Install the exact GitHub release without using npm.

dsh plugin --profile web add github:ZJUZhiyuCai/dsh-ivory#v0.2.14

Remove Ivory and return to the native DSH interface.

dsh plugin --profile web remove dsh-ivory

npm ci
npm test          # renderer/host-contract unit tests, build, release gates, publint, and package checks
npm run test:desktop  # 94 checks with installed desktop and Web styles
npm run qa:r2     # browser regressions; missing optional-plugin targets report skips
npm run qa:adversarial  # 34 stress checks: reconciliation safety, toggle/resize storms, degraded mode
npm run qa:activity     # 26 checks for thinking/tool-call rows, icons, and terminal polish
npm run qa:micro        # 28 Vision Toolkit/Ivory micro-component checks; set DVT_CLIENT_JS if the toolkit is not installed in the DSH web profile
npm run qa:host         # 13 checks against the live host: contract health, sidebar/composer/settings surfaces, both themes
npm run qa:contract     # diagnostic probe (no pass/fail): self-diagnosis channel plus a live selector inventory
npm run derive:host     # re-derive the desktop CSS-module alias table from the installed DSH; run after every host upgrade
npm run snapshot:host   # compare committed module snapshots with both installed hosts
npm run test:runtime    # isolated browser regressions; no DSH server or token required

derive:host previews a mapping resolved by package, CSS module and member name. Use npm run derive:host -- --check to fail on drift, or npm run derive:host -- --write to save a complete result. Missing or ambiguous modules fail without writing a partial table. Update the recorded host versions, peer range and any desktop-only selectors when adapting a new host release. Then run npm run snapshot:host -- --write to extract matching module exports from both installed hosts. The default tests and release gates compare the actual alias table with these versioned snapshots, including component identity.

npm test includes isolated browser checks for content replacement, bounded Markdown rendering, copy-button ownership, storage failures and drift diagnostics. Install its browser once with npx --no-install playwright-core install chromium, or set DSH_QA_CHROMIUM to an existing browser. CI installs Chromium automatically. Complex Markdown retains the complete source when its render budget is exceeded. Preference changes work for the current session even when storage is unavailable.

The live browser entries require DSH_QA_TOKEN from the dsh web URL. Every qa:* entry point is documented here and checked by the release gate.

The browser suite covers responsive layout, composer focus, dark mode, Markdown injection attempts, streaming state, lifecycle cleanup, block-copy payloads, plugin coexistence, long tables, reduced motion, and forced colors.

Releases use npm Trusted Publisher with GitHub OIDC. The repository stores no long-lived npm publish token, and future CI releases receive npm provenance automatically.

npm ci
npm run build

dsh plugin --profile web add link:$PWD
dsh web

Edit src/skin.css, src/client.template.js, or src/markdown.js, then run npm run build. The generated lib/client.js is committed so GitHub installs need no build permission.

src/skin.css             theme and compatibility styles
src/client.template.js   client lifecycle and optional enhancements
src/markdown.js          capped DOM-built Markdown preview renderer
scripts/test-markdown.mjs  renderer unit tests (node --test)
lib/client.js            deterministic generated browser bundle
lib/index.js             inert host entry point
cordis.patch.yml         DSH bundle registration
scripts/                 build and verification gates

See CONTRIBUTING.md before opening a pull request.