to patched installs for the whole session. Every chip render reads
+		 * it, so it reaches the DOM on the next refresh after it is set.
+		 */
+		let seamHint = null;
+
 		function ComposerGitChip({ sessionId }) {
 			const target = sessionId === void 0 ? void 0 : { kind: "session", id: sessionId };
 			// the PR/CI token is always on the chip, so its fetch is not gated
@@ -730,6 +738,11 @@ window.__ModuleLoader__.load({
 					whiteSpace: "nowrap",
 					cursor: "default"
 				},
+				// the only in-product message a market user gets when the seam is
+				// absent: hover the chip you CAN see to learn the one command that
+				// turns on the rows you cannot. null until the delayed check in
+				// apply() proves the seam never appeared.
+				title: seamHint === null ? undefined : seamHint,
 				// the card is fetched for a pointer that RESTS here, not one that
 				// merely crosses the chip
 				onPointerEnter: () => setHovered(true),
@@ -851,6 +864,19 @@ window.__ModuleLoader__.load({
 							// The patcher ships IN this package — no clone needed.
 							"off (seam absent) — run `npx dsh-git-badge apply` to add them, then restart dsh web.")
 			);
+			// The chip tooltip can only be set LATE. At apply() time the workspace
+			// browser may not have declared the seam yet (the boot race documented
+			// above), so claiming absence here would lie to patched installs for the
+			// whole session — the exact mistake that made the old one-shot line
+			// claim "sidebar rows = off" while five row badges were rendering. Give
+			// the composed graph a beat to settle; only a seam that is STILL absent
+			// earns the hint, and every chip render after that carries it.
+			setTimeout(() => {
+				if (rowsReported) return; // seam present; badges rendered — nothing to hint about
+				if (ctx.slots.spec("sidebar.workspaces.sessionRow") !== void 0) return;
+				seamHint =
+					"Session-row badges are off: run `npx dsh-git-badge apply`, then restart dsh web. (Input-chip badges are unaffected.)";
+			}, 5000);
 			// The hover card depends on a primitive the SHELL seeds, not on anything
 			// this plugin declares. Report the outcome rather than letting a missing
 			// seed look like a missing feature: the try/catch above deliberately keeps

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-git-badge",
-  "version": "0.9.1",
-  "description": "Git status badges for DeepSeek Harness: sidebar session rows (via the sidebar.workspaces.sessionRow seam) and an input-row chip showing the current conversation's workspace git state. Event-driven freshness over SSE.",
+  "version": "0.10.1",
+  "description": "Git status badges for DeepSeek Harness: an input-row chip on every install, plus sidebar session-row badges (git status, PR/CI action tokens) after one manual step: `npx dsh-git-badge apply`, then restart dsh web. Event-driven freshness over SSE.",
   "type": "module",
   "main": "lib/index.js",
   "bin": {
@@ -13,7 +13,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test",
+    "postinstall": "node seam/postinstall.js"
   },
   "dsh": {
     "bundle": {
@@ -50,6 +51,7 @@
     "lib/client.js",
     "seam/apply.js",
     "seam/anchors.js",
+    "seam/postinstall.js",
     "seam/stub-index.js",
     "cordis.patch.yml",
     "package.json",

package/seam/apply.js

@@ -33,8 +33,10 @@
  *
  * Environment:
  *   DSH_INSTALL    the DSH package root. Default: `<global npm root>/@deepseek-ai/dsh`.
- *   SEAM_DATA_DIR  where revert backups are written. Default: this script's
- *                  directory (inside the installed package).
+ *   SEAM_DATA_DIR  where revert backups are written. Default:
+ *                  `$DSH_HOME/git-badge-seam` (else `~/.dsh/git-badge-seam`) —
+ *                  a stable, user-level store shared by every way this tool
+ *                  can run. See the note at the definition below.
  *
  * Usage: apply.js apply | apply.js revert | apply.js status
  */
@@ -54,7 +56,17 @@ import {
 } from "./anchors.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const DATA_DIR = process.env.SEAM_DATA_DIR || HERE;
+/**
+ * Where revert backups live. A STABLE, user-level directory by default — NOT
+ * this script's own directory. For an npx run that directory is a cache entry
+ * keyed by package version: a backup written by one `npx dsh-git-badge apply`
+ * was invisible to the next `npx dsh-git-badge revert`, which then had to
+ * refuse ("patched but no backup exists") even though the bytes were on disk
+ * somewhere. Sharing one store across npx runs, the profile bin and the repo
+ * wrapper makes the apply→revert round trip reliable for everyone. Override
+ * with SEAM_DATA_DIR (the test suite does, to stay hermetic).
+ */
+const DATA_DIR = process.env.SEAM_DATA_DIR || join(process.env.DSH_HOME || join(process.env.HOME || "", ".dsh"), "git-badge-seam");
 
 // sha256 of the upstream build the anchors were last verified against. ADVISORY:
 // status prints it for orientation; apply does NOT require it.
@@ -291,9 +303,13 @@ if (verb === "apply") {
 	} else {
 		const r = inspect();
 		if (r.state === "ours-current" || r.state === "ours-stale" || r.state === "ours-corrupt") {
-			console.error("REFUSING: the installed file is patched but no backup exists, so the");
-			console.error("original bytes are unknown. Reinstall the package to clear the patch:");
-			console.error("  npm rebuild -g @deepseek-ai/dsh   # or your package manager's equivalent");
+			console.error("REFUSING: the installed file is patched but no backup exists in");
+			console.error(`${DATA_DIR}, so the original bytes are unknown here. Options:`);
+			console.error("  1. If you applied from a clone of the plugin's repository, run its");
+			console.error("     wrapper instead — it keeps its own backup:");
+			console.error("       <clone>/seam/apply.sh revert");
+			console.error("  2. Otherwise reinstall the package — pristine files, guaranteed:");
+			console.error("       npm i -g @deepseek-ai/dsh@latest");
 			process.exit(1);
 		}
 		console.log("no backup present and nothing of ours installed; client.js left untouched.");

package/seam/postinstall.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/**
+ * postinstall hook — best-effort seam apply at plugin-install time.
+ *
+ * WHY THIS EXISTS: a market install activates the input chip immediately, but
+ * the sidebar session-row badges additionally need the seam patch on the DSH
+ * package itself, and nothing in the install flow told the user so. When pnpm
+ * allows this script (the user approves it under `allowBuilds` — DSH's plugin
+ * installer prints exactly that instruction when pnpm blocks it), the seam is
+ * applied right here; otherwise the plugin's boot log and the chip tooltip name
+ * the same one manual command.
+ *
+ * GUARDRAILS — this script may never break an install:
+ *   - it runs ONLY when the installed DSH client.js is pristine upstream AND
+ *     every anchor resolves exactly once (`patchable`); any other state —
+ *     already patched, drifted, upstream-landed, DSH not found — just prints
+ *   - it never throws: every failure path prints the manual command and exits 0
+ *   - it cannot restart dsh web; the printed message says to
+ *
+ * The restart is deliberately manual: the running dsh web process rebuilds its
+ * client bundle at boot, and an install script restarting the host that is
+ * installing it is not safe to automate.
+ */
+import { execSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { applyPatch, firstFailure, isOurs, seamPresent } from "./anchors.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const HINT = "Sidebar session-row badges need one manual step: `npx dsh-git-badge apply`, then restart dsh web.";
+/**
+ * Same stable backup store apply.js defaults to — the backup this hook takes
+ * must be findable by a LATER `npx dsh-git-badge revert` running from a
+ * different cache entry. SEAM_DATA_DIR overrides (test suite).
+ */
+const DATA_DIR = process.env.SEAM_DATA_DIR || join(process.env.DSH_HOME || join(process.env.HOME || "", ".dsh"), "git-badge-seam");
+
+function dshClientPath() {
+	try {
+		const root = process.env.DSH_INSTALL || join(execSync("npm root -g", { encoding: "utf8" }).trim(), "@deepseek-ai", "dsh");
+		return join(root, "node_modules", "@deepseek-ai", "dsh-client-ui-workspace", "lib", "client.js");
+	} catch {
+		return null;
+	}
+}
+
+function main() {
+	const client = dshClientPath();
+	if (client === null || !existsSync(client)) {
+		console.log(`[dsh-git-badge] DSH install not found; skipping seam setup. ${HINT}`);
+		return;
+	}
+	// the index stub is copied with the client on apply (see apply.js)
+	const index = join(dirname(client), "index.js");
+	const text = readFileSync(client, "utf8");
+
+	// Already ours (any rev): nothing to do here; apply.js upgrade rules govern.
+	if (isOurs(text)) {
+		console.log("[dsh-git-badge] seam already applied — sidebar session-row badges active after restart.");
+		return;
+	}
+	// Upstream landed the seam: the patch is retired.
+	if (seamPresent(text)) {
+		console.log("[dsh-git-badge] DSH declares the seam itself — no patch needed.");
+		return;
+	}
+	// Pristine, but the anchors no longer resolve: a DSH update moved anchored
+	// code. Never patch half of anything — print, and let a patched anchors.js
+	// do it.
+	const fail = firstFailure(text);
+	if (fail !== null) {
+		console.log(`[dsh-git-badge] DSH build drifted from the patch anchors (${fail.name}); skipping. ${HINT}`);
+		return;
+	}
+	// The one state we act on: pristine upstream, anchors resolve.
+	mkdirSync(DATA_DIR, { recursive: true });
+	copyFileSync(client, join(DATA_DIR, "backup-client.js"));
+	copyFileSync(index, join(DATA_DIR, "backup-index.js"));
+	writeFileSync(client, applyPatch(text));
+	copyFileSync(join(HERE, "stub-index.js"), index);
+	console.log("[dsh-git-badge] seam applied — RESTART dsh web to get sidebar session-row badges.");
+}
+
+try {
+	main();
+} catch (error) {
+	// An install hook must never fail the install over the seam.
+	console.log(`[dsh-git-badge] seam setup skipped (${String(error && error.message ? error.message : error)}). ${HINT}`);
+}
+process.exit(0);