dsh-workspace-studio
DeepSeek Harness 插件：工作区文件浏览器 + 代码查看器 + 会话更改差异 + 代码块级部分还原（Trae-style）。已在桌面应用（0.2.1-rc.5）和 Web UI 上验证。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:houlain/dsh-workspace-studio#24db92931bcd47bd4d2f39ccedbde761c217e503Workspace Studio 以 dsh-workspace-studio 发布，当前版本为 0.3.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
⚠️ Platform status: Windows verified only. This plugin has been tested on Windows (PowerShell). It has NOT been verified on Linux or macOS — path handling, shell behavior, and sandbox interactions may differ on those platforms. Use with caution on non-Windows systems.
✅ Host compatibility: DSH Desktop 0.2.1-rc.5. Declared as
engines.dsh >= 0.2.1-rc.5, which is the requirement the host's own plugin gate actually reads. Theagents.store/session.eventsfallbacks in the code are defensive, not a supported configuration — a 0.1.x host refuses the install before any of that code runs.
A DeepSeek Harness (dsh) plugin that turns the Web UI into a lightweight coding workspace with Trae-style partial revert:
write / edit the agent makes is tracked with full before/after snapshots and rendered as line-level diff hunks, with live SSE updates.write / edit tool calls are tracked. Direct file edits made outside those tools (e.g. in your own editor) are not recorded.One bundle serves both the Desktop app and the dsh web UI: a host half (change ledger + /api/dsh-workspace-studio/* routes) and a client half (the Studio view in the conversation tab strip). The Desktop app renders the same web client, so the only difference is which profile you install into.
github:houlain/dsh-workspace-studio.The installer registers the bundle in the profile's dsh.profile.bundles for you; no manual step is needed. If you install by hand (below), add "dsh-workspace-studio" to that list yourself.
dsh web CLIdsh plugin --profile web add github:houlain/dsh-workspace-studio
Then restart dsh web and open a new session.
Note on
dsh.client.inject: 0.1.0 declared@deepseek-ai/dsh-client-runtime, which no 0.2.x host provides. That list is loading/prefetch metadata — the host's plugin-author notes say it never sequencesapply— so whether the stale entry actually blocked activation was not proven by a browser-side test; it is removed because a name that resolves to nothing has no reason to be declared. What is still unverified is the end-to-end desktop check (opening the app and seeing the Studio tab).
Copy the package into the profile's node_modules:
$src = "<your-clone-path>\dsh-workspace-studio"
$dst = "$env:USERPROFILE\.dsh\profiles\web\node_modules\dsh-workspace-studio"
Copy-Item -Recurse -Force $src $dst
Register it in the profile's package.json:
{
"dependencies": { "dsh-workspace-studio": "0.1.0" },
"dsh": { "profile": { "bundles": ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app", "dsh-workspace-studio"] } }
}
Restart dsh web.
The package ships pre-built (
lib/), so no build step is needed for installation. The installed copy must be a copy, not a symlink into a directory you keep editing — rebuild and re-copy after updating.
▸ / ▾); folders containing pending changes show a count badge and auto-expand.One package, two halves (dsh.bundle + dsh.client manifests), mounted as a single loader entry:
dsh-workspace-studio/
├── src/
│ ├── core/ # Pure logic, zero deps, fully unit-tested
│ │ ├── diff.ts # LCS line diff → hunks with context
│ │ ├── ledger.ts # before/after snapshot ledger + persistence
│ │ ├── hunkRevert.ts # per-hunk reverse apply + conflict detection
│ │ └── fileTree.ts # tree builder with ignore rules
│ ├── host/ # Node half: tools/result listener, HTTP/SSE routes, ctx.fs
│ ├── client/ # Browser half: Studio view (React, no external deps)
│ └── shared/ # Payload types shared by both halves
├── lib/ # Pre-built bundles (lib/index.js host, lib/client.js browser)
└── tests/ # 82 tests (node:test, no test framework dependency)
/api/dsh-workspace-studio/*)| Route | Method | Purpose |
|---|---|---|
/api/dsh-workspace-studio/tree?root= | GET | Workspace file tree |
/api/dsh-workspace-studio/file?path= | GET | File content (size-capped) |
/api/dsh-workspace-studio/ops?session= | GET | Change operations with hunks (pending only in the file list) |
/api/dsh-workspace-studio/revert?session= | POST | Revert one hunk, or the whole file (no op/hunk) |
/api/dsh-workspace-studio/accept?session= | POST | Accept one hunk |
/api/dsh-workspace-studio/clear?session= | POST | Clear the session's change records |
/api/dsh-workspace-studio/context?session= | GET | Session working directory |
/api/dsh-workspace-studio/events | GET (SSE) | Live change notifications |
These routes are registered on the host's route carrier, not behind the /api gateway's auth fence, so the plugin enforces its own fences. Be precise about what they are and are not:
EventSource cannot set headers) requires x-dsh-workspace-studio: 1, a loopback peer IP literal (a hostname such as 127.evil.com is rejected), sec-fetch-site: same-origin when present, and Origin matching Host when present. This stops cross-site pages and DNS rebinding.root/path must resolve inside a registered workspace (ctx.workspaceRegistry.list()) or the requesting session's cwd, compared through one canonical path form (Windows case-folded, /-unified). Anything else is 403..secrets, .env/.env.*, *.key, *.pem, id_rsa*, id_ed25519*, credentials*, .netrc, or anywhere under ~/.dsh.{kind:'replaceIfVersion', version} (the host's FsWriteIntent), so a concurrent agent write is rejected instead of silently overwritten. Whole-file revert re-reads and verifies a baseline first; it refuses rather than overwrite when the original snapshot was pruned.~/.dsh/ws-studio-state.json: debounced, atomic write (tmp + fsync + rename with a random suffix), flushed on exit and after every accept/revert/clear action.0600 is best-effort: on Windows Node's mode does not create a DACL, so the file inherits the directory's ACL. If that matters on your machine, tighten the ACL on ~/.dsh yourself (the ledger holds full-text snapshots of edited files).truncated placeholder — visible but not revertible); plus a global cap of 2000 operations. A whole-file revert whose original baseline was pruned away is refused — it will not guess.*.corrupt-<ts> / *.oversized-<ts>); records that fail validation are dropped with a log and the original file is copied to *.dropped-<ts> first.ctx.fs) with a session-level sandbox policy (workspace-write + the session's workspace root), so writes outside the session workspace are rejected by the harness sandbox itself.ctx.fs when available (fallback: node:fs).The file tree ignores common noise by default (.git, node_modules, dist, build, lockfiles, coverage, etc.). The ignore list lives in src/core/fileTree.ts (DEFAULT_TREE_OPTIONS) — rebuild if you want to customize it.
Requirements: Node.js ≥ 22.6 (tests run via Node's native TypeScript type-stripping — no build needed for tests), npm.
npm install # dev dependency: esbuild
npm run build # bundles lib/index.js (host) + lib/client.js (browser)
npm test # 82 tests via node --test
Notes for contributors:
React.createElement (no JSX). Tests call components as plain functions (no renderer), so npm test maps react to a deliberately tiny stub: tests/react-stub/shim.mjs, wired in by tests/react-stub/register.mjs (node --import). The stub expands function components eagerly, flattens children like React, and makes hooks return their initial value without re-rendering. It is committed and versioned — never install a real react into the repo just to run tests, and never rely on a hand-made node_modules/react..ts extensions (NodeNext).write/edit tool calls.An adversarial review of 0.2.2 (data / security / compatibility / counter-example) produced 32 defects. All are fixed here; the ones worth knowing:
.secrets/ directory inside the registered workspace would be served to any local process. Reads now require the trust header, and a sensitive-path list (.secrets, .env*, *.key, *.pem, id_rsa*, credentials*, ~/.dsh) is refused even inside a workspace.ops[0], which ledger pruning can silently turn into an intermediate (or a create) record — reproduced: file deleted, original content unrecoverable. The baseline is now "the earliest record that still carries a content snapshot"; missing snapshot → refuse; only created records may delete; deletion is confined to the session workspace root.writeText's third argument must be {kind:'replaceIfVersion', version}; passing a bare version silently disabled the guard.fs.remove. The 0.2.1-rc.5 fs seam has no delete verb, so deletion either uses fs.remove (future hosts) or processPath + unlink after re-verifying the sandbox root.opId, not array index: pruning shifts indices and could revert/accept the wrong block. Revert now also refuses already-handled hunks./ops without a file filter no longer dumps the session ledger; results are filtered to allowed roots. /events carries no session id. SSE capped and keep-alive pinged.truncated flag for oversized snapshots, strict validation on load (dropped records logged and backed up to *.dropped-<ts>).res.ok/{ok:false} are checked, switching sessions resets the panel, stale responses are discarded by sequence number, and empty/error states have readable text.dsh.client.inject named @deepseek-ai/dsh-client-runtime, which does not exist in the desktop app's 71 client entries. The entry is removed. Honesty note: that list is loading/prefetch metadata, and a browser-side test was not available here, so "it was why the Studio tab never appeared" is a hypothesis, not a proven root cause.node_modules): subagent lineage is session.header.parentSession (not agent.owner), event logs come from session.snapshotEvents() (not session.events), and the fs delete verb is the optional fs.remove(target, policy) (not fs.unlink). All three are implemented with defensive fallbacks.write reports before: null both for operation: 'create' and for an update that carried no baseline. 0.1.0 treated both as "new file" and deleted it — reverting an overwriting write destroyed a pre-existing file. The operation is now recorded, and only create may delete.ctx.agents.get(id) is used when present (0.2.1+), with a fallback to ctx.agents.store — the fallback is defensive; the host gate refuses older hosts outright.peerDependencies (@deepseek-ai/cordis, react) and engines.dsh >= 0.2.1-rc.5. Note which one is real: the host's compatibility gate reads engines.dsh (and DSH peer package names), so the peers are documentation — under the profile's autoInstallPeers: false they surface as pnpm warnings, not as an install gate.ctx.effect and now return a disposer, so hot reload / unload no longer leaves duplicate /api/dsh-workspace-studio/* registrations behind (the desktop app reloads plugins in place).peerDependencies (@deepseek-ai/cordis, react) and engines.dsh >= 0.2.1-rc.5 so an incompatible host is reported instead of failing quietly.tests/react-stub/ provides the React stub the client tests always assumed, and covers both accessor shapes. 82 tests, all passing.The first cut of 0.2.0 only fixed the client activation bug. An adversarial review of that cut (security / compatibility / stability) found the following; all of them are fixed here:
?path= went straight to ctx.fs, so any local process could read any file (for example ~/.dsh/.credentials.yaml). Paths are now confined to registered workspaces, traversal is normalized first, and out-of-workspace requests get 403.revert/accept/clear were plain GET/POST with no trust decision. They are now POST-only and require the x-dsh-workspace-studio header plus a loopback, same-origin request.cwd was unknown, sandboxPolicyFor() returned undefined, handing the write to whatever policy the deployment used (possibly full access). Writes and deletes are now fail-closed.ctx.fs.unlink with no policy and no authorization; it now runs through the same workspace check as writes.ctx.fs offers. The version is now captured before the read and passed to writeText, so a concurrent agent write is rejected.Content-Length pre-check and an immediate disconnect.EventSource then stayed half-open and received nothing), and the client reconnected on every selected-file change. The server now caps clients at 32, keep-alive pings, ends them on unload; the client subscribes once per session.*.corrupt-<ts>) with writing disabled for the rest of the process.ops/context/clear had no try/catch and load() validated nothing; records are now shape-checked on load and the handlers return 500 instead of throwing into the host.write/edit, per-hunk revert and accept, live SSE updates.MIT © 2026 houlain
0600 guarantees file protection on Windows (Node's mode sets no DACL).tests/agents.test.tsagents