DMY-59: establish Web-first phone workbench

.github/workflows/deepseek-harness-plugin-ci.yml

@@ -3,11 +3,19 @@ name: DeepSeek Harness Plugin CI
 on:
   push:
     paths:
+      - 'packages/device-runtime/**'
+      - 'packages/phone-agent/**'
+      - 'packages/task-service/**'
+      - 'packages/workbench/**'
       - 'deepseek-harness-plugin/**'
       - '.agents/plugins/marketplace.json'
       - '.github/workflows/deepseek-harness-plugin-ci.yml'
   pull_request:
     paths:
+      - 'packages/device-runtime/**'
+      - 'packages/phone-agent/**'
+      - 'packages/task-service/**'
+      - 'packages/workbench/**'
       - 'deepseek-harness-plugin/**'
       - '.agents/plugins/marketplace.json'
       - '.github/workflows/deepseek-harness-plugin-ci.yml'
@@ -23,9 +31,12 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: deepseek-harness-plugin
+        working-directory: ${{ runner.temp }}/opengui-build/deepseek-harness-plugin
     steps:
       - uses: actions/checkout@v4
+      - name: Export isolated adapter and shared core
+        working-directory: ${{ github.workspace }}
+        run: node packages/device-runtime/build.mjs stage dsh "$RUNNER_TEMP/opengui-build"
       - uses: pnpm/action-setup@v4
         with:
           version: 11.19.0
@@ -94,9 +105,12 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: deepseek-harness-plugin
+        working-directory: ${{ runner.temp }}/opengui-build/deepseek-harness-plugin
     steps:
       - uses: actions/checkout@v4
+      - name: Export isolated adapter and shared core
+        working-directory: ${{ github.workspace }}
+        run: node packages/device-runtime/build.mjs stage dsh "$RUNNER_TEMP/opengui-build"
       - uses: pnpm/action-setup@v4
         with:
           version: 11.19.0

.github/workflows/opengui-codex-ci.yml

@@ -3,10 +3,18 @@ name: Standalone OpenGUI Codex CI
 on:
   pull_request:
     paths:
+      - 'packages/device-runtime/**'
+      - 'packages/phone-agent/**'
+      - 'packages/workbench/**'
+      - 'packages/task-service/**'
       - 'plugins/opengui/**'
       - '.github/workflows/opengui-codex-*.yml'
   push:
     paths:
+      - 'packages/device-runtime/**'
+      - 'packages/phone-agent/**'
+      - 'packages/workbench/**'
+      - 'packages/task-service/**'
       - 'plugins/opengui/**'
       - '.github/workflows/opengui-codex-*.yml'
 
@@ -33,24 +41,24 @@ jobs:
       - name: Copy only the standalone source into an isolated build root
         shell: bash
         run: |
-          cp -R plugins/opengui "$RUNNER_TEMP/opengui"
+          node packages/device-runtime/build.mjs stage codex "$RUNNER_TEMP/opengui-build"
           test ! -e "$RUNNER_TEMP/deepseek-harness-plugin"
       - name: Install without lifecycle hooks
-        working-directory: ${{ runner.temp }}/opengui
+        working-directory: ${{ runner.temp }}/opengui-build/plugins/opengui
         run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Test and validate the isolated package
-        working-directory: ${{ runner.temp }}/opengui
+        working-directory: ${{ runner.temp }}/opengui-build/plugins/opengui
         run: pnpm check
       - name: Produce the allowlisted upload and archive
-        working-directory: ${{ runner.temp }}/opengui
+        working-directory: ${{ runner.temp }}/opengui-build/plugins/opengui
         run: |
           pnpm package
           bash -n scripts/install-macos.command
           node scripts/test-installer.mjs
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: opengui-codex-${{ matrix.os }}
-          path: ${{ runner.temp }}/opengui/.artifacts/
+          path: ${{ runner.temp }}/opengui-build/plugins/opengui/.artifacts/
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 7

.github/workflows/opengui-codex-release.yml

@@ -33,17 +33,17 @@ jobs:
         with:
           node-version: 22.23.2
       - name: Copy the independent package
-        run: cp -R plugins/opengui "$RUNNER_TEMP/opengui"
+        run: node packages/device-runtime/build.mjs stage codex "$RUNNER_TEMP/opengui-build"
       - name: Build and validate without DSH
-        working-directory: ${{ runner.temp }}/opengui
+        working-directory: ${{ runner.temp }}/opengui-build/plugins/opengui
         run: |
           pnpm install --frozen-lockfile --ignore-scripts
           pnpm check
           pnpm package
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: opengui-codex-release
-          path: ${{ runner.temp }}/opengui/.artifacts/
+          path: ${{ runner.temp }}/opengui-build/plugins/opengui/.artifacts/
           include-hidden-files: true
           if-no-files-found: error
   release-draft:

.github/workflows/workbuddy-plugin-ci.yml

@@ -3,10 +3,18 @@ name: WorkBuddy Plugin CI
 on:
   push:
     paths:
+      - 'packages/device-runtime/**'
+      - 'packages/phone-agent/**'
+      - 'packages/workbench/**'
+      - 'packages/task-service/**'
       - 'workbuddy-plugin/**'
       - '.github/workflows/workbuddy-plugin-*.yml'
   pull_request:
     paths:
+      - 'packages/device-runtime/**'
+      - 'packages/phone-agent/**'
+      - 'packages/workbench/**'
+      - 'packages/task-service/**'
       - 'workbuddy-plugin/**'
       - '.github/workflows/workbuddy-plugin-*.yml'
 
@@ -20,41 +28,51 @@ jobs:
     strategy:
       matrix:
         node: ['22.19.0', '24']
-    defaults:
-      run:
-        working-directory: workbuddy-plugin
     steps:
       - uses: actions/checkout@v4
+      - name: Export isolated adapter and shared core
+        shell: bash
+        working-directory: ${{ github.workspace }}
+        run: node packages/device-runtime/build.mjs stage workbuddy "$RUNNER_TEMP/opengui-build"
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           cache: npm
           cache-dependency-path: workbuddy-plugin/package-lock.json
       - run: npm ci
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm run pack:release
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm audit --omit=dev --audit-level=moderate
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
   macos-package:
     runs-on: macos-latest
     timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: workbuddy-plugin
     steps:
       - uses: actions/checkout@v4
+      - name: Export isolated adapter and shared core
+        shell: bash
+        working-directory: ${{ github.workspace }}
+        run: node packages/device-runtime/build.mjs stage workbuddy "$RUNNER_TEMP/opengui-build"
       - uses: actions/setup-node@v4
         with:
           node-version: '22.19.0'
           cache: npm
           cache-dependency-path: workbuddy-plugin/package-lock.json
       - run: npm ci
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm run pack:release
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: node scripts/test-publish.mjs
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: node scripts/test-release-installer.mjs
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm run test:native
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - uses: actions/upload-artifact@v4
         with:
           name: workbuddy-candidate
-          path: workbuddy-plugin/dist/*
+          path: ${{ runner.temp }}/opengui-build/workbuddy-plugin/dist/*
           if-no-files-found: error
   packaged-startup:
     needs: [check, macos-package]
@@ -64,20 +82,24 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        working-directory: workbuddy-plugin
     steps:
       - uses: actions/checkout@v4
+      - name: Export isolated adapter and shared core
+        shell: bash
+        working-directory: ${{ github.workspace }}
+        run: node packages/device-runtime/build.mjs stage workbuddy "$RUNNER_TEMP/opengui-build"
       - uses: actions/setup-node@v4
         with:
           node-version: '22.19.0'
           cache: npm
           cache-dependency-path: workbuddy-plugin/package-lock.json
       - run: npm ci
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm run check
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - uses: actions/download-artifact@v4
         with:
           name: workbuddy-candidate
-          path: workbuddy-plugin/dist
+          path: ${{ runner.temp }}/opengui-build/workbuddy-plugin/dist
       - run: npm run smoke:packed
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin

.github/workflows/workbuddy-plugin-release.yml

@@ -24,27 +24,35 @@ jobs:
     timeout-minutes: 20
     env:
       OPENGUI_PRERELEASE: ${{ github.event_name == 'push' || inputs.prerelease }}
-    defaults:
-      run:
-        working-directory: workbuddy-plugin
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Export isolated adapter and shared core
+        shell: bash
+        working-directory: ${{ github.workspace }}
+        run: node packages/device-runtime/build.mjs stage workbuddy "$RUNNER_TEMP/opengui-build"
       - uses: actions/setup-node@v4
         with:
           node-version: '22.19.0'
           cache: npm
           cache-dependency-path: workbuddy-plugin/package-lock.json
       - name: Require main ancestry
+        working-directory: ${{ github.workspace }}
         run: git merge-base --is-ancestor HEAD origin/main
       - run: npm ci
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm run pack:release
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - run: npm run smoke:packed
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - name: Require real WorkBuddy acceptance for stable publication
         if: env.OPENGUI_PRERELEASE != 'true'
         run: node scripts/validate.mjs --release
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin
       - name: Publish immutable WorkBuddy assets
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
         run: node scripts/publish.mjs
+        working-directory: ${{ runner.temp }}/opengui-build/workbuddy-plugin

deepseek-harness-plugin/README.md

@@ -1,8 +1,10 @@
 # OpenGUI
 
+> Current candidate phone execution is host-driven: the current DSH conversation model plans and inspects screenshots through `opengui_manage_task next/decide`. The workbench has no separate model configuration. `/opengui` opens the workbench; `/opengui <goal>` submits once and hands the accepted task back to the host. Embedded homepage handoff uses `/opengui continue <taskId>`. Closing the page does not stop execution, but execution cannot continue without host decisions. New phone tasks currently support macOS only. Dedicated-model and router/subagent instructions below describe legacy/browser paths, not the new phone workbench. See the [current Chinese flow](README.zh.md). Real DSH host/model acceptance remains pending.
+
 English | [中文](README.zh.md)
 
-`dsh-coremate-mobile` is the OpenGUI plugin for DeepSeek Harness. It uses restricted child tasks to control authorized Android phones and a plugin-managed local browser. It provides `/opengui` and the `phone_agent` and `browser_agent` delegation tools. OpenGUI prefers the model already selected in the receiving DSH conversation; a separate visual model is only a compatibility fallback. The legacy `/coremate` command remains available for compatibility.
+`dsh-coremate-mobile` is the OpenGUI plugin for DeepSeek Harness. Current phone tasks use host decisions and a shared device runtime; the plugin-managed local browser retains its existing execution path. It provides `/opengui` and the `phone_agent` and `browser_agent` delegation tools. New phone tasks use the model selected in the receiving DSH conversation, without a separate model fallback. The legacy `/coremate` command remains available for compatibility.
 
 The plugin does not modify DeepSeek Harness and does not depend on CoreMateDesktop2, system Chrome, Python, or Hermes CLI. Chromium is installed on demand only after the first browser task receives user approval.