dsh-harness-supervisor 0.0.0-stage → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Harness Supervisor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,48 @@
-# Temporary Holding Version
+# DSH Harness Supervisor
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+将 DSH 会话作为 Harness Supervisor 的 Master，委派 Pi、Qoder、MiniMax Code 等原生 Worker。支持 DSH `0.2.2-rc.1`，配套 HS `0.10.2`；其他 DSH 版本尚需验收。
+
+[项目仓库](https://gitcode.com/chenpi_1/harness-supervisor) · [完整项目 README](https://gitcode.com/chenpi_1/harness-supervisor/blob/main/README.md)
+
+## 安装与使用
+
+在 DSH 插件管理器安装 `dsh-harness-supervisor-0.1.2.tgz` 并启用。安装包包含核心、依赖和共用 WebUI，无需额外安装 HS 或编译。
+
+从左侧导航、会话顶部或设置中的 **Harness Supervisor** 打开共用 WebUI。人工视图可查看全部 Worker，默认只展开当前对话分组；没有当前对话时也可在左侧导航和设置页查看。也可用 `/hs` 在右侧浏览器打开同样的全局视图。支持 DSH Desktop 和本机 DSH Web；禁用或卸载插件不会停止已有 Worker。
+
+## 通过插件更新核心
+
+1. 安装新版插件 `.tgz`。此时仅准备配套核心，运行中的 HS 保持原版本。
+2. 在设置中点击 **Harness Supervisor → 应用配套 HS 核心**。
+3. HS 暂停接收新任务，等待已有任务与队列结束，再切换并验证新核心。可点击 **刷新状态** 查看进展。
+
+等待期间仍可回答请求、取消 Worker 或取消此次更新，不会到时强杀任务。关闭设置页或禁用插件后，已登记的更新仍由 HS 继续执行。切换后需重新打开 WebUI。
+
+更新的是相同状态目录中的共享核心，不会覆盖源码仓库或全局安装文件。当前使用 `.tgz` 分发，尚未提供在线检查新版功能。旧 `0.9.2` 等缺少所需能力的实例须先安排维护窗口、处理活动 Worker 并停止旧 daemon，插件不会自动替换它们。
+
+## 配置与边界
+
+默认复用独立 HS 的状态目录：`HARNESS_SUPERVISOR_HOME` 或 `~/.harness-supervisor`。可在插件配置中设置 `stateDir`、`nodeExecutable`；不同状态目录属于不同实例，更新不会跨实例生效。
+
+插件为每个真实 DSH Agent 复用一个 MCP 连接，固定会话归属和通知策略。模型只能查询和操作所属会话的 Worker 与通知 ACK，不能修改共享通知目标或执行升级。旧 Worker 不会自动归入 DSH 会话。会话范围是路由护栏，不是操作系统隔离。
+
+WebUI 的浏览器入口使用一次性链接兑换独立凭证，不接触 IPC Token。刷新和读取结果不会唤醒模型或自动 ACK；daemon 重启后需重新从入口连接。
+
+无法确认进程状态时，自动切换会停止，不会强杀进程或并行启动另一核心。恢复线索位于状态目录的 `runtime-update.json`、`runtime-update.log` 和 `runtime-backups/`；不要删除锁强行恢复。
+
+## 开发与打包
+
+插件与 HS 核心在同一仓库维护。以下命令在插件目录执行，普通安装无需执行：
+
+```powershell
+npm test
+npm run build
+```
+
+先在仓库根目录运行 `npm run build`、`npm run pack:core`，再在插件目录打包：
+
+```powershell
+npm run pack:release -- --core-tarball ../../.artifacts/harness-supervisor-0.10.2.tgz
+```
+
+HS 核心发布物已包含经过根锁文件校验的生产依赖。插件打包只解包该固定压缩包，对照 `production-lock.json` 核对依赖版本，再使用 npm `bundleDependencies` 制作可直接安装的发布物；不重新解析依赖版本，不执行安装脚本。DSH SDK、React 等宿主能力不随插件重复打包。

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+- insert:
+    - id: harness-supervisor
+      name: dsh-harness-supervisor
+
+# The plugin explicitly provides a browser entry on both Desktop and Web.
+- id: ui-sidebar-browser
+  disabled: false

package/dist/bridge.js

@@ -0,0 +1,157 @@
+import { createHash } from "node:crypto";
+
+/** Correlation scope only. It is not a same-user or operating-system sandbox. */
+export function ownerRefFor(namespace, sessionId) {
+  if (typeof sessionId !== "string" || !sessionId || sessionId.length > 300) {
+    throw new Error("DSH did not supply a valid live Agent/Session identity");
+  }
+  return `dsh:${createHash("sha256").update(namespace).update("\0").update(sessionId).digest("hex")}`;
+}
+
+/** Own native MCP fibers by exact Agent object, including in-flight activation. */
+export class AgentBridge {
+  #entries = new Map();
+  #closing = false;
+  constructor({ namespace, attach, report = () => {} }) {
+    this.namespace = namespace;
+    this.attach = attach;
+    this.report = report;
+  }
+
+  attachAgent(agent) {
+    if (this.#closing) return Promise.resolve();
+    const found = this.#entries.get(agent);
+    if (found) return found.ready;
+    const entry = { removed: false, fiber: undefined, ready: undefined };
+    this.#entries.set(agent, entry);
+    entry.ready = (async () => {
+      try {
+        const ownerRef = ownerRefFor(this.namespace, agent.id);
+        if (agent.session?.id !== agent.id || typeof agent.ctx?.plugin !== "function") {
+          throw new Error("DSH live Agent capabilities are incompatible (expected 0.2.2-rc.1)");
+        }
+        // attach returns the Fiber synchronously; awaiting the Fiber waits for ready.
+        entry.fiber = this.attach(agent, ownerRef);
+        if (!entry.fiber || typeof entry.fiber.dispose !== "function") {
+          throw new Error("DSH MCP registration did not return a disposable Fiber");
+        }
+        if (entry.removed || this.#closing) {
+          await entry.fiber.dispose();
+          return;
+        }
+        await entry.fiber;
+        if (entry.removed || this.#closing) await entry.fiber.dispose();
+        else this.report(agent, { state: "connected", ownerRef });
+      } catch (error) {
+        if (!entry.removed && !this.#closing) {
+          this.report(agent, { state: "failed", message: error instanceof Error ? error.message : String(error) });
+        }
+        // No global fallback: a failed scope must never register global tools.
+        await entry.fiber?.dispose();
+      }
+    })();
+    return entry.ready;
+  }
+
+  async detachAgent(agent) {
+    const entry = this.#entries.get(agent);
+    if (!entry) return;
+    entry.removed = true;
+    this.#entries.delete(agent);
+    await entry.fiber?.dispose();
+    await entry.ready;
+  }
+
+  async dispose() {
+    if (this.#closing) return;
+    this.#closing = true;
+    const agents = [...this.#entries.keys()];
+    await Promise.allSettled(agents.map((agent) => this.detachAgent(agent)));
+  }
+}
+
+export const RPC_PREFIX = "harness-supervisor/";
+export const RPC_ENDPOINTS = new Set(["open-ui", "status", "apply-core", "cancel-update"]);
+
+/**
+ * Exact Fetch routes are owner-only in DSH Connection before this adapter runs.
+ * Reuse the public RPC wire format without claiming the single /api interceptor.
+ */
+export function createFetchRoutes(handler) {
+  return [...RPC_ENDPOINTS].map((method) => ({
+    path: `/api/${RPC_PREFIX}${method}`, methods: ["POST"], requestBody: "buffered",
+    async fetch(request) {
+      if (request.headers.get("content-type")?.split(";", 1)[0]?.trim() !== "application/json") return new Response("Expected application/json", { status: 415 });
+      let message;
+      try { message = await request.json(); } catch { return new Response("Invalid JSON", { status: 400 }); }
+      if (!message || typeof message !== "object" || Array.isArray(message)
+        || Object.keys(message).some((key) => !["type", "rpcId", "method", "payload"].includes(key))
+        || message.type !== "client-request" || typeof message.rpcId !== "string" || !message.rpcId || message.rpcId.length > 200
+        || message.method !== `${RPC_PREFIX}${method}`) return new Response("Invalid RPC envelope", { status: 400 });
+      const result = await handler(method, message.payload, request.signal, { principal: { kind: "owner" } });
+      return Response.json({ type: "server-response", rpcId: message.rpcId, result });
+    },
+  }));
+}
+
+export function localApplicationOrigin(value) {
+  if (typeof value !== "string") throw new Error("A DSH application origin is required");
+  // Desktop has an opaque URL.origin. Preserve only its exact registered
+  // application origin so the shared UI can be framed in a conversation view.
+  if (value === "dsh-app://app") return value;
+  const url = new URL(value);
+  if (!['http:', 'https:'].includes(url.protocol) || !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+    || url.username || url.password || url.origin !== value) {
+    throw new Error("HS embedding is available only in a local DSH application");
+  }
+  return url.origin;
+}
+
+export function createRpcHandler({ agents, namespace, request, status, applyCore, cancelUpdate }) {
+  return async (endpoint, payload, signal, peer) => {
+    try {
+      if (peer?.principal?.kind !== "owner") throw new Error("Only the authenticated DSH owner may manage HS");
+      if (signal.aborted) throw new Error("Request aborted");
+      const method = endpoint;
+      if (!RPC_ENDPOINTS.has(method)) throw new Error("Unknown HS endpoint");
+      if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Invalid HS request");
+      let value;
+      if (method === "open-ui") {
+        if (Object.keys(payload).some((key) => !["sessionId", "applicationOrigin", "viewKey", "viewGeneration"].includes(key))) throw new Error("Unexpected open-ui field");
+        if (payload.viewKey !== undefined && (typeof payload.viewKey !== "string" || !payload.viewKey || payload.viewKey.length > 200)) throw new Error("Invalid panel view key");
+        if (payload.viewGeneration !== undefined && (!Number.isSafeInteger(payload.viewGeneration) || payload.viewGeneration < 1 || payload.viewKey === undefined)) throw new Error("Invalid panel generation");
+        let preferredOwnerRef;
+        if (payload.sessionId !== undefined) {
+          const agent = typeof payload.sessionId === "string" ? agents.get(payload.sessionId) : undefined;
+          if (!agent || agent.session?.id !== agent.id) throw new Error("Open a live DSH session before choosing its default Worker group");
+          preferredOwnerRef = ownerRefFor(namespace, agent.id);
+        }
+        const frameOrigin = localApplicationOrigin(payload.applicationOrigin);
+        try {
+          // This route is authenticated owner UI, not a model tool. Its access
+          // is global; the live session is only a default expansion preference.
+          value = await request("ui_start", { ...(preferredOwnerRef === undefined ? {} : { preferredOwnerRef }), frameOrigin, ...(payload.viewKey === undefined ? {} : { viewKey: payload.viewKey }), ...(payload.viewGeneration === undefined ? {} : { viewGeneration: payload.viewGeneration }) });
+        } catch (error) {
+          if (["BAD_REQUEST", "UNSUPPORTED"].includes(error?.code)) {
+            throw new Error("当前运行的 HS 核心尚不支持顶部面板。请在设置 → Harness Supervisor → 应用配套 HS 核心后，重新打开标签页。");
+          }
+          throw error;
+        }
+      } else if (method === "status") {
+        if (Object.keys(payload).length) throw new Error("Unexpected status field");
+        value = await status();
+      } else if (method === "apply-core") {
+        if (Object.keys(payload).length) throw new Error("The paired core version is fixed by the plugin");
+        value = await applyCore();
+      } else {
+        if (Object.keys(payload).some((key) => key !== "intentId") || typeof payload.intentId !== "string" || !payload.intentId || payload.intentId.length > 200) {
+          throw new Error("A current update intentId is required");
+        }
+        value = await cancelUpdate(payload.intentId);
+      }
+      return { ok: true, value };
+    } catch (error) {
+      return { ok: false, error: { code: "harness-supervisor/request-refused", message: error instanceof Error ? error.message : String(error), details: {} } };
+    }
+  };
+}

package/dist/client.js

@@ -0,0 +1,172 @@
+window.__ModuleLoader__.load({
+  id: "dsh-harness-supervisor",
+  factory: (require) => {
+    const module = { exports: {} };
+    const exports = module.exports;
+const React = require("react");
+const h = React.createElement;
+const PREFIX = "harness-supervisor/";
+
+exports.inject = ["connection", "slots", "sidebarRight", "commandUi", "uiSession"];
+
+exports.apply = function apply(ctx) {
+  let disposed = false;
+  const panelKey = `dsh-main-${crypto.randomUUID()}`;
+  const viewGenerations = new Map();
+  const controllers = new Set();
+  const call = async (method, payload = {}, abort = new AbortController()) => {
+    if (disposed) throw new Error("HS 插件已关闭");
+    controllers.add(abort);
+    try {
+      const reply = await ctx.connection.rpc.call("/api", PREFIX + method, payload, abort.signal);
+      if (!reply.ok) throw new Error(reply.error.message);
+      return reply.value;
+    } finally { controllers.delete(abort); }
+  };
+  const entryUrl = async (sessionId, abort, viewKey) => {
+    const applicationOrigin = window.location.protocol === "dsh-app:" && window.location.host === "app"
+      ? "dsh-app://app" : window.location.origin;
+    const viewGeneration = viewKey ? (viewGenerations.get(viewKey) ?? 0) + 1 : undefined;
+    if (viewKey) viewGenerations.set(viewKey, viewGeneration);
+    const entry = await call("open-ui", { ...(sessionId ? { sessionId } : {}), applicationOrigin, ...(viewKey ? { viewKey, viewGeneration } : {}) }, abort);
+    const url = new URL(entry.url);
+    if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.username || url.password) throw new Error("HS 未返回本机界面地址");
+    return entry.url;
+  };
+  const open = async (sessionId) => {
+    const url = await entryUrl(sessionId);
+    if (!disposed) ctx.sidebarRight.openTab("browser", { params: { url } });
+  };
+  ctx.effect(() => () => {
+    disposed = true;
+    for (const abort of controllers) abort.abort();
+    controllers.clear();
+    viewGenerations.clear();
+  }, "HS UI requests");
+
+  ctx.effect(() => ctx.commandUi.register({
+    name: "hs", label: () => "Harness Supervisor", description: () => "打开全局 Worker 面板，默认展开当前对话",
+    available: (session) => typeof session?.sessionId === "string",
+    ui: { kind: "action", run: (session) => {
+      // The action consumes the UI token without submitting a model message.
+      void open(session?.sessionId).catch((error) => window.alert(error.message));
+    } },
+  }), "HS open command");
+
+  function SessionView({ sessionId, conversationLayout = false, surface = "sidebar" }) {
+    const [url, setUrl] = React.useState("");
+    const [error, setError] = React.useState("");
+    React.useEffect(() => {
+      let active = true;
+      const abort = new AbortController();
+      setUrl(""); setError("");
+      void entryUrl(sessionId, abort, `${panelKey}:${surface}`).then(
+        (next) => { if (active && !disposed) setUrl(next); },
+        (failure) => { if (active && !disposed) setError(failure.message); },
+      );
+      return () => { active = false; abort.abort(); };
+    }, [sessionId, surface]);
+    // Follow DSH's full-height Trajectory view contract and leave room for its
+    // floating composer, whose measured height is supplied by the host.
+    return h("section", { ...(conversationLayout ? { "data-conversation-composer-overlay": "" } : {}), style: {
+      display: "flex", flexDirection: "column", height: "100%", minHeight: 0,
+      boxSizing: "border-box", overflow: "hidden", ...(conversationLayout ? { paddingBottom: "calc(var(--dsh-composer-height, 152px) + 16px)" } : {}),
+    } },
+      error ? h("div", { role: "alert", style: { padding: 24, overflowWrap: "anywhere" } }, "无法打开 HS 面板：", error)
+        : url ? h("iframe", { key: url, src: url, title: "Harness Supervisor · 全局 Worker", sandbox: "allow-scripts allow-same-origin", referrerPolicy: "no-referrer",
+          style: { flex: 1, width: "100%", minHeight: 0, border: 0 } })
+          : h("p", { role: "status", style: { padding: 24 } }, "正在连接全局 Worker 面板…"));
+  }
+  // A keyed boundary resets the preferred conversation before a new frame mounts.
+  function WorkerView({ sessionId }) { return h(SessionView, { key: sessionId ?? "global", sessionId, conversationLayout: true, surface: "conversation" }); }
+  ctx.effect(() => ctx.slots.inject("conversation.view", () => ctx.slots.register({
+    name: "conversation.view", id: "harness-supervisor", order: 30, label: () => "Harness Supervisor",
+  }, WorkerView)), "HS conversation view");
+
+  function Introduction() {
+    return h("header", null,
+      h("h2", null, "Harness Supervisor"),
+      h("p", null, "本地、轻量、运行时无关的 Agent Worker 生命周期与通信层。让 DSH 委派和管理 Pi、Qoder、MiniMax Code 等原生 Worker。"),
+      h("p", { style: { display: "flex", gap: 16 } },
+        h("a", { href: "https://gitcode.com/chenpi_1/harness-supervisor", target: "_blank", rel: "noopener noreferrer" }, "项目仓库"),
+        h("a", { href: "https://gitcode.com/chenpi_1/harness-supervisor/blob/main/README.md", target: "_blank", rel: "noopener noreferrer" }, "完整 README")));
+  }
+  function MainView() {
+    const binding = React.useSyncExternalStore(ctx.uiSession.current.subscribe, ctx.uiSession.current.getSnapshot);
+    // The actual current session determines only the initially expanded group.
+    return h(SessionView, { key: binding.key ?? "global", sessionId: binding.key });
+  }
+  function SidebarIcon({ size = 16 }) {
+    return h("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: 1.8, strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": true },
+      h("path", { d: "M3 5v14M9 5v14M3 12h6M21 7c-1-1-2-2-4-2s-4 1-4 3.5S15 12 17 12s4 1 4 3.5-2 3.5-4 3.5-3-1-4-2" }));
+  }
+  ctx.effect(() => ctx.slots.inject("main", () => ctx.slots.register({
+    name: "main", key: "harness-supervisor",
+  }, MainView)), "HS main panel");
+  ctx.effect(() => ctx.slots.inject("sidebar.panellist", () => ctx.slots.register({
+    name: "sidebar.panellist", id: "harness-supervisor", order: 20, label: () => "Harness Supervisor",
+  }, SidebarIcon)), "HS sidebar entry");
+
+  function Settings() {
+    const [data, setData] = React.useState();
+    const [error, setError] = React.useState("");
+    const [notice, setNotice] = React.useState("");
+    const [busy, setBusy] = React.useState(false);
+    const binding = React.useSyncExternalStore(ctx.uiSession.current.subscribe, ctx.uiSession.current.getSnapshot);
+    const sessionId = binding.key;
+    const active = React.useRef(true);
+    React.useEffect(() => {
+      active.current = true;
+      return () => { active.current = false; };
+    }, []);
+    const run = async (work) => {
+      if (busy) return;
+      setBusy(true); setError(""); setNotice("");
+      try { await work(); }
+      catch (failure) { if (active.current) setError(failure.message); }
+      finally { if (active.current) setBusy(false); }
+    };
+    const refresh = async () => { const next = await call("status"); if (active.current) setData(next); };
+    React.useEffect(() => { void run(refresh); }, []);
+    const intent = data?.update?.intent;
+    const draining = intent?.phase === "draining";
+    const phaseText = {
+      draining: "正在等待已有任务结束", switching: "正在切换配套核心", verifying: "正在验证新核心",
+      complete: "配套核心已应用", cancelled: "此次更新已取消", failed: "更新未完成，请查看诊断详情",
+      recovery_required: "需要人工恢复，请查看诊断详情",
+    }[intent?.phase] || (data?.update?.managed ? "核心已由 HS 托管" : "当前实例尚未托管");
+    const remaining = data?.update?.drain?.workerIds?.length || 0;
+    const button = (label, onClick, disabled = false) => h("button", {
+      type: "button", disabled: busy || disabled, onClick: () => void run(onClick),
+      style: { border: "1px solid var(--dsw-alias-border-l2, #8886)", borderRadius: 7, padding: "7px 12px", color: "inherit", background: "var(--dsw-alias-bg-layer-1, transparent)", cursor: "pointer" },
+    }, label);
+    return h("section", { style: { padding: 20, width: "100%", lineHeight: 1.6 } },
+      h("div", { style: { maxWidth: 780 } }, h(Introduction),
+        h("p", null, "人工面板可查看全部 Worker，默认展开当前对话分组；没有当前对话时也可查看。")),
+      h("div", { style: { width: "100%", height: "70vh", minHeight: 520, margin: "20px 0 28px" } },
+        h(SessionView, { key: sessionId ?? "global", sessionId, surface: "settings" })),
+      h("section", { style: { maxWidth: 780 } },
+      h("div", { style: { display: "flex", gap: 8, flexWrap: "wrap" } },
+        button("在右侧栏打开全局面板", () => open(sessionId), !sessionId),
+        button("刷新状态", refresh)),
+      h("h3", null, "配套 HS 核心"),
+      h("p", null, `插件 ${data?.pluginVersion || "0.1.2"} · 配套核心 ${data?.pairedCoreVersion || "0.10.2"} · 运行核心 ${data?.supervisor?.version || "正在读取"}`),
+      h("p", null, "等待已有任务结束后切换，期间仍可审批和取消任务。"),
+      h("div", { style: { display: "flex", gap: 8, flexWrap: "wrap" } },
+        button("应用配套 HS 核心", async () => { const result = await call("apply-core"); if (active.current) setNotice(result.alreadyActive ? "当前已是配套 HS 核心。" : "已登记更新；排空完成后由 HS 自动切换。"); await refresh(); }, draining || ["switching", "verifying"].includes(intent?.phase)),
+        draining && button("取消此次更新", async () => { await call("cancel-update", { intentId: intent.id }); await refresh(); if (active.current) setNotice("已取消此次更新。"); })),
+      notice && h("p", { role: "status" }, notice),
+      error && h("p", { role: "alert", style: { color: "var(--dsw-alias-state-error-primary, #c33)", overflowWrap: "anywhere" } }, error),
+      data?.update && h("p", { role: "status" }, phaseText, draining ? `，剩余 ${remaining} 个 Worker。` : "。"),
+      data && h("details", null, h("summary", null, "诊断详情"), h("pre", { style: { whiteSpace: "pre-wrap", overflowWrap: "anywhere", fontSize: 12 } }, JSON.stringify({ update: data.update, sessions: data.sessions }, null, 2))),
+      h("p", { style: { fontSize: 12, opacity: 0.75 } }, "顶部标签、左侧导航、设置页和 /hs 均为人工全局视图，默认展开当前对话分组。核心重启后重新打开面板。")));
+  }
+  ctx.effect(() => ctx.slots.inject("settings.section", () => ctx.slots.register({
+    name: "settings.section", id: "harness-supervisor", order: 80,
+    label: () => "Harness Supervisor",
+  }, Settings)), "HS settings section");
+};
+
+    return module.exports;
+  }
+});

package/dist/index.js

@@ -0,0 +1,86 @@
+import path from "node:path";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+import * as mcpClient from "@deepseek-ai/dsh-mcp-client";
+import z from "@deepseek-ai/schemastery";
+import { SupervisorClient, prepareManagedRuntime } from "harness-supervisor";
+import { AgentBridge, createRpcHandler, createFetchRoutes } from "./bridge.js";
+import { resolveNodeExecutable } from "./node-runtime.js";
+
+export const name = "harness-supervisor";
+export const inject = ["agents", "connection", "webServer"];
+export const Config = z.object({
+  stateDir: z.string().default(""),
+  nodeExecutable: z.string().default(""),
+});
+
+const coreRoot = path.resolve(path.dirname(fileURLToPath(import.meta.resolve("harness-supervisor"))), "../..");
+const EXPECTED_CORE_VERSION = "0.10.2";
+
+export function assertCapabilities(info) {
+  const required = ["ownerScope", "webUi", "managedRuntime", "drain"];
+  if (!info?.capabilities || required.some((key) => info.capabilities[key] !== true)) {
+    throw new Error(`The shared HS daemon (${info?.version ?? "unknown"}) lacks required capabilities. Migrate it in a maintenance window; the plugin will not replace it or use global model access.`);
+  }
+}
+
+export async function apply(ctx, config) {
+  if (!ctx.agents?.list || !ctx.agents?.get || !ctx.connection?.fetch?.register || typeof ctx.effect !== "function") {
+    throw new Error("DSH 0.2.2-rc.1 Agent and Connection APIs are required");
+  }
+  const stateDir = path.resolve(config.stateDir || process.env.HARNESS_SUPERVISOR_HOME || path.join(os.homedir(), ".harness-supervisor"));
+  const namespace = path.resolve(process.env.DSH_HOME || path.join(os.homedir(), ".dsh"));
+  const nodeExecutable = resolveNodeExecutable(config.nodeExecutable);
+  // Stage before auto-start: plugin removal must not remove a live daemon's code.
+  // An existing daemon still wins its normal lock and is checked, never replaced.
+  const bundledRuntime = await prepareManagedRuntime(stateDir, coreRoot);
+  const client = new SupervisorClient({ stateDir, daemonEntry: path.join(bundledRuntime.root, "dist/src/daemon-entry.js"), nodeExecutable });
+  const connections = new Map();
+  const request = async (method, params = {}) => client.request(method, params, { timeoutMs: 120_000 });
+  ctx.effect(() => () => client.close(), "HS operator IPC connection");
+  // The daemon's own managed resolver selects the active core. No host install is changed.
+  const info = await request("info");
+  assertCapabilities(info);
+
+  const bridge = new AgentBridge({
+    namespace,
+    attach: (agent, ownerRef) => agent.ctx.plugin(mcpClient, {
+      transport: "stdio", serverName: "harness_supervisor", command: nodeExecutable,
+      args: [path.join(bundledRuntime.root, "dist/src/mcp.js"), "--state-dir", stateDir, "--owner-ref", ownerRef, "--notify-none"],
+      env: {}, cwd: agent.session.meta?.cwd || process.cwd(), toolCallTimeoutMs: 150_000,
+      startupTimeoutMs: 30_000, closeTimeoutMs: 5_000, expandTemplates: false, failOnStartupError: true,
+    }),
+    report: (agent, status) => {
+      connections.set(agent, status);
+      if (status.state === "failed") ctx.logger.warn(`HS session connection failed: ${status.message}`);
+    },
+  });
+  ctx.effect(() => () => bridge.dispose(), "HS session MCP fibers");
+  ctx.on("agent/created", async ({ agent }) => bridge.attachAgent(agent));
+  ctx.on("agent/disposed", ({ agent }) => { connections.delete(agent); return bridge.detachAgent(agent); });
+  let applying;
+  const applyCore = () => applying ??= (async () => {
+    const current = await request("runtime_update_status");
+    if (current.activeRuntimeId === bundledRuntime.id && !["draining", "switching", "verifying"].includes(current.intent?.phase)) {
+      return { alreadyActive: true, runtimeId: bundledRuntime.id, version: EXPECTED_CORE_VERSION };
+    }
+    const intentId = current.intent?.targetRuntimeId === bundledRuntime.id && ["draining", "switching", "verifying"].includes(current.intent.phase)
+      ? current.intent.id : randomUUID();
+    return request("runtime_update", { intentId, runtimeId: bundledRuntime.id });
+  })().finally(() => { applying = undefined; });
+  const rpc = createRpcHandler({
+    agents: ctx.agents, namespace, request,
+    status: async () => ({
+      pluginVersion: "0.1.2", pairedCoreVersion: EXPECTED_CORE_VERSION,
+      supervisor: await request("info"), update: await request("runtime_update_status"),
+      sessions: [...connections].map(([agent, status]) => ({ sessionId: agent.id, ...status })),
+    }),
+    applyCore,
+    cancelUpdate: (intentId) => request("runtime_update_cancel", { intentId }),
+  });
+  for (const route of createFetchRoutes(rpc)) {
+    ctx.effect(() => ctx.connection.fetch.register(route), `HS owner-only ${route.path}`);
+  }
+  await Promise.all(ctx.agents.list().map((agent) => bridge.attachAgent(agent)));
+}

package/dist/node-runtime.js

@@ -0,0 +1,17 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+/** Desktop's Electron executable needs its own flags; use its shipped Node instead. */
+export function resolveNodeExecutable(explicit, runtime = process) {
+  if (explicit) {
+    if (!path.isAbsolute(explicit) || !existsSync(explicit) || /\.(?:cmd|bat|ps1)$/i.test(explicit)) {
+      throw new Error("nodeExecutable must name an existing absolute Node executable, not a shell shim");
+    }
+    return explicit;
+  }
+  if (!runtime.versions.electron) return runtime.execPath;
+  const resources = runtime.resourcesPath || path.join(path.dirname(runtime.execPath), "resources");
+  const shipped = path.join(resources, "runtime/primary-runtime/dependencies/node/bin", runtime.platform === "win32" ? "node.exe" : "node");
+  if (existsSync(shipped)) return shipped;
+  throw new Error("The DSH Desktop Node runtime was not found. Configure nodeExecutable with Node >=22.19; HS will not launch Electron as a daemon.");
+}

package/node_modules/harness-supervisor/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Harness Supervisor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.