feat: add DeepSeek Harness integration and native Braid Web panel

.github/workflows/release.yml

@@ -30,5 +30,5 @@ jobs:
         run: node scripts/check-release.mjs
       - run: npm ci
       - run: npm run verify
-      - name: Publish core and Pi package with npm trusted publishing
+      - name: Publish core and integration packages with npm trusted publishing
         run: node scripts/publish.mjs

.gitignore

@@ -6,3 +6,4 @@ coverage/
 integrations/pi/LICENSE
 .env.*
 !.env.example
+integrations/dsh/LICENSE

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+### Features
+
+- Add the `@chrok/dsh-braid` DeepSeek Harness plugin with background graphs,
+  isolated workers, revision-checked updates, pause/resume, cancellation, and
+  completion reminders through DSH's native model, tool, and job services.
+- Add a native DSH Web panel with live graphs, execution history, paged outputs,
+  usage, and controls. Braid tool cards preserve recorded operation summaries
+  and open the corresponding job, node, or execution in the live panel.
+
 ### Documentation
 
 - Introduce Braid with a parallel code-review example and clear installation

CONTRIBUTING.md

@@ -15,23 +15,28 @@ npm ci
 npm run verify
 ```
 
-The root npm workspace lockfile covers both packages. A development-only
+The root npm workspace lockfile covers all packages. A development-only
 `@chrok/braid: file:.` dependency links the core checkout into `node_modules`;
-Pi's manifest still declares the exact release version. This lets CI test a
+Each integration manifest still declares the exact release version. This lets CI test a
 new core before it is published. `check:pi`, `test:pi`, and `build:pi` rebuild
 core so package imports resolve current JavaScript and declarations. Consumers
-installing either published package do not install this development dependency.
+installing published packages do not install this development dependency.
 Use `npm install --workspace @chrok/pi-braid <dependency>` for Pi dependency
-updates; do not create a separate lockfile in `integrations/pi`.
-
-The core has no runtime dependencies. Pi's dependencies belong in its workspace
-manifest. Update and commit the root lockfile when changing a dependency. Do not commit generated `dist` directories,
+updates, or `npm install --workspace @chrok/dsh-braid <dependency>` for DSH.
+Do not create separate lockfiles in integration directories. DSH uses
+`check:dsh`, `test:dsh`, and `build:dsh` with the same core rebuild convention.
+DSH Host and React Client use separate TypeScript programs to keep Cordis service
+augmentations isolated. `build-client.mjs` emits the shared-React DSH loader factory;
+`test:dsh` rebuilds it before testing the native Remote/slot lifecycle.
+
+The core has no runtime dependencies. Integration dependencies belong in their workspace
+manifests. Update and commit the root lockfile when changing a dependency. Do not commit generated `dist` directories,
 tarballs, credentials, or provider output containing private data.
 
-`verify` type-checks both packages, runs deterministic tests and offline examples,
+`verify` type-checks core and both integrations, runs deterministic tests and offline examples,
 then builds tarballs and installs them into a temporary consumer outside the
-checkout. That last check needs registry access for Pi dependencies but never
-calls a model. `npm test` is the fast core-only loop; `npm run test:pi` tests Pi.
+checkout. That last check needs registry access for integration dependencies but never
+calls a model. `npm test` is the fast core-only loop; `npm run test:pi` tests Pi; `npm run test:dsh` tests DeepSeek Harness.
 `npm run bench` measures the scheduler without a provider.
 
 Run `npm run audit:dependencies` after `npm ci` to scan the complete dependency

README.md

@@ -4,7 +4,7 @@ Braid coordinates multiple LLM agents as a graph. Define each agent's task and
 which results it needs; Braid runs independent tasks in parallel and passes
 their outputs to the next step.
 
-Use it as a TypeScript/JavaScript library or as an extension for the Pi coding agent.
+Use it as a TypeScript/JavaScript library or as a plugin for Pi or DeepSeek Harness.
 
 [![CI](https://github.com/Epsirom/braid/actions/workflows/ci.yml/badge.svg)](https://github.com/Epsirom/braid/actions/workflows/ci.yml)
 [![npm core](https://img.shields.io/npm/v/%40chrok%2Fbraid?label=%40chrok%2Fbraid)](https://www.npmjs.com/package/@chrok/braid)
@@ -37,6 +37,7 @@ and [execution control](docs/execution-control.md) when you need those features.
 | --- | --- |
 | In your own application | [Install `@chrok/braid`](#install-in-your-application) and supply a model runner |
 | In Pi | [Install `@chrok/pi-braid`](#install-in-pi) to run agents in the background and inspect them in a live panel |
+| In DeepSeek Harness | [Install `@chrok/dsh-braid` from source](integrations/dsh/README.md#install) for background agents and a native Web graph panel |
 
 ## Install in your application
 
@@ -548,6 +549,7 @@ is needed for the test suite; its HTTP requests are intercepted in tests.
 - [`src/workspaces.ts`](src/workspaces.ts): Git snapshots, checkpoint refs, merge
   serialization, local Git tools, and worktree cleanup.
 - [`src/adapters/openai.ts`](src/adapters/openai.ts): optional provider translation.
+- [`integrations/dsh/`](integrations/dsh/): native DeepSeek Harness model/tool adapter, agent-scoped jobs, reminders, and a native Web graph panel.
 - [`integrations/pi/`](integrations/pi/): thin Pi model-registry/tool adapter, Mermaid graph renderer, and live execution renderer (`display.ts`).
 - [`test/`](test/): deterministic scheduling, execution-event, and intercepted HTTP/tool tests.
 

docs/releasing.md

@@ -1,15 +1,17 @@
 # Releasing
 
-Core and Pi are separate public npm packages built from one commit. Both use the
-same version. The core has no runtime dependencies. Pi declares an exact
-`@chrok/braid` dependency and includes only its own compiled integration code.
+Core, Pi, and DSH are separate public npm packages built from one commit. All use
+the same version. The core has no runtime dependencies. Each integration declares
+an exact `@chrok/braid` dependency and includes its own compiled integration code.
 
 ## Registry and source association
 
 The public packages are [@chrok/braid](https://www.npmjs.com/package/@chrok/braid)
 and [@chrok/pi-braid](https://www.npmjs.com/package/@chrok/pi-braid) on npmjs.
-Keep `publishConfig.registry` set to `https://registry.npmjs.org`. Both manifests
-link to `Epsirom/braid`; Pi's `repository.directory` is `integrations/pi`.
+`@chrok/dsh-braid` is a new package awaiting its first publication.
+Keep `publishConfig.registry` set to `https://registry.npmjs.org`. All manifests
+link to `Epsirom/braid`; integration `repository.directory` values are
+`integrations/pi` and `integrations/dsh`.
 The repository About website and README badges provide the reverse links.
 GitHub Packages is a separate registry and is not a mirror in this release flow.
 
@@ -23,9 +25,10 @@ To inspect the public release without npm account credentials:
 ```sh
 npm view @chrok/braid dist-tags description repository homepage gitHead dist.attestations --json
 npm view @chrok/pi-braid dist-tags description repository homepage gitHead dist.attestations --json
+npm view @chrok/dsh-braid dist-tags description repository homepage gitHead dist.attestations --json
 ```
 
-For a release, query the exact `@X.Y.Z` versions too. Confirm both `gitHead`
+For a release, query the exact `@X.Y.Z` versions too. Confirm all `gitHead`
 values match the release commit, the source links point to this repository, and
 provenance identifies this repository's release workflow. The successful
 [Publish runs](https://github.com/Epsirom/braid/actions/workflows/release.yml)
@@ -38,23 +41,23 @@ Version tags (`v*`) cannot be moved or deleted. New GitHub releases are immutabl
 prepare a draft and attach any assets before publishing. Published tag/asset
 corrections require a new version. See [repository settings](repository-settings.md).
 
-1. Update both `package.json` versions, Pi's exact `@chrok/braid` dependency,
+1. Update all `package.json` versions, both integrations' exact `@chrok/braid` dependencies,
    and the root workspace lockfile (`npm install --package-lock-only`). Use a minor version
    for breaking 0.x changes, and describe migrations in the changelog.
 2. Run `npm ci` and `npm run verify` from the repository root.
    The package check verifies clean builds, public ESM imports, declarations,
-   licenses, and Pi registration in a temporary consumer outside the checkout.
+   licenses, Pi/DSH background jobs, and the DSH browser entry in temporary consumers outside the checkout.
    A temporary local registry serves the unpublished core tarball; installing
-   only the Pi tarball must fetch core transitively through its version dependency.
+   either integration tarball must fetch core transitively through its version dependency.
 3. Update the changelog, migration guidance, package descriptions/keywords, and
-   supported Pi version. Reconcile README/Pi development notices and ROADMAP
+   supported Pi/DSH versions. Reconcile README/integration development notices and ROADMAP
    status with the release being prepared; mark publication complete only after
-   both packages are available. Commit and review the changes;
+   all packages are available. Commit and review the changes;
    require the CI matrix to pass before tagging that commit `vX.Y.Z`.
-4. Inspect `npm pack --dry-run` and `npm pack --dry-run` from `integrations/pi`.
+4. Inspect `npm pack --dry-run` from the root, `integrations/pi`, and `integrations/dsh`.
    `prepack` rebuilds each package. Never publish stale prebuilt output.
 5. Prepare the GitHub release draft using the release-note policy below. After
-   publishing, verify both registry versions, `latest` tags, provenance, and a
+   publishing, verify all registry versions, `latest` tags, provenance, and a
    clean install before reporting the release complete.
 
 ## Release notes and contributor credit
@@ -97,7 +100,7 @@ recovery codes private.
 
 Log in locally with `npm login --registry=https://registry.npmjs.org`; confirm the
 account with `npm whoami`. Publish the core with `npm publish --access public`,
-then run `npm publish --access public` from `integrations/pi`. Complete npm's
+then run `npm publish --access public` from each integration directory. Complete npm's
 interactive account/2FA checks if requested. Never put credentials in source,
 issues, shell history, or CI logs. An npm registration alone does not guarantee
 ownership of a previously used package name.
@@ -108,7 +111,7 @@ Allow time for the exact versions to become available through `npm view`; do not
 republish or bump versions just to work around this delay.
 
 After availability is confirmed, install the registry versions in a fresh project and verify
-both exported core entry points and the Pi extension. Add the actual publication
+both exported core entry points and the Pi/DSH integrations. Add the actual publication
 date to the changelog and create the corresponding GitHub release.
 
 ## Subsequent releases with trusted publishing
@@ -126,21 +129,23 @@ With npm 11.20 or later, the equivalent CLI setup is:
 ```sh
 npm trust github @chrok/braid --file release.yml --repo Epsirom/braid --allow-publish
 npm trust github @chrok/pi-braid --file release.yml --repo Epsirom/braid --allow-publish
+npm trust github @chrok/dsh-braid --file release.yml --repo Epsirom/braid --allow-publish
 npm trust list @chrok/braid
 npm trust list @chrok/pi-braid
+npm trust list @chrok/dsh-braid
 ```
 
 Publishing a non-prerelease GitHub release triggers `.github/workflows/release.yml`.
 It validates the tag/version relationship, repeats all checks, and publishes
-core then Pi using short-lived OIDC credentials. After each publish (or retry
+core then Pi and DSH using short-lived OIDC credentials. After each publish (or retry
 of an existing version), it waits for matching version/commit metadata and a
-successful tarball download. Pi is not published until core is available. npm
+successful tarball download. Integrations are not published until core is available. npm
 processing is polled every 15 seconds for up to 10 minutes; a timeout fails the
 workflow with retry instructions. It does not require `NPM_TOKEN`.
 The workflow installs npm 11 and uses Node 24. See
 [npm's trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/).
 
-If the second publish fails, rerun the same workflow after resolving the error.
+If a later publish fails, rerun the same workflow after resolving the error.
 The script skips an existing version only when npm records the exact current
 Git commit as its `gitHead`. A collision from another commit fails explicitly;
 never unpublish/reuse a version to repair it. Publish a new patch instead.