fix(web): verify current GUI updates end to end

apps/web/tests/hmr-live.e2e.ts

@@ -0,0 +1,132 @@
+/** Published dsh web --dev + pnpm dev:web → browser HMR, with no page reload. */
+
+import { existsSync } from 'node:fs'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { chromium } from 'playwright'
+import { expect, it } from 'vitest'
+import { Context } from 'cordis'
+import type { Fiber } from 'cordis'
+import LocalSubprocessService from '@deepseek-ai/dsh-subprocess-local'
+import type { SubprocessHandle, SubprocessSpawnSpec } from '@deepseek-ai/dsh-subprocess'
+import { REPO_ROOT } from './support.ts'
+
+function spawnSpec(argv: readonly string[], cwd: string, env?: Record<string, string>): SubprocessSpawnSpec {
+  return {
+    argv,
+    cwd,
+    stdio: { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
+    graceMs: 5_000,
+    ...env === undefined ? {} : { env },
+  }
+}
+
+function waitForOutput(child: SubprocessHandle, pattern: RegExp, label: string): Promise<string> {
+  return new Promise((resolveReady, reject) => {
+    let output = ''
+    let settled = false
+    const cleanup = (): void => {
+      clearTimeout(timer)
+      child.stdout?.off('data', onData)
+      child.stderr?.off('data', onData)
+    }
+    const resolveOnce = (value: string): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      resolveReady(value)
+    }
+    const rejectOnce = (error: Error): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      reject(error)
+    }
+    const onData = (chunk: Buffer): void => {
+      output += chunk.toString()
+      const match = pattern.exec(output)
+      if (match === null) return
+      resolveOnce(match[1] ?? match[0])
+    }
+    const timer = setTimeout(() => { rejectOnce(new Error(`${label} not ready:\n${output}`)) }, 60_000)
+    child.stdout?.on('data', onData)
+    child.stderr?.on('data', onData)
+    void child.done.then((outcome) => {
+      rejectOnce(new Error(`${label} exited before ready (${JSON.stringify(outcome)}):\n${output}`))
+    }, (error: unknown) => {
+      rejectOnce(new Error(`${label} failed before ready:\n${output}`, { cause: error }))
+    })
+  })
+}
+
+async function stopTree(child: SubprocessHandle): Promise<void> {
+  child.terminate()
+  const stopped = await child.waitForExit(AbortSignal.timeout(15_000))
+  if (!stopped) throw new Error(`process tree ${String(child.pid)} did not stop after termination escalation`)
+  await child.done
+}
+
+it('hot-reloads a real client-plugin source edit without refreshing the page', async () => {
+  const world = await mkdtemp(join(tmpdir(), 'dsh-web-hmr-world-'))
+  const sourcePath = join(REPO_ROOT, 'packages/client/ui-conversation/src/client/skeleton/EmptyHero.tsx')
+  const bundlePath = join(REPO_ROOT, 'packages/client/ui-conversation/lib/client.js')
+  const binPath = join(REPO_ROOT, 'apps/cli/lib/bin.js')
+  if (!existsSync(binPath)) throw new Error('HMR browser test needs the built dsh bin; run pnpm run build first')
+  const originalSource = await readFile(sourcePath)
+  const originalBundle = await readFile(bundlePath)
+  const oldText = "Let's start building"
+  const sourceNeedle = 'Let&apos;s start building'
+  const newText = `HMR UPDATED ${'x'.repeat(80)}`
+  const updatedSource = originalSource.toString().replace(sourceNeedle, newText)
+  if (updatedSource === originalSource.toString()) throw new Error(`HMR source lacks ${JSON.stringify(sourceNeedle)}`)
+
+  const subprocessCtx = new Context()
+  let subprocessFiber: Fiber | undefined
+  let watcher: SubprocessHandle | undefined
+  let host: SubprocessHandle | undefined
+  let browser: Awaited<ReturnType<typeof chromium.launch>> | undefined
+  const failures: unknown[] = []
+  try {
+    subprocessFiber = await subprocessCtx.plugin(LocalSubprocessService)
+    watcher = subprocessCtx.subprocess.spawn(spawnSpec(['pnpm', 'run', 'dev:web'], REPO_ROOT))
+    await waitForOutput(watcher, /dev-web: watching/, 'pnpm run dev:web')
+    host = subprocessCtx.subprocess.spawn(spawnSpec(
+      [process.execPath, binPath, 'web', '--dev', '--port', '0'],
+      world,
+      {
+        DEEPSEEK_API_KEY: 'keyless-hmr-no-call',
+        DSH_HOME: join(world, '.dsh'),
+      },
+    ))
+    const baseUrl = await waitForOutput(host, /dsh web: (http:\/\/[^\s]+)/, 'built dsh web --dev')
+    browser = await chromium.launch()
+    const page = await browser.newPage()
+    const pageErrors: string[] = []
+    page.on('pageerror', error => pageErrors.push(String(error)))
+    await page.goto(baseUrl, { waitUntil: 'load' })
+    await page.getByText(oldText, { exact: true }).waitFor({ timeout: 15_000 })
+    const pageIdentity = await page.evaluate(() => {
+      const identity = crypto.randomUUID()
+      Object.defineProperty(window, '__dshHmrPageIdentity', { value: identity })
+      return identity
+    })
+
+    await writeFile(sourcePath, updatedSource)
+    await page.getByText(newText, { exact: true }).waitFor({ timeout: 30_000 })
+    expect(await page.evaluate(() => (window as Window & { __dshHmrPageIdentity?: string }).__dshHmrPageIdentity))
+      .toBe(pageIdentity)
+    expect(pageErrors).toEqual([])
+  } catch (error) {
+    failures.push(error)
+  } finally {
+    await writeFile(sourcePath, originalSource).catch((error: unknown) => failures.push(error))
+    if (watcher !== undefined) await stopTree(watcher).catch((error: unknown) => failures.push(error))
+    await writeFile(bundlePath, originalBundle).catch((error: unknown) => failures.push(error))
+    if (host !== undefined) await stopTree(host).catch((error: unknown) => failures.push(error))
+    await browser?.close().catch((error: unknown) => failures.push(error))
+    await subprocessFiber?.dispose().catch((error: unknown) => failures.push(error))
+    await rm(world, { recursive: true, force: true }).catch((error: unknown) => failures.push(error))
+  }
+  if (failures.length > 0) throw new AggregateError(failures, 'HMR browser test or cleanup failed')
+}, 120_000)

apps/web/tests/replay-round-trip.e2e.ts

@@ -101,14 +101,14 @@ describe('web e2e: fresh round trip through the real assembly', () => {
       callId: CallId('web-url-probe'),
       name: 'bash',
       arguments: {
-        command: 'printf \'%s\\n\' "$DSH_WEB_URL"',
-        description: 'Print current Web URL',
+        command: 'printf \'%s\\n%s\\n\' "$DSH_WEB_URL" "$DSH_WEB_MODE"',
+        description: 'Print current Web runtime',
       },
       agent,
     })
     expect(result.isError).toBe(false)
     expect(result.content.filter(block => block.type === 'text').map(block => block.text).join(''))
-      .toBe(`${scaffold.baseUrl}\n`)
+      .toBe(`${scaffold.baseUrl}\nproduction\n`)
   })
 
   it.skipIf(MODE === 'record')('rendered the settled turn: markdown, tool row, composer restore', async () => {

apps/web/tests/scaffold.ts

@@ -208,7 +208,7 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
       throw new Error('web e2e scaffold: httpServer service missing after settled boot')
     }
     port = boundPort
-    installWebPromptContext(ctx, REPO_ROOT, `http://127.0.0.1:${String(port)}`)
+    installWebPromptContext(ctx, REPO_ROOT, `http://127.0.0.1:${String(port)}`, 'production')
 
     // Fill the open llm seam on the settled root ctx (llm-deepseek is disabled
     // in keyless modes; a scenario with no fixture leaves the seam empty so a

apps/web/tests/smoke-real.e2e.ts

@@ -20,12 +20,14 @@ import { createServer } from 'node:http'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 import type { Browser, Page } from 'playwright'
 import { chromium } from 'playwright'
 import { afterAll, beforeAll, describe, expect, it, onTestFailed } from 'vitest'
 import { REPO_ROOT, connectFreshWorkspace, probeFreePort, requireDist, saveFailureShot } from './support.ts'
 
+const DEVELOPMENT_PROMPT = fileURLToPath(new URL('./snapshots/web-runtime-context/development-prompt.expected.md', import.meta.url))
+
 function waitForReadyLine(child: ChildProcess): Promise<string> {
   return new Promise((resolveReady, reject) => {
     let out = ''
@@ -180,7 +182,7 @@ describe('dsh web keyless CLI smoke', () => {
     }
   })
 
-  it('injects the invoking workspace AGENTS.md into the provider request', async () => {
+  it('routes --dev runtime context and workspace instructions through the real CLI request', async () => {
     requireDist()
     const workspace = mkdtempSync(join(tmpdir(), 'dsh-web-workspace-'))
     mkdirSync(join(workspace, '.git'))
@@ -212,7 +214,7 @@ describe('dsh web keyless CLI smoke', () => {
     const tsxLoader = pathToFileURL(createRequire(join(REPO_ROOT, 'package.json')).resolve('tsx')).href
     const child = spawn(
       process.execPath,
-      ['--import', tsxLoader, join(REPO_ROOT, 'apps/cli/src/bin.ts'), 'web', '--port', '0'],
+      ['--import', tsxLoader, join(REPO_ROOT, 'apps/cli/src/bin.ts'), 'web', '--port', '0', '--dev'],
       {
         cwd: workspace,
         env: {
@@ -241,6 +243,10 @@ describe('dsh web keyless CLI smoke', () => {
       ])
       const workspaceMessage = captured.messages?.find(message =>
         message.role === 'user' && message.content?.includes('web-workspace-context-probe'))
+      const systemMessage = captured.messages?.find(message => message.role === 'system')
+      const expectedWebSection = readFileSync(DEVELOPMENT_PROMPT, 'utf8').trimEnd()
+        .replace('{{webUrl}}', baseUrl)
+      expect(systemMessage?.content).toContain(expectedWebSection)
       expect(workspaceMessage).toMatchInlineSnapshot(`
         {
           "content": "<system-reminder>

apps/web/tests/snapshots/fresh-round-trip/system-prompt.expected.md

@@ -2,6 +2,6 @@ You are an AI agent powered by the DeepSeek Harness SDK.
 
 Your own source code is the checkout at {{sourceRoot}}; you can read it there to learn how dsh works and how to extend it.
 
-You are interacting with the user through the DeepSeek Harness Web GUI at {{webUrl}}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. For changes to this GUI, rebuild the affected Web artifacts and verify this existing URL after a refresh; starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background task and verify its exact URL.
+You are interacting with the user through the DeepSeek Harness Web GUI at {{webUrl}}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. This Web process was launched without `--dev`, so HMR is inactive: rebuild the affected Web artifacts and verify this existing URL after a page refresh. If the user wants no-refresh client-plugin updates, explain that this GUI must be restarted with `dsh web --dev` and `pnpm run dev:web` must also run from this same checkout; do not present either command alone as sufficient. Starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background task and verify its exact URL.
 
 You are a coding agent powered by the deepseek-v4-flash model. Your working directory is {{cwd}}.

apps/web/tests/snapshots/web-runtime-context/development-prompt.expected.md

@@ -0,0 +1 @@
+You are interacting with the user through the DeepSeek Harness Web GUI at {{webUrl}}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. This Web process was launched with `dsh web --dev`, so its client-plugin HMR receiver is active. No-refresh updates occur only when `pnpm run dev:web` is also running from this same checkout to rebuild client-plugin bundles; verify that watcher before promising automatic updates. Client-plugin changes then reload automatically, while apps/web shell and other plain-package changes still require a rebuild and page refresh. Starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background task and verify its exact URL.

apps/web/tests/support/listen-probe.mjs

@@ -0,0 +1,9 @@
+import { appendFileSync } from 'node:fs'
+import { Server } from 'node:net'
+
+const marker = process.env.DSH_LISTEN_PROBE_MARKER
+const listen = Server.prototype.listen
+Server.prototype.listen = function (...args) {
+  if (marker !== undefined) appendFileSync(marker, 'listen\n')
+  return listen.apply(this, args)
+}

apps/web/tests/vite-entry.e2e.ts

@@ -1,7 +1,9 @@
 /** Bare Vite must fail before it can present a bootless shell as a working GUI. */
 
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 import { join } from 'node:path'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
 import { createServer } from 'node:net'
 import { execa } from 'execa'
 import { describe, expect, it } from 'vitest'
@@ -28,29 +30,34 @@ describe('Web development entry', () => {
   it('rejects the package dev alias with the full-host correction', async () => {
     const result = await execa('pnpm', ['run', 'dev'], { cwd: WEB_ROOT, reject: false })
     expect(result.exitCode).not.toBe(0)
-    expect(result.stderr).toContain('apps/web is build-only')
+    expect(result.stderr).toContain('apps/web is not a standalone application')
     expect(result.stderr).toContain('dsh web')
   })
 
   it('rejects the standalone Vite server with the full-host correction', async () => {
+    const probeRoot = mkdtempSync(join(tmpdir(), 'dsh-vite-listen-probe-'))
+    const marker = join(probeRoot, 'listen-called')
     const port = await freePort()
-    const result = await execa(join(WEB_ROOT, 'node_modules/.bin/vite'), ['--host', '127.0.0.1', '--port', String(port)], {
-      cwd: WEB_ROOT,
-      reject: false,
-      timeout: 10_000,
-    })
-    expect(result.timedOut).toBe(false)
-    expect(result.exitCode).not.toBe(0)
-    expect(result.stderr).toContain('apps/web is not a standalone application')
-    expect(result.stderr).toContain('dsh web')
-    expect(result.stderr).toContain('window.__DSH_BOOT__')
-    await expect(new Promise<void>((resolve, reject) => {
-      const probe = createServer()
-      probe.once('error', reject)
-      probe.listen(port, '127.0.0.1', () => probe.close((error) => {
-        if (error === undefined) resolve()
-        else reject(error)
-      }))
-    })).resolves.toBeUndefined()
+    try {
+      const probeModule = fileURLToPath(new URL('./support/listen-probe.mjs', import.meta.url))
+      const result = await execa(join(WEB_ROOT, 'node_modules/.bin/vite'), ['--host', '127.0.0.1', '--port', String(port)], {
+        cwd: WEB_ROOT,
+        reject: false,
+        timeout: 10_000,
+        env: {
+          ...process.env,
+          DSH_LISTEN_PROBE_MARKER: marker,
+          NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --import ${pathToFileURL(probeModule).href}`.trim(),
+        },
+      })
+      expect(result.timedOut).toBe(false)
+      expect(result.exitCode).not.toBe(0)
+      expect(result.stderr).toContain('apps/web is not a standalone application')
+      expect(result.stderr).toContain('dsh web')
+      expect(result.stderr).toContain('window.__DSH_BOOT__')
+      expect(existsSync(marker), 'Vite called Server.listen before rejecting standalone serve mode').toBe(false)
+    } finally {
+      rmSync(probeRoot, { recursive: true, force: true })
+    }
   })
 })