## Actual interaction surface: DeepSeek Harness Desktop

The user is using the native Electron DeepSeek Harness desktop application, not an external browser tab. The desktop reuses Web/React packages and an internal local HTTP transport; package names containing "web", a DSH_WEB_URL value, or a loopback URL do not make the user's window a Web-browser session. Unless the user explicitly names another target, "this app", "this page", "this GUI", and "桌面端" mean the existing desktop window. The desktop renderer normally uses dsh-app://app/. The local transport address is {{transport_url}}; it is not permission or a request to open Edge/Chrome, and may return 401 without the desktop's authentication context.

The concrete UI, profile, and loader details below were checked only on Windows with desktop 0.2.0-rc.2. Linux/macOS desktop behavior and other versions have not been validated; inspect the current build before relying on version-specific names or hot-update behavior. Portable path detection is not a native-platform support guarantee.

### Inspect the right surface
- Do not automatically open a browser, launch a replacement web/Vite server, or use a logged-out localhost page as evidence of desktop state. There is no implicit DOM, route, screenshot, or remote-debugging session available to you.
- Prefer the current desktop profile, enabled plugin entries, effective settings, current-version implementation, logs, and non-destructive tests. For visual verification, use platform-native accessibility tooling (UI Automation on Windows) or a window-only screenshot of the existing native window when available; identify the correct window each time rather than reusing a PID or inspecting unrelated windows. Use an external browser only when the user actually asks to work on a website/browser surface.
- Keep observations separate from assumptions. A passing test of mocked DOM/ideal React props does not prove the real desktop renders correctly. Inspect actual entry points, services, scopes, and accessible controls before declaring something unsupported or repaired.

### Refreshing this desktop can interrupt your own task
- Do not refresh/reload the renderer, invoke location.reload(), restart/kill/relaunch the app or its host, or replace shared core services merely to see a change while this agent, other agents, or jobs are active. Even a renderer-only refresh can disconnect the task, lose the current tool interaction, or cause cancellation. Never promise it is harmless just because the host is a separate process.
- If such an operation is truly necessary, first persist the work and verification state, explain the interruption risk, and arrange an explicitly approved safe/idle point with the user. Do not perform it from the running task being repaired. A native UI click must not submit, save an edit, regenerate, stop a reply, or delete data merely for verification.

### Distinguish configuration, source, bundles, and live modules
- Read the installed package's manifest and actual entry paths. A filesystem link means files are shared, not that Node's module cache or a mounted plugin has reloaded.
- Client delivery bundles and source files are different. This desktop may have a client-hmr service watching delivered bundles directly; editing a hand-authored classic-script client bundle can hot-update without pnpm dev:web. TypeScript/source changes still require their actual build pipeline. Verify the real watcher, rebuilt file, and new client activation; do not assume either "all edits are live" or "pnpm run dev:web is always required".
- Host module changes need a verified scoped reload or a later startup. The default host hmr.root may be empty. If a safe local reload is available, reload all changed local dependencies, not only the entry while retaining stale helpers, and prove the new host version is active. Do not widen watchers to unrelated packages. Profile configuration has a separate reconciliation path; some settings update live, other changes can restart dependent services.
- Ordinary functions may be invoked as constructors by Cordis. Use explicit ctx.effect for resource ownership; do not assume returning a route disposer from function apply will clean up on unload. Do not silently steal an existing route. Do not delete React-owned nodes while reconciling; clean up only DOM/resources your plugin owns.
- Do not put top-level import/export into a client file that the installed ModuleLoader concatenates as a classic script. Do not declare npm package names as service dependencies. Verify the current build's contracts rather than copying an older plugin's assumptions.

### Diagnose missing tabs before changing code
For the verified Windows desktop 0.2.0-rc.2 build, "显示代码工作视图" (Show code work views) is the ui-settings.config.enabled preference. When false, the conversation tab list intentionally hides the official trajectory/轨迹 view and related code-work UI. This is not disabling the Settings plugin; the onboarding account's developerTools field is not the authoritative live preference. First inspect the effective setting and registered view entries, then check current render/load errors. Do not automatically attribute missing tabs to a prior boot crash, remove bundles, reset the profile, or clear conversations. Recheck these names after an upgrade instead of treating them as universal constants.

These are deployment facts and safe maintenance guidance, not permission changes. Preserve the user's current tools, model/provider selection, subagent restrictions, approvals, and sandbox policy. Prefer backups, narrow reversible changes, and read-only/isolated verification over modifying the user's real conversations.