fix(client): register the browser half with the module loader

.github/workflows/compat.yml

@@ -63,6 +63,14 @@ jobs:
   profile:
     runs-on: ubuntu-latest
     timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        # Both ends of the declared band: the oldest line still supported and
+        # the current one. A range is what the manifest accepts, not what CI
+        # has exercised, so both are run.
+        dsh: ['0.1.7-rc.2', '0.2.0-rc.2']
+    name: profile (${{ matrix.dsh }})
     steps:
       - uses: actions/checkout@v5
 
@@ -83,7 +91,7 @@ jobs:
           pnpm run build
           pnpm pack --pack-destination "$RUNNER_TEMP"
       - name: Install dsh CLI
-        run: npm install -g @deepseek-ai/dsh@0.1.7-rc.2
+        run: npm install -g @deepseek-ai/dsh@${{ matrix.dsh }}
 
       - name: Install into a scratch profile (builds allowlisted)
         run: |
@@ -104,7 +112,7 @@ jobs:
             protobufjs: true
             '@google/genai': true
           YAML
-          dsh plugin --profile compat add '@deepseek-ai/dsh-base@0.1.7-rc.2' '@deepseek-ai/dsh-headless@0.1.7-rc.2' "$TARBALL"
+          dsh plugin --profile compat add "@deepseek-ai/dsh-base@${{ matrix.dsh }}" "@deepseek-ai/dsh-headless@${{ matrix.dsh }}" "$TARBALL"
 
       - name: Row-mount assertion
         run: |

CHANGELOG.md

@@ -6,6 +6,33 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-10-01
+
+### Added
+
+- **DeepSeek Harness `0.2` support.** The declared host ranges (`engines.dsh` and the `@deepseek-ai/dsh-*` `peerDependencies` union) gain `|| >=0.2.0-rc.1 <0.3.0-0`, `dshWorkshop.compatibility.dshVersions` records `0.2.0-rc.2`, and the Compat workflow's profile job now runs both ends of the range (`0.1.7-rc.2` and `0.2.0-rc.2`) instead of a single pin.
+
+### Fixed
+
+- **The browser half never registered with the client module loader, so the Plugins page reported the plugin as failed to sync.** `lib/client.js` shipped as verbatim `tsc` ESM output — top-level `import`/`export` bindings and no `window.__ModuleLoader__.load({ id, factory })` call. The host's client module system (`@deepseek-ai/dsh-client-modules`) is a lazy CJS table whose only acceptance test is that registration, so the bundle executed, registered nothing, and the page surfaced
+
+  ```
+  client-modules: could not load "@perrylink/dsh-github": … :
+    loaded without registering "@perrylink/dsh-github" via __ModuleLoader__.load
+  ```
+
+  The host half was unaffected and kept its tools registered throughout. `scripts/build-client.mjs` now rewrites the compiled bundle in place: `import … from 'm'` becomes `require('m')`, each top-level `export` declaration loses its keyword and gains an `exports.<name> = <name>` line, and the body is wrapped in the loader's factory. It is wired into both `build` and `prepare`, fails loud on any shape it cannot transform, and is a no-op on an already-wrapped bundle. Original line order is preserved and the shipped `lib/client.js.map` is shifted by the wrapper's line count, so it stays aligned.
+
+  The same acceptance test and the same message are present in `@deepseek-ai/dsh-client-modules@0.1.7-rc.2`, so this is a defect in how the artifact is built rather than a `0.2`-only regression; worth confirming whether the committed bundle ever registered on the older line.
+
+- **`dsh.client.inject` omitted two modules the browser half requires.** `src/client.ts` imports `react` and `@deepseek-ai/dsh-client-ui-primitives`, and neither was declared, so the module graph did not guarantee they arrive before this row materializes. Both are now listed.
+
+- **The configuration card mounted in the Plugins page's Official group.** The browser half took the `plugins.item` seat, which the page renders through `renderGroup("official", …)` beside the host's own settings plugins (agent-loop, shell, subagent, web-search) — so this community bundle was presented as an official plugin rather than an installed one. The card now takes this bundle row's own seat, `plugins.row.config`, keyed `<package>#<rowId>`; both seats hand the card the same `{ view, form }` props, so the card itself is unchanged. `test/client-card-seat.test.ts` pins the seat and derives the key from `cordis.patch.yml` rather than restating it.
+
+### Changed
+
+- **The client bundle is now covered by the gates that were missing it.** `scripts/verify-artifacts.mjs` executed only the host face; it now also runs the shipped client bundle against a stub `__ModuleLoader__`, asserts it registers exactly once under the package name, materializes its factory, and rejects top-level ESM. `test/client-bundle-contract.test.ts` asserts the same contract as a unit test — the 0.7.14 lesson ("`lib/client.js` is a build artifact of `src/client.ts`, and nothing in the test suite renders it") applied to the half that had no gate at all.
+
 ## [0.7.15] - 2026-09-25
 
 ### Changed

README-es.md

@@ -48,7 +48,7 @@
 
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (compatibilidad declarada para `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0`; 0.1.2-rc.1 adaptado el 2026-09-09): el job de revisión pasa a ser propiedad de un `SessionId` desnudo y la fuente de aviso usa el kind propio del plugin `dsh-github` (la unión `Agent \| SessionId` del host y su `kind: 'plugin'` comodín ya no existen); la tarjeta de configuración se registra en la **página Plugins** (grupo Official, slot `plugins.item`) y se renderiza desde el form que entrega `dsh-client-ui-plugin-manager`, en lugar de enlazar el eliminado `ctx.settingsScope`; el controlador de CI autoaprueba mediante la costura oficial `ctx.approval.setPolicy`; el bot de revisión sondea como tarea en segundo plano `ctx.jobs` con respaldo por temporizador. Actualizado el 2026-09-24 a `0.1.7-rc.2` (typecheck + typecheck:ci + 185 pruebas unitarias en verde). |
+| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (compatibilidad declarada para `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.2.0-rc.1 <0.3.0-0`; la línea `0.2` (`0.2.0-rc.1` / `0.2.0-rc.2`) queda declarada y soportada desde `0.8.0`, donde la mitad de navegador se registra mediante el contrato `__ModuleLoader__` del host en lugar de terminar en enlaces ESM de nivel superior; 0.1.2-rc.1 adaptado el 2026-09-09): el job de revisión pasa a ser propiedad de un `SessionId` desnudo y la fuente de aviso usa el kind propio del plugin `dsh-github` (la unión `Agent \| SessionId` del host y su `kind: 'plugin'` comodín ya no existen); la tarjeta de configuración se registra en la **página Plugins** (grupo Official, slot `plugins.item`) y se renderiza desde el form que entrega `dsh-client-ui-plugin-manager`, en lugar de enlazar el eliminado `ctx.settingsScope`; el controlador de CI autoaprueba mediante la costura oficial `ctx.approval.setPolicy`; el bot de revisión sondea como tarea en segundo plano `ctx.jobs` con respaldo por temporizador. Actualizado el 2026-09-24 a `0.1.7-rc.2` (typecheck + typecheck:ci + 185 pruebas unitarias en verde). |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (plugin host; red saliente a GitHub) |
 | Modelo | Cualquiera (la revisión estática es determinista; `reviewMode: "model"` es opcional) |

README-hi.md

@@ -48,7 +48,7 @@
 
 | सतह | स्थिति |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (`>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` के लिए compat घोषित; 0.1.2-rc.1 2026-09-09 को अनुकूलित): review job अब नंगे `SessionId` का है और notice source plugin का अपना kind `dsh-github` है (host का `Agent \| SessionId` union और उसका catch-all `kind: 'plugin'` दोनों हट गए); settings card **Plugins पेज** (Official समूह, `plugins.item` slot) पर पंजीकृत होता है और `dsh-client-ui-plugin-manager` द्वारा दिए गए owner form से render होता है, हटाए गए `ctx.settingsScope` को bind करने की जगह; CI driver आधिकारिक `ctx.approval.setPolicy` नीति सीम से ऑटो-अनुमोदन करता है; review bot `ctx.jobs` पृष्ठभूमि job के रूप में टाइमर फ़ॉलबैक के साथ पोल करता है। 2026-09-24 को `0.1.7-rc.2` पर अपग्रेड (typecheck + typecheck:ci + 185 यूनिट टेस्ट हरे)। |
+| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (`>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.2.0-rc.1 <0.3.0-0` के लिए compat घोषित; `0.2` लाइन (`0.2.0-rc.1` / `0.2.0-rc.2`) `0.8.0` से घोषित और समर्थित है, जहाँ browser half top-level ESM bindings छोड़ने के बजाय host के `__ModuleLoader__` contract से रजिस्टर होता है; 0.1.2-rc.1 2026-09-09 को अनुकूलित): review job अब नंगे `SessionId` का है और notice source plugin का अपना kind `dsh-github` है (host का `Agent \| SessionId` union और उसका catch-all `kind: 'plugin'` दोनों हट गए); settings card **Plugins पेज** (Official समूह, `plugins.item` slot) पर पंजीकृत होता है और `dsh-client-ui-plugin-manager` द्वारा दिए गए owner form से render होता है, हटाए गए `ctx.settingsScope` को bind करने की जगह; CI driver आधिकारिक `ctx.approval.setPolicy` नीति सीम से ऑटो-अनुमोदन करता है; review bot `ctx.jobs` पृष्ठभूमि job के रूप में टाइमर फ़ॉलबैक के साथ पोल करता है। 2026-09-24 को `0.1.7-rc.2` पर अपग्रेड (typecheck + typecheck:ci + 185 यूनिट टेस्ट हरे)। |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | सभी (host plugin; GitHub की ओर outbound network) |
 | Model | कोई भी (static review deterministic है; `reviewMode: "model"` वैकल्पिक है) |

README-pt.md

@@ -48,7 +48,7 @@
 
 | Superfície | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (compatibilidade declarada para `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0`; 0.1.2-rc.1 adaptado em 2026-09-09): o job de revisão passa a pertencer a um `SessionId` puro e a fonte dos avisos usa o kind próprio do plugin `dsh-github` (a união `Agent \| SessionId` do host e o `kind: 'plugin'` genérico deixaram de existir); o cartão de configurações se registra na **página Plugins** (grupo Official, slot `plugins.item`) e renderiza a partir do form entregue por `dsh-client-ui-plugin-manager`, em vez de vincular o removido `ctx.settingsScope`; o driver de CI autoaprova pela costura oficial `ctx.approval.setPolicy`; o bot de revisão pesquisa como job em segundo plano `ctx.jobs` com fallback por temporizador. Atualizado em 2026-09-24 para `0.1.7-rc.2` (typecheck + typecheck:ci + 185 testes unitários verdes). |
+| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (compatibilidade declarada para `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.2.0-rc.1 <0.3.0-0`; a linha `0.2` (`0.2.0-rc.1` / `0.2.0-rc.2`) passa a ser declarada e suportada a partir de `0.8.0`, em que a metade de navegador se registra pelo contrato `__ModuleLoader__` do host em vez de terminar em vínculos ESM de nível superior; 0.1.2-rc.1 adaptado em 2026-09-09): o job de revisão passa a pertencer a um `SessionId` puro e a fonte dos avisos usa o kind próprio do plugin `dsh-github` (a união `Agent \| SessionId` do host e o `kind: 'plugin'` genérico deixaram de existir); o cartão de configurações se registra na **página Plugins** (grupo Official, slot `plugins.item`) e renderiza a partir do form entregue por `dsh-client-ui-plugin-manager`, em vez de vincular o removido `ctx.settingsScope`; o driver de CI autoaprova pela costura oficial `ctx.approval.setPolicy`; o bot de revisão pesquisa como job em segundo plano `ctx.jobs` com fallback por temporizador. Atualizado em 2026-09-24 para `0.1.7-rc.2` (typecheck + typecheck:ci + 185 testes unitários verdes). |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (plugin host; rede de saída para o GitHub) |
 | Modelo | Qualquer (a revisão estática é determinística; `reviewMode: "model"` é opcional) |

README-zh.md

@@ -50,7 +50,7 @@
 
 | 界面 | 状态 |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2`（兼容声明覆盖 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0`；0.1.2-rc.1 于 2026-09-09 已适配）：评审任务改由裸 `SessionId` 归属、通知来源改为插件自有的 `dsh-github` kind（宿主的 `Agent \| SessionId` 联合与兜底 `kind: 'plugin'` 均已移除）；设置卡注册在 **Plugins 页**（Official 组，`plugins.item` 槽），并从 `dsh-client-ui-plugin-manager` 提供的 owner form 渲染，不再绑定已删除的 `ctx.settingsScope`；CI 驱动器通过官方 `ctx.approval.setPolicy` 策略缝自动放行；评审机器人以 `ctx.jobs` 后台任务轮询，并带定时器降级。2026-09-24 升级至 `0.1.7-rc.2`（typecheck + typecheck:ci + 185 项单元测试全绿）。 |
+| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2`（兼容声明覆盖 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.2.0-rc.1 <0.3.0-0`；`0.2` 线（`0.2.0-rc.1` / `0.2.0-rc.2`）自 `0.8.0` 起纳入声明并提供支持——浏览器半边改为通过宿主的 `__ModuleLoader__` 契约注册，不再以顶层 ESM 绑定收尾；0.1.2-rc.1 于 2026-09-09 已适配）：评审任务改由裸 `SessionId` 归属、通知来源改为插件自有的 `dsh-github` kind（宿主的 `Agent \| SessionId` 联合与兜底 `kind: 'plugin'` 均已移除）；设置卡注册在 **Plugins 页**（Official 组，`plugins.item` 槽），并从 `dsh-client-ui-plugin-manager` 提供的 owner form 渲染，不再绑定已删除的 `ctx.settingsScope`；CI 驱动器通过官方 `ctx.approval.setPolicy` 策略缝自动放行；评审机器人以 `ctx.jobs` 后台任务轮询，并带定时器降级。2026-09-24 升级至 `0.1.7-rc.2`（typecheck + typecheck:ci + 185 项单元测试全绿）。 |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | 全部（host 插件；出站网络访问 GitHub） |
 | Model | 任意（静态审查是确定性的；`reviewMode: "model"` 为可选） |

README.md

@@ -51,7 +51,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (compat declared for `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0`; 0.1.2-rc.1 adapted 2026-09-09): the review job is owned by a bare `SessionId` and a notice source is the plugin-owned kind `dsh-github` (the host's `Agent \| SessionId` union and its catch-all `kind: 'plugin'` are both gone); the settings card registers on the **Plugins page** (Official group, `plugins.item` slot) and renders from the owner form `dsh-client-ui-plugin-manager` supplies, instead of binding the removed `ctx.settingsScope`; the CI driver auto-approves through the official `ctx.approval.setPolicy` policy seam; the review bot polls as a `ctx.jobs` background job with a timer fallback. Upgraded 2026-09-24 to `0.1.7-rc.2` (typecheck + typecheck:ci + 185 unit tests green). |
+| Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (compat declared for `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.2.0-rc.1 <0.3.0-0`; the `0.2` line (`0.2.0-rc.1` / `0.2.0-rc.2`) is declared and supported from `0.8.0`, where the browser half registers through the host's `__ModuleLoader__` contract instead of leaving top-level ESM bindings; 0.1.2-rc.1 adapted 2026-09-09): the review job is owned by a bare `SessionId` and a notice source is the plugin-owned kind `dsh-github` (the host's `Agent \| SessionId` union and its catch-all `kind: 'plugin'` are both gone); the settings card registers on the **Plugins page** (Official group, `plugins.item` slot) and renders from the owner form `dsh-client-ui-plugin-manager` supplies, instead of binding the removed `ctx.settingsScope`; the CI driver auto-approves through the official `ctx.approval.setPolicy` policy seam; the review bot polls as a `ctx.jobs` background job with a timer fallback. Upgraded 2026-09-24 to `0.1.7-rc.2` (typecheck + typecheck:ci + 185 unit tests green). |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | All (host plugin; outbound network to GitHub) |
 | Model | Any (static review is deterministic; `reviewMode: "model"` is optional) |