Merge remote-tracking branch 'origin/master' into feat/ripgrep-packaged-binary

apps/web/tests/hmr-live.e2e.ts

@@ -0,0 +1,132 @@
+/** Published dsh web --dev + pnpm dev:web → browser HMR, with no page reload. */
+
+import { existsSync } from 'node:fs'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { chromium } from 'playwright'
+import { expect, it } from 'vitest'
+import { Context } from 'cordis'
+import type { Fiber } from 'cordis'
+import LocalSubprocessService from '@deepseek-ai/dsh-subprocess-local'
+import type { SubprocessHandle, SubprocessSpawnSpec } from '@deepseek-ai/dsh-subprocess'
+import { REPO_ROOT } from './support.ts'
+
+function spawnSpec(argv: readonly string[], cwd: string, env?: Record<string, string>): SubprocessSpawnSpec {
+  return {
+    argv,
+    cwd,
+    stdio: { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
+    graceMs: 5_000,
+    ...env === undefined ? {} : { env },
+  }
+}
+
+function waitForOutput(child: SubprocessHandle, pattern: RegExp, label: string): Promise<string> {
+  return new Promise((resolveReady, reject) => {
+    let output = ''
+    let settled = false
+    const cleanup = (): void => {
+      clearTimeout(timer)
+      child.stdout?.off('data', onData)
+      child.stderr?.off('data', onData)
+    }
+    const resolveOnce = (value: string): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      resolveReady(value)
+    }
+    const rejectOnce = (error: Error): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      reject(error)
+    }
+    const onData = (chunk: Buffer): void => {
+      output += chunk.toString()
+      const match = pattern.exec(output)
+      if (match === null) return
+      resolveOnce(match[1] ?? match[0])
+    }
+    const timer = setTimeout(() => { rejectOnce(new Error(`${label} not ready:\n${output}`)) }, 60_000)
+    child.stdout?.on('data', onData)
+    child.stderr?.on('data', onData)
+    void child.done.then((outcome) => {
+      rejectOnce(new Error(`${label} exited before ready (${JSON.stringify(outcome)}):\n${output}`))
+    }, (error: unknown) => {
+      rejectOnce(new Error(`${label} failed before ready:\n${output}`, { cause: error }))
+    })
+  })
+}
+
+async function stopTree(child: SubprocessHandle): Promise<void> {
+  child.terminate()
+  const stopped = await child.waitForExit(AbortSignal.timeout(15_000))
+  if (!stopped) throw new Error(`process tree ${String(child.pid)} did not stop after termination escalation`)
+  await child.done
+}
+
+it('hot-reloads a real client-plugin source edit without refreshing the page', async () => {
+  const world = await mkdtemp(join(tmpdir(), 'dsh-web-hmr-world-'))
+  const sourcePath = join(REPO_ROOT, 'packages/client/ui-conversation/src/client/locales.ts')
+  const bundlePath = join(REPO_ROOT, 'packages/client/ui-conversation/lib/client.js')
+  const binPath = join(REPO_ROOT, 'apps/cli/lib/bin.js')
+  if (!existsSync(binPath)) throw new Error('HMR browser test needs the built dsh bin; run pnpm run build first')
+  const originalSource = await readFile(sourcePath)
+  const originalBundle = await readFile(bundlePath)
+  const oldText = "Let's start building"
+  const sourceNeedle = "'hero.headline': 'Let\\'s start building'"
+  const newText = `HMR UPDATED ${'x'.repeat(80)}`
+  const updatedSource = originalSource.toString().replace(sourceNeedle, `'hero.headline': '${newText}'`)
+  if (updatedSource === originalSource.toString()) throw new Error(`HMR source lacks ${JSON.stringify(sourceNeedle)}`)
+
+  const subprocessCtx = new Context()
+  let subprocessFiber: Fiber | undefined
+  let watcher: SubprocessHandle | undefined
+  let host: SubprocessHandle | undefined
+  let browser: Awaited<ReturnType<typeof chromium.launch>> | undefined
+  const failures: unknown[] = []
+  try {
+    subprocessFiber = await subprocessCtx.plugin(LocalSubprocessService)
+    watcher = subprocessCtx.subprocess.spawn(spawnSpec(['pnpm', 'run', 'dev:web'], REPO_ROOT))
+    await waitForOutput(watcher, /dev-web: watching/, 'pnpm run dev:web')
+    host = subprocessCtx.subprocess.spawn(spawnSpec(
+      [process.execPath, binPath, 'web', '--dev', '--port', '0'],
+      world,
+      {
+        DEEPSEEK_API_KEY: 'keyless-hmr-no-call',
+        DSH_HOME: join(world, '.dsh'),
+      },
+    ))
+    const baseUrl = await waitForOutput(host, /dsh web: (http:\/\/[^\s]+)/, 'built dsh web --dev')
+    browser = await chromium.launch()
+    const page = await browser.newPage()
+    const pageErrors: string[] = []
+    page.on('pageerror', error => pageErrors.push(String(error)))
+    await page.goto(baseUrl, { waitUntil: 'load' })
+    await page.getByText(oldText, { exact: true }).waitFor({ timeout: 15_000 })
+    const pageIdentity = await page.evaluate(() => {
+      const identity = crypto.randomUUID()
+      Object.defineProperty(window, '__dshHmrPageIdentity', { value: identity })
+      return identity
+    })
+
+    await writeFile(sourcePath, updatedSource)
+    await page.getByText(newText, { exact: true }).waitFor({ timeout: 30_000 })
+    expect(await page.evaluate(() => (window as Window & { __dshHmrPageIdentity?: string }).__dshHmrPageIdentity))
+      .toBe(pageIdentity)
+    expect(pageErrors).toEqual([])
+  } catch (error) {
+    failures.push(error)
+  } finally {
+    await writeFile(sourcePath, originalSource).catch((error: unknown) => failures.push(error))
+    if (watcher !== undefined) await stopTree(watcher).catch((error: unknown) => failures.push(error))
+    await writeFile(bundlePath, originalBundle).catch((error: unknown) => failures.push(error))
+    if (host !== undefined) await stopTree(host).catch((error: unknown) => failures.push(error))
+    await browser?.close().catch((error: unknown) => failures.push(error))
+    await subprocessFiber?.dispose().catch((error: unknown) => failures.push(error))
+    await rm(world, { recursive: true, force: true }).catch((error: unknown) => failures.push(error))
+  }
+  if (failures.length > 0) throw new AggregateError(failures, 'HMR browser test or cleanup failed')
+}, 120_000)

apps/web/tests/replay-round-trip.e2e.ts

@@ -9,20 +9,23 @@
 // Record: DSH_SNAPSHOT=record rewrites session.jsonl, then a keyless
 // DSH_SNAPSHOT=refresh regenerates ui.expected.md.
 import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import type { Browser, Page } from 'playwright'
 import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
-import type { SessionEvent } from '@deepseek-ai/dsh-session'
+import { CallId } from '@deepseek-ai/dsh-llm'
+import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import {
   assertFixtureInventory, captureStableAria, compareOrRefreshGolden, fixtureUserPrompts,
   launchWebScaffold, recordFixture, watchConsole, webSnapshotMode, type WebScaffold,
 } from './scaffold.ts'
-import { connectFreshWorkspace, newEnglishPage, saveFailureShot } from './support.ts'
+import { connectFreshWorkspace, newEnglishPage, REPO_ROOT, saveFailureShot } from './support.ts'
 
 const SNAPSHOT_DIR = fileURLToPath(new URL('./snapshots/fresh-round-trip', import.meta.url))
 const FIXTURE = fileURLToPath(new URL('./snapshots/fresh-round-trip/session.jsonl', import.meta.url))
 const UI_EXPECTED = fileURLToPath(new URL('./snapshots/fresh-round-trip/ui.expected.md', import.meta.url))
+const SYSTEM_PROMPT_EXPECTED = fileURLToPath(new URL('./snapshots/fresh-round-trip/system-prompt.expected.md', import.meta.url))
 const MODE = webSnapshotMode()
 
 // The scenario's one drive prompt. Record sends it; replay asserts the
@@ -35,6 +38,7 @@ describe('web e2e: fresh round trip through the real assembly', () => {
   let browser: Browser
   let page: Page
   let tripwire: ReturnType<typeof watchConsole>
+  let settledSessionId: SessionId | undefined
   const sessionEvents: SessionEvent[] = []
 
   beforeAll(async () => {
@@ -69,11 +73,44 @@ describe('web e2e: fresh round trip through the real assembly', () => {
     await input.fill(PROMPT)
     await input.press('Enter')
     const sessionId = await settled
+    settledSessionId = sessionId
     if (MODE === 'record') {
       await recordFixture(scaffold, sessionId, FIXTURE)
     }
   }, 200_000)
 
+  it('records the Web surface, source checkout, and session cwd in the request header', async () => {
+    if (settledSessionId === undefined) throw new Error('the drive turn did not publish a session id')
+    const agent = scaffold.ctx.agents.get(settledSessionId)
+    if (agent === undefined) throw new Error(`the settled Web agent ${settledSessionId} is no longer live`)
+    const system = agent.session.requestHeader()?.system
+    if (system === undefined) throw new Error('the settled Web request has no system prompt')
+    const prefix = system.split('\n\n').slice(0, 4).join('\n\n')
+      .split(REPO_ROOT).join('{{sourceRoot}}')
+      .split(join(scaffold.workspaceCwd, 'workspace')).join('{{cwd}}')
+      .split(scaffold.baseUrl).join('{{webUrl}}')
+    await compareOrRefreshGolden(SYSTEM_PROMPT_EXPECTED, prefix, MODE)
+  })
+
+  it('exposes the assembled Web URL to the real bash tool', async () => {
+    if (settledSessionId === undefined) throw new Error('the drive turn did not publish a session id')
+    const agent = scaffold.ctx.agents.get(settledSessionId)
+    if (agent === undefined) throw new Error(`the settled Web agent ${settledSessionId} is no longer live`)
+    const result = await scaffold.ctx.tools.execute({
+      signal: AbortSignal.timeout(5_000),
+      callId: CallId('web-url-probe'),
+      name: 'bash',
+      arguments: {
+        command: 'printf \'%s\\n%s\\n\' "$DSH_WEB_URL" "$DSH_WEB_MODE"',
+        description: 'Print current Web runtime',
+      },
+      agent,
+    })
+    expect(result.isError).toBe(false)
+    expect(result.content.filter(block => block.type === 'text').map(block => block.text).join(''))
+      .toBe(`${scaffold.baseUrl}\nproduction\n`)
+  })
+
   it.skipIf(MODE === 'record')('rendered the settled turn: markdown, tool row, composer restore', async () => {
     onTestFailed(() => saveFailureShot(page, 'web-e2e-round-trip-settled'))
     // Browser settled-poll after host completion (host strictly precedes render).
@@ -129,6 +166,6 @@ describe('web e2e: fresh round trip through the real assembly', () => {
   it.skipIf(MODE === 'record')('stayed clean: no pageerrors, no reconnect self-healing, no server errors', async () => {
     expect(tripwire.pageErrors).toEqual([])
     expect(tripwire.warnings).toEqual([])
-    await assertFixtureInventory(SNAPSHOT_DIR, ['session.jsonl', 'ui.expected.md'])
+    await assertFixtureInventory(SNAPSHOT_DIR, ['session.jsonl', 'system-prompt.expected.md', 'ui.expected.md'])
   })
 })

apps/web/tests/scaffold.ts

@@ -53,6 +53,7 @@ import * as ToolCordis from '@deepseek-ai/dsh-tool-cordis'
 // Empty type imports carry the httpServer/agents/sessionPersistence Context merges.
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-agent'
+import { prepareWebRuntimeContext } from '../../cli/src/web.ts'
 import { DIST_INDEX, REPO_ROOT, requireDist } from './support.ts'
 
 /** Snapshot mode for the lane, from $DSH_SNAPSHOT (same vocabulary as the ACP/TUI suites). */
@@ -300,6 +301,7 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
     // The shipped CLI deliberately has no dependency on this opt-in package.
     // Keep the Loader row real without broadening the product installation.
     if (options.cordisTools === true) ctx.loader.builtins['tool-cordis'] = ToolCordis
+    prepareWebRuntimeContext(ctx, REPO_ROOT, 'production')
     await ctx.loader.create({
       name: 'cordis:include',
       config: { path: pathToFileURL(resolve(CONFIG_PATH)).href, patches },

apps/web/tests/smoke-real.e2e.ts

@@ -26,6 +26,8 @@ import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
 import { REPO_ROOT, connectFreshWorkspace, newEnglishPage, probeFreePort, requireDist, saveFailureShot } from './support.ts'
 
+const DEVELOPMENT_PROMPT = fileURLToPath(new URL('./snapshots/web-runtime-context/development-prompt.expected.md', import.meta.url))
+
 function waitForReadyLine(child: ChildProcess): Promise<string> {
   return new Promise((resolveReady, reject) => {
     let out = ''
@@ -184,7 +186,7 @@ describe('dsh web keyless CLI smoke', () => {
     }
   })
 
-  it('injects the invoking workspace AGENTS.md into the provider request', async () => {
+  it('routes --dev runtime context and workspace instructions through the real CLI request', async () => {
     requireDist()
     const workspace = mkdtempSync(join(tmpdir(), 'dsh-web-workspace-'))
     mkdirSync(join(workspace, '.git'))
@@ -220,7 +222,7 @@ describe('dsh web keyless CLI smoke', () => {
     const tsxLoader = pathToFileURL(createRequire(join(REPO_ROOT, 'package.json')).resolve('tsx')).href
     const child = spawn(
       process.execPath,
-      ['--import', tsxLoader, join(REPO_ROOT, 'apps/cli/src/bin.ts'), 'web', '--port', '0'],
+      ['--import', tsxLoader, join(REPO_ROOT, 'apps/cli/src/bin.ts'), 'web', '--port', '0', '--dev'],
       {
         cwd: workspace,
         env: {
@@ -252,6 +254,10 @@ describe('dsh web keyless CLI smoke', () => {
         message.role === 'user' && message.content?.includes('<available_skills>'))).toBe(false)
       const workspaceMessage = captured.messages?.find(message =>
         message.role === 'user' && message.content?.includes('web-workspace-context-probe'))
+      const systemMessage = captured.messages?.find(message => message.role === 'system')
+      const expectedWebSection = readFileSync(DEVELOPMENT_PROMPT, 'utf8').trimEnd()
+        .replace('{{webUrl}}', baseUrl)
+      expect(systemMessage?.content).toContain(expectedWebSection)
       expect(workspaceMessage).toMatchInlineSnapshot(`
         {
           "content": "<system-reminder>

apps/web/tests/snapshots/fresh-round-trip/system-prompt.expected.md

@@ -0,0 +1,7 @@
+You are an AI agent powered by the DeepSeek Harness SDK.
+
+The DeepSeek Harness implementation checkout is at {{sourceRoot}}. The checkout location and current working directory are separate values and may differ; never infer the working directory from this path. Use pwd to determine the current working directory. Use this checkout only to inspect or extend DSH itself.
+
+You are interacting with the user through the DeepSeek Harness Web GUI at {{webUrl}}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. This Web process was launched without `--dev`, so HMR is inactive: rebuild the affected Web artifacts and verify this existing URL after a page refresh. If the user wants no-refresh client-plugin updates, explain that this GUI must be restarted with `dsh web --dev` and `pnpm run dev:web` must also run from this same checkout; do not present either command alone as sufficient. Starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background task and verify its exact URL.
+
+You are a coding agent powered by the deepseek-v4-flash model. Your working directory is {{cwd}}.

apps/web/tests/snapshots/web-runtime-context/development-prompt.expected.md

@@ -0,0 +1 @@
+You are interacting with the user through the DeepSeek Harness Web GUI at {{webUrl}}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. This Web process was launched with `dsh web --dev`, so its client-plugin HMR receiver is active. No-refresh updates occur only when `pnpm run dev:web` is also running from this same checkout to rebuild client-plugin bundles; verify that watcher before promising automatic updates. Client-plugin changes then reload automatically, while apps/web shell and other plain-package changes still require a rebuild and page refresh. Starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background task and verify its exact URL.

apps/web/tests/support/listen-probe.mjs

@@ -0,0 +1,9 @@
+import { appendFileSync } from 'node:fs'
+import { Server } from 'node:net'
+
+const marker = process.env.DSH_LISTEN_PROBE_MARKER
+const listen = Server.prototype.listen
+Server.prototype.listen = function (...args) {
+  if (marker !== undefined) appendFileSync(marker, 'listen\n')
+  return listen.apply(this, args)
+}

apps/web/tests/vite-entry.e2e.ts

@@ -0,0 +1,63 @@
+/** Bare Vite must fail before it can present a bootless shell as a working GUI. */
+
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { join } from 'node:path'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { createServer } from 'node:net'
+import { execa } from 'execa'
+import { describe, expect, it } from 'vitest'
+
+const WEB_ROOT = fileURLToPath(new URL('..', import.meta.url))
+
+/** Reserve an available loopback port, then release it for the child invocation. */
+async function freePort(): Promise<number> {
+  const server = createServer()
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('port probe returned no address')
+  await new Promise<void>((resolve, reject) => server.close((error) => {
+    if (error === undefined) resolve()
+    else reject(error)
+  }))
+  return address.port
+}
+
+describe('Web development entry', () => {
+  it('rejects the package dev alias with the full-host correction', async () => {
+    const result = await execa('pnpm', ['run', 'dev'], { cwd: WEB_ROOT, reject: false })
+    expect(result.exitCode).not.toBe(0)
+    expect(result.stderr).toContain('apps/web is not a standalone application')
+    expect(result.stderr).toContain('dsh web')
+  })
+
+  it('rejects the standalone Vite server with the full-host correction', async () => {
+    const probeRoot = mkdtempSync(join(tmpdir(), 'dsh-vite-listen-probe-'))
+    const marker = join(probeRoot, 'listen-called')
+    const port = await freePort()
+    try {
+      const probeModule = fileURLToPath(new URL('./support/listen-probe.mjs', import.meta.url))
+      const result = await execa(join(WEB_ROOT, 'node_modules/.bin/vite'), ['--host', '127.0.0.1', '--port', String(port)], {
+        cwd: WEB_ROOT,
+        reject: false,
+        timeout: 10_000,
+        env: {
+          ...process.env,
+          DSH_LISTEN_PROBE_MARKER: marker,
+          NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --import ${pathToFileURL(probeModule).href}`.trim(),
+        },
+      })
+      expect(result.timedOut).toBe(false)
+      expect(result.exitCode).not.toBe(0)
+      expect(result.stderr).toContain('apps/web is not a standalone application')
+      expect(result.stderr).toContain('dsh web')
+      expect(result.stderr).toContain('window.__DSH_BOOT__')
+      expect(existsSync(marker), 'Vite called Server.listen before rejecting standalone serve mode').toBe(false)
+    } finally {
+      rmSync(probeRoot, { recursive: true, force: true })
+    }
+  })
+})

apps/web/tsconfig.json

@@ -38,6 +38,7 @@
     "tests/onboarding-deepseek-config.e2e.ts",
     "tests/workspace-management.e2e.ts",
     "tests/replay-round-trip.e2e.ts",
+    "tests/hmr-live.e2e.ts",
     "tests/seeded-history.e2e.ts",
     "tests/sidebar-scrollbar.e2e.ts",
     "tests/code-mode-round.e2e.ts",

apps/web/vite.config.ts

@@ -1,11 +1,25 @@
 import { fileURLToPath } from 'node:url'
 import { defineConfig } from 'vite'
+import type { Plugin } from 'vite'
 import react from '@vitejs/plugin-react'
 
 const src = (rel: string): string => fileURLToPath(new URL(rel, import.meta.url))
+const STANDALONE_ERROR = 'apps/web is not a standalone application: bare Vite cannot inject window.__DSH_BOOT__. '
+  + 'Build with `pnpm run build && pnpm run build:web`, then run `dsh web` (repository checkout: `pnpm run dsh -- web`). '
+  + 'For client-plugin HMR, run `pnpm run dsh -- web --dev` together with `pnpm run dev:web`.'
+
+/** Fail before a Vite dev or preview server can expose the boot-manifest-free shell. */
+function rejectStandaloneServe(): Plugin {
+  return {
+    name: 'dsh-reject-standalone-web-serve',
+    config(_config, env) {
+      if (env.command === 'serve') throw new Error(STANDALONE_ERROR)
+    },
+  }
+}
 
 export default defineConfig({
-  plugins: [react()],
+  plugins: [rejectStandaloneServe(), react()],
   resolve: {
     // Workspace packages resolve to SOURCE: package.json exports point at lib
     // for Node/type consumers, but the browser bundle must compile src directly