[buptwhr]

This is by an automated agent, not a human.

Summary

Restores dsh-memory on the current DeepSeek Harness (0.2.2-alpha.2). Version 0.1.4 made the whole Web UI fail to start because its Bundle patch still required a service that current DSH no longer provides. This PR fixes the Bundle composition, aligns the affected Host API calls, and ships regression evidence.

Refs #1. Not merged or published, per the issue request.

Root cause

cordis.patch.yml overrode the standard connection row with inject: [webRuntime, webServer]. Current DSH:

• has no webRuntime service, so connection waited forever and Web aborted with connection (required) missing webRuntime;
• needs webStartup for that row's trustedHosts config, which the override dropped;
• still reads webServer from the Connection provider context for connection.rpc.handle().

Removing the override alone is also insufficient: the memory RPC child then fails with cannot get property "webServer" without inject, and /memory/status returns HTTP 405.

Changes

• cordis.patch.yml: inject webStartup (row config) and webServer (generic RPC registration) into the standard Connection row.
• src/index.ts / src/host-contracts.ts: use the current two-argument connection.rpc.handle(channel, handler); the channel now follows Connection's standard Host/Origin and browser-auth fence instead of an unsupported per-channel authority option.
• src/consolidation-worker.ts / src/dsh-runtime.d.ts: use the current one-argument installModelSelection(agentCtx).
• package.json: remove the no-longer-existing @deepseek-ai/dsh-client-runtime from dsh.client.inject; bump to 0.1.5.
• Tests/check script: cover the patched and unpatched provider contexts, config preservation, RPC registration/disposal, and Headless loading against a real DSH checkout.
• Docs: update the Connection decision, architecture, development smoke steps, and remove stale loopback-authority wording.

Verification

• pnpm run check — typecheck, 122 tests (19 files), and build pass.
• node scripts/check-memory-rpc.mjs <dsh-checkout> — unpatched: passed, patched: passed, headless: passed.
• GitHub Actions check passed for d9a1a5a.
• Fresh isolated profile (DSH_HOME under a temp dir) installed the packed 0.1.5 tarball:
  • --dump-config shows inject: [webStartup, webServer];
  • Web boots and prints its URL with no missing-service list;
  • __DSH_BOOT__ includes @hr98w/dsh-memory and the client bundle is served as JavaScript;
  • Settings → Memory renders with status “已启用” and the memory root;
  • /memory/status, global/read, global/replace (commit and stale-revision conflict) respond correctly.
• UI captured in headless Chrome at 1440×1000, zh-CN.

Before

Shipped v0.1.4 on DSH 0.2.2-alpha.2 (actual baseline)

Web startup aborts, so no page can render; there is no rendered “before” screenshot to capture:

dsh: startup failed: 1 required plugin did not activate

Plugins waiting for services (7):
  Plugin                 Missing services
  connection (required)  webRuntime
  session-log-download   connection
  open-in-app            connection
  directory-picker       connection
  session-controller     fileUploads
  file-upload            connection
  ui-deliverables        connection, sessionController

Supporting diagnostic — removing the stale override alone

Not the shipped baseline; shows why webServer must still be injected. Memory loads but its RPC channel is never registered (transport failure ... HTTP 405).

After

0.1.5 on DSH 0.2.2-alpha.2; same viewport, theme, and zh-CN locale, Memory page enabled and loading data over the RPC channel:

Limitations

• The baseline cannot produce a rendered before image because the application exits during startup; the failure log above is the actual baseline capture.
• The isolated profile had no configured model provider and no conversational Session, so a full consolidation model turn was not exercised end-to-end. The worker API alignment is covered by typecheck and the existing worker/runner unit tests; the empty-Session consolidation path returned no-change against the real Host.
• The Connection override replaces entry-level inject. A future DSH row-dependency change is not merged automatically; the real-DSH check pins the patched list to the current bundle dependencies plus webServer and fails on drift instead of silently dropping a dependency.
• No auto-merge, publish, or issue closure is performed by this PR.