feat(desktop): integrate DeepSeek Harness

desktop/frontend/agent_model.mbt

@@ -1,23 +1,27 @@
-// The unified model chip: one composer control whose grouped menu spans both
-// agents. Picking an option decides an (agent, model) pair — the state is two
-// facts even though the control is one select. A conversation's agent is
+// The unified model chip: one composer control whose grouped menu spans every
+// available agent. Picking an option decides an (agent, model) pair — the
+// state is two facts even though the control is one select. A conversation's agent is
 // fixed by its first turn; only a composing conversation (an OpenSeek chat
 // with nothing sent, or a Codex draft with no app-server thread) may still be
-// handed to the other agent, so only those chips offer both groups.
+// handed to another agent, so only those chips offer cross-agent groups. dsh
+// cannot list models before a session exists, so its entry creates that
+// session first; the dsh composer then renders the authoritative catalog.
 
 ///|
 /// Which agent runs a conversation. Persisted as the default for the next
 /// "New chat"; a conversation that has begun never changes agents.
 priv enum AgentChoice {
   OpenSeekAgent
   CodexAgent
+  DshAgent
 } derive(Eq)
 
 ///|
 fn AgentChoice::wire(self : AgentChoice) -> String {
   match self {
     OpenSeekAgent => "openseek"
     CodexAgent => "codex"
+    DshAgent => "dsh"
   }
 }
 
@@ -26,6 +30,7 @@ fn AgentChoice::parse(value : String) -> AgentChoice? {
   match value.trim().to_owned() {
     "openseek" => Some(OpenSeekAgent)
     "codex" => Some(CodexAgent)
+    "dsh" => Some(DshAgent)
     _ => None
   }
 }
@@ -43,6 +48,12 @@ priv enum ModelChoice {
   // is a request to open the Codex page, where sign-in and connection state
   // live; it never changes the selected model.
   CodexUnavailablePick
+  // dsh's model catalog belongs to one concrete session. A ready pick creates
+  // that session in the current local project; the placeholder opens the dsh
+  // page so its connection problem can be resolved without pretending that a
+  // model is already selectable.
+  DshNewConversation
+  DshUnavailablePick
 }
 
 ///|
@@ -54,12 +65,20 @@ const CodexChoicePrefix = "codex:"
 ///|
 const CodexUnavailableChoiceWire = "codex.unavailable"
 
+///|
+const DshNewConversationWire = "dsh:new"
+
+///|
+const DshUnavailableChoiceWire = "dsh.unavailable"
+
 ///|
 fn ModelChoice::wire(self : ModelChoice) -> String {
   match self {
     OpenSeekModel(model) => OpenSeekChoicePrefix + model.wire()
     CodexModel(id) => CodexChoicePrefix + id
     CodexUnavailablePick => CodexUnavailableChoiceWire
+    DshNewConversation => DshNewConversationWire
+    DshUnavailablePick => DshUnavailableChoiceWire
   }
 }
 
@@ -68,6 +87,12 @@ fn ModelChoice::parse(value : String) -> ModelChoice? {
   if value == CodexUnavailableChoiceWire {
     return Some(CodexUnavailablePick)
   }
+  if value == DshNewConversationWire {
+    return Some(DshNewConversation)
+  }
+  if value == DshUnavailableChoiceWire {
+    return Some(DshUnavailablePick)
+  }
   if value.has_prefix(OpenSeekChoicePrefix) {
     let rest = value.view(start_offset=OpenSeekChoicePrefix.length()).to_owned()
     return EngineModel::parse(rest).map(model => OpenSeekModel(model))
@@ -96,6 +121,8 @@ test "model choices round-trip and the agent namespaces stay disjoint" {
   assert_true(
     ModelChoice::parse("codex.unavailable") is Some(CodexUnavailablePick),
   )
+  assert_true(ModelChoice::parse("dsh:new") is Some(DshNewConversation))
+  assert_true(ModelChoice::parse("dsh.unavailable") is Some(DshUnavailablePick))
   assert_true(ModelChoice::parse("codex:") is None)
   assert_true(ModelChoice::parse("openseek:") is None)
   inspect(
@@ -113,10 +140,21 @@ test "model choices round-trip and the agent namespaces stay disjoint" {
 test "agent choices round-trip their wire names" {
   assert_true(AgentChoice::parse("openseek") is Some(OpenSeekAgent))
   assert_true(AgentChoice::parse("codex") is Some(CodexAgent))
+  assert_true(AgentChoice::parse("dsh") is Some(DshAgent))
   assert_true(AgentChoice::parse("") is None)
   assert_true(AgentChoice::parse("claude") is None)
   inspect(AgentChoice::OpenSeekAgent.wire(), content="openseek")
   inspect(AgentChoice::CodexAgent.wire(), content="codex")
+  inspect(AgentChoice::DshAgent.wire(), content="dsh")
+}
+
+///|
+test "the dsh group stays an honest doorway until dsh can create a session" {
+  let group = { ..test_model(), is_desktop: true }.dsh_model_group()
+  assert_eq(group.label, "DeepSeek Harness")
+  assert_eq(group.options.length(), 1)
+  assert_eq(group.options[0].value, DshUnavailableChoiceWire)
+  assert_eq(group.options[0].label, "Open DeepSeek Harness")
 }
 
 ///|
@@ -165,11 +203,33 @@ fn Model::codex_model_group(self : Model) -> @composer.ModelGroup {
   }
 }
 
+///|
+/// dsh cannot answer `session.models` until a session exists. Keep that fact
+/// explicit in the unified menu: a ready row creates a conversation, while an
+/// unavailable row only opens the dsh page and asks its actor to reconnect.
+fn Model::dsh_model_group(self : Model) -> @composer.ModelGroup {
+  if self.dsh.can_create() {
+    {
+      label: "DeepSeek Harness",
+      options: [
+        { value: DshNewConversationWire, label: "New DeepSeek Harness chat" },
+      ],
+    }
+  } else {
+    {
+      label: "DeepSeek Harness",
+      options: [
+        { value: DshUnavailableChoiceWire, label: "Open DeepSeek Harness" },
+      ],
+    }
+  }
+}
+
 ///|
 /// The unified model chip on an OpenSeek conversation. A conversation that
-/// has not begun may still be handed to Codex, so its chip offers both
-/// groups; once the transcript exists the agent is fixed and the menu
-/// narrows to OpenSeek's tiers.
+/// has not begun may still be handed to another available local agent; once
+/// the transcript exists the agent is fixed and the menu narrows to
+/// OpenSeek's tiers.
 fn Model::openseek_model_chip(
   self : Model,
   dispatch : @cmd.Emit[Msg],
@@ -180,6 +240,12 @@ fn Model::openseek_model_chip(
   ]
   if self.composing_new_chat() {
     groups.push(self.codex_model_group())
+    // dsh lives in this native process. A remote or browser conversation has
+    // no local project authority to hand to it, so do not advertise a switch
+    // whose workspace could not be preserved.
+    if self.is_desktop && self.focused == @interop.ChannelId::Local {
+      groups.push(self.dsh_model_group())
+    }
   }
   @composer.ModelSelect::{
     groups,
@@ -219,8 +285,8 @@ fn Model::openseek_reasoning_chip(
 
 ///|
 /// The unified model chip on the Codex page. A composing draft may still be
-/// handed back to OpenSeek; a stored thread's transcript is Codex's alone,
-/// so its menu narrows to Codex models.
+/// handed to OpenSeek or local dsh; a stored thread's transcript is Codex's
+/// alone, so its menu narrows to Codex models.
 fn Model::codex_model_chip(
   self : Model,
   dispatch : @cmd.Emit[Msg],
@@ -230,6 +296,11 @@ fn Model::codex_model_chip(
     groups.push(openseek_model_group(self.default_model))
   }
   groups.push(self.codex_model_group())
+  if self.codex.composing_draft() &&
+    self.is_desktop &&
+    self.focused == @interop.ChannelId::Local {
+    groups.push(self.dsh_model_group())
+  }
   let selected = match self.codex.model_listing() {
     CodexModels(_, selected~) => ModelChoice::CodexModel(selected).wire()
     CodexModelsUnavailable(_) => CodexUnavailableChoiceWire

desktop/frontend/archive.mbt

@@ -186,6 +186,40 @@ fn delete_archived_session(
   })
 }
 
+///|
+/// The confirmation staged before archiving a DeepSeek Harness conversation.
+/// dsh's archive set is append-only — no client, dsh's own included, can bring
+/// one back — so this is the same class of decision as a permanent delete,
+/// even though the transcript stays on disk.
+priv struct DshArchiveConfirm {
+  session_id : String
+  title : String
+} derive(Debug, Eq)
+
+///|
+fn dsh_archive_modal(
+  dispatch : @cmd.Emit[Msg],
+  confirm : DshArchiveConfirm,
+) -> @html.Html {
+  @html.div(class="modal-backdrop", on_click=dispatch(CancelDshArchive), [
+    @html.div(class="modal", [
+      @html.div(class="modal-title", "Archive this conversation?"),
+      @html.div(
+        class="modal-body",
+        "“\{confirm.title}” disappears from DeepSeek Harness for good: nothing in dsh can bring an archived conversation back. Its transcript stays on disk, and project files and Git branches remain.",
+      ),
+      @html.div(class="modal-actions", [
+        @html.button(on_click=dispatch(CancelDshArchive), "Cancel"),
+        @html.button(
+          class="danger",
+          on_click=dispatch(ConfirmDshArchive),
+          "Archive",
+        ),
+      ]),
+    ]),
+  ])
+}
+
 ///|
 /// Permanent archived-chat deletion requires a second, explicit click. The
 /// copy names what disappears and what survives so the user does not have to

desktop/frontend/boot.mbt

@@ -176,6 +176,7 @@ fn SidebarDispatcher::conversation_open(
     }
     "codex.live" => self.emit(CodexOpenThread(id.conversation()))
     "codex.draft" => self.emit(OpenCodex)
+    "dsh.live" => self.emit(DshOpenSession(id.conversation()))
     source => self.unroutable("open", "source \{source}")
   }
 }
@@ -191,6 +192,7 @@ fn SidebarDispatcher::conversation_archive(
   match id.source() {
     "openseek.live" => self.emit(ArchiveSession(channel, id.conversation()))
     "codex.live" => self.emit(CodexArchiveThread(id.conversation()))
+    "dsh.live" => self.emit(DshArchiveSession(id.conversation()))
     source => self.unroutable("archive", "\{source}@\{id.channel()}")
   }
 }
@@ -246,6 +248,7 @@ fn SidebarDispatcher::project_new(
       }
       self.emit(NewChatIn(channel, Some(project)))
     }
+    "dsh.workspaces" => self.emit(DshNewSessionIn(id.root()))
     source => self.unroutable("new chat", "\{source}@\{id.channel()}")
   }
 }
@@ -272,6 +275,12 @@ fn SidebarDispatcher::project_detach(
   guard @interop.ChannelId::from_uri_authority(id.channel()) is Some(channel) else {
     return self.unroutable("detach", "channel \{id.channel()}")
   }
+  // A dsh row is keyed by Workspace id rather than by path: dsh owns that
+  // registry, and detaching there means forgetting the grouping, not the
+  // directory.
+  if id.source() == "dsh.workspaces" {
+    return self.emit(DshRemoveWorkspace(id.root()))
+  }
   guard @resource.of_path(channel, id.root()) is Some(project) else {
     return @cmd.none
   }
@@ -289,6 +298,7 @@ fn SidebarDispatcher::section_primary(
   match id.source() {
     "openseek.projects" => self.emit(PickProject(channel))
     "openseek.chats" => self.emit(NewChatIn(channel, None))
+    "dsh" => self.emit(DshNewSession)
     source => self.unroutable("section action", "source \{source}")
   }
 }
@@ -298,7 +308,10 @@ fn SidebarDispatcher::placeholder_open(
   self : SidebarDispatcher,
   id : String,
 ) -> @cmd.Cmd {
-  self.unroutable("placeholder action", id)
+  match id {
+    "dsh.open" => self.emit(OpenDsh)
+    _ => self.unroutable("placeholder action", id)
+  }
 }
 
 ///|
@@ -501,6 +514,21 @@ pub fn boot() -> Unit {
       codex_composer_input,
       emit.map(action => CodexComposerAction(action)),
     )
+    let dsh_emit = emit.map(msg => Dsh(msg))
+    let dsh_composer_input = state.map(model => {
+      model.dsh.composer_input(dsh_emit)
+    })
+    let dsh_composer_html = @composer.component(
+      dsh_composer_input,
+      emit.map(action => Dsh(@dsh.Msg::composer_action(action))),
+    )
+    // Rabbita combines at most nine incremental values in one root view.
+    // Codex and dsh are mutually exclusive conversation pages, so carry their
+    // independently stateful composer components as one external-page pair.
+    let external_composers = codex_composer_html.map2(dsh_composer_html, (
+      codex,
+      dsh,
+    ) => (codex, dsh))
     let sidebar_input = state.map(model => model.sidebar_component_input())
     let sidebar_html = @sidebar.component(
       sidebar_input,
@@ -520,7 +548,7 @@ pub fn boot() -> Unit {
       transcript_html,
       right_panel_html,
       composer_html,
-      codex_composer_html,
+      external_composers,
       sidebar_html,
       quick_open_html,
       skills_html,
@@ -530,11 +558,12 @@ pub fn boot() -> Unit {
         transcript_html,
         right_panel_html,
         composer_html,
-        codex_composer_html,
+        external_composers,
         sidebar_html,
         quick_open_html,
         skills_html,
       ) => {
+        let (codex_composer_html, dsh_composer_html) = external_composers
         view(
           emit,
           terminal_emit(@terminal.ToggleTerminal),
@@ -545,6 +574,7 @@ pub fn boot() -> Unit {
           right_panel_html,
           composer_html,
           codex_composer_html,
+          dsh_composer_html,
           sidebar_html,
           quick_open_html,
           skills_html,

desktop/frontend/bridge.mbt

@@ -186,6 +186,20 @@ fn bridge_msg(
       } else {
         None
       }
+    // dsh is a native Desktop-only source. The host never relays these
+    // notifications, but keep the Local guard explicit at the frontend edge.
+    DshStatusChanged(payload) =>
+      if channel is Local {
+        Some(Dsh(@dsh.Msg::status_changed(payload.to_json())))
+      } else {
+        None
+      }
+    DshEvent(payload) =>
+      if channel is Local {
+        Some(Dsh(@dsh.Msg::event(payload.to_json())))
+      } else {
+        None
+      }
     _ => device_msg(channel, notification).map(msg => FromDevice(channel, msg))
   }
 }
@@ -365,7 +379,7 @@ fn proton_event_methods() -> Array[@protocol.NotificationKind] {
 }
 
 ///|
-test "proton subscribes to all Codex app-server events" {
+test "proton subscribes to local Codex and dsh events" {
   assert_true(
     proton_event_methods().contains(
       @protocol.NotificationKind::CodexStatusChanged,
@@ -392,6 +406,26 @@ test "proton subscribes to all Codex app-server events" {
     )
     is Some(Codex(channel=Local, _)),
   )
+  assert_true(
+    proton_event_methods().contains(
+      @protocol.NotificationKind::DshStatusChanged,
+    ),
+  )
+  assert_true(
+    proton_event_methods().contains(@protocol.NotificationKind::DshEvent),
+  )
+  assert_true(
+    bridge_msg(
+      Local,
+      @protocol.Notification::DshEvent({
+        stream: "host",
+        message: {},
+        generation: 0,
+        session_revision: 0,
+      }),
+    )
+    is Some(Dsh(_)),
+  )
 }
 
 ///|