Merge remote-tracking branch 'origin/master' into fix/preset-host-plane-task-registry

apps/cli/composition.md

@@ -46,6 +46,8 @@ flowchart LR
   cfg --> plugin_dsh_base_llm_pi_ai
   plugin_dsh_base_session_persistence_jsonl["session-persistence-jsonl<br/>@deepseek-ai/dsh-session-persistence-jsonl"]
   cfg --> plugin_dsh_base_session_persistence_jsonl
+  plugin_dsh_base_attachment_local["attachment-local<br/>@deepseek-ai/dsh-attachment-local"]
+  cfg --> plugin_dsh_base_attachment_local
   plugin_dsh_base_session_query_sqlite["session-query-sqlite<br/>@deepseek-ai/dsh-session-query-sqlite"]
   cfg --> plugin_dsh_base_session_query_sqlite
   plugin_dsh_base_session_projection["session-projection<br/>@deepseek-ai/dsh-session-projection"]
@@ -183,6 +185,7 @@ flowchart LR
 | `credentials` | `@deepseek-ai/dsh-credentials-local` |
 | `llm-pi-ai` | `@deepseek-ai/dsh-llm-pi-ai` |
 | `session-persistence-jsonl` | `@deepseek-ai/dsh-session-persistence-jsonl` |
+| `attachment-local` | `@deepseek-ai/dsh-attachment-local` |
 | `session-query-sqlite` | `@deepseek-ai/dsh-session-query-sqlite` |
 | `session-projection` | `@deepseek-ai/dsh-session-projection` |
 | `telemetry-otel` | `@deepseek-ai/dsh-session-telemetry-otel` |

apps/cli/reference/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/reference/README.md
-README.md: bb3e1d77f00e03f6a21f4da3c04994f208e84293
-README.zh.md: 3802f940ef6663ec215cf09293a9edda5ea4c512
+README.md: 40807da0b1a88708e2e5e9efa3569bd0d6f6a020
+README.zh.md: b9c48c16dd4be186266d30a438329463c31aca70

apps/cli/reference/README.md

@@ -43,7 +43,7 @@ Git-hosted plugins that ship sources build during install through their `prepare
 
 ## Web alias
 
-`dsh web` is a hardcoded alias for `--profile web` that additionally accepts the Web flag family. `--host`, `--port`, `--workspace-root`, and repeatable `--trusted-host` values become patches over the composed rows; their owning plugin schemas validate them at boot. `--dev` switches the web-runtime row to development mode and inserts the client-plugin HMR receiver; it expects a separate `pnpm run dev:web` watcher for no-refresh client bundle updates.
+`dsh web` is a hardcoded alias for `--profile web` that additionally accepts the Web flag family. `--host`, `--port`, and repeatable `--trusted-host` values become patches over the composed rows; their owning plugin schemas validate them at boot. `--dev` switches the web-runtime row to development mode and inserts the client-plugin HMR receiver; it expects a separate `pnpm run dev:web` watcher for no-refresh client bundle updates.
 
 ```sh
 dsh web

apps/cli/reference/README.zh.md

@@ -43,7 +43,7 @@ Git 托管、随附源码的插件在安装期间通过其 `prepare` 脚本构
 
 ## Web 别名
 
-`dsh web` 是 `--profile web` 的硬编码别名，并额外接受 Web flag 系列。`--host`、`--port`、`--workspace-root` 和可重复的 `--trusted-host` 值会成为作用在组合行之上的 patch；负责这些值的插件 schema 会在启动时验证它们。`--dev` 把 web-runtime 行切换到开发模式并插入客户端插件 HMR（热模块替换）接收器；若要无刷新更新客户端 bundle，还需单独运行 `pnpm run dev:web` watcher。
+`dsh web` 是 `--profile web` 的硬编码别名，并额外接受 Web flag 系列。`--host`、`--port` 和可重复的 `--trusted-host` 值会成为作用在组合行之上的 patch；负责这些值的插件 schema 会在启动时验证它们。`--dev` 把 web-runtime 行切换到开发模式并插入客户端插件 HMR（热模块替换）接收器；若要无刷新更新客户端 bundle，还需单独运行 `pnpm run dev:web` watcher。
 
 ```sh
 dsh web

apps/cli/src/args.ts

@@ -48,7 +48,6 @@ interface WebInvocation {
   host?: string
   port?: number
   dev: boolean
-  workspaceRoot?: string
   /** Extra authorities for the /api browser-trust fence. */
   trustedHosts?: string[]
 }
@@ -70,7 +69,6 @@ interface WebOptions {
   host?: string
   port?: string
   dev?: boolean
-  workspaceRoot?: string
   trustedHost?: string[]
   dumpConfig?: boolean
   dumpDefaultConfig?: boolean
@@ -176,7 +174,6 @@ Examples:
     .option('--host <host>', 'bind host; pass 0.0.0.0 to reach it from another machine')
     .option('--port <port>', 'listen port; pass 0 to let the OS pick a free one')
     .option('--dev', 'mount the client-plugin HMR receiver (run pnpm run dev:web separately to rebuild bundles)')
-    .option('--workspace-root <path>', 'parent directory for workspaces created from the browser UI')
     .option('--trusted-host <authority...>', 'extra authority the /api browser-trust fence accepts (host or host:port; repeatable)')
     .option('--dump-config', 'print the composed web-profile tree (with the user layer and any --patch) and exit')
     .option('--dump-default-config', 'print the web profile\'s bundle layers (no user layer) and exit')
@@ -196,8 +193,8 @@ Examples:
         // dropping them would print a tree that differs from the same
         // invocation's boot.
         if (options.host !== undefined || options.port !== undefined || options.dev === true
-          || options.workspaceRoot !== undefined || options.trustedHost !== undefined) {
-          program.error('error: config dumps take no web flags (--host/--port/--dev/--workspace-root/--trusted-host)')
+          || options.trustedHost !== undefined) {
+          program.error('error: config dumps take no web flags (--host/--port/--dev/--trusted-host)')
         }
         resolved = { mode: 'dump-config', profile: 'web', defaultOnly, patches }
         return
@@ -211,7 +208,6 @@ Examples:
         ...options.host !== undefined && { host: options.host },
         ...options.port !== undefined && { port: Number(options.port) },
         dev: options.dev === true,
-        ...options.workspaceRoot !== undefined && { workspaceRoot: options.workspaceRoot },
         ...options.trustedHost !== undefined && { trustedHosts: options.trustedHost },
       }
     })

apps/cli/src/web.ts

@@ -1,7 +1,7 @@
 /**
  * `dsh web` — the browser-surface alias over the profile boot: `--profile web`
- * plus the Web flag family (`--host/--port/--dev/--workspace-root/
- * --trusted-host`), each flag becoming a patch over the composed profile
+ * plus the Web flag family (`--host/--port/--dev/--trusted-host`), each flag
+ * becoming a patch over the composed profile
  * tree. All web runtime glue (dist serving, prompt section, URL line) lives
  * in the `@deepseek-ai/dsh-web-app` bundle; this launcher only derives
  * flag patches and the LAN-trust snapshot.
@@ -59,7 +59,6 @@ export interface WebFlags {
   host?: string
   port?: number
   dev: boolean
-  workspaceRoot?: string
   trustedHosts?: string[]
 }
 
@@ -83,7 +82,6 @@ function deriveWebFlagPatches(
   }
   if (flags.host !== undefined) put('webserver', 'host', flags.host)
   if (flags.port !== undefined) put('webserver', 'port', flags.port)
-  if (flags.workspaceRoot !== undefined) put('api-gateway', 'workspaceRoot', flags.workspaceRoot)
   const composedHost = (rows.get('webserver')?.config as { host?: string } | undefined)?.host
   const { lanAddresses, trustedHosts } = resolveLanTrust(flags.host ?? composedHost, flags.trustedHosts ?? [])
   if (trustedHosts.length > 0) {
@@ -122,8 +120,8 @@ export function webSurfaceContextEnabled(rows: ProfileRows): boolean {
 }
 
 /**
- * Serve the browser UI from the web profile. Host/port/workspace-root flags
- * are passed through only when given (absent, the composed profile values
+ * Serve the browser UI from the web profile. Host/port flags are passed
+ * through only when given (absent, the composed profile values
  * stand); `web-runtime.mode` and `lanAddresses` are launcher-derived on
  * every boot. The URL line is printed by the web-app bundle's runtime row
  * after Loader settlement.

apps/cli/tests/args.spec.ts

@@ -33,8 +33,8 @@ describe('parseDshArgs', () => {
       .toEqual({ mode: 'run', profile: 'headless', patches: [], task: '--profile is task text' })
     expect(parse(['web'])).toEqual({ mode: 'web', dev: false, patches: [] })
     expect(parse(['web', '--patch', 'web.yml'])).toEqual({ mode: 'web', dev: false, patches: ['web.yml'] })
-    expect(parse(['web', '--host', '0.0.0.0', '--port', '8080', '--dev', '--workspace-root', '/w']))
-      .toEqual({ mode: 'web', host: '0.0.0.0', port: 8080, dev: true, workspaceRoot: '/w', patches: [] })
+    expect(parse(['web', '--host', '0.0.0.0', '--port', '8080', '--dev']))
+      .toEqual({ mode: 'web', host: '0.0.0.0', port: 8080, dev: true, patches: [] })
     expect(parse(['web', '--trusted-host', 'harness.internal:3080', 'lab.internal', '--trusted-host', '10.0.0.9']))
       .toEqual({ mode: 'web', dev: false, patches: [], trustedHosts: ['harness.internal:3080', 'lab.internal', '10.0.0.9'] })
   })

apps/web/tests/agent-preset-authoring.e2e.ts

@@ -44,9 +44,15 @@ describe('web e2e: agent-preset authoring is a host-side copy', () => {
     return page.getByRole('dialog', { name: '设置' })
   }
 
-  /** Tokenize the lane-owned preset root the way the scaffold tokenizes cwd. */
+  /** Tokenize the lane-owned preset root after general aria normalization. */
   function withPresetRoot(snapshot: string): string {
-    return snapshot.split(userRoot).join('{{presetRoot}}')
+    const rootSuffix = `/${userRoot.split('/').pop()!}`
+    return snapshot.split('\n').map((line) => {
+      const rootStart = line.indexOf(rootSuffix)
+      if (rootStart === -1) return line
+      const pathStart = line.lastIndexOf(' ', rootStart) + 1
+      return `${line.slice(0, pathStart)}{{presetRoot}}${line.slice(rootStart + rootSuffix.length)}`
+    }).join('\n')
   }
 
   beforeAll(async () => {

apps/web/tests/image-display.snapshot.ts

@@ -0,0 +1,138 @@
+// @vitest-environment jsdom
+// Multimodal image surfaces over the BUILT client graph (the code-mode-fixture
+// idiom: real bundles via AppWebEntry, keyless FixtureApiClient transport).
+// Opens the fixture history session whose turn 72 carries an image in BOTH a
+// user message and an assistant message, and pins the product surfaces: the
+// history ImageGallery loading real fixture bytes through the authorized
+// sessions.attachment route, the double-click ImageLightbox, and the composer
+// intake chain (paste → ordered thumbnail rail → image-only send enablement → remove).
+import { fireEvent, screen, waitFor, within } from '@testing-library/react'
+import { expect, it } from 'vitest'
+import { installAssembledBootEnv, mountAssembledApp } from './assembled-boot.ts'
+
+installAssembledBootEnv()
+
+/** Open the fixture history session (the alpha log carrying the turn-72 image pair) and wait for its gallery. */
+async function openFixtureSession(): Promise<void> {
+  const tree = await screen.findByRole('tree', { name: '会话' }, { timeout: 10_000 })
+  const group = (await within(tree).findAllByText('fixture'))
+    .map(el => el.closest<HTMLElement>('[role="treeitem"]'))
+    .find(el => el?.getAttribute('aria-expanded') !== null)
+  if (group === null || group === undefined) throw new Error('fixture Workspace group missing')
+  if (group.getAttribute('aria-expanded') === 'false') {
+    fireEvent.click(within(group).getByText('fixture'))
+    await waitFor(() => {
+      expect(group.getAttribute('aria-expanded')).toBe('true')
+    })
+  }
+  const session = await within(tree).findByText('Fixture 历史会话')
+  fireEvent.click(session)
+  await waitFor(() => {
+    expect(document.querySelectorAll('[data-align] img').length).toBeGreaterThan(0)
+  }, { timeout: 10_000 })
+}
+
+it('renders the history image pair through the authorized attachment route and opens the lightbox', async () => {
+  localStorage.setItem('dsh.locale', 'zh')
+  mountAssembledApp()
+  await openFixtureSession()
+
+  // Both the user-side (align=end) and assistant-side (align=start) galleries
+  // load real fixture bytes over sessions.attachment. jsdom provides
+  // createObjectURL, so this environment MUST take the object-URL path — a
+  // data: src here would mean the fallback ran where it should not.
+  await waitFor(() => {
+    if (document.querySelector('[data-align="end"] img') === null
+      || document.querySelector('[data-align="start"] img') === null) {
+      throw new Error('history image galleries missing')
+    }
+  }, { timeout: 10_000 })
+  const galleryShape = (align: string) => [...document.querySelectorAll(`[data-align="${align}"] img`)]
+    .map(img => ({ alt: img.getAttribute('alt'), scheme: img.getAttribute('src')?.split(':')[0] }))
+  expect({ user: galleryShape('end'), assistant: galleryShape('start') }).toMatchInlineSnapshot(`
+    {
+      "assistant": [
+        {
+          "alt": "fixture-image.png",
+          "scheme": "blob",
+        },
+      ],
+      "user": [
+        {
+          "alt": "fixture-image.png",
+          "scheme": "blob",
+        },
+      ],
+    }
+  `)
+  const userImage = document.querySelector<HTMLElement>('[data-align="end"] img')!
+
+  // Double-click opens the original-size lightbox; Escape/close dismisses it.
+  const frame = userImage.closest('button')
+  if (frame === null) throw new Error('image frame button missing')
+  fireEvent.doubleClick(frame)
+  const lightbox = await screen.findByRole('dialog')
+  expect(within(lightbox).getByRole('img').getAttribute('src')?.split(':')[0]).toBe('blob')
+  fireEvent.click(within(lightbox).getByRole('button', { name: /关闭/ }))
+  await waitFor(() => {
+    expect(screen.queryByRole('dialog')).toBeNull()
+  })
+})
+
+it('accepts pasted images into the composer rail in order and removes them', async () => {
+  localStorage.setItem('dsh.locale', 'zh')
+  mountAssembledApp()
+
+  const tree = await screen.findByRole('tree', { name: '会话' }, { timeout: 10_000 })
+  const start = tree.querySelector<HTMLButtonElement>('button[aria-label="在“fixture”中新建会话"]')
+  if (start === null) throw new Error('fixture Workspace new-session action missing')
+  fireEvent.click(start)
+
+  // Image-only send arming is pinned at package level (input-bar.spec.tsx);
+  // this assembled lane pins the intake chain over the built graph.
+  const textarea = await screen.findByPlaceholderText('描述你想要构建的内容', {}, { timeout: 10_000 })
+  const image = new File([new Uint8Array([137, 80, 78, 71])], 'pasted.png', { type: 'image/png' })
+  fireEvent.paste(textarea, {
+    clipboardData: {
+      items: [{ kind: 'file', type: 'image/png', getAsFile: () => image }],
+      getData: () => '',
+    },
+  })
+
+  // The rail is an accessible group holding the draft thumbnail (queried via
+  // DOM: jsdom's a11y-visibility computation hides the composer subtree).
+  const rail = await waitFor(() => {
+    const el = document.querySelector('[role="group"][aria-label="待发送图片"]')
+    if (el === null) throw new Error('attachment rail missing')
+    return el
+  }, { timeout: 5_000 })
+  expect([...rail.querySelectorAll('img')].map(img => ({
+    alt: img.getAttribute('alt'), scheme: img.getAttribute('src')?.split(':')[0],
+  }))).toMatchInlineSnapshot(`
+    [
+      {
+        "alt": "pasted.png",
+        "scheme": "blob",
+      },
+    ]
+  `)
+
+  const second = new File([new Uint8Array([137, 80, 78, 71])], 'second.png', { type: 'image/png' })
+  fireEvent.paste(textarea, {
+    clipboardData: {
+      items: [{ kind: 'file', type: 'image/png', getAsFile: () => second }],
+      getData: () => '',
+    },
+  })
+  await waitFor(() => {
+    expect([...rail.querySelectorAll('img')].map(img => img.getAttribute('alt')))
+      .toEqual(['pasted.png', 'second.png'])
+  })
+
+  const remove = [...rail.querySelectorAll('button[aria-label^="移除图片"]')]
+  if (remove.length !== 2) throw new Error('remove buttons missing')
+  for (const button of remove) fireEvent.click(button)
+  await waitFor(() => {
+    expect(document.querySelector('[role="group"][aria-label="待发送图片"]')).toBeNull()
+  })
+})

apps/web/tests/navigation-panes.e2e.ts

@@ -78,8 +78,8 @@ describe('web e2e: navigation & panes over a rich seeded session', () => {
   beforeAll(async () => {
     scaffold = await launchWebScaffold({})
     // The workspace-aware flow runs sessions in <workspaceCwd>/workspace;
-    // the read targets must live in that session cwd (pre-creation is safe:
-    // create-by-name adopts an existing directory).
+    // the read targets must live in that session cwd (pre-creation is safe
+    // because the picker adopts an existing directory by path).
     const sessionCwd = join(scaffold.workspaceCwd, 'workspace')
     await mkdir(sessionCwd, { recursive: true })
     await writeFile(join(sessionCwd, 'nav-a.md'), '# alpha nav\n')

apps/web/tests/seeded-history.e2e.ts

@@ -187,8 +187,8 @@ describe('web e2e: seeded history renders through cold resume', () => {
     scaffold = await launchWebScaffold({})
     // The workspace-aware flow runs sessions in <workspaceCwd>/workspace
     // (the composer's default draft name); the read-tool targets must live in
-    // that session cwd. Pre-creating the directory is safe: create-by-name
-    // adopts an existing directory.
+    // that session cwd. Pre-creating the directory is safe because the picker
+    // adopts an existing directory by path.
     const sessionCwd = join(scaffold.workspaceCwd, 'workspace')
     await mkdir(sessionCwd, { recursive: true })
     await writeFile(join(sessionCwd, 'a.txt'), 'alpha\n')

apps/web/tests/snapshots/plan-review/approved.expected.md

@@ -7,7 +7,7 @@
     - tab "Chat" [selected]
     - tab "Trajectory"
 - img
-- text: "plan Plan mode on. Use /plan off to leave. Interjection Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. {{clock}}"
+- text: "plan Plan mode on. Use /plan off to leave. Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. {{clock}}"
 - button "Copy":
   - img
 - button "Context injection @deepseek-ai/dsh-system-prompt":

apps/web/tests/snapshots/steer-all/mid-steer.expected.md

@@ -19,10 +19,10 @@
   - img
   - text: Think The user wants me to ask them a checkpoint question first, then continue with whatever they interject. Let me do exactly that.
 - status: Deep diving...
-- text: "Interjection Interjection: include the word BANANA in your final reply."
+- text: "Interjection: include the word BANANA in your final reply."
 - button "Copy":
   - img
-- text: "Interjection Interjection: include the word ORANGE in your final reply."
+- text: "Interjection: include the word ORANGE in your final reply."
 - button "Copy":
   - img
 - textbox "Message the agent"

apps/web/tests/snapshots/steer-all/settled.expected.md

@@ -21,10 +21,10 @@
   - img
   - img
   - text: Ask question 1/1 answered
-- text: "Interjection Interjection: include the word BANANA in your final reply. {{clock}}"
+- text: "Interjection: include the word BANANA in your final reply. {{clock}}"
 - button "Copy":
   - img
-- text: "Interjection Interjection: include the word ORANGE in your final reply. {{clock}}"
+- text: "Interjection: include the word ORANGE in your final reply. {{clock}}"
 - button "Copy":
   - img
 - paragraph: "Got it: BANANA and ORANGE."

apps/web/tests/snapshots/steering/mid-steer.expected.md

@@ -23,7 +23,7 @@
   - img
   - text: Ask question waiting
 - status: Deep diving...
-- text: "Interjection Interjection: include the word BANANA in your final reply."
+- text: "Interjection: include the word BANANA in your final reply."
 - button "Copy":
   - img
 - region "Ready to continue?":

apps/web/tests/snapshots/steering/settled.expected.md

@@ -21,7 +21,7 @@
   - img
   - img
   - text: Ask question 1/1 answered
-- text: "Interjection Interjection: include the word BANANA in your final reply. {{clock}}"
+- text: "Interjection: include the word BANANA in your final reply. {{clock}}"
 - button "Copy":
   - img
 - button "Think The user selected \"Yes\" and wants me to include the word \"BANANA\" in my final reply. Let me acknowledge their answer.":

apps/web/tests/subagent-conversation.e2e.ts

@@ -446,7 +446,7 @@ describe('web e2e: persisted subagent conversation and human continuation', () =
     ).toBe(3)
     expect(await page.getByText('Ungrouped', { exact: true }).count()).toBe(0)
     const hierarchy = page.getByRole('navigation', { name: 'Session hierarchy' })
-    expect(await hierarchy.getByRole('button').count()).toBe(1)
+    await expect.poll(() => hierarchy.getByRole('button').count()).toBe(1)
     await compareOrRefreshGolden(
       FORK_EXPECTED,
       await captureStableAria(page, '[role="tree"][aria-label="Sessions"]', scaffold.workspaceCwd),

apps/web/tests/todo-row.snapshot.ts

@@ -2,7 +2,7 @@
 // Assembled todo snapshot: boots the real built `packages/client/*/lib/
 // client.js` bundles through AppWebEntry's ModuleLoader path against the
 // keyless FixtureApiClient transport, opens the fixture session, and pins the
-// two surfaces the fixture's parallel plan (turn 72, two items `in_progress`)
+// two surfaces the fixture's parallel plan (turn 73, two items `in_progress`)
 // reaches — the `todo_write` tool row and the dock's plan strip.
 //
 // The row is pinned as three separate fields on purpose. `summary=` is the