dsh-monkeyai-sessions 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artenx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,84 @@
-# Temporary Holding Version
+# DSH MonkeyAI Sessions
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Read and continue your MonkeyAI conversations inside DeepSeek Harness.
+
+Browse the sessions on your MonkeyAI devices, open one to read its full conversation history, and send new instructions to carry on the work you started in the MonkeyAI client — no copy-pasting context, no restarting the task. Replies stream back live, and you can stop a running turn or switch models without leaving DSH.
+
+Authorization uses the MonkeyAI OAuth authorization-code flow with PKCE; DSH stores the resulting grant in its credential store.
+
+## Development
+
+The plugin targets DSH `v0.2.2-rc.1` and Node.js `>=24.9.0`.
+
+```sh
+npm test
+npm run build
+```
+
+`npm test` builds the Client bundle before running tests. The build generates `client.js` and `lib/client-runtime.cjs`; both artifacts are distributed with the package.
+Tests load the generated Client bundle, validate unary and duplex stream descriptors, check the `main` and `sidebar.panellist` registrations, verify stream and Remote cleanup on unload, and test PKCE state/challenge construction.
+Host-service and Host-stream tests use credential-store, fetch, and WebSocket fakes to cover authorization exchange, device/session scoping, connection tickets, history and live frames, prompt delivery, connection loss, permission revocation, and read-only rejection.
+
+The Host registers invocation descriptors through `ctx.typert`. The Client mounts the package's Remote contribution with `$mount()`. Shared Remote metadata uses the protocol package's `remote-info` entry, which has no Cordis runtime import.
+The Client bundle inlines a spec-compatible copy of that factory (`src/shared/remote-info-lite.mjs`): DSH materializes only the modules listed in `dsh.client.inject`, and the protocol package's subpath entries are not seed words there.
+
+## Authorization
+
+The panel uses DSH's light theme for a consistent, simple look. The layout is state-driven: an unconnected panel shows a single connect card (server origin plus one primary button, with the paste-callback mode collapsed), a connected panel shows a compact toolbar (account, device, one Refresh action that loads devices and sessions together, disconnect) above the session cards, and an open session focuses the conversation with a compact header (back button, title, model switcher), an approval card with plain option buttons instead of raw JSON, and an Enter-to-send composer. Secondary actions (adding a device by machine ID, creating a new session) stay collapsed in details sections.
+The device list reads the account-wide endpoint directory (`GET /api/v1/endpoints`, no runtime-API header) so every registered device appears, marking `online` from the boolean field and skipping revoked entries. Selecting a device loads its sessions automatically. Headless runtime devices that register through the separate device-code grant may not appear in that directory; for those, add a device manually by machine ID ("Device missing?..." section in the panel) - the entry is kept in browser storage and merged into the device selector.
+
+Three ways to connect, in order of convenience:
+
+- **Sign in (default)**: enter the MonkeyAI server origin, account email, and password in the panel. The Host performs the whole OAuth exchange server-side — it logs in, opens an authorization request, approves it, and exchanges the returned code — so nothing has to come back from the browser. This is the only mode that works when the browser runs on a phone or any machine other than the DSH Host. The password is used for those requests only and is never stored; the panel clears the field on success.
+- **Browser authorization (loopback)**: the Host listens on `127.0.0.1` with a random port and the MonkeyAI server redirects to `http://127.0.0.1:<port>/oauth/callback`. When the browser shares the Host's machine the callback page posts the code back to the panel and the grant completes with no copy-paste. A remote browser cannot reach that loopback address, so use sign-in instead.
+- **Paste callback (scheme)**: the original `monkeyai-desktop://oauth/callback` redirect for environments where loopback is rejected.
+
+All three request `device:connect`, `session:read`, and `session:control` through the registered `monkeyai-desktop` public client. OAuth state and the PKCE verifier stay in the DSH Host process.
+
+## Sessions
+
+Full conversation history is loaded over the runtime's HTTP read channel (`POST {http_base}/read/session` with `_monkeyai/session/messages`, paginated by cursor) instead of the bounded ACP `session/load` replay, so long sessions show every turn including the latest replies. While a turn is running the composer shows a stop button that sends `session/cancel`; the model switcher uses `_monkeyai/session/model/set` on the live session connection. Assistant messages render lightweight markdown (code blocks, inline code, bold, headings, lists).
+
+## Installation
+
+From npm, once published:
+
+```sh
+dsh plugin --profile web add dsh-monkeyai-sessions
+```
+
+From the plugin market index: enable **Custom plugin indexes** under Plugins → Experimental plugins, open **Discover**, and add this index source:
+
+```
+https://artenx.github.io/dsh-monkeyai-sessions/index.json
+```
+
+From a checkout:
+
+```sh
+npm install
+npm run build
+npm pack
+dsh plugin --profile web add ./dsh-monkeyai-sessions-0.1.0.tgz
+```
+
+Verified against a real DSH `0.2.2-rc.1` web profile and a live MonkeyAI runtime: authorization, full history loading, prompt delivery, model switching, and turn cancellation all work end to end.
+
+## Publishing
+
+The package declares a DSH bundle (`dsh.bundle.patch`), a web Client (`dsh.client`), and `engines.dsh`. Host-provided modules resolve through the running DSH installation, so the only peer dependency is `@deepseek-ai/cordis`.
+
+```sh
+# Build the Client bundle and the market index
+npm run build
+npm run build:market
+
+# Publish the package (requires an npm account with publish rights)
+npm publish --access public
+```
+
+`scripts/build-market-index.mjs` reads published versions and their publish times from the npm registry, falling back to the current `package.json` version before the first release. The resulting `market/index.json` follows plugin market index format 1 and is deployed to GitHub Pages by `.github/workflows/market-index.yml`. Set `MARKET_INDEX_URL` to override the printed index address.
+
+## License
+
+MIT

package/assets/icon.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="64" height="64">
+  <circle cx="7" cy="9.5" r="3.2" fill="#8b5e3c"/>
+  <circle cx="17" cy="9.5" r="3.2" fill="#8b5e3c"/>
+  <circle cx="7" cy="9.5" r="1.6" fill="#e8c9a8"/>
+  <circle cx="17" cy="9.5" r="1.6" fill="#e8c9a8"/>
+  <circle cx="12" cy="12" r="7.5" fill="#a06b42"/>
+  <path d="M6.8 12.2c0-2.6 2.3-4.4 5.2-4.4s5.2 1.8 5.2 4.4c0 3.2-2.3 5.6-5.2 5.6s-5.2-2.4-5.2-5.6z" fill="#f3ddc4"/>
+  <circle cx="9.7" cy="11.6" r="1.05" fill="#3d2b1c"/>
+  <circle cx="14.3" cy="11.6" r="1.05" fill="#3d2b1c"/>
+  <path d="M9.8 14.9c.6.7 1.4 1 2.2 1s1.6-.3 2.2-1" stroke="#3d2b1c" stroke-width="1.1" stroke-linecap="round" fill="none"/>
+</svg>