Pass an explicit Linux platform to the two remaining SIGTERM-specific ladder tests instead of inheriting the host platform.
This keeps their synchronous-exit assertions focused on the POSIX middle and final rungs while the dedicated Windows case continues to verify the direct SIGKILL path.
Without the pin, native Windows coverage deterministically expected SIGTERM but observed the intended SIGKILL-only behavior.
Observe signal errors and bound the final forced-exit edge with disposeGraceMs so a refused or ineffective SIGKILL cannot leave disposal pending forever.
Apply the confirmation bound on POSIX and Windows, remove listeners and timers on every outcome, and update the ACP consumer contract plus the generated config catalog.
Cover emitted signal errors, synchronous kill exceptions, refused termination, and accepted termination that never reports exit.
Bring in the one-session surface manager landed through #376 after master advanced beyond the prior merge base.
Resolve the generated event-matrix overlap by regenerating from the merged TypeScript tree, preserving master's updated session declaration locations together with the TUI listener edges. Regenerate and verify the RFC index so both lifecycle updates remain represented.
Record the July 17 package split as an implemented bilingual feature RFC. The decision explains why TUI and stdio have separate terminal contracts, why concrete front-door selection belongs to composition, and how the TUI preserves existing session, tool-presentation, and lifecycle ownership.
Link the deterministic dark, light, and animated demos from the RFC so the assets have an in-repository owner. Cross-link the feature and testing decisions from the package README, then regenerate the RFC index and bilingual consistency record.
Master advanced with PR #375's documentation-only simplification RFCs while the TUI merge was validating. Incorporate that exact head as a merge commit so PR #363 retains current-base ancestry without rewriting its reviewed history; no TUI behavior or generated terminal artifact changes are involved.
Master unifies every live agent with its exact SessionId and moves declarative startup failures to agent-loop/config-start-failed. Keeping the branch’s AgentId label binding would let the TUI target the wrong lifecycle after reload and would miss asynchronous resume failures.
Resolve that contract migration by giving the selected terminal front door the same generated or resumed SessionId as agent-core, mounting the front door first, and entering fullscreen only after the matching root appears. Refresh the source-derived catalogs and keyless terminal goldens so Code Mode, workflow, Cordis-tool, and transient UI scenarios all exercise the merged identity model.
fixing-accessibility: expandable rows expose aria-expanded/controls, user
messages become keyboard-operable buttons, pane dividers and the composer
gain accessible names, the live status row announces politely, the busy
form sets aria-busy, feedback failures render inline next to the form,
and the muted/faint text tiers rise to AA-viable contrast.
fixing-motion-performance: composer autosize moves to CSS field-sizing
(dropping the per-keystroke measure/write cycle) and streaming scroll
writes coalesce per frame while direct user actions stay synchronous.
baseline-ui: data columns use tabular numerals, headings balance and
prose wraps pretty, and z-index joins the token scale.
improve-ui: straggler radii and control heights land on the declared
size scale (radius-xs joins the ramp).
fixing-metadata: the document language follows the active locale.
A finished turn whose persisted JSONL had not flushed yet left the live
turn on screen; the next prompt then patched its content into the stale
skeleton, so the new message rendered under the previous user bubble.
Key each live turn and rebuild the skeleton on mismatch, and poll the
persisted trace after a lagging read so the conversation converges
without waiting for a user action. Module nav rows also collapse to one
line at the primary-action control height.
formatCwd has distinct branches for the home directory itself, a descendant of home, an unset cwd, and a path outside home. The descendant branch was exercised only indirectly because the test harness defaulted to process.cwd(), so the per-file coverage gate changed with the checkout location and failed in detached worktrees under /private/tmp even though every behavior assertion passed.
Derive the home-root case from homedir() and add an explicit synthetic child with platform-aware path joins. Keep the unset and outside-home cases unchanged. The suite now drives every formatting branch regardless of where the repository is checked out, and the expected child form follows the host path separator on macOS, Linux, and Windows.
Model responses, replayed session data, tool presenter output, question metadata, configuration, and diagnostics all cross into ANSI-aware pi-tui renderers. Passing their C0 or C1 controls through unchanged lets an otherwise ordinary transcript emit OSC, CSI, cursor, or title operations in the user terminal.
Introduce one displayText boundary that preserves line-feed layout but renders every other C0/C1 control as visible \\xNN text before application styling is applied. Route transcript blocks, streaming output, tool cards, diffs, plans, dialogs, headers, cwd/title data, notices, errors, and pre-mount startup failures through that boundary while leaving pi-tui and the theme responsible for legitimate terminal control sequences.
Pin the contract at three levels: a settled headless-terminal golden spans the main untrusted display sources, unit coverage checks the pre-fullscreen failure path, and the real Loader/PTY conversation streams hostile OSC, cursor, and C1 probes and proves only their inert textual forms reach the terminal stream.
Adds the 3.6 MB take-3 walkthrough mp4 that README already references
via a poster image, and replaces the "coming in a follow-up commit"
placeholder line with a real link (poster now click-through to the
video, caption points at the same file).
Path: examples/desktop/docs/demo-shots/showcase-2026-07-18/
demo-walkthrough.mp4
No source or config changes; the shell tree from a3ca492a is byte-
identical to what it was, this commit just fills in the recording
slot the previous docs commit deferred.
Expanded README landing page for first-time cloners: Pages & Features
guide walks through each of the 14 UI surfaces (chat, trace timeline,
subagent panel, context surface, rubrics, plugins, compaction, budget,
etc.) with 2-4 sentences on what each page shows and why it exists.
Feature highlights section lists 10 concrete affordances a plugin
author or researcher would want to know are there.
Quick Start rewritten for the cold-clone path:
- two-step pnpm install (repo root for tsx, then examples/desktop for
Electron) — resolves the P0-5 install failure a fresh clone hits
- HARNESS_DEV layouts documented: in-repo (default when cloning
deepseek-harness), sibling deepseek-harness-dev/ (original dev
workflow), DSH_DEV_ROOT env (custom layouts)
- .env locations described relative to the runtime root rather than
hardcoded paths
- Profiles table reordered with stdio-echo first (keyless, works on
master); daemon-echo and daemon-vibe-echo marked 'Not yet available
on master' with a note pointing at the integration worktree
Facts-only tone; the only referenced assets are 01-overview.png,
03-chat.png, and video-poster.png in docs/readme-shots/ — all present
in the release tree.
Minimal Electron shell over the DSH JSON-RPC runtime — a first-look at
what a ChatGPT.app-style host on top of the DeepSeek Harness looks
like, with the harness's normally-invisible internals (trace timeline,
context surface, subagent tree, compaction, plugin registry, rubrics)
brought forward as first-class UI surfaces so plugin authors and
researchers can see what the agent is actually doing.
Runs against three keyless-to-live profiles (stdio-echo works on
master out of the box; daemon-echo / daemon-vibe-echo activate once
the daemon-demo lands; stdio-deepseek and daemon-vibe hit the real
DeepSeek API when you supply a key). HARNESS_DEV auto-resolves to the
in-repo runtime when this shell ships under examples/desktop/, so a
fresh clone launches without config; env DSH_DEV_ROOT overrides for
custom layouts, and a sibling deepseek-harness-dev/ checkout is the
original dev workflow.
Cold-clone gate (P0 fixes for first-time-clone usability):
- HARNESS_DEV: 3-candidate resolver (env → walk-up in-repo marker →
sibling), unit-tested via mock fs so ordering is locked without
needing either real layout on disk.
- config yml leaves rewritten at assemble time so the sibling-clone
paths (../../deepseek-harness-dev/examples/echo-agent/…) become
the in-repo paths (../../echo-agent/…) in the released tree —
source yml stays usable for local dev, released tree ships a
working shape.
- pnpm-workspace.yaml allowBuilds.electron = true (was placeholder).
- missing-key card in stdio-deepseek offers a one-click switch to
stdio-echo (the keyless profile that works on master) rather than
daemon-echo (blocked on the not-yet-shipped daemon-demo).
- assemble-oss-release.sh rewrites the source-side breadcrumb name
'dsh-desktop-demo' → 'dsh-desktop' for the released package.json.
FOUC guard on the onboarding gate (41fc5df carried) keeps the
first-launch splash from flashing before the runtime probe finishes.
Test suite (1634 tests in source, 3990 in the runtime repo) covers
resolver ordering, renderer classifiers, trace timeline shape,
compaction diff rendering, rubric parity, and the missing-key
onboarding paths.
Tianyi Cui
NI0317
ZiyaZhang