fix(web): keep one composer bar DOM across the no-workspace transition
The composer.bar slot moves from session to session-maybe scope: with no
current session the entry still mounts, the machine faces (keyboard, stop,
command) arrive undefined, and the bar renders its normal DOM inert via the
disabled owner prop. DisabledInputBar and its parallel tree are gone, so the
textarea node survives the cold-start workspace pick instead of flashing
through a remount. A blank session whose workspace was deleted takes the
same inert path through owner props.
test(web): add the composer DOM-continuity acceptance probe
Drives a real dsh web server with headless chromium through the cold-start
-> pick-workspace -> type flow and asserts the composer textarea is the
same DOM node throughout (a marker property must survive). Rerun
prerequisites are in the header comment.
docs(web): session-maybe identity is adoption, not hold-forever
fix(web): session-maybe entries adopt the first session, then remount like strict entries
A session-maybe entry used to keep one React instance across every
transition, so component-local state leaked between sessions once the
composer bar moved to that scope (PermissionSelect's optimistic pick, the
IME composition guard). Identity is now adoption: an incarnation born
session-less holds through the arrival of the first session (the blank
shell's DOM survives the workspace pick), and afterwards behaves exactly
like a strict session entry — a switch or a drop to no-session remounts,
clearing local state by construction. The child key is an incarnation
counter kept in the stable outlet wrapper via render-phase setState.
chore: knip knows the root acceptance probe's playwright dependency
scripts/hero-composer-dom-continuity.mjs resolves playwright through
apps/web's devDependency tree (createRequire), which knip cannot follow;
ignore it at the root workspace.
- gate model selection on steering-placement image carriers from enqueue
until their steering/message event publishes; release the gate when an
admission ends idle without publication (both behaviorally asserted)
- reject session.updateQueue edits carrying non-text blocks at the RPC
boundary (queue edits cannot bypass image admission)
- extend the durable-directory walk past a first-created DSH_HOME to the
deepest pre-existing ancestor
- strip Windows-style separators from attachment display names on POSIX
- verify attachment reads with a header-only probe (digest already proves
the bytes decoded fully at admission); document the read path
- make SessionInputShell.addImages refusal observable and keep workspace
transfers/composer intake from leaking refused drafts
- own ONE recursive image walk (dsh-llm contentHasImage) across apiproxy,
pi-ai, compact-basic, and the DeepSeek text-only assertion
- drop the redundant canonical-base64 regex and the no-op role read
- move AttachmentId/AttachmentError out of types.ts (brand.ts/error.ts);
document why AttachmentError does not extend HarnessError
- document the hard attachments inject in both consumer READMEs
The seat's height publisher needs a ResizeObserver stub in every spec that
renders ConversationRoot (jsdom has none), and the two branch-tail StatsLine
assertions move to the grouped detail-row output.
Stats line moves into the InputBar's new footer slot (sharing the card's
width column) and expands to the design's grouped detail row: turns/steps,
LLM and tool wall time, cache hit, and input/output token split, all
derived client-side from the snapshot. The composer stack owns one 8px
rhythm, the seat fades the transcript through a fixed 36px gradient band,
back-to-bottom follows a live --dsh-composer-height, and goal/todo strips
share one 752px tip-fill column.
The #921 selector change and the duplication gate both first ran against
this branch after the merge made it MERGEABLE: assembly-surfaces still
queried the retired data-sample="todo-row" hook (the composed TodoRow
carries ToolRow's data-tool attribute instead), and the redesigned
QuestionComposer duplicated the custom-draft onChange/onKeyDown pair
across its inline input and optionless textarea. The spec now anchors on
data-tool="todo_write", and the composer shares one draftCustom /
continueFromCustom handler pair (Enter continues, Shift+Enter stays a
newline, IME composition stays inert).
Sink the behavior previously held only by the apps/web jsdom snapshots
into the owning packages, each bench mounting the real apply on the
production slot machinery with fixture-fed data:
- ui-conversation/assembly-surfaces: the todo_write turn reaches both
product surfaces (keyed toolview row + dock plan strip via the todos
projection) and the strip follows projection retirement; the keyed
bash row carries its resident terminal card while the fallback row
reaches one through expand; the locked no-session view state; the
composer textarea surviving the blank→active conversion as the same
DOM node; the promptError alert strip with the machine-restored
draft; one summary update re-labeling the breadcrumb.
- ui-workspace/rename-assembly: the session-rename chain (row menu →
dialog → the injected renameSession hop → ISession.rename with the
edge-trimmed draft → dialog close and row re-label from the list),
plus the rejected arm keeping the dialog open with the error.
- runtime/workspaces-service: startInitialSelection — connects the
recent Workspace once both baselines are ready and opens the session,
stays idle with a current session or no recent target (double start
fails loud), and a failed connect returns to waiting and retries on
the next list change.
Component-level arms stay in the existing package suites; these files
prove only the assembled wiring.
Unify the /plan claimed hint with the plan placeholder through a locale
namespace, localize slash menu group titles, replace the PermissionSelect
native select with the Menu primitive, add a goal pause verb chain, clamp
anchored popups to the viewport with scroll-into-view and outside-dismiss,
and fix onPasteUpgrade insertedRange to account for the chip trailing gap.
- llm-deepseek: the uncatalogued resolveModel fallback declares text-only
modalities — the wire route is text-only regardless of catalog
membership, so "unknown" must not let the host persist-then-fail images.
- session.selectModel also consults the pending-inbox mirror: a queued
image prompt enters the log only when claimed, after a switch would land.
- attachment store: ensureDurableDirectory syncs every ancestor entry up to
a caller-vouched boundary regardless of what mkdir reports — a raced
"already existed" is not "already durable".
- One image walker (imageBlockIn/imageInEvent) now serves both attachment
authorization and the selection gate; referencedImage therefore also
authorizes references inside wrapped message content.
- InputHub: the scope disposer resolves the conversation service optionally
(teardown/HMR must reach quiescence), and a send failing after its scope
died releases the in-flight drafts instead of restoring them onto a
disposed shell.
- http-bridge destroys declared-oversize requests with connection: close
instead of draining a body the client can trickle indefinitely.
- LlmService validates AND detaches modality arrays identically on the
advisory and exact routes; READMEs record the fourth INVALID_MODEL_INFO
rejection reason.
- CLI provider docs (JSDoc, README pair, Agent Note pair) describe the
reuse behavior; llm-route.spec now parses the SHIPPED cordis.yml through
the production extraction, pinning the row coupling.
- image-display lane pins gallery/rail shape in inline snapshots and the
object-URL scheme this environment must take; stale host.schema comment
dropped.
Yichen Jiang