@vibeinging/dsh-work-product-host-ipc

This desktop-adapter Bundle exposes session-bound product services and narrow browserWorkspaceHost, fileDialogHost, and windowHost services. The Browser Workspace, native file dialogs, and window operations stay in Electron's trusted main process; the official Web and Client Bundles never receive a preload, Electron object, or generic IPC channel.

Browser methods accept only HTTP(S) targets, bounded tab identifiers, bounded layout values, and explicit session context. File dialogs accept only bounded titles, filters, and user-visible open operations; interactive file-dialog requests use a longer bounded wait so a user can finish the native panel, while cancellation still follows the initiating Session. Window methods are limited to reading state, focusing, minimizing, maximizing, and restoring. Unknown methods, unbound DSH Sessions, unsafe URLs, arbitrary paths, and JavaScript execution are rejected.

This private DSH Profile Bundle is the desktop transport adapter between the DSH child process and the DSH Desktop parent. It owns the correlated product-request, product-cancel, and product-response wire, then provides narrow Cordis services: productHost for parent-authorized conversation creation plus project, context, Canvas, and structured UI capabilities, officeArtifactHost for Office artifact inspection, creation, and editing, and the native services described above.

Each official Web Agent announces its DSH Session to the parent for the lifetime of that Agent. Before serving a business ProductHost method, the parent checks the official Workspace account and Session cwd, then creates a durable App Session binding. It first reuses an existing binding or project source-folder membership. On a single-user desktop, an unmapped official Workspace receives one App project and writable source-folder mapping derived from the official Workspace title and path. Conflicting folders or multiple active App users stay native-only instead of guessing an identity. A native-only Session may query conversationCreateScope and use only the DESKTOP_NATIVE_METHODS allowlist; releasing its Agent removes that authorization and aborts pending native requests. The scope query returns whether conversation creation belongs to the product parent or the ordinary DSH Session Controller.

Feature Bundles consume those services and never import the desktop server, database, Renderer, Electron preload, or process wire. Every call carries the initiating DSH Session id and optional cancellation signal. Consumers query conversationCreateScope before creation: a product-bound caller uses conversationCreate, while a DSH-only caller uses the official Session Controller. For conversationCreate, the parent derives user and project only from the binding, creates the App Session and DSH Session together, and registers the new binding before returning both ids. The parent remains responsible for resolving the App Session, user, project, permissions, credentials, storage, and method allowlist.

This package is a desktop-adapter, not a portable official-Web plugin. It requires the Electron-owned parent IPC channel. The split keeps the consumer contracts independent from transport so a future published DSH ProductHost provider can replace this adapter without moving tool or UI behavior back into the shell.