* feat(bundle): accept an ordered patch file list in dsh.bundle.patch `dsh.bundle.patch` now accepts `string | string[]`. A list names patch files applied in order as one bundle layer; each file's relative plugin paths still resolve beside that file. `bundlePatchPaths` in dsh-app-boot is the one resolver from a declaration to absolute paths, and every reader uses it: profile loading, plugin-manager reconcile and bundle rows, the client-runtime roster, and the workspace, cordis-config, and product-isolation gates. `ProfileLayer.patchPath` becomes `patchPaths`. * fix(bundle): keep declared patch files package-relative in the workspace gate path.join produced backslash entries on Windows, so the expected files list did not match package.json files. bundlePatchFiles returns the validated declaration as written; bundlePatchPaths joins it.
apps/web browser e2e
English | 中文
These tests boot the real web composition in-process and drive it with a real Chromium over real HTTP. The lane's mechanics — modes, fixtures, goldens, and the deliberate composition divergences from dsh web — are documented in scaffold.ts and the browser e2e Agent Note.
Completion observations
State-sensitive cases use Workspace, admission, attachment, and model-stream barriers to separate visible intermediate states from completed operations. Details close waits for frame transitions; archive verification assigns an explicit title to the seeded Session and follows that identity across reload. See the CI fixture synchronization decision.
These are Host-face tests
They type-check in the root tsconfig.host.json, not in the Client aggregate, because they read Host services directly: ctx.connection, the Host SessionStore, and ctx.sessionProjectionCache. Driving a browser at runtime does not make a file part of the Client program — the two faces merge Cordis Context under the same keys with different services, so one program cannot see both. Moving these files into the Client aggregate makes every Host-service access fail to compile.
Do not import @deepseek-ai/dsh-client-* here
Importing a Client package — a value or a type — pulls its whole TypeScript project, and every project it references, into the Host build graph. That has bitten this lane once already: four Client consumer packages reference api/remotes' Client face, which cannot compile until Host tsdown has generated @deepseek-ai/dsh-goal/remote, so the Host build phase ended up waiting on an artifact it produces itself.
When a scenario needs a Client-owned constant or pure function, mirror it here instead, next to the commented-out import that names the source module. A drift then surfaces as a missed selector or a stale mirrored value — a loud failure, never a silent pass. scaffold.ts follows this rule for the welcome-notice namespace, acknowledgement field, version, and asserted Chinese copy.
The built-client harness is the exception. assembled-boot.ts imports AppWebEntry, the boot-manifest type, and RemoteMock; assembled-remote.ts imports the Client test runtime's default responses and RemoteMock. These packages are explicit project references for booting the real shell against a test-owned carrier. The chat scenarios mirror conversationContextKey in support.ts instead of importing its Client owner.
Nothing mechanically enforces this rule; keep it in review.