feat(site-packs): add DeepSeek Harness pack and support http origins

[urzeye]

描述 Description

Adds a declarative site pack for self-hosted DeepSeek Harness instances, and lifts the production HTTPS-only restriction that made such instances impossible to bind in the first place.

1. HTTP origin support (b410987b)

Self-hosted AI instances are commonly served over plain HTTP, but every http:// surface was gated behind IS_DEVELOPMENT_BUILD via site-pack-http-policy.ts.

The lower layers already handled http — match pattern parsing, origin canonicalization, optional_host_permissions, userscript match coverage — so only the policy flag stood in the way. Rather than flipping it globally, the policy is split along the trust boundary:

Surface	Before	After
Custom origin binding	dev builds only	always
Local JSON import	dev builds only	always
Site adapter wizard	dev builds only	always
Re-reading installed packs	dev builds only	always
Registry-distributed packs	dev builds only	never

Registry packs staying HTTPS-only matches what registry/scripts/validate.mjs already enforces in CI, and removes the prior inconsistency where a development build would accept a registry pack carrying http matches.

site-pack-http-policy.ts degenerated into a constant once the split was made, so it and its test are removed. The wizard issue code https-required becomes unsupported-scheme (it now only rejects non-http(s) protocols), the unused sitePacksBindingHttpsRequired string is dropped, and sitePacksBindingHint is reworded — all synced across the 11 locales.

2. DeepSeek Harness site pack (59ba8ada)

registry/sites/deepseek-harness.json — outline, outline-user-queries, export-basic, generation-detect, stop-generation, width, zen, prompt-insert, reading-history.

Selectors rely only on the stable data-slot / data-chat-flow render hooks. The CSS module class names are lightningcss build hashes and the aria-labels are localized, so neither is used.

• matches is empty — self-hosted instances are activated through a user-created origin binding, same as LibreChat and LobeChat.
• Send and stop share one class and differ only by icon, so the buttons are told apart by their SVG path / rect.
• Width sets --dsh-chat-content-width on the conversation root; the composer max width derives from that variable, so chat column, composer and stats line resize together.
• One user turn expands into many assistant-step and tool-call flow items, so export needs turnSelector to keep DOM order — pairing by index would misalign the transcript. Tool calls stay out of the export.
• Zen Mode overrides the AppFrame inline grid-template-columns rather than only hiding the side columns, otherwise the collapsed tracks leave empty gutters.

conversation-list, new-chat, model-lock and theme sync are not declared: the first three have no counterpart in the captured DOM, and the theme preference lives in server-side settings rather than localStorage, so declarative themeSync cannot drive it.

3. Registry metadata (0ab2c4ac)

Raises minAppVersion to 1.2.0 for the five already-shipped packs. This change was already present in the working tree; it is committed separately so it can be reviewed or dropped independently of the rest.

变更类型 Type of change

• ✨ 新功能 (New feature)

验证 Verification

pnpm registry:validate (6 packs) · pnpm format:check · pnpm lint:check (0 errors) · pnpm typecheck · pnpm test (283 passed) · pnpm build · pnpm build:userscript — all pass.

Not verified at runtime. The pack was authored against a captured DOM fragment plus the upstream @deepseek-ai/dsh-client-ui-* package sources; it has not been exercised against a live DeepSeek Harness instance. The Zen Mode rule is the weakest link — the AppFrame structure comes from the package source, since the capture only contained the center column.

关联 Issue Related Issues

#799

[github-actions]

Registry validation passed ✅

All SitePack and patch sources satisfy the schema, safety, ID, and match-conflict checks.