@fonlan/dsh-quick-commands 0.1.7 → 0.1.8

package/lib/client.js

@@ -825,7 +825,7 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
-		//#region \0dsh-css:/home/runner/work/dsh-quick-commands/dsh-quick-commands/src/client/settings-section.css.mjs
+		//#region \0dsh-css:/Users/fonlan/Repos/dsh-quick-commands/src/client/settings-section.css.mjs
 		const css$1 = "/**\n * Styles for the quick-commands settings page.\n *\n * The page occupies the settings panel content column: a static header\n * (title plus a one-line summary) over the always-visible command editor.\n * Inner controls follow the built-in settings language.\n */\n\n/* page layout */\n\n.qc-page {\n  display: flex;\n  flex-direction: column;\n  gap: 16px;\n  max-width: 720px;\n}\n.qc-page-head {\n  display: flex;\n  flex-direction: column;\n  gap: 6px;\n}\n.qc-page-title {\n  margin: 0;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  font-size: 15px;\n  font-weight: 600;\n  line-height: 1.4;\n}\n.qc-page-sub {\n  margin: 0;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  font-size: 13px;\n  line-height: 1.5;\n}\n\n/* body: workspace / command-set editor */\n\n.qc-settings-body {\n  display: flex;\n  flex-direction: column;\n  gap: 10px;\n}\n.qc-settings-intro {\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  margin: 0;\n  line-height: 1.5;\n}\n.qc-settings-anchor {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  font-size: 12px;\n}\n.qc-settings-anchor-label {\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  font-weight: 500;\n}\n.qc-settings-radio {\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  cursor: pointer;\n}\n.qc-settings-error {\n  font-size: 12px;\n  color: var(--dsw-alias-state-error-primary, #e5484d);\n}\n.qc-settings-empty {\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  margin: 0;\n}\n.qc-settings-workspace {\n  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));\n  border-radius: 10px;\n  padding: 10px;\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n.qc-settings-workspace-head {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n}\n.qc-settings-workspace-title {\n  font-size: 13px;\n  font-weight: 600;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n}\n.qc-settings-workspace-path {\n  font-size: 11px;\n  font-family: var(--dsw-font-family-mono, monospace);\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n.qc-settings-no-commands {\n  font-size: 12px;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  margin: 0;\n}\n.qc-settings-command {\n  display: flex;\n  gap: 6px;\n  align-items: center;\n}\n.qc-settings-field {\n  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1, #2a2a2d);\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  font-size: 12px;\n  padding: 6px 8px;\n  outline: none;\n}\n.qc-settings-field::placeholder {\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n}\n.qc-settings-field:focus {\n  border-color: var(--dsw-alias-brand-primary, #4a9eff);\n}\n.qc-settings-field-name {\n  width: 160px;\n  flex: none;\n}\n.qc-settings-field-command {\n  flex: 1;\n  font-family: var(--dsw-font-family-mono, monospace);\n}\n.qc-settings-icon-btn {\n  border: 0;\n  background: transparent;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  cursor: pointer;\n  padding: 4px;\n  display: inline-flex;\n  align-items: center;\n  border-radius: 6px;\n}\n.qc-settings-icon-btn:hover {\n  background: color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 10%, transparent);\n  color: var(--dsw-alias-state-error-primary, #e5484d);\n}\n.qc-settings-add-btn {\n  align-self: flex-start;\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));\n  border-radius: 8px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  font-size: 12px;\n  padding: 4px 10px;\n  cursor: pointer;\n}\n.qc-settings-add-btn:hover {\n  background: color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 10%, transparent);\n}\n";
 		const tagId$1 = "@fonlan/dsh-quick-commands/settings-section.css#d7004149";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$1) + "]") === null) {
@@ -1152,7 +1152,7 @@ window.__ModuleLoader__.load({
 			cardAnchorButton: "Anchored at button"
 		};
 		//#endregion
-		//#region \0dsh-css:/home/runner/work/dsh-quick-commands/dsh-quick-commands/src/client/quick-commands.css.mjs
+		//#region \0dsh-css:/Users/fonlan/Repos/dsh-quick-commands/src/client/quick-commands.css.mjs
 		const css = "/* @fonlan/dsh-quick-commands client styles.\n   Uses theme CSS variables (--dsw-alias-*); falls back to neutral literals.\n   Constraint: this deployment's theme defines only these text tokens —\n   label-primary, label-secondary, label-tertiary, label-dimmed. READABLE\n   description copy uses label-secondary / label-tertiary (never label-dimmed,\n   which is intentionally near-invisible and reserved for disabled states). */\n\n/* ── header button (icon-only, left of Session log pill) ─────────────────── */\n.qc-head-wrap {\n  position: relative;\n  display: inline-flex;\n  align-items: center;\n}\n/* Sized to DSH built-in header buttons (e.g. the open-in-app split button on\n   the left): 26px tall pill, 13px radius, hairline border-l4, hover uses the\n   shared --dsw-alias-interactive-bg-hover token. */\n.qc-head-btn {\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 26px;\n  height: 26px;\n  border: 0.5px solid var(--dsw-alias-border-l4, rgba(128, 128, 128, 0.35));\n  border-radius: 13px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  cursor: pointer;\n  padding: 0;\n}\n.qc-head-btn:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover, color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 10%, transparent));\n}\n.qc-head-btn:disabled {\n  color: var(--dsw-alias-label-dimmed, #666);\n  cursor: not-allowed;\n}\n.qc-head-btn svg {\n  flex: none;\n}\n\n/* ── command menu popover (anchored under the button) ────────────────────── */\n.qc-menu {\n  position: absolute;\n  top: calc(100% + 6px);\n  right: 12px;\n  min-width: 280px;\n  max-height: 420px;\n  overflow: auto;\n  background: var(--dsw-alias-bg-overlay, #1b1b1c);\n  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));\n  border-radius: 10px;\n  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.35);\n  z-index: 50;\n  padding: 6px;\n  display: flex;\n  flex-direction: column;\n}\n.qc-menu-head {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  padding: 4px 8px 6px;\n  border-bottom: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.25));\n}\n.qc-menu-title {\n  font-size: 12px;\n  font-weight: 600;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n}\n.qc-menu-ws {\n  flex: 1;\n  font-size: 11px;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n  text-align: right;\n  margin-right: 2px;\n}\n.qc-menu-remote {\n  flex: 0 0 auto;\n  font-size: 10px;\n  font-weight: 600;\n  line-height: 1;\n  padding: 2px 5px;\n  border-radius: 5px;\n  color: var(--dsw-alias-fg-on-accent, #fff);\n  background: var(--dsw-alias-accent, #4a8dff);\n  letter-spacing: 0.04em;\n}\n.qc-menu-close {\n  border: 0;\n  background: transparent;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  cursor: pointer;\n  padding: 2px;\n  display: inline-flex;\n  align-items: center;\n}\n.qc-menu-empty {\n  font-size: 12px;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  padding: 10px 8px;\n  margin: 0;\n}\n.qc-menu-item {\n  display: flex;\n  flex-direction: column;\n  align-items: flex-start;\n  gap: 2px;\n  text-align: left;\n  border: 0;\n  background: transparent;\n  border-radius: 8px;\n  padding: 6px 8px;\n  cursor: pointer;\n  width: 100%;\n}\n.qc-menu-item:hover:not(:disabled) {\n  background: color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 10%, transparent);\n}\n.qc-menu-item:disabled {\n  opacity: 0.6;\n  cursor: wait;\n}\n.qc-menu-item-name {\n  font-size: 13px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n}\n.qc-menu-item-cmd {\n  font-family: var(--dsw-font-family-mono, monospace);\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n  max-width: 100%;\n}\n\n/* ── live output popup ───────────────────────────────────────────────────── */\n.qc-popup {\n  position: relative; /* anchors the absolutely-positioned resize grip */\n  display: flex;\n  flex-direction: column;\n  background: var(--dsw-alias-bg-overlay, #1b1b1c);\n  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));\n  border-radius: 12px;\n  box-shadow: 0 12px 36px rgba(0, 0, 0, 0.45);\n  z-index: 60;\n  overflow: hidden;\n}\n.qc-popup-corner {\n  position: fixed;\n  right: 20px;\n  bottom: 20px;\n  width: 520px;\n  max-width: calc(100vw - 40px);\n  height: 340px;\n  max-height: calc(100vh - 120px);\n}\n.qc-popup-button {\n  position: absolute;\n  top: calc(100% + 6px);\n  right: 12px;\n  width: 440px;\n  max-width: calc(100vw - 40px);\n  height: 300px;\n  max-height: calc(100vh - 120px);\n}\n.qc-popup-head {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  padding: 8px 10px;\n  border-bottom: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.25));\n}\n.qc-popup-title {\n  flex: 1;\n  font-size: 12px;\n  font-weight: 600;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n.qc-popup-cmd {\n  font-family: var(--dsw-font-family-mono, monospace);\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n  max-width: 40%;\n}\n.qc-popup-remote {\n  flex: 0 0 auto;\n  font-size: 10px;\n  font-weight: 600;\n  line-height: 1;\n  padding: 3px 6px;\n  border-radius: 6px;\n  color: var(--dsw-alias-fg-on-accent, #fff);\n  background: var(--dsw-alias-accent, #4a8dff);\n  letter-spacing: 0.04em;\n}\n.qc-popup-icon {\n  border: 0;\n  background: transparent;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  cursor: pointer;\n  padding: 4px;\n  display: inline-flex;\n  align-items: center;\n  border-radius: 6px;\n}\n.qc-popup-icon:hover:not(:disabled) {\n  background: color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 10%, transparent);\n}\n.qc-popup-icon:disabled {\n  opacity: 0.4;\n  cursor: not-allowed;\n}\n.qc-popup-kill {\n  color: var(--dsw-alias-state-error-primary, #e5484d);\n}\n.qc-popup-confirm {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  font-size: 12px;\n  padding: 8px 10px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary, #f5a623) 12%, transparent);\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  border-bottom: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.25));\n}\n.qc-popup-btn {\n  border: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.35));\n  border-radius: 8px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  font-size: 12px;\n  padding: 4px 10px;\n  cursor: pointer;\n}\n.qc-popup-btn:hover {\n  background: color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 10%, transparent);\n}\n.qc-popup-btn-plain {\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n}\n.qc-popup-tabs {\n  display: flex;\n  gap: 2px;\n  padding: 6px 10px 0;\n  border-bottom: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.25));\n}\n.qc-popup-tab {\n  border: 0;\n  background: transparent;\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n  font-size: 12px;\n  padding: 5px 10px;\n  cursor: pointer;\n  border-bottom: 2px solid transparent;\n}\n.qc-popup-tab-active {\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n  border-bottom-color: var(--dsw-alias-brand-primary, #4a9eff);\n}\n.qc-popup-output {\n  flex: 1;\n  overflow: auto;\n  padding: 8px 10px;\n  font-family: var(--dsw-font-family-mono, monospace);\n  font-size: 12px;\n  line-height: 1.5;\n}\n.qc-popup-pre {\n  margin: 0;\n  white-space: pre-wrap;\n  word-break: break-word;\n  color: var(--dsw-alias-label-primary, #f2f2f2);\n}\n.qc-popup-empty {\n  margin: 0;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  font-size: 12px;\n}\n.qc-popup-error {\n  margin: 0 0 6px;\n  color: var(--dsw-alias-state-error-primary, #e5484d);\n  font-size: 12px;\n}\n.qc-popup-foot {\n  display: flex;\n  align-items: center;\n  padding: 6px 10px;\n  border-top: 1px solid var(--dsw-alias-border-l2, rgba(128, 128, 128, 0.25));\n  font-size: 11px;\n}\n.qc-popup-state {\n  color: var(--dsw-alias-label-secondary, #cfd3d6);\n}\n\n/* Resize handles. The popup pins its RIGHT edge (both anchors); width is\n   always dragged from the LEFT border. Height is dragged from the TOP border\n   (corner anchor, bottom pinned) or the BOTTOM border (button anchor, top\n   pinned below the button). The free corner (top-left / bottom-left) carries\n   the diagonal grip. Pointer capture lives in header.tsx; touch-action:none\n   lets touch drags resize instead of scrolling. */\n.qc-popup-resize {\n  position: absolute;\n  z-index: 3;\n  touch-action: none;\n  user-select: none;\n}\n.qc-popup-resize-left {\n  left: 0;\n  top: 10px;\n  bottom: 10px;\n  width: 7px;\n  cursor: ew-resize;\n}\n.qc-popup-resize-top {\n  top: 0;\n  left: 10px;\n  right: 10px;\n  height: 7px;\n  cursor: ns-resize;\n}\n.qc-popup-resize-bottom {\n  bottom: 0;\n  left: 10px;\n  right: 10px;\n  height: 7px;\n  cursor: ns-resize;\n}\n.qc-popup-resize-left:hover,\n.qc-popup-resize-top:hover,\n.qc-popup-resize-bottom:hover {\n  background: color-mix(in srgb, var(--dsw-alias-label-primary, #f2f2f2) 14%, transparent);\n}\n.qc-popup-resize-corner {\n  width: 22px;\n  height: 22px;\n  z-index: 4;\n  display: flex;\n  padding: 3px;\n  color: var(--dsw-alias-label-tertiary, #adb2b8);\n  opacity: 0.6;\n  transition: opacity .15s ease;\n}\n.qc-popup-resize-corner-tl {\n  top: 0;\n  left: 0;\n  cursor: nwse-resize;\n  align-items: flex-start;\n  justify-content: flex-start;\n}\n.qc-popup-resize-corner-bl {\n  bottom: 0;\n  left: 0;\n  cursor: nesw-resize;\n  align-items: flex-end;\n  justify-content: flex-start;\n}\n.qc-popup-resize-corner:hover,\n.qc-popup-resize-corner:active {\n  opacity: 1;\n}\n\n/* ── mobile fallback (dsh-mobile-nav) ──────────────────────────────────────\n   The dsh-mobile-nav plugin (≤1023px) hides the ENTIRE header utilities seat\n   with `[data-mobile-nav=\"frame\"] [data-phase] header > :first-child >\n   :last-child { display: none !important; }`, because the seat used to hold\n   only the session-log-export capsule (which it relocates to the drawer\n   footer). Our quick-run ▶ button rides that same seat, so it vanished on\n   phones.\n\n   Re-show ONLY our button: restore the seat's flex layout (out-ranking the\n   host rule via `:has(.qc-head-wrap)` specificity (0,5,1) > (0,4,1)) and keep\n   every other seat occupant hidden (the session-log capsule stays relocated\n   to the drawer footer). Desktop (no [data-mobile-nav]) is untouched. */\n[data-mobile-nav=\"frame\"] [data-phase] header > :first-child > :last-child:has(.qc-head-wrap) {\n  display: flex !important;\n  margin-left: 4px !important;\n  gap: 0 !important;\n}\n[data-mobile-nav=\"frame\"] [data-phase] header > :first-child > :last-child:has(.qc-head-wrap)\n  [data-slot=\"conversation.session.header.utilities\"] > :not(.qc-head-wrap) {\n  display: none !important;\n}\n\n/* ── viewport-level command menu ─────────────────────────────────────────\n   The phone shell's nav rail creates a sibling stacking context and its\n   center column can clip header descendants. The React menu therefore mounts\n   in document.body; these styles deliberately detach it from that header\n   context. Pixel coordinates (including the 56px rail exclusion) are set by\n   positionMenu() in header.tsx. */\n.qc-menu-portal {\n  position: fixed;\n  right: auto;\n  z-index: 1100;\n  box-sizing: border-box;\n  max-height: min(420px, calc(100dvh - 72px));\n}\n\n@media (max-width: 767px) {\n  /* A 44px target lets a fingertip reliably activate both the stop and close\n     buttons without changing the desktop header density. */\n  body[data-dsh-mobile] .qc-popup-icon,\n  [data-mobile-nav=\"frame\"] .qc-popup-icon {\n    min-width: 44px;\n    min-height: 44px;\n    justify-content: center;\n  }\n}";
 		const tagId = "@fonlan/dsh-quick-commands/quick-commands.css#b65a4ce4";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {

package/lib/index.js

@@ -1,7 +1,141 @@
 import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
 import z from "@deepseek-ai/schemastery";
+//#region src/server/shell-path.ts
+/**
+* Login-shell PATH resolution for the local quick-command backend.
+*
+* `dsh web` started from a terminal inherits the user's full PATH, so a
+* configured command such as `npm run typecheck` or `docker compose up -d`
+* finds its toolchain. **DSH Desktop does not**: the Electron host is launched
+* by launchd and runs with the minimal system PATH
+* (`/usr/bin:/bin:/usr/sbin:/sbin`), which hides homebrew, `/usr/local/bin`,
+* nvm, corepack and Docker Desktop. Every command that leans on the user's
+* toolchain then fails with "command not found" in Desktop while the very same
+* profile keeps working in a browser-launched host.
+*
+* This module asks the user's interactive login shell for its PATH once
+* (cached for the process lifetime) and prepends it to the inherited PATH for
+* local runs. Resolution is best effort by design: a missing `$SHELL`, a
+* timeout, a non-zero exit or unparseable output all leave the inherited PATH
+* untouched, so a terminal-launched host behaves exactly as before.
+*/
+/** Delimiters wrapping the shell's own PATH in the probe's stdout. */
+const PATH_START = "__DSH_QC_PATH_START__";
+const PATH_END = "__DSH_QC_PATH_END__";
+const defaultRunner = (file, args, options) => new Promise((resolve, reject) => {
+	execFile(file, args, options, (error, stdout) => {
+		if (error) reject(error);
+		else resolve({ stdout });
+	});
+});
+/**
+* Extract the PATH a shell printed between the markers.
+*
+* Login profiles are free to print their own noise (nvm notices, version
+* managers, MOTDs), so only the marked span counts — never the whole stdout.
+* @param stdout - raw probe stdout.
+* @returns the marked PATH, or '' when the markers are missing.
+*/
+function extractShellPath(stdout) {
+	if (typeof stdout !== "string" && !(stdout instanceof Buffer)) return "";
+	const text = String(stdout);
+	const start = text.indexOf(PATH_START);
+	const end = text.lastIndexOf(PATH_END);
+	if (start < 0 || end < 0 || end < start) return "";
+	return text.slice(start + 21, end);
+}
+/**
+* Put the login-shell PATH in front of the inherited one.
+*
+* The login PATH wins (that is where the user's toolchain lives); entries from
+* the inherited PATH stay behind it as a fallback. Empty entries are dropped
+* and duplicates keep their first position.
+* @param loginPath - PATH reported by the login shell ('' when unavailable).
+* @param inheritedPath - the host process's own PATH.
+* @returns the merged PATH (the inherited value when there is no login one).
+*/
+function mergePaths(loginPath, inheritedPath) {
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	for (const part of `${loginPath}:${inheritedPath ?? ""}`.split(":")) {
+		const entry = part.trim();
+		if (entry === "" || seen.has(entry)) continue;
+		seen.add(entry);
+		entries.push(entry);
+	}
+	return entries.join(":");
+}
+/** The shell program whose login PATH describes this user's environment. */
+function loginShell(env = process.env) {
+	const shell = env.SHELL?.trim();
+	return shell !== void 0 && shell !== "" ? shell : void 0;
+}
+/**
+* Ask `shell` (interactive login) for its PATH.
+*
+* Both flags matter: `-l` sources the profile files that own the system PATH
+* (on macOS `/etc/zprofile` → `path_helper`), `-i` additionally sources the
+* interactive config where nvm/fnm/volta and other version managers install
+* their shims (this user's node lives in `~/.zshrc`). A hung or noisy
+* interactive profile cannot block a run: the probe carries a deadline, and
+* only the marked span of stdout is read.
+* @param options.shell - shell program; defaults to `$SHELL`.
+* @param options.timeoutMs - probe deadline.
+* @param options.run - probe runner, injectable for tests.
+* @param options.env - environment the probe itself runs with.
+* @returns the login PATH, or '' when it cannot be determined.
+*/
+async function resolveLoginShellPath(options = {}) {
+	if (process.platform === "win32") return "";
+	const env = options.env ?? process.env;
+	const shell = options.shell ?? loginShell(env);
+	if (shell === void 0) return "";
+	const run = options.run ?? defaultRunner;
+	const command = `printf '%s' "${PATH_START}\${PATH}${PATH_END}"`;
+	try {
+		const { stdout } = await run(shell, [
+			"-i",
+			"-l",
+			"-c",
+			command
+		], {
+			timeout: options.timeoutMs ?? 3e3,
+			windowsHide: true,
+			env
+		});
+		const path = extractShellPath(stdout).trim();
+		return /[\s]/.test(path) ? "" : path;
+	} catch {
+		return "";
+	}
+}
+let cached;
+/** Cached, process-wide login-shell PATH (one probe per host lifetime). */
+function loginShellPath() {
+	cached ??= resolveLoginShellPath();
+	return cached;
+}
+/**
+* Environment for one local quick command.
+*
+* A copy of the host environment with the login-shell PATH merged in front, so
+* Desktop-launched hosts see the same toolchain a terminal-launched host does.
+* @param overrides - plugin-owned variables (DSH_WORKSPACE*) merged last.
+* @returns the spawn environment.
+*/
+async function localCommandEnv(overrides = {}) {
+	const env = { ...process.env };
+	const loginPath = await loginShellPath();
+	if (loginPath !== "") env.PATH = mergePaths(loginPath, process.env.PATH);
+	return {
+		...env,
+		...overrides
+	};
+}
+//#endregion
 //#region src/server/remote.ts
 /**
 * Remote (SSH) execution support: detect that a workspace path is a dsh-ssh
@@ -312,12 +446,11 @@ var QuickCommandRunner = class {
 				stdout: { maxBytes: TAIL_MAX_BYTES },
 				stderr: { maxBytes: TAIL_MAX_BYTES }
 			},
-			env: {
-				...process.env,
+			env: await localCommandEnv({
 				DSH_WORKSPACE: input.workspacePath,
 				DSH_WORKSPACE_ID: input.workspaceId,
 				DSH_WORKSPACE_TITLE: input.workspaceTitle
-			}
+			})
 		});
 		const live = {
 			runId,
@@ -861,10 +994,8 @@ function registerApiRoutes(ctx, runner, settings) {
 			};
 		}
 	}
-	const webServer = ctx.get("webServer");
-	if (webServer === void 0) return () => void 0;
 	return ctx.effect(() => {
-		return webServer.register({
+		return ctx.webServer.register({
 			kind: "prefix",
 			path: API_PREFIX,
 			handler: async (req, res) => {
@@ -899,30 +1030,28 @@ const Config = QuickCommandsSettingsSchema;
 /** Configuration rides the entry config; edits persist through the settings service. */
 function apply(ctx, config) {
 	const settings = registerSettings(ctx, config);
-	const subprocess = ctx.get("subprocess");
-	if (subprocess === void 0) {
-		ctx.logger?.warn?.("@fonlan/dsh-quick-commands: subprocess service unavailable; commands cannot run");
-		return;
-	}
-	const resolveRemote = () => {
-		const sshPool = ctx.get("sshPool");
-		if (sshPool === void 0 || typeof sshPool.acquire !== "function" || typeof sshPool.release !== "function") return;
-		return {
-			pool: sshPool,
-			resolveHost: (hostId) => readHostConfig((ns) => {
-				try {
-					return ctx.get("settings")?.get(ns);
-				} catch {
-					return;
-				}
-			}, hostId)
+	ctx.inject(["subprocess", "webServer"], (sctx) => {
+		const subprocess = sctx.get("subprocess");
+		const resolveRemote = () => {
+			const sshPool = sctx.get("sshPool");
+			if (sshPool === void 0 || typeof sshPool.acquire !== "function" || typeof sshPool.release !== "function") return;
+			return {
+				pool: sshPool,
+				resolveHost: (hostId) => readHostConfig((ns) => {
+					try {
+						return sctx.get("settings")?.get(ns);
+					} catch {
+						return;
+					}
+				}, hostId)
+			};
 		};
-	};
-	const runner = new QuickCommandRunner(subprocess, () => resolveRemote());
-	ctx.effect(() => registerApiRoutes(ctx, runner, settings), "quick-commands: api routes");
-	ctx.effect(() => () => {
-		for (const id of runner.listAll()) runner.kill(id);
-	}, "quick-commands: process cleanup");
+		const runner = new QuickCommandRunner(subprocess, () => resolveRemote());
+		sctx.effect(() => registerApiRoutes(sctx, runner, settings), "quick-commands: api routes");
+		sctx.effect(() => () => {
+			for (const id of runner.listAll()) runner.kill(id);
+		}, "quick-commands: process cleanup");
+	});
 }
 //#endregion
 export { Config, apply, inject, name };

package/lib/types/server/shell-path.d.ts

@@ -0,0 +1,69 @@
+/** Delimiters wrapping the shell's own PATH in the probe's stdout. */
+export declare const PATH_START = "__DSH_QC_PATH_START__";
+export declare const PATH_END = "__DSH_QC_PATH_END__";
+/** Default deadline for the login-shell probe (ms). */
+export declare const PROBE_TIMEOUT_MS = 3000;
+/** Minimal probe runner shape: `child_process.execFile`, or a test double. */
+export type ProbeRunner = (file: string, args: string[], options: {
+    timeout: number;
+    windowsHide: boolean;
+    env: NodeJS.ProcessEnv;
+}) => Promise<{
+    stdout?: string | Buffer;
+}>;
+/**
+ * Extract the PATH a shell printed between the markers.
+ *
+ * Login profiles are free to print their own noise (nvm notices, version
+ * managers, MOTDs), so only the marked span counts — never the whole stdout.
+ * @param stdout - raw probe stdout.
+ * @returns the marked PATH, or '' when the markers are missing.
+ */
+export declare function extractShellPath(stdout: unknown): string;
+/**
+ * Put the login-shell PATH in front of the inherited one.
+ *
+ * The login PATH wins (that is where the user's toolchain lives); entries from
+ * the inherited PATH stay behind it as a fallback. Empty entries are dropped
+ * and duplicates keep their first position.
+ * @param loginPath - PATH reported by the login shell ('' when unavailable).
+ * @param inheritedPath - the host process's own PATH.
+ * @returns the merged PATH (the inherited value when there is no login one).
+ */
+export declare function mergePaths(loginPath: string, inheritedPath: string | undefined): string;
+/** The shell program whose login PATH describes this user's environment. */
+export declare function loginShell(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Ask `shell` (interactive login) for its PATH.
+ *
+ * Both flags matter: `-l` sources the profile files that own the system PATH
+ * (on macOS `/etc/zprofile` → `path_helper`), `-i` additionally sources the
+ * interactive config where nvm/fnm/volta and other version managers install
+ * their shims (this user's node lives in `~/.zshrc`). A hung or noisy
+ * interactive profile cannot block a run: the probe carries a deadline, and
+ * only the marked span of stdout is read.
+ * @param options.shell - shell program; defaults to `$SHELL`.
+ * @param options.timeoutMs - probe deadline.
+ * @param options.run - probe runner, injectable for tests.
+ * @param options.env - environment the probe itself runs with.
+ * @returns the login PATH, or '' when it cannot be determined.
+ */
+export declare function resolveLoginShellPath(options?: {
+    shell?: string | undefined;
+    timeoutMs?: number;
+    run?: ProbeRunner;
+    env?: NodeJS.ProcessEnv;
+}): Promise<string>;
+/** Cached, process-wide login-shell PATH (one probe per host lifetime). */
+export declare function loginShellPath(): Promise<string>;
+/** Drop the cache (tests, and settings reloads that may have changed `$SHELL`). */
+export declare function resetLoginShellPathCache(): void;
+/**
+ * Environment for one local quick command.
+ *
+ * A copy of the host environment with the login-shell PATH merged in front, so
+ * Desktop-launched hosts see the same toolchain a terminal-launched host does.
+ * @param overrides - plugin-owned variables (DSH_WORKSPACE*) merged last.
+ * @returns the spawn environment.
+ */
+export declare function localCommandEnv(overrides?: Record<string, string>): Promise<NodeJS.ProcessEnv>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fonlan/dsh-quick-commands",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "DSH web plugin: per-workspace quick commands. Configure named shell commands per DSH workspace, run one from the session header with live stdout/stderr in a floating popup.",
   "license": "MIT",
   "repository": {
@@ -44,6 +44,18 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "rm -rf lib && tsc -p tsconfig.build.json && tsdown",
+    "build:client": "tsdown",
+    "prepare": "npm run build",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.client.json",
+    "test": "node --experimental-transform-types --test test/remote.test.ts test/settings-config.test.ts test/host-apply.test.ts test/shell-path.test.ts && node test/header-icons.test.mjs",
+    "bundle": "tsdown",
+    "watch": "tsdown --watch",
+    "release:patch": "npm version patch && git push && git push --tags",
+    "release:minor": "npm version minor && git push && git push --tags",
+    "release:major": "npm version major && git push && git push --tags"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -91,15 +103,5 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.9.0"
   },
-  "scripts": {
-    "build": "rm -rf lib && tsc -p tsconfig.build.json && tsdown",
-    "build:client": "tsdown",
-    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.client.json",
-    "test": "node --experimental-transform-types --test test/remote.test.ts test/settings-config.test.ts && node test/header-icons.test.mjs",
-    "bundle": "tsdown",
-    "watch": "tsdown --watch",
-    "release:patch": "npm version patch && git push && git push --tags",
-    "release:minor": "npm version minor && git push && git push --tags",
-    "release:major": "npm version major && git push && git push --tags"
-  }
-}
+  "packageManager": "pnpm@11.21.0"
+}

package/src/index.ts

@@ -32,37 +32,45 @@ export const Config = QuickCommandsSettingsSchema
 /** Configuration rides the entry config; edits persist through the settings service. */
 export function apply(ctx: Context, config: QuickCommandsSettings): void {
   const settings = registerSettings(ctx, config)
-  const subprocess = ctx.get('subprocess')
-  if (subprocess === undefined) {
-    ctx.logger?.warn?.('@fonlan/dsh-quick-commands: subprocess service unavailable; commands cannot run')
-    return
-  }
-  // Remote backend (duck-typed over @dsh-ssh/dsh-ssh): resolved lazily so the
-  // sshPool service is picked up whenever the SSH plugin loads.
-  const resolveRemote = (): RemoteBackend | undefined => {
-    const sshPool = ctx.get('sshPool') as
-      | { acquire(cfg: { id: string; [key: string]: unknown }): Promise<unknown>; release(): void }
-      | undefined
-    if (sshPool === undefined || typeof sshPool.acquire !== 'function' || typeof sshPool.release !== 'function') {
-      return undefined
+  // dsh >= 0.1.7 activates entries asynchronously: a fiber is only readable as a
+  // service once its own init settled, and the webserver's init waits for its
+  // listen. Resolving services with a one-shot `ctx.get()` during apply could
+  // therefore observe undefined with nothing to retry — the header menu's
+  // "HTTP 405": `subprocess` (and/or the route helper's own `webServer` guard)
+  // came back missing, the API prefix route was never registered, and every
+  // client POST fell through to the /plugins client-modules bundle route, which
+  // answers any non-GET with 405.
+  // ctx.inject is the retrying form: the body runs once both services are live,
+  // so the pairing also covers whichever one arrives after this entry.
+  ctx.inject(['subprocess', 'webServer'], (sctx) => {
+    const subprocess = sctx.get('subprocess')
+    // Remote backend (duck-typed over @dsh-ssh/dsh-ssh): resolved lazily so the
+    // sshPool service is picked up whenever the SSH plugin loads.
+    const resolveRemote = (): RemoteBackend | undefined => {
+      const sshPool = sctx.get('sshPool') as
+        | { acquire(cfg: { id: string; [key: string]: unknown }): Promise<unknown>; release(): void }
+        | undefined
+      if (sshPool === undefined || typeof sshPool.acquire !== 'function' || typeof sshPool.release !== 'function') {
+        return undefined
+      }
+      return {
+        pool: sshPool as never,
+        resolveHost: (hostId) => readHostConfig((ns) => {
+          try {
+            return (sctx.get('settings') as { get(ns: string): unknown } | undefined)?.get(ns)
+          } catch {
+            return undefined
+          }
+        }, hostId),
+      }
     }
-    return {
-      pool: sshPool as never,
-      resolveHost: (hostId) => readHostConfig((ns) => {
-        try {
-          return (ctx.get('settings') as { get(ns: string): unknown } | undefined)?.get(ns)
-        } catch {
-          return undefined
-        }
-      }, hostId),
-    }
-  }
-  const runner = new QuickCommandRunner(subprocess as never, () => resolveRemote())
-  ctx.effect(() => registerApiRoutes(ctx, runner, settings), 'quick-commands: api routes')
-  ctx.effect(() => () => {
-    // Terminate every live process when the plugin fiber stops.
-    for (const id of runner.listAll()) {
-      runner.kill(id)
-    }
-  }, 'quick-commands: process cleanup')
+    const runner = new QuickCommandRunner(subprocess as never, () => resolveRemote())
+    sctx.effect(() => registerApiRoutes(sctx, runner, settings), 'quick-commands: api routes')
+    sctx.effect(() => () => {
+      // Terminate every live process when the plugin fiber stops.
+      for (const id of runner.listAll()) {
+        runner.kill(id)
+      }
+    }, 'quick-commands: process cleanup')
+  })
 }

package/src/server/rpc.ts

@@ -255,10 +255,15 @@ export function registerApiRoutes(ctx: Context, runner: QuickRunner, settings: Q
     }
   }
 
-  const webServer = ctx.get('webServer')
-  if (webServer === undefined) return () => undefined
+  // The caller reaches this function through ctx.inject(['webServer']), so the
+  // service is active by construction. A one-shot `ctx.get('webServer')` guard
+  // here used to return an empty disposer whenever the webserver fiber had not
+  // finished activating yet (dsh >= 0.1.7 activates entries asynchronously and
+  // makes a service readable only once its own init settled — for the webserver
+  // that means listening): no route was ever registered and every client POST
+  // fell through to the /plugins bundle route, which answers non-GET with 405.
   return ctx.effect(() => {
-    return webServer.register({
+    return ctx.webServer.register({
       kind: 'prefix',
       path: API_PREFIX,
       handler: async (req: IncomingMessage, res: ServerResponse): Promise<void> => {

package/src/server/runner.ts

@@ -17,6 +17,7 @@
 import { randomUUID } from 'node:crypto'
 import type { SubprocessHandle, SubprocessSpawnSpec } from '@deepseek-ai/dsh-subprocess'
 import type { QuickCommandsSettings } from '../shared/contract.js'
+import { localCommandEnv } from './shell-path.js'
 import {
   localPathToRemoteRef,
   resolveRemoteCwd,
@@ -203,12 +204,15 @@ export class QuickCommandRunner implements QuickRunner {
         stdout: { maxBytes: TAIL_MAX_BYTES },
         stderr: { maxBytes: TAIL_MAX_BYTES },
       },
-      env: {
-        ...process.env,
+      // The login-shell PATH rides in front of the host's own: DSH Desktop runs
+      // the host with launchd's minimal PATH, so `npm run typecheck` and
+      // `docker compose up -d` only resolve once the user's toolchain is
+      // visible. See ./shell-path.ts.
+      env: await localCommandEnv({
         DSH_WORKSPACE: input.workspacePath,
         DSH_WORKSPACE_ID: input.workspaceId,
         DSH_WORKSPACE_TITLE: input.workspaceTitle,
-      },
+      }),
     })
 
     const live: LiveRun = {

package/src/server/shell-path.ts

@@ -0,0 +1,160 @@
+/**
+ * Login-shell PATH resolution for the local quick-command backend.
+ *
+ * `dsh web` started from a terminal inherits the user's full PATH, so a
+ * configured command such as `npm run typecheck` or `docker compose up -d`
+ * finds its toolchain. **DSH Desktop does not**: the Electron host is launched
+ * by launchd and runs with the minimal system PATH
+ * (`/usr/bin:/bin:/usr/sbin:/sbin`), which hides homebrew, `/usr/local/bin`,
+ * nvm, corepack and Docker Desktop. Every command that leans on the user's
+ * toolchain then fails with "command not found" in Desktop while the very same
+ * profile keeps working in a browser-launched host.
+ *
+ * This module asks the user's interactive login shell for its PATH once
+ * (cached for the process lifetime) and prepends it to the inherited PATH for
+ * local runs. Resolution is best effort by design: a missing `$SHELL`, a
+ * timeout, a non-zero exit or unparseable output all leave the inherited PATH
+ * untouched, so a terminal-launched host behaves exactly as before.
+ */
+import { execFile } from 'node:child_process'
+
+/** Delimiters wrapping the shell's own PATH in the probe's stdout. */
+export const PATH_START = '__DSH_QC_PATH_START__'
+export const PATH_END = '__DSH_QC_PATH_END__'
+
+/** Default deadline for the login-shell probe (ms). */
+export const PROBE_TIMEOUT_MS = 3000
+
+/** Minimal probe runner shape: `child_process.execFile`, or a test double. */
+export type ProbeRunner = (
+  file: string,
+  args: string[],
+  options: { timeout: number; windowsHide: boolean; env: NodeJS.ProcessEnv },
+) => Promise<{ stdout?: string | Buffer }>
+
+const defaultRunner: ProbeRunner = (file, args, options) =>
+  new Promise((resolve, reject) => {
+    execFile(file, args, options, (error, stdout) => {
+      if (error) reject(error)
+      else resolve({ stdout })
+    })
+  })
+
+/**
+ * Extract the PATH a shell printed between the markers.
+ *
+ * Login profiles are free to print their own noise (nvm notices, version
+ * managers, MOTDs), so only the marked span counts — never the whole stdout.
+ * @param stdout - raw probe stdout.
+ * @returns the marked PATH, or '' when the markers are missing.
+ */
+export function extractShellPath(stdout: unknown): string {
+  if (typeof stdout !== 'string' && !(stdout instanceof Buffer)) return ''
+  const text = String(stdout)
+  const start = text.indexOf(PATH_START)
+  const end = text.lastIndexOf(PATH_END)
+  if (start < 0 || end < 0 || end < start) return ''
+  return text.slice(start + PATH_START.length, end)
+}
+
+/**
+ * Put the login-shell PATH in front of the inherited one.
+ *
+ * The login PATH wins (that is where the user's toolchain lives); entries from
+ * the inherited PATH stay behind it as a fallback. Empty entries are dropped
+ * and duplicates keep their first position.
+ * @param loginPath - PATH reported by the login shell ('' when unavailable).
+ * @param inheritedPath - the host process's own PATH.
+ * @returns the merged PATH (the inherited value when there is no login one).
+ */
+export function mergePaths(loginPath: string, inheritedPath: string | undefined): string {
+  const seen = new Set<string>()
+  const entries: string[] = []
+  for (const part of `${loginPath}:${inheritedPath ?? ''}`.split(':')) {
+    const entry = part.trim()
+    if (entry === '' || seen.has(entry)) continue
+    seen.add(entry)
+    entries.push(entry)
+  }
+  return entries.join(':')
+}
+
+/** The shell program whose login PATH describes this user's environment. */
+export function loginShell(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const shell = env.SHELL?.trim()
+  return shell !== undefined && shell !== '' ? shell : undefined
+}
+
+/**
+ * Ask `shell` (interactive login) for its PATH.
+ *
+ * Both flags matter: `-l` sources the profile files that own the system PATH
+ * (on macOS `/etc/zprofile` → `path_helper`), `-i` additionally sources the
+ * interactive config where nvm/fnm/volta and other version managers install
+ * their shims (this user's node lives in `~/.zshrc`). A hung or noisy
+ * interactive profile cannot block a run: the probe carries a deadline, and
+ * only the marked span of stdout is read.
+ * @param options.shell - shell program; defaults to `$SHELL`.
+ * @param options.timeoutMs - probe deadline.
+ * @param options.run - probe runner, injectable for tests.
+ * @param options.env - environment the probe itself runs with.
+ * @returns the login PATH, or '' when it cannot be determined.
+ */
+export async function resolveLoginShellPath(options: {
+  shell?: string | undefined
+  timeoutMs?: number
+  run?: ProbeRunner
+  env?: NodeJS.ProcessEnv
+} = {}): Promise<string> {
+  if (process.platform === 'win32') return ''
+  const env = options.env ?? process.env
+  const shell = options.shell ?? loginShell(env)
+  if (shell === undefined) return ''
+  const run = options.run ?? defaultRunner
+  // `${PATH}` must stay braced: an unbraced `$PATH__DSH...` is read as one
+  // identifier by POSIX shells and silently expands to nothing.
+  const command = `printf '%s' "${PATH_START}\${PATH}${PATH_END}"`
+  try {
+    const { stdout } = await run(shell, ['-i', '-l', '-c', command], {
+      timeout: options.timeoutMs ?? PROBE_TIMEOUT_MS,
+      windowsHide: true,
+      env,
+    })
+    const path = extractShellPath(stdout).trim()
+    // A list-valued shell (fish) renders "$PATH" as space-separated entries:
+    // merging that would inject a single bogus entry, so keep the host PATH.
+    return /[\s]/.test(path) ? '' : path
+  } catch {
+    // Any failure (missing shell, timeout, killed profile) keeps the inherited
+    // PATH: a quick command must never be worse than the host's own shell.
+    return ''
+  }
+}
+
+let cached: Promise<string> | undefined
+
+/** Cached, process-wide login-shell PATH (one probe per host lifetime). */
+export function loginShellPath(): Promise<string> {
+  cached ??= resolveLoginShellPath()
+  return cached
+}
+
+/** Drop the cache (tests, and settings reloads that may have changed `$SHELL`). */
+export function resetLoginShellPathCache(): void {
+  cached = undefined
+}
+
+/**
+ * Environment for one local quick command.
+ *
+ * A copy of the host environment with the login-shell PATH merged in front, so
+ * Desktop-launched hosts see the same toolchain a terminal-launched host does.
+ * @param overrides - plugin-owned variables (DSH_WORKSPACE*) merged last.
+ * @returns the spawn environment.
+ */
+export async function localCommandEnv(overrides: Record<string, string> = {}): Promise<NodeJS.ProcessEnv> {
+  const env: NodeJS.ProcessEnv = { ...process.env }
+  const loginPath = await loginShellPath()
+  if (loginPath !== '') env.PATH = mergePaths(loginPath, process.env.PATH)
+  return { ...env, ...overrides }
+}