zhu1090093659/dsh-web v0.4.9

dsh-web v0.4.9

on GitHub

This release moves a browser the agent can actually drive into the right dock: the new @linxin666/dsh-client-ui-browser-view package runs a real CDP-driven Chromium that the agent operates through browser_navigate, browser_snapshot, browser_click and their siblings, so the page the user watches is the page it is rendering; Chrome starts lazily and is not launched when the plugin mounts. The family gains two rows: dsh-agents turns agent squads into real sessions that run as a whole squad (a member pins an agent preset, a permission, a model and a reasoning level, and its brief joins that member session's system prompt), and dsh-message-edit rewrites a text-only user message, forks at the preceding event boundary and resends on the new branch. The task board hands subtask dispatch to the parent card in this version, and its capability face is bound to the remote bridge through dsh-task-board-remote (board.v1), so a paired phone reads the same ledger. The remote bridge keeps extending protocol v1: usage statistics (usage.v1, usage.stats.v1), workspace and session-management write methods (workspace.v1, session.admin.v1), slash commands (commands.v1), squads (squads.v1), reconciliation of held questions (questions.list.v1) and a push channel (push.v1, with an APNs sender and live cards). The host floor moves to 0.2.1-rc.3, the same version CI pins.

Upgrade DSH first, then this package: the aggregate's dsh.engines.dsh and its @deepseek-ai/dsh peer dependency both move from the previous line to >=0.2.1-rc.3, the version CI pins as DSH_CLI_VERSION 0.2.1-rc.3. A host below that version skips the family rows at the engine gate — the symptom is plugins disappearing from the panel rather than an error — so upgrade DSH first and this package second. To roll back, reinstall @linxin666/dsh-web-all@0.4.8.
Only one entry point really migrates: this repository no longer has a Doctor pre-launch migration path; dsh-doctor is only a tombstone today, it cannot be installed and no launcher consumer exists. The plugin-manager update (including the legacy aggregate-name @linxin666/dsh-web-ui-all migration branch) is the only path with preflight, version assertion and rollback; a direct dsh web performs no install and no preflight, so an old profile stays exactly as it is. To recover by hand, run dsh plugin --profile <name> add @linxin666/dsh-web-all@0.4.9.
This version deletes or renames no persisted or wire-protocol identifier: settings section ids, configuration keys, localStorage keys, control-plane API paths and aggregate row ids all keep their values. Everything new is purely additive: the aggregate gains the rows web-ui-agents, web-ui-message-edit, web-ui-browser-view and web-ui-task-board-remote, and the bridge gains the capability bits usage.v1, usage.stats.v1, workspace.v1, session.admin.v1, commands.v1, questions.list.v1, squads.v1 and push.v1.
A card without a pinned workspace no longer runs: when no workspace resolves, the card refuses instead of quietly landing in the profile directory. A card that never pinned one needs a workspace before it can run again.
A forwarded request is no longer treated as loopback: the remote face and the shared layer decide loopback in layers, an upstream request that was forwarded counts only when it is explicitly declared trusted, and the task board additionally admits Host connection-authenticated proxy requests (#1930). A reverse-proxy deployment must switch that trust on in its configuration, or its requests are refused as external.
A new package's first release: @linxin666/dsh-client-ui-browser-view did not exist on npm before; it debuts at 0.4.9 and ships with the aggregate in this version, and gives the aggregate a browser tab the agent can drive. It starts lazily — mounting the plugin does not launch Chrome, the first real browsing action does — so an install costs no process.
A freshly published version may be held back by pnpm's release age: with minimumReleaseAge enabled (24 hours by common default), an update that runs right after the satellite packages publish is refused outright. The remedy is minimumReleaseAgeExclude for @linxin666/* in the profile's pnpm-workspace.yaml, or waiting the window out before updating.
The satellite ranges move in the same batch: the four satellite repositories publish 0.4.9 first, and only once the registry resolves them does the aggregate's dependency range move from ^0.4.8 to ^0.4.9:

• Skin center (dsh-skins): @linxin666/dsh-client-ui-skin-center@0.4.9
• Pet (dsh-pet): @linxin666/dsh-pet@0.4.9
• Community plugin index (dsh-community-plugins): @linxin666/dsh-client-ui-community-plugins@0.4.9
• Preset center (dsh-presets): @linxin666/dsh-client-ui-preset-center@0.4.9

New Features

• [browser-view] New dsh-client-ui-browser-view package: a live browser tab docked on the right, where the agent drives a real Chromium and the user watches the page it is rendering
• [browser-view] The tool surface covers navigation, snapshots, clicks, typing, keys, scrolling, screenshots, console, network and tab management (browser_navigate, browser_snapshot, browser_click, browser_type, browser_press, browser_scroll, browser_screenshot, browser_console, browser_network, browser_tabs, browser_close)
• [browser-view] A tab belongs to the session that opened it and is disposed with that session
• [agents] New dsh-agents squad sub-plugin, mounted as a family row of the aggregate
• [agents] A squad runs as a whole squad: its runtime forks official Agent Teams, and each member is a real DSH session
• [agents] Models get a tool surface for the same squad and member definitions
• [agents] A member form picks its model and reasoning level from a dropdown
• [agents] The squad form switches to a segmented layout with a workspace dropdown and a model-drafted member brief
• [message-edit] New dsh-message-edit: rewrite a text-only user message, fork at its preceding event boundary, and resend on the new branch
• [task-board-remote] The aggregate gains the dsh-task-board-remote row, and the phone's Tasks face gets board.v1
• [task-board] Subtasks dispatch from the parent card instead of a Host cascade
• [task-board] The card detail becomes a two-column folded panel that follows the panel's disclosure and action contract
• [task-board] The official automation-tasks entry hides while the board is on
• [remote-bridge] usage.v1 reads the composition of a session's requests and the DeepSeek account balance
• [remote-bridge] usage.stats.v1 aggregates the usage ledger, and usage.session carries modelContextWindow
• [remote-bridge] workspace.list plus five session-management write methods
• [remote-bridge] commands.v1 lists slash commands and skills and executes one line
• [remote-bridge] questions.list.v1 reconciles the questions a phone still holds
• [remote-bridge] squads.v1 lets a phone read and write agent squads
• [remote-bridge] push.v1 adds push.register and an APNs sender, and live cards project and deliver per session
• [remote-bridge] The bridge keeps its own standing watcher, so a turn end arrives even with no client connected
• [remote-bridge] A question is claimed for a registered push device while the phone is offline
• [remote-bridge] Several sessions lay out on one lock-screen card
• [remote-web-ui] An authorized device can be named, and same-UA duplicates merge
• [relay] A named-tunnel control plane and a second connector
• [relay] An additive Durable Object bridge behind the quick path
• [usage] Spend displays in CNY or USD at a configured rate (#1937)
• [usage] The whale-yuan voucher is minted from every provider
• [ssh] The SSH connection timeout is configurable (#1931, #1932)
• [task-board-github] GitHub traffic goes through a configurable proxy
• [session-archive] An opt-in observed archive time is recorded (#1908)
• [market] The DIY Journal skin is featured, and dsh-free-search leaves the editor picks
• [market] A skin archive over the Workers asset cap is skipped instead of failing the whole fetch

Bug Fixes

• [plugin-manager] An update that landed but only a restart loads is reported as landed (#1905)
• [liangshen] The subagent list-agents row the official side removed is dropped (#1940)
• [liangshen] An authorized route pair survives a probe that reports no fields
• [liangshen] The wire is selected by executor row, which suits the 0.2.x cohort
• [remote-bridge] Roster writes are serialized on Windows
• [remote-bridge] Roster cleanup waits on the real write promise instead of spinning the event loop
• [remote-bridge] A roster row's title is read from its in-row projection
• [remote-bridge] usage.session judges existence by the host roster, so a session that existed is no longer reported absent
• [remote-bridge] The hello announcement raises its minor from 16 to 17
• [remote-bridge] Live cards project and deliver per session
• [remote-bridge] Bracketed names stay, terminal rows go, and the card uses the App's own words
• [remote-bridge] The copy action renders only with real content, and its result announces through a live region
• [remote-web-ui] LAN reachability comes from the runtime forwarder (#1917)
• [remote-web-ui] Loopback is decided in layers, and a tunnelled phone pairs again (#1919)
• [remote-web-ui] Plugin request headers are forwarded (#1925)
• [remote-web-ui] The relay lease is claimed for the transport, not the tunnel
• [shared] An un-injected service answers not-paired instead of throwing (#1942)
• [shared] A forwarded loopback upstream request can be trusted explicitly (#1918)
• [usage] The usage section opens through the shell's settings store (#1921)
• [agents] Service probing goes through ctx.get, which fixes a fatal mount failure in this row
• [agents] The member card and page-header alignment defects are put back on the KFL grid
• [agents] The settings card carries the family marker icon
• [market] A transient download failure retries, and a Cloudflare challenge is reported as such (#1941)
• [market] A bridged lease claims without a tunnel or a CNAME
• [task-board] A card without a pinned workspace refuses to run instead of quietly landing in the profile directory
• [task-board] Host connection-authenticated proxy requests are admitted (#1930)
• [ssh] Agent authentication is submitted when the agent path is empty (#1910)
• [message-edit] The editor width lines up with the composer
• [web-all] The root viewport lock rides an attribute instead of :has() (#1913, #1916)
• [scripts] A placeholder mismatch in the i18n gate reports precisely instead of crashing

Other Changes

• [sdk] The plugin cohort advances to 0.2.1-rc.3, and the aggregate's dsh engine and peer range move to >=0.2.1-rc.3 with it
• [hooks] A gitlink pinning unpushed satellite content is blocked on push
• [ci] A Windows lane runs the bridge and browser-view suites
• [ci] The coverage baseline is recorded for all twenty packages
• [satellites] The four satellites' gitlinks move to their 0.4.9 release commits
• [market] Follow the satellites' merges in the skin, pet, community-plugin and preset pins
• [libs] Rebuild the aggregate bundles and refresh the recorded fingerprints
• [task-board] The settings card topic switches to nested density and tighter copy
• [remote-bridge] The protocol v1 pairing panel uses the official Modal and Button
• [test] Pin the semantics of hasMore at a snapshot page boundary
• [test] Give the push-channel cases role titles and Given/When/Then structure
• [docs] Record the workspace and session-management channels, the squad runtime, the bridge's standing watcher and what commands.v1 gave up, and sync the bilingual READMEs for the issue batch
• [docs] Record what the Windows smoke lane costs and why it exists