feat: support DSH 0.2.0-rc.2

[jarvisluk]

Summary

Adapts the plugin to DeepSeek Harness 0.2.0-rc.2 and bumps it to 0.6.0.

API migration

• Bumps all DSH client packages to 0.2.0-rc.2 (cordis ^4.0.4). The removed dsh-client-runtime is replaced by the split services:
  • ctx.workspaces (Workspace Controller)
  • ctx.sessions (Session Controller)
  • ctx.uiWorkspace (blank-Session connection, navigation and archival)
• The Session list no longer has a current field, so the open Session is now detected by its mainView reference (retainedBy.mainView). The leftover sweep waits for the Workspace list phase to be ready (was baselinesReady).
• Switches to the renamed *Regular primitive icons.

Runtime issues found on a real DSH 0.2.0-rc.2

• Host endpoints: in 0.2.0-rc.2, connection.rpc.handle looks up webServer on the Connection plugin's own fiber, so it fails for any third-party caller (cannot get property "webServer" without inject). The three filesystem endpoints are now exact Fetch routes (connection.fetch.register) under the shared /api channel. That channel already applies DSH's Host/Origin fence and browser authentication. The browser half still calls rpc.call; the Host decodes and answers Connection's envelope itself.
• Directory-flow hole: in 0.2 a hole can be declared by only one entry, and an entry can only render holes it declared. The built-in picker owns conversation.hero.workspace.directoryFlow, so the shadowing picker now declares its own dsh-projectless-session.directoryFlow and mirrors the occupant of DSH's hole into it. Add workspace… keeps using the native chooser or the in-app browser.

Docs

README, CHANGELOG, SECURITY and CONTRIBUTING are updated for 0.2 and for the /api security boundary.

Testing

• npm run verify: typecheck, 25/25 tests (new tests/host.test.ts covers the envelope handling and route registration), build. lib/ is in sync with a fresh build.
• Manual Playwright run against a real dsh --profile web 0.2.0-rc.2 with the packed tarball installed:
  • Host and client halves both activate.
  • Picker shows Session without workspace; after picking it, the chip label and check mark move to that entry.
  • Add workspace… opens DSH's directory browser dialog.
  • After the first prompt the Session moves to Ungrouped, and it is still there after a reload.
  • A blank projectless Session left without sending is archived and its empty directory is removed. Leftovers are swept after a reload.

Notes

• The directory-flow mirror depends on the public slot registry entries/subscribe API. It should be dropped if DSH adds an official way to extend that hole. The /api workaround can likewise go once rpc.handle is fixed upstream.
• Occasionally, leaving a blank Session logs Sidebar Session opening failed … reference is released in the browser console. It comes from DSH's right sidebar code, has no visible effect, and did not reproduce in repeated runs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pa42ksDaPgAVgL5uPB4uA1

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.