@khorsheed/dsh-mobile 0.1.0

package/lib/types/client/viewport.js

@@ -0,0 +1,42 @@
+/** Geometry only: keep the official composer mounted and reserve its measured height. */
+export class MobileViewport {
+    win;
+    seat;
+    root;
+    observer;
+    theme = '';
+    constructor(win) {
+        this.win = win;
+        if (typeof ResizeObserver !== 'undefined')
+            this.observer = new ResizeObserver(() => this.measure());
+    }
+    sync(frame) {
+        const root = frame?.querySelector('[data-slot="main.conversation"] > [data-phase]') ?? undefined;
+        const seat = root?.querySelector('[data-composer-seat]') ?? undefined;
+        if (seat !== this.seat || root !== this.root) {
+            this.observer?.disconnect();
+            this.root?.style.removeProperty('--mobile-composer-height');
+            this.root = root;
+            this.seat = seat;
+            if (seat)
+                this.observer?.observe(seat);
+        }
+        this.measure();
+        if (!frame)
+            return;
+        // Resolve CSS aliases through a color property, not a guessed light/dark palette.
+        const background = this.win.getComputedStyle(frame).backgroundColor;
+        if (background !== this.theme && /^rgba?\([\d.,\s]+\)$/.test(background)) {
+            this.theme = background;
+            this.win.webkit?.messageHandlers?.dshMobile?.postMessage({ type: 'appearance', bridgeVersion: 1, background: background.match(/[\d.]+/g)?.slice(0, 3).map(Number) });
+        }
+    }
+    measure() {
+        if (!this.seat || !this.root)
+            return;
+        const height = `${Math.ceil(this.seat.getBoundingClientRect().height)}px`;
+        if (this.root.style.getPropertyValue('--mobile-composer-height') !== height)
+            this.root.style.setProperty('--mobile-composer-height', height);
+    }
+    dispose() { this.observer?.disconnect(); this.root?.style.removeProperty('--mobile-composer-height'); this.root = undefined; this.seat = undefined; }
+}

package/lib/types/connect.d.ts

@@ -0,0 +1,7 @@
+import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+import type { MobileConnectInfo } from './protocol.ts';
+/** Deployment-owned destination only: a browser cannot choose where a bearer is sent. */
+export declare function connectInfo(connection: HostConnectionHandle, configured?: string): MobileConnectInfo;
+/** Called only behind the official authenticated Fetch registry. */
+export declare function connectResponse(connection: HostConnectionHandle, configured?: string): (request: Request) => Promise<Response>;
+//# sourceMappingURL=connect.d.ts.map

package/lib/types/connect.js

@@ -0,0 +1,61 @@
+const headers = { 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' };
+/** Deployment-owned destination only: a browser cannot choose where a bearer is sent. */
+export function connectInfo(connection, configured) {
+    if (!configured)
+        return { state: 'not-configured', origin: null };
+    let url;
+    try {
+        url = new URL(configured);
+        if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/'
+            || ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
+            throw new Error('invalid');
+    }
+    catch {
+        return { state: 'invalid-origin', origin: null };
+    }
+    if (typeof connection.authenticatedUrl !== 'function' || typeof connection.requestRejection !== 'function') {
+        return { state: 'unsupported', origin: url.origin };
+    }
+    // Probe the public Host/Origin fence without credentials. 401 is expected;
+    // accepting the destination does not authenticate this synthetic request.
+    if (connection.requestRejection({ headers: { host: url.host, origin: url.origin } }) === 403) {
+        return { state: 'untrusted-origin', origin: url.origin };
+    }
+    return { state: 'ready', origin: url.origin };
+}
+/** Called only behind the official authenticated Fetch registry. */
+export function connectResponse(connection, configured) {
+    return async (request) => {
+        const info = connectInfo(connection, configured);
+        if (request.method === 'GET')
+            return Response.json(info, { headers });
+        // Explicit same-origin action; a navigation/form must never reveal a login URL.
+        // The official HTTP bridge uses an internal Request URL. Compare the
+        // preserved Host/Origin headers, as the official trust fence does, so an
+        // HTTPS reverse proxy does not turn a valid action into a false 403.
+        let sameOrigin = false;
+        try {
+            const origin = new URL(request.headers.get('origin') ?? '');
+            const host = request.headers.get('host');
+            sameOrigin = !!host && ['http:', 'https:'].includes(origin.protocol)
+                && origin.host === new URL(`http://${host}`).host;
+        }
+        catch { /* opaque or absent origin */ }
+        if (!sameOrigin || request.headers.get('content-type') !== 'application/json') {
+            return Response.json({ error: 'forbidden' }, { status: 403, headers });
+        }
+        if (info.state !== 'ready' || !info.origin)
+            return Response.json(info, { status: 409, headers });
+        try {
+            const login = new URL(connection.authenticatedUrl(info.origin));
+            if (login.origin !== info.origin || login.pathname !== '/' || login.username || login.password || login.hash
+                || !login.searchParams.get('token') || [...login.searchParams].length !== 1)
+                throw new Error('unsupported');
+            return Response.json({ origin: info.origin, loginUrl: login.href }, { headers });
+        }
+        catch {
+            // Never echo a provider error that might contain the launch credential.
+            return Response.json({ error: 'unavailable' }, { status: 503, headers });
+        }
+    };
+}

package/lib/types/directories.d.ts

@@ -0,0 +1,5 @@
+import type { MobileDirectoryListing } from './protocol.ts';
+/** Read-only companion for native-picker hosts; never changes the shared picker backend. */
+export declare function listMobileDirectory(path: string | undefined, signal: AbortSignal): Promise<MobileDirectoryListing>;
+export declare function directoryResponse(request: Request): Promise<Response>;
+//# sourceMappingURL=directories.d.ts.map

package/lib/types/directories.js

@@ -0,0 +1,39 @@
+import { opendir, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+/** Read-only companion for native-picker hosts; never changes the shared picker backend. */
+export async function listMobileDirectory(path, signal) {
+    if (path !== undefined && (!path || path.length > 4096 || path.includes('\0') || !isAbsolute(path)
+        || (process.platform === 'win32' && !/^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/]+[^\\/]+)/.test(path))))
+        throw new Error('invalid-path');
+    signal.throwIfAborted();
+    const target = resolve(path ?? homedir());
+    const entries = [];
+    let scanned = 0, truncated = false;
+    for await (const entry of await opendir(target)) {
+        signal.throwIfAborted();
+        if (++scanned > 10000 || entries.length >= 1000) {
+            truncated = true;
+            break;
+        }
+        const child = join(target, entry.name);
+        if (entry.isDirectory() || (entry.isSymbolicLink() && await stat(child).then(s => s.isDirectory(), () => false))) {
+            entries.push({ name: entry.name, path: child, hidden: entry.name.startsWith('.') });
+        }
+    }
+    signal.throwIfAborted();
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    return { path: target, parent: dirname(target) === target ? null : dirname(target), entries, truncated };
+}
+export async function directoryResponse(request) {
+    try {
+        const path = new URL(request.url).searchParams.get('path') ?? undefined;
+        return Response.json(await listMobileDirectory(path, request.signal), { headers: { 'cache-control': 'no-store' } });
+    }
+    catch (error) {
+        const invalid = error instanceof Error && error.message === 'invalid-path';
+        return Response.json({ error: invalid ? 'invalid-path' : 'directory-unavailable' }, {
+            status: request.signal.aborted ? 499 : invalid ? 400 : 422, headers: { 'cache-control': 'no-store' },
+        });
+    }
+}

package/lib/types/index.d.ts

@@ -0,0 +1,9 @@
+/** Mobile's host face uses the official authenticated Connection registry. */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "mobile";
+export declare const inject: string[];
+/** Attach only when the official Connection carrier is composed. */
+export declare function apply(ctx: Context, config?: {
+    publicOrigin?: string;
+}): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/index.js

@@ -0,0 +1,21 @@
+import { CONNECT_PATH, DIRECTORY_PATH, HANDSHAKE_PATH, mobileHandshake } from './protocol.js';
+import { connectResponse } from './connect.js';
+import { directoryResponse } from './directories.js';
+export const name = 'mobile';
+export const inject = [];
+/** Attach only when the official Connection carrier is composed. */
+export function apply(ctx, config = {}) {
+    ctx.inject(['connection'], (web) => {
+        web.connection.fetch.register({ path: CONNECT_PATH, methods: ['GET', 'POST'], requestBody: 'buffered',
+            fetch: connectResponse(web.connection, config.publicOrigin ?? process.env.DSH_MOBILE_PUBLIC_ORIGIN) });
+        web.connection.fetch.register({ path: DIRECTORY_PATH, methods: ['GET'], requestBody: 'buffered', fetch: directoryResponse });
+        web.connection.fetch.register({
+            path: HANDSHAKE_PATH,
+            methods: ['GET'],
+            requestBody: 'buffered',
+            fetch: async () => Response.json(mobileHandshake(), {
+                headers: { 'cache-control': 'no-store' },
+            }),
+        });
+    });
+}

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@khorsheed/dsh-mobile`.
+ * @module @khorsheed/dsh-mobile/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "mobile-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -0,0 +1,17 @@
+/**
+ * Package-owned invariant companion for `@khorsheed/dsh-mobile`.
+ * @module @khorsheed/dsh-mobile/invariant
+ */
+const PACKAGE_NAME = '@khorsheed/dsh-mobile';
+/** Cordis companion plugin name. */
+export const name = 'mobile-invariant';
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants'];
+/** Mobile owns no session data relations; the host owns authentication and streams. */
+const install = () => { };
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));

package/lib/types/protocol.d.ts

@@ -0,0 +1,30 @@
+/** Identifiers shared by the plugin and its optional native shell. */
+export declare const MOBILE_VERSION = "0.1.0";
+export declare const BRIDGE_VERSION = 1;
+export declare const HANDSHAKE_PATH = "/api/mobile/handshake";
+export declare const CONNECT_PATH = "/api/mobile/connect";
+export interface MobileConnectInfo {
+    state: 'ready' | 'not-configured' | 'invalid-origin' | 'untrusted-origin' | 'unsupported';
+    origin: string | null;
+}
+/** Read-only feature discovery; this does not create a login or grant access. */
+export declare function mobileHandshake(): {
+    readonly mobileVersion: "0.1.0";
+    readonly bridgeVersion: 1;
+    readonly capabilities: readonly ['responsive-layout', 'official-composer', 'browser-session-auth'];
+    readonly authentication: 'official-browser-session';
+    readonly devicePairing: false;
+    readonly pushNotifications: false;
+};
+export declare const DIRECTORY_PATH = "/api/mobile/directories";
+export interface MobileDirectoryListing {
+    path: string;
+    parent: string | null;
+    entries: {
+        name: string;
+        path: string;
+        hidden: boolean;
+    }[];
+    truncated: boolean;
+}
+//# sourceMappingURL=protocol.d.ts.map

package/lib/types/protocol.js

@@ -0,0 +1,17 @@
+/** Identifiers shared by the plugin and its optional native shell. */
+export const MOBILE_VERSION = '0.1.0';
+export const BRIDGE_VERSION = 1;
+export const HANDSHAKE_PATH = '/api/mobile/handshake';
+export const CONNECT_PATH = '/api/mobile/connect';
+/** Read-only feature discovery; this does not create a login or grant access. */
+export function mobileHandshake() {
+    return {
+        mobileVersion: MOBILE_VERSION,
+        bridgeVersion: BRIDGE_VERSION,
+        capabilities: ['responsive-layout', 'official-composer', 'browser-session-auth'],
+        authentication: 'official-browser-session',
+        devicePairing: false,
+        pushNotifications: false,
+    };
+}
+export const DIRECTORY_PATH = '/api/mobile/directories';

package/locale/en.json

@@ -0,0 +1 @@
+{"meta": {"title": "Mobile", "description": "Mobile layout and conversation library with an iOS bridge"}}

package/locale/zh.json

@@ -0,0 +1 @@
+{"meta": {"title": "移动端", "description": "提供移动布局、会话首页和 iOS 客户端桥接。"}}

package/package.json

@@ -0,0 +1,102 @@
+{
+  "name": "@khorsheed/dsh-mobile",
+  "version": "0.1.0",
+  "description": "Removable mobile presentation and iOS bridge for DeepSeek Harness.",
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "dsh-plugin",
+    "mobile",
+    "ios"
+  ],
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "examples",
+    "README.md",
+    "README.zh.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-connection"
+      ]
+    },
+    "compat": {
+      "minHost": "0.1.5-rc.1",
+      "notes": "Mobile layout and iOS shell under validation; Safari live-reply resume on Host 0.1.5-rc.1 requires the opt-in bundled ingress adapter. Device pairing and push are not provided."
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-layout": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.6",
+    "react": "^18.2.0",
+    "@deepseek-ai/dsh-client-ui-workspace": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.0-rc.6"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-locale": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-layout": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-slots": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-renderer": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-conversation": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-invariants": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-workspace": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-session-controller": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-workspace-controller": {
+      "optional": true
+    }
+  }
+}