fix(web): close the GUI update feedback loop

apps/web/package.json

@@ -10,7 +10,7 @@
   },
   "scripts": {
     "build": "vite build",
-    "dev": "vite",
+    "dev": "node -e \"console.error('apps/web is build-only; run dsh web or dsh web --dev with pnpm run dev:web') ; process.exit(1)\"",
     "watch": "vite build --watch"
   },
   "license": "BSD-3-Clause",

apps/web/tests/replay-round-trip.e2e.ts

@@ -14,6 +14,7 @@ import { fileURLToPath } from 'node:url'
 import type { Browser, Page } from 'playwright'
 import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
+import { CallId } from '@deepseek-ai/dsh-llm'
 import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import {
   assertFixtureInventory, captureStableAria, compareOrRefreshGolden, fixtureUserPrompts,
@@ -87,9 +88,29 @@ describe('web e2e: fresh round trip through the real assembly', () => {
     const prefix = system.split('\n\n').slice(0, 4).join('\n\n')
       .split(REPO_ROOT).join('{{sourceRoot}}')
       .split(join(scaffold.workspaceCwd, 'workspace')).join('{{cwd}}')
+      .split(scaffold.baseUrl).join('{{webUrl}}')
     await compareOrRefreshGolden(SYSTEM_PROMPT_EXPECTED, prefix, MODE)
   })
 
+  it('exposes the assembled Web URL to the real bash tool', async () => {
+    if (settledSessionId === undefined) throw new Error('the drive turn did not publish a session id')
+    const agent = scaffold.ctx.agents.get(settledSessionId)
+    if (agent === undefined) throw new Error(`the settled Web agent ${settledSessionId} is no longer live`)
+    const result = await scaffold.ctx.tools.execute({
+      signal: AbortSignal.timeout(5_000),
+      callId: CallId('web-url-probe'),
+      name: 'bash',
+      arguments: {
+        command: 'printf \'%s\\n\' "$DSH_WEB_URL"',
+        description: 'Print current Web URL',
+      },
+      agent,
+    })
+    expect(result.isError).toBe(false)
+    expect(result.content.filter(block => block.type === 'text').map(block => block.text).join(''))
+      .toBe(`${scaffold.baseUrl}\n`)
+  })
+
   it.skipIf(MODE === 'record')('rendered the settled turn: markdown, tool row, composer restore', async () => {
     onTestFailed(() => saveFailureShot(page, 'web-e2e-round-trip-settled'))
     // Browser settled-poll after host completion (host strictly precedes render).

apps/web/tests/scaffold.ts

@@ -203,12 +203,12 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
     })
     await ctx.loader.await()
     assertEntriesLoaded(ctx, 'web e2e scaffold')
-    installWebPromptContext(ctx, REPO_ROOT)
     const boundPort = ctx.get('httpServer')?.port
     if (boundPort === undefined) {
       throw new Error('web e2e scaffold: httpServer service missing after settled boot')
     }
     port = boundPort
+    installWebPromptContext(ctx, REPO_ROOT, `http://127.0.0.1:${String(port)}`)
 
     // Fill the open llm seam on the settled root ctx (llm-deepseek is disabled
     // in keyless modes; a scenario with no fixture leaves the seam empty so a

apps/web/tests/snapshots/fresh-round-trip/system-prompt.expected.md

@@ -2,6 +2,6 @@ You are an AI agent powered by the DeepSeek Harness SDK.
 
 Your own source code is the checkout at {{sourceRoot}}; you can read it there to learn how dsh works and how to extend it.
 
-You are interacting with the user through the DeepSeek Harness Web GUI. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context.
+You are interacting with the user through the DeepSeek Harness Web GUI at {{webUrl}}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. For changes to this GUI, rebuild the affected Web artifacts and verify this existing URL after a refresh; starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background task and verify its exact URL.
 
 You are a coding agent powered by the deepseek-v4-flash model. Your working directory is {{cwd}}.

apps/web/tests/vite-entry.e2e.ts

@@ -0,0 +1,29 @@
+/** Bare Vite must fail before it can present a bootless shell as a working GUI. */
+
+import { fileURLToPath } from 'node:url'
+import { join } from 'node:path'
+import { execa } from 'execa'
+import { describe, expect, it } from 'vitest'
+
+const WEB_ROOT = fileURLToPath(new URL('..', import.meta.url))
+
+describe('Web development entry', () => {
+  it('rejects the package dev alias with the full-host correction', async () => {
+    const result = await execa('pnpm', ['run', 'dev'], { cwd: WEB_ROOT, reject: false })
+    expect(result.exitCode).not.toBe(0)
+    expect(result.stderr).toContain('apps/web is build-only')
+    expect(result.stderr).toContain('dsh web')
+  })
+
+  it('rejects the standalone Vite server with the full-host correction', async () => {
+    const result = await execa(join(WEB_ROOT, 'node_modules/.bin/vite'), ['--host', '127.0.0.1', '--port', '0'], {
+      cwd: WEB_ROOT,
+      reject: false,
+      timeout: 2_000,
+    })
+    expect(result.exitCode).not.toBe(0)
+    expect(result.stderr).toContain('apps/web is not a standalone application')
+    expect(result.stderr).toContain('dsh web')
+    expect(result.stderr).toContain('window.__DSH_BOOT__')
+  })
+})

apps/web/vite.config.ts

@@ -1,11 +1,26 @@
 import { fileURLToPath } from 'node:url'
 import { defineConfig } from 'vite'
+import type { Plugin } from 'vite'
 import react from '@vitejs/plugin-react'
 
 const src = (rel: string): string => fileURLToPath(new URL(rel, import.meta.url))
+const STANDALONE_ERROR = 'apps/web is not a standalone application: bare Vite cannot inject window.__DSH_BOOT__. '
+  + 'Build with `pnpm run build && pnpm run build:web`, then run `dsh web` (repository checkout: `pnpm run dsh -- web`). '
+  + 'For client-plugin HMR, run `pnpm run dsh -- web --dev` together with `pnpm run dev:web`.'
+
+/** Fail before a Vite dev or preview server can expose the boot-manifest-free shell. */
+function rejectStandaloneServe(): Plugin {
+  const reject = (): never => { throw new Error(STANDALONE_ERROR) }
+  return {
+    name: 'dsh-reject-standalone-web-serve',
+    apply: 'serve',
+    configureServer: reject,
+    configurePreviewServer: reject,
+  }
+}
 
 export default defineConfig({
-  plugins: [react()],
+  plugins: [rejectStandaloneServe(), react()],
   resolve: {
     // Workspace packages resolve to SOURCE: package.json exports point at lib
     // for Node/type consumers, but the browser bundle must compile src directly