refactor(gui): host graph from dshClient discovery; webserver self-watches bundles for HMR

The registry scans mounted Loader entries' dshClient declarations and
composes __DSH_BOOT__ {rev, entries} — inject edges and the immediately
mark come from manifests, never hand-copied; malformed fields fail loud
at load. The composing app owns one flat roster plus the --dev switch
(hmr row and bundle watching are dev-graph decisions).

The rebuild signal is the webserver's own observation: in dev mode the
registry stat-polls each scanned bundle (fs.watchFile; polling because
network mounts deliver no inotify), re-hashes on change, and broadcasts
a rebuilt frame on the /plugins/events SSE channel only when the rev
actually changed. Watch membership follows the table across rescans;
dispose drops all watches; a torn read self-heals on the next tick.
The POST /plugins/rebuilt endpoint is gone — builders and the host
share zero protocol. dsh web --dev logs the watched bundle list and
each rebuilt id with its rev transition.

apps/cli/package.json

@@ -14,6 +14,15 @@
   "license": "BSD-3-Clause",
   "dependencies": {
     "@deepseek-ai/dsh-app-boot": "workspace:^",
+    "@deepseek-ai/dsh-client-connection": "workspace:^",
+    "@deepseek-ai/dsh-client-hmr": "workspace:^",
+    "@deepseek-ai/dsh-client-i18n": "workspace:^",
+    "@deepseek-ai/dsh-client-runtime": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-conversation": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-layout": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-sidebar": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-theme": "workspace:^",
+    "@deepseek-ai/dsh-client-ui-trajectory": "workspace:^",
     "@deepseek-ai/dsh-frontend": "workspace:^",
     "@deepseek-ai/dsh-host-apiproxy": "workspace:^",
     "@deepseek-ai/dsh-host-runtime": "workspace:^",

apps/cli/src/web.ts

@@ -13,12 +13,40 @@ import { createHostWebPluginRegistry, startWebServer } from '@deepseek-ai/dsh-ho
 const LOOPBACK_HOST = '127.0.0.1'
 const ALL_INTERFACES_HOST = '0.0.0.0'
 
+// --- Client composition (composition decisions live in the composing app) ---
+// The composition layer owns one decision: which plugin packages mount (the
+// roster). Dependency edges and the boot prefetch tier live in each package's
+// dshClient declaration.
+
+/**
+ * Dev-only plugin: the client HMR driver. Whether it composes in is a
+ * deployment decision — the dev graph includes its row, the prod graph does
+ * not mount it at all.
+ */
+const CLIENT_HMR_ID = '@deepseek-ai/dsh-client-hmr'
+
+/** Bundle stat-poll interval for --dev (held here so the startup log states the real value). */
+const CLIENT_BUNDLE_POLL_MS = 500
+
+/** The client plugin roster (flat; per-row boot behavior comes from manifests). */
+const CLIENT_PACKAGES = [
+  '@deepseek-ai/dsh-client-connection',
+  '@deepseek-ai/dsh-client-runtime',
+  '@deepseek-ai/dsh-client-ui-theme',
+  '@deepseek-ai/dsh-client-i18n',
+  '@deepseek-ai/dsh-client-ui-layout',
+  '@deepseek-ai/dsh-client-ui-sidebar',
+  '@deepseek-ai/dsh-client-ui-conversation',
+  '@deepseek-ai/dsh-client-ui-trajectory',
+] as const
+
 export async function runWeb(argv: string[]): Promise<void> {
   const { values } = parseArgs({
     args: argv,
     options: {
       host: { type: 'string', default: LOOPBACK_HOST },
       port: { type: 'string', default: '3080' },
+      dev: { type: 'boolean', default: false },
     },
     allowPositionals: false,
   })
@@ -44,15 +72,37 @@ export async function runWeb(argv: string[]): Promise<void> {
     },
   })
 
-  // Web UI plugin chain: in-memory Loader tree over the eight UI packages,
-  // then the registry that feeds __DSH_BOOT__ and /plugins/<id>/client.js.
-  const mounted = await mountWebPlugins(host.ctx)
+  // Client plugin chain: in-memory Loader tree over the composed roster, then
+  // the registry that feeds the __DSH_BOOT__ entry graph and
+  // /plugins/<id>/client.js. All row content comes from dshClient discovery
+  // over the mounted roster (dev adds the HMR driver row and turns on the
+  // bundle watch that drives rebuilt frames).
+  const roster = [...CLIENT_PACKAGES, ...values.dev ? [CLIENT_HMR_ID] : []]
+  const mounted = await mountWebPlugins(host.ctx, roster, import.meta.url)
   const webPlugins = createHostWebPluginRegistry({
     ctx: host.ctx,
     loader: mounted.loader,
     resolvePkgJson: mounted.resolvePkgJson,
     onError: (err: Error) => { process.stderr.write(`dsh web: plugin rescan: ${String(err)}\n`) },
+    ...values.dev ? { watch: { intervalMs: CLIENT_BUNDLE_POLL_MS } } : {},
   })
+  if (values.dev) {
+    // Dev visibility (the registry is a library and never prints): list what
+    // the bundle watch covers, then log every observed rebuild. This is a
+    // second onRebuilt subscription — the SSE relay inside the webserver is
+    // unaffected (multicast).
+    const revs = new Map(webPlugins.graph().entries.map(row => [row.id, row.rev]))
+    const bundlePaths = [...revs.keys()]
+      .map(id => webPlugins.clientPath(id))
+      .filter((path): path is string => path !== undefined)
+    console.log(
+      `dsh web: watching ${String(bundlePaths.length)} plugin bundles (${String(CLIENT_BUNDLE_POLL_MS)}ms poll):\n  ${bundlePaths.join('\n  ')}`,
+    )
+    webPlugins.onRebuilt((id, rev) => {
+      console.log(`dsh web: plugin rebuilt: ${id} rev ${revs.get(id) ?? '?'} -> ${rev}`)
+      revs.set(id, rev)
+    })
+  }
   // Published so the webserver invariant companion can audit manifest/bundle
   // consistency; nothing else reads this key.
   host.ctx.reflect.provide('webPlugins', webPlugins)

apps/cli/tsconfig.json

@@ -14,6 +14,15 @@
     { "path": "../../packages/host/webserver" },
     { "path": "../../packages/core/session" },
     { "path": "../../packages/ui/app-boot" },
-    { "path": "../../packages/util/paths" }
+    { "path": "../../packages/util/paths" },
+    { "path": "../../packages/client/connection" },
+    { "path": "../../packages/client/hmr" },
+    { "path": "../../packages/client/runtime" },
+    { "path": "../../packages/client/ui-theme" },
+    { "path": "../../packages/client/i18n" },
+    { "path": "../../packages/client/ui-layout" },
+    { "path": "../../packages/client/ui-sidebar" },
+    { "path": "../../packages/client/ui-conversation" },
+    { "path": "../../packages/client/ui-trajectory" }
   ]
 }