dsh-vscode-workbench 0.1.8 → 0.1.9

package/README.en.md

@@ -1,48 +1,50 @@
 <h1 align="center">DSH VS Code Workbench</h1>
 
+<p align="center">
+  <img src="https://raw.githubusercontent.com/tingfeng347/dsh-vscode-workbench/main/assets/dsh-neon-workbench-core.svg" width="220" alt="DSH VS Code Workbench Logo">
+</p>
+
 <p align="center">A VS Code-style local development workbench for DeepSeek Harness.</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/dsh-vscode-workbench"><img src="https://img.shields.io/npm/v/dsh-vscode-workbench?logo=npm&label=npm" alt="npm version"></a>
+  <a href="https://www.npmjs.com/package/dsh-vscode-workbench"><img src="https://img.shields.io/npm/dm/dsh-vscode-workbench?label=downloads" alt="npm downloads"></a>
+  <a href="https://github.com/tingfeng347/dsh-vscode-workbench/stargazers"><img src="https://img.shields.io/github/stars/tingfeng347/dsh-vscode-workbench?logo=github&label=Stars" alt="GitHub stars"></a>
+  <a href="https://github.com/tingfeng347/dsh-vscode-workbench/commits/main"><img src="https://img.shields.io/github/last-commit/tingfeng347/dsh-vscode-workbench?label=last%20commit" alt="Last commit"></a>
+  <a href="https://github.com/tingfeng347/dsh-vscode-workbench/blob/main/LICENSE"><img src="https://img.shields.io/github/license/tingfeng347/dsh-vscode-workbench?label=license" alt="MIT license"></a>
+  <br>
+  <a href="https://awesome-dsh-plugin.com/p/tingfeng347/dsh-vscode-workbench/"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin"></a>
+  <a href="https://dshpluginhub.ai/plugins/dsh-vscode-workbench"><img src="https://dshpluginhub.ai/badges/plugins/dsh-vscode-workbench.svg" alt="Listed on DSH Plugin Hub"></a>
+  <a href="https://dshmarket.com/p/tingfeng347/dsh-vscode-workbench/"><img src="https://img.shields.io/badge/dsh--market-Listed-5b7cfa?style=flat" alt="Listed on dsh-market"></a>
+  <a href="https://dshmk.com/plugins/1343926987"><img src="https://img.shields.io/badge/DSH%20Plugin%20Market-Listed-0ea5e9?style=flat" alt="Listed on DSH Plugin Market"></a>
+  <a href="https://dsh-ai.org/p/tingfeng347/dsh-vscode-workbench"><img src="https://img.shields.io/badge/dsh--ai.org-Listed-8b5cf6?style=flat" alt="Listed on dsh-ai.org"></a>
+  <a href="https://duink.com/plugins/1343926987/"><img src="https://img.shields.io/badge/DSH%20Universe-Listed-14b8a6?style=flat" alt="Listed on DSH Universe"></a>
+  <a href="https://deepseekplugin.org/en/plugins/tingfeng347-dsh-vscode-workbench"><img src="https://img.shields.io/badge/DeepseekPlugin-Listed-2563eb?style=flat" alt="Listed on DeepseekPlugin"></a>
+</p>
+
 <p align="center"><a href="README.md">中文</a> · <b>English</b></p>
 
 ## Highlights
 
-- **Genuine VS Code feel**: explorer / search / source-control views, an activity bar, and `Ctrl+Shift+E/F/G` shortcuts — the workflow you already know.
-- **Reliable saves**: atomic writes with revision checks; conflicts are raised instead of silently overwriting.
-- **External-change awareness**: a WebSocket watches the workspace, flagging files changed on disk in the tab and status bar.
-- **Commit graph**: a swimlane commit graph visualizes branch history.
-- **Per-workspace restore**: active view, tabs, widths, panels, and tree expansion persist per workspace across reloads.
+- **One local workbench**: explorer, Monaco editor, search, Git, terminal, and DSH conversation in one VS Code-style interface.
+- **Complete file experience**: open text, Markdown, images, PDF, and Word files directly; the tree supports drag-and-drop uploads and common file operations.
+- **Reliable and live**: atomic saves and revision checks prevent silent overwrites, while WebSocket updates flag external workspace changes.
+- **Visual Git workflow**: status, staging, commits, branches, diffs, commit files, and a swimlane commit graph.
+- **Persistent workspace context**: restore tabs, tree, views, panels, and widths per workspace; terminals support multiple sessions, splits, and rename.
+- **Built for DSH**: reuse the DSH conversation surface on the right and manage theme and layout from workbench settings.
 
 ## Features
 
-### Explorer
-A lazily loaded tree with create, upload, rename, delete, and refresh. Drop local files onto the workspace root or any directory; Git file markers show `A`, `M`, and other status codes.
-
-### Editor
-Monaco tabs with dirty tracking, atomic saves, and revision-conflict plus external-change notices.
-
-### Preview
-Markdown rendered by default with source and outline modes; workspace-relative links, image and common file previews.
-
-### Search
-`@vscode/ripgrep` full-text search with case, whole-word, regex, and include / exclude controls.
-
-### Git
-Grouped status, stage, unstage, discard, commit, branch switching, inline / side-by-side diffs, and a commit graph.
-
-### Layout
-Resizable and collapsible primary view, an extensible bottom panel, and a status bar; theme and widths centralized in settings.
-
-### DSH conversation
-Reuses the official conversation UI with messages, coding tools, models, attachments, and permissions.
-
-### Terminal
-The workbench includes an interactive local terminal powered by `node-pty` and xterm. Use the terminal icon in the left activity bar to open the bottom panel; it supports multiple terminals, renaming, resize, ANSI output, and Ctrl+C.
-
-### Restore
-Persists the active view, tabs, widths, and panel state per workspace across reloads.
+- **Files and editor**: lazy explorer with create, upload, drag-and-drop, rename, delete, and Git markers; Monaco tabs provide dirty state, atomic saves, and conflict notices.
+- **Preview**: Markdown source, outline, relative links, and images; built-in PDF paging and zoom plus DOCX rendering, with DOC/ODT download support.
+- **Search and Git**: `@vscode/ripgrep` supports case, whole-word, regex, and path filters; Git covers stage, unstage, discard, commit, branches, diffs, commit files, and the graph.
+- **Terminal**: `node-pty` and xterm with up to eight sessions, rename, a right-side switcher, splits, ANSI output, and Ctrl+C.
+- **Layout and DSH**: the primary view, terminal panel, and DSH conversation sidebar can be shown and resized independently; settings manage theme and widths.
+- **Sync and restore**: workspace file changes stream to the UI, while reload restores views, tabs, expanded directories, panels, and layout.
 
 The workbench mounts through the official `sidebar.footer.action` and `shell.overlay` extension points. It does not replace or disable `ui-layout`.
 
-## Screenshots
+## Demo
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/tingfeng347/dsh-vscode-workbench/main/assets/screenshots/explorer.png" width="800" alt="Explorer and Monaco editor">
@@ -54,21 +56,86 @@ The workbench mounts through the official `sidebar.footer.action` and `shell.ove
   <br><em>Source control and commit graph</em>
 </p>
 
-![2026-08-31 22-52-58.png](https://pic1.imgdb.cn/i/034GkZFU8ULHsWgFio93Lw.png)
+<p align="center">
+  <img src="https://pic1.imgdb.cn/i/034GkZFU8ULHsWgFio93Lw.png" width="800" alt="terminal">
+  <br><em>terminal</em>
+</p>
+
 
 ## Installation
 
+Plugin 0.1.9 targets DeepSeek Harness `0.2.1-alpha.3` (Cordis `4.0.5-alpha.2`). Update Harness before installing; plugin 0.1.8 targets Harness `0.1.1-rc.2`.
+
 ```bash
 dsh plugin --profile web add dsh-vscode-workbench
 ```
 
-With pnpm, `node-pty` needs approval to run its native build script. If pnpm asks for it, add the following to the active profile's `pnpm-workspace.yaml`:
+### First terminal installation
+
+The terminal uses `node-pty`. If installation reports a blocked build script, merge the following into `~/.dsh/profiles/web/pnpm-workspace.yaml` on the DSH host, preserving existing settings:
 
 ```yaml
 allowBuilds:
   node-pty: true
 ```
 
+Newer Harness releases may roll back failed installations, so run the install command again after configuring builds. If the plugin is installed but `node-pty` still cannot load, run:
+
+```bash
+cd ~/.dsh/profiles/web
+pnpm rebuild node-pty
+```
+
+pnpm can also delay versions published less than 24 hours ago. Retry after the waiting period, or use DSH's "Update now" action when it is offered.
+
+### Upgrading an existing installation
+
+The running plugin manager rejects installing over an existing package when HMR is active. Remove the old plugin before installing the new version. With the CLI:
+
+```bash
+dsh plugin --profile web remove dsh-vscode-workbench
+dsh plugin --profile web add dsh-vscode-workbench
+```
+
+Reopen the workbench afterwards; restart `dsh web` and refresh the page if needed.
+
+### Install fails: incompatible Harness
+
+If the install ends with only this line, Harness refused the plugin before installing anything — pnpm never ran and no file was written:
+
+```
+dsh: plugin command failed; diagnostics: ~/.dsh/profiles/<profile>/.plugin-manager/logs/operation-*/pnpm.log
+```
+
+Harness runs a compatibility preflight first: it compares the plugin's `@deepseek-ai/dsh*` peerDependencies with the running Harness version and aborts on a mismatch. The diagnostic log holds the actual verdict:
+
+```
+dsh: installation rejected: Plugin dsh-vscode-workbench@<plugin version> is incompatible with dsh <Harness version>: peerDependencies {...}
+dsh: nothing was installed.
+```
+
+The plugin marketplace files this under the generic `plugin-side install failure`, so the auto-submitted issue body keeps only the `pnpm.log` path instead of that line.
+
+| Plugin version | Required Harness |
+| --- | --- |
+| 0.1.9 | `0.2.1-alpha.3` or newer (Cordis `4.0.5-alpha.2`) |
+| 0.1.8 | `0.1.1-rc.2` |
+
+No plugin version runs on Harness `0.2.0-rc.2`: 0.1.9 needs the `workingDirectory` service that first shipped in Harness `0.2.1-alpha.2`, while 0.1.8 only targets `0.1.1-rc.2`. Update Harness to `0.2.1-alpha.3` or newer before installing, for example with a global npm install:
+
+```bash
+npm i -g @deepseek-ai/dsh@0.2.1-alpha.4
+```
+
+`dsh plugin allow-version` only bypasses the version gate; it does not supply the missing host services, so the plugin still fails to load on `0.2.0-rc.2`. Update Harness instead.
+
+### Harness architecture integration
+
+- Client contributions use `ui-renderer` slots and select the current session through `ui-session`'s `mainView` retain count, replacing the removed `dsh-client-runtime`.
+- Files, search, Git and new terminals use `workingDirectory.get(session)`. Workspace selection follows the working-directory projection; missing sessions return 404.
+- HTTP and WebSocket routes share Harness authentication and Host/Origin checks through `connection.requestRejection()`. Terminals also require loopback access.
+- The conversation panel locates the official `data-phase` container across the new `conversation.content` layout.
+
 ## Shortcuts
 
 | Shortcut | Action |
@@ -83,7 +150,7 @@ allowBuilds:
 
 ## Security
 
-The host accepts only paths relative to the active DSH session workspace and rejects traversal and symlink escape. Saves use revision checks and atomic replacement. Git and ripgrep run with argument arrays rather than shell-concatenated commands. The terminal accepts same-origin loopback requests only, starts in the session workspace, and removes API keys, tokens, secrets, and similar environment variables.
+All plugin routes require Harness authentication. The host accepts only paths relative to the active DSH session workspace and rejects traversal and symlink escape. Saves use revision checks and atomic replacement. Git and ripgrep run with argument arrays rather than shell-concatenated commands. The terminal accepts same-origin loopback requests only, stays in the session workspace selected at creation, and removes API keys, tokens, secrets, and similar environment variables.
 
 ## Development
 

package/README.md

@@ -1,49 +1,50 @@
 <h1 align="center">DSH VS Code Workbench</h1>
 
+<p align="center">
+  <img src="https://raw.githubusercontent.com/tingfeng347/dsh-vscode-workbench/main/assets/dsh-neon-workbench-core.svg" width="220" alt="DSH VS Code Workbench Logo">
+</p>
+
 <p align="center">在 DeepSeek Harness 中叠加 VS Code 风格的本地开发工作台。</p>
 
+<p align="center">
+  <a href="https://www.npmjs.com/package/dsh-vscode-workbench"><img src="https://img.shields.io/npm/v/dsh-vscode-workbench?logo=npm&label=npm" alt="npm 版本"></a>
+  <a href="https://www.npmjs.com/package/dsh-vscode-workbench"><img src="https://img.shields.io/npm/dm/dsh-vscode-workbench?label=downloads" alt="npm 月下载量"></a>
+  <a href="https://github.com/tingfeng347/dsh-vscode-workbench/stargazers"><img src="https://img.shields.io/github/stars/tingfeng347/dsh-vscode-workbench?logo=github&label=Stars" alt="GitHub Stars"></a>
+  <a href="https://github.com/tingfeng347/dsh-vscode-workbench/commits/main"><img src="https://img.shields.io/github/last-commit/tingfeng347/dsh-vscode-workbench?label=last%20commit" alt="最近提交"></a>
+  <a href="https://github.com/tingfeng347/dsh-vscode-workbench/blob/main/LICENSE"><img src="https://img.shields.io/github/license/tingfeng347/dsh-vscode-workbench?label=license" alt="MIT 许可证"></a>
+  <br>
+  <a href="https://awesome-dsh-plugin.com/p/tingfeng347/dsh-vscode-workbench/"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin"></a>
+  <a href="https://dshpluginhub.ai/plugins/dsh-vscode-workbench"><img src="https://dshpluginhub.ai/badges/plugins/dsh-vscode-workbench.svg" alt="DSH Plugin Hub 已收录"></a>
+  <a href="https://dshmarket.com/p/tingfeng347/dsh-vscode-workbench/"><img src="https://img.shields.io/badge/dsh--market-已收录-5b7cfa?style=flat" alt="dsh-market 已收录"></a>
+  <a href="https://dshmk.com/plugins/1343926987"><img src="https://img.shields.io/badge/DSH%20插件市场-已收录-0ea5e9?style=flat" alt="DSH 插件市场已收录"></a>
+  <a href="https://dsh-ai.org/p/tingfeng347/dsh-vscode-workbench"><img src="https://img.shields.io/badge/dsh--ai.org-已收录-8b5cf6?style=flat" alt="dsh-ai.org 已收录"></a>
+  <a href="https://duink.com/plugins/1343926987/"><img src="https://img.shields.io/badge/DSH%20Universe-已收录-14b8a6?style=flat" alt="DSH Universe 已收录"></a>
+  <a href="https://deepseekplugin.org/plugins/tingfeng347-dsh-vscode-workbench"><img src="https://img.shields.io/badge/DeepseekPlugin-已收录-2563eb?style=flat" alt="DeepseekPlugin 已收录"></a>
+</p>
+
 <p align="center"><b>中文</b> · <a href="README.en.md">English</a></p>
 
 ## 亮点
 
-- **真正的 VS Code 风格**：资源管理器 / 搜索 / 源代码管理三视图 + 活动栏 + `Ctrl+Shift+E/F/G` 快捷键，沿用熟悉的 VS Code 工作流。
-- **可靠的保存**：原子写入 + 版本校验，磁盘文件被外部改动时立即报冲突，绝不静默覆盖。
-- **外部变更可感知**：WebSocket 实时监听工作区，脏文件被外部修改会在标签与状态栏标记。
-- **提交图表**：泳道式提交图，分支历史一目了然。
-- **按工作区恢复**：活动视图、标签、栏宽、面板与目录展开状态随工作区持久化，刷新后继续工作。
+- **一体化本地工作台**：资源管理器、Monaco 编辑器、搜索、Git、终端和 DSH 对话集中在一个 VS Code 风格界面。
+- **完整文件体验**：文本、Markdown、图片、PDF 和 Word 文档均可直接打开；目录支持拖放上传和常用文件操作。
+- **可靠且实时**：原子保存与版本校验避免静默覆盖，WebSocket 会及时标记工作区的外部变更。
+- **可视化 Git 工作流**：覆盖状态、暂存、提交、分支、差异、提交文件与泳道式提交图。
+- **可持续的工作上下文**：按工作区恢复标签、目录、视图、面板与栏宽；终端支持多会话、分屏与重命名。
+- **贴合 DSH**：右侧直接复用 DSH 对话能力，主题与布局集中在工作台设置中管理。
 
 ## 功能
 
-### 资源管理器
-懒加载目录树，支持新建文件 / 目录、上传、重命名、删除与刷新。可把本地文件拖到工作区根目录或任一目录；新增文件显示 `A`，已修改文件显示 `M` 等 Git 状态。
-
-### 编辑器
-Monaco 多标签编辑，脏状态跟踪，原子保存，版本冲突与外部变更提示。
-
-### 预览
-Markdown 默认渲染，可切换源码与大纲；支持工作区相对链接、图片与常见图片文件预览。
-
-### 搜索
-基于 `@vscode/ripgrep` 的全文搜索，支持大小写、全词、正则与包含 / 排除规则。
-
-### Git
-状态分组、暂存、撤销暂存、丢弃、提交、分支切换、内联 / 并排差异与提交图表。
-
-### 布局
-可调节与折叠的左侧视图、可扩展的底部面板与状态栏；设置统一管理主题与栏宽。
-
-### DSH 对话
-右侧复用官方会话界面，保留消息、编程工具、模型、附件与权限能力。
-
-### 终端
-内置由 `node-pty` 与 xterm 驱动的本地交互终端。点击左侧活动栏终端图标打开底部面板，支持多终端、重命名、尺寸自适应、ANSI 输出与 Ctrl+C。
-
-### 状态恢复
-按工作区保存活动视图、标签、栏宽与面板状态，刷新后继续工作。
+- **文件与编辑器**：懒加载目录树、创建、上传、拖放、重命名、删除和 Git 状态；Monaco 多标签编辑支持脏状态、原子保存与冲突提示。
+- **预览**：Markdown 支持源码、大纲、相对链接和图片；内置 PDF 翻页缩放与 DOCX 渲染，DOC/ODT 可直接下载打开。
+- **搜索与 Git**：`@vscode/ripgrep` 支持大小写、全词、正则和路径筛选；Git 提供暂存、撤销、丢弃、提交、分支、差异、提交文件和提交图表。
+- **终端**：基于 `node-pty` 与 xterm，支持最多 8 个会话、会话重命名、右侧切换、分屏、ANSI 输出和 Ctrl+C。
+- **布局与 DSH**：左侧视图、终端面板和右侧 DSH 对话栏可独立显示和调整；设置面板管理主题与各栏宽度。
+- **同步与恢复**：工作区文件变化实时推送；刷新后恢复活动视图、标签、目录展开、面板和布局。
 
 工作台通过官方 `sidebar.footer.action` 与 `shell.overlay` 扩展点挂载，不替换或卸载 `ui-layout`。
 
-## 截图
+## 演示
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/tingfeng347/dsh-vscode-workbench/main/assets/screenshots/explorer.png" width="800" alt="资源管理器与 Monaco 编辑器">
@@ -55,21 +56,86 @@ Markdown 默认渲染，可切换源码与大纲；支持工作区相对链接
   <br><em>源代码管理与提交图表</em>
 </p>
 
-![2026-08-31 22-52-58.png](https://pic1.imgdb.cn/i/034GkZFU8ULHsWgFio93Lw.png)
+<p align="center">
+  <img src="https://pic1.imgdb.cn/i/034GkZFU8ULHsWgFio93Lw.png" width="800" alt="终端">
+  <br><em>终端</em>
+</p>
+
 
 ## 安装
 
+插件 0.1.9 适配 DeepSeek Harness `0.2.1-alpha.3`（Cordis `4.0.5-alpha.2`）。请先更新 Harness，再安装插件；Harness `0.1.1-rc.2` 对应插件 0.1.8。
+
 ```bash
 dsh plugin --profile web add dsh-vscode-workbench
 ```
 
-使用 pnpm 安装时，`node-pty` 需要执行受限的原生构建脚本。若出现构建许可提示，请在当前 profile 的 `pnpm-workspace.yaml` 中加入：
+### 首次安装终端支持
+
+终端使用 `node-pty`。如果安装日志提示其构建脚本被阻止，在 DSH 所在机器的 `~/.dsh/profiles/web/pnpm-workspace.yaml` 中合并以下配置，保留已有设置：
 
 ```yaml
 allowBuilds:
   node-pty: true
 ```
 
+新版 Harness 可能回滚失败的安装，配置后应重新执行安装命令。若插件已安装但终端仍提示 `node-pty` 加载失败，可执行：
+
+```bash
+cd ~/.dsh/profiles/web
+pnpm rebuild node-pty
+```
+
+刚发布不足 24 小时的版本可能被 pnpm 的安全等待期拦截。等待后重试即可；DSH 提供“立即更新”时可直接选择它。
+
+### 从旧版升级
+
+运行中的插件管理器启用 HMR 时，不允许覆盖安装同名包。先在插件管理器中移除旧版，再安装新版；CLI 可使用：
+
+```bash
+dsh plugin --profile web remove dsh-vscode-workbench
+dsh plugin --profile web add dsh-vscode-workbench
+```
+
+完成后重新打开工作台，必要时重启 `dsh web` 并刷新页面。
+
+### 安装失败：Harness 版本不兼容
+
+如果安装只以这一行结束，说明 DSH 在安装前就拒绝了插件，pnpm 没有执行、也没有任何文件被写入：
+
+```
+dsh: plugin command failed; diagnostics: ~/.dsh/profiles/<profile>/.plugin-manager/logs/operation-*/pnpm.log
+```
+
+原因是 Harness 的兼容性预检：它用插件的 `@deepseek-ai/dsh*` peerDependencies 比对当前 Harness 版本，不匹配就中止安装。诊断日志里能看到真正的结论：
+
+```
+dsh: installation rejected: Plugin dsh-vscode-workbench@<插件版本> is incompatible with dsh <Harness 版本>: peerDependencies {...}
+dsh: nothing was installed.
+```
+
+插件市场把这类失败归入通用的 `plugin-side install failure`，所以自动提交的 Issue 里不会带上上面这行，正文只剩 `pnpm.log` 的路径。
+
+| 插件版本 | 需要的 Harness |
+| --- | --- |
+| 0.1.9 | `0.2.1-alpha.3` 及以上（Cordis `4.0.5-alpha.2`） |
+| 0.1.8 | `0.1.1-rc.2` |
+
+Harness `0.2.0-rc.2` 上没有可用的插件版本：0.1.9 依赖 Harness `0.2.1-alpha.2` 才引入的 `workingDirectory` 服务，0.1.8 又只适配 `0.1.1-rc.2`。请先把 Harness 升级到 `0.2.1-alpha.3` 及以上再安装，例如 npm 全局安装时：
+
+```bash
+npm i -g @deepseek-ai/dsh@0.2.1-alpha.4
+```
+
+`dsh plugin allow-version` 只跳过版本闸门，不会补上缺失的宿主服务，在 `0.2.0-rc.2` 上插件仍然加载不起来；请优先升级 Harness。
+
+### 新版架构适配
+
+- 客户端通过 `ui-renderer` 提供的槽位服务注册界面，使用 `ui-session` 的 `mainView` 引用选择当前会话；不再依赖已移除的 `dsh-client-runtime`。
+- 文件、搜索、Git 和新建终端通过 `workingDirectory.get(session)` 使用会话当前目录，跟随工作目录投影切换；失效会话返回 404。
+- HTTP 与 WebSocket 接口使用 `connection.requestRejection()`，共享 Harness 登录认证及 Host/Origin 校验；终端额外保留 loopback 限制。
+- 对话栏按官方 `data-phase` 容器定位，支持新版 `conversation.content` 布局。
+
 ## 快捷键
 
 | 快捷键 | 操作 |
@@ -82,11 +148,11 @@ allowBuilds:
 | `Ctrl+\`` | 显示或隐藏终端 |
 | `Ctrl+Shift+\`` | 新建终端 |
 
-左侧活动栏的终端按钮会展开终端面板；已打开时再次点击不会关闭它。
+左侧活动栏的终端按钮可切换显示或隐藏终端面板。
 
 ## 安全
 
-Host 只接受当前 DSH 会话工作目录内的相对路径，并阻止目录穿越与符号链接越界。保存使用版本校验与原子替换；Git 与 ripgrep 使用参数数组启动，不拼接 Shell 命令。终端只接受同源 loopback 请求，固定在会话工作目录启动，并移除 API key、token、secret 等敏感环境变量。
+所有插件接口要求 Harness 登录认证。Host 只接受当前 DSH 会话工作目录内的相对路径，并阻止目录穿越与符号链接越界。保存使用版本校验与原子替换；Git 与 ripgrep 使用参数数组启动，不拼接 Shell 命令。终端只接受同源 loopback 请求，固定在创建时的会话工作目录启动，并移除 API key、token、secret 等敏感环境变量。
 
 ## 开发
 

package/lib/client.js

@@ -12066,7 +12066,7 @@ Please report this to https://github.com/markedjs/marked.`, e) {
 		//#region src/client/DshConversationPanel.tsx
 		/** Locate the resident DSH conversation without depending on generated CSS module names. */
 		function findDshConversationRoot(documentRoot = document) {
-			const root = documentRoot.querySelector("[data-conversation-scroll]")?.parentElement;
+			const root = documentRoot.querySelector("[data-phase] [data-conversation-scroll]")?.closest("[data-phase]");
 			return root instanceof HTMLElement && root.dataset.phase !== void 0 ? root : null;
 		}
 		/** Keep the official conversation mounted while presenting it in the workbench's right column. */
@@ -47493,15 +47493,13 @@ section.${c}>footer { z-index: 1; }
 				children: "VS Code 工作台"
 			});
 		}
-		function Workbench({ service, useSessions }) {
+		function Workbench({ service, sessionId, cwd }) {
 			const [snapshot, setSnapshot] = (0, react.useState)(() => service.getSnapshot());
 			const [panels, setPanels] = (0, react.useState)(() => service.getPanels());
 			(0, react.useEffect)(() => service.subscribe(() => {
 				setSnapshot(service.getSnapshot());
 				setPanels(service.getPanels());
 			}), [service]);
-			const sessionId = useSessions((state) => state.current);
-			const cwd = useSessions((state) => sessionId === void 0 ? void 0 : state.byId[sessionId]?.cwd);
 			const [workspace, setWorkspace] = (0, react.useState)();
 			const [tabs, setTabs] = (0, react.useState)([]);
 			const [active, setActive] = (0, react.useState)();
@@ -48226,9 +48224,9 @@ section.${c}>footer { z-index: 1; }
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "dvw-bottom-body",
-								children: Panel && cwd && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Panel, {
+								children: Panel && workspace && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Panel, {
 									sessionId,
-									cwd,
+									cwd: workspace.cwd,
 									visible: true,
 									colorScheme
 								})
@@ -48333,13 +48331,21 @@ body[data-ds-dark-theme] .dvw-overlay,.dvw-overlay[data-dvw-theme=dark]{color-sc
 			};
 		}
 		//#endregion
+		//#region src/client/session.ts
+		/** Background retains do not select the workspace shown in the main conversation. */
+		function mainViewSession(state) {
+			return Object.values(state.byId).find((session) => (session.retainedBy.mainView ?? 0) > 0);
+		}
+		//#endregion
 		//#region src/client/index.tsx
 		const Overlay = ({ service, useSessions }) => {
-			const sessionId = useSessions((state) => state.current);
+			const session = useSessions(mainViewSession);
+			const cwd = session?.projectionValues?.workingDirectory ?? session?.cwd;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Workbench, {
 				service,
-				useSessions
-			}, sessionId ?? "no-session");
+				sessionId: session?.id,
+				cwd
+			}, `${session?.id ?? "no-session"}:${cwd ?? ""}`);
 		};
 		const Footer = ({ service }) => {
 			const [target, setTarget] = (0, react.useState)();