@kinocode/dsh-mobile-bridge 0.0.0-stage → 0.3.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,48 @@
-# Temporary Holding Version
+# dsh-mobile-bridge
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **English summary.** DeepSeek Harness (DSH) host plugin for the DSH Mobile Android app. It serves its own HTTPS gateway for the phone (private CA, pairing QR from a sidebar button, WebView proxy of the stock DSH Web UI), joins the DSH Gateway event stream as an in-process owner client so approvals and questions in the live desktop session can be answered from the phone, and pushes approval requests, questions and turn completion through a relay over an outbound WebSocket. No third-party plugin is required. Requires DSH `>=0.2.1-rc.2 <0.3.0`.
+>
+> Install from the DSH **Plugins** page, or: `dsh plugin --profile desktop add @kinocode/dsh-mobile-bridge`
+>
+> The npm package is scoped because the unscoped name `dsh-mobile-bridge` belongs to an unrelated package. The source repository is private; the rest of this README is in Japanese.
+
+npm パッケージ名: `@kinocode/dsh-mobile-bridge`（DSH 内の拡張 ID とログの表示名は `dsh-mobile-bridge`）。ソースの GitHub リポジトリは非公開です。
+
+DeepSeek Harness のホストプラグインです。DSH Mobile（Android）から、デスクトップと同じ生きたセッションの承認・質問に答えられるようにし、承認待ち・質問・ターン完了をプッシュします。
+
+設計: [../docs/ADR-0001-architecture.md](../docs/ADR-0001-architecture.md) / 通信仕様: [../docs/PROTOCOL.md](../docs/PROTOCOL.md) / 導入: [../docs/SETUP.md](../docs/SETUP.md)
+
+## しくみ
+
+- **接続口**: PC のプライベート IPv4（LAN と Tailscale）で HTTPS を開き（既定 3543、自前 CA）、ペアリング・直結の制御 API・DSH 純正 Web 画面の中継を行います。DSH 自身の認証は接続口がサーバー側で持ち、スマホには渡しません。
+- **ペアリング**: DSH のサイドバー左下の「スマホを接続」で QR（CA 指紋・一回限りのコード・接続先）を出します。端末一覧と削除も同じパネルです。
+- DSH Gateway の転送イベント（`$events`）に、プロセス内の owner クライアントとして参加します。GUI のウィンドウがもう一つ増えたのと同じ扱いです。
+- `approval/request` / `user-questions/request` のリスナーは登録しません。承認を横取りすることも、GUI を飛ばすこともありません。
+- 回答は `$events/result` で返します。Gateway が最初の回答だけを採用し、ほかの画面（デスクトップ GUI、WebView）のカードを閉じます。
+- 承認リクエストにはコマンド本文がないため、`session/event` の `tool/call` を `callId` で引いてプレビューを作ります。
+- スマホからの制御リクエストは、リレーへの外向き WebSocket で受け取り、端末鍵の署名（ECDSA P-256）を検証します。
+
+## 依存
+
+- DeepSeek Harness 0.2.1-rc.2 以上 0.3 未満（Gateway の `wireStream` / `$events/result` は公開前の内部 API なので、範囲を固定しています）
+- DSH の Web サーバー（`webserver`）。接続口はここから画面を中継します
+- Node 22.4 以上の `WebSocket`（Electron 版 DSH に含まれます）
+
+## 設定
+
+[SETUP.md §2.2](../docs/SETUP.md) を参照してください。すべて任意です。
+
+## ブラウザ側
+
+`lib/client.js` は DSH Web に読み込まれ、(1) サイドバーに「スマホを接続」ボタンを足して QR と端末一覧のパネルを出し、(2) アプリから `dsh-mobile-bridge:open-session` イベントを受けたときに `uiWorkspace.openSession()` を呼びます（通知タップで該当セッションを開くため）。QR の生成には同梱の qrcode-generator（MIT）を使います。
+
+## テスト
+
+```bash
+node --test test/*.test.mjs
+```
+
+## 既知の制限
+
+- Gateway の内部 API に依存しています。DSH 0.3 で変わった場合は、`/connect` + `/api/remote.mux` を使う外部クライアント方式へ切り替えます（ADR §4）。
+- セッション名は `session/title` イベントと Session Controller の一覧から取ります。どちらにもない新しいセッションは「DeepSeek Harness」と表示します。

package/cordis.patch.yml

@@ -0,0 +1,16 @@
+# @kinocode/dsh-mobile-bridge bundle layer. Every field is optional. To enable push and notification
+# actions, add this to your profile's cordis.patch.yml (a profile patch replaces the whole
+# config, so list every field you want to keep):
+#
+#   - id: mobile-bridge
+#     config:
+#       relayUrl: https://dsh-relay.example.com
+#       relayEnrollToken: '...'
+#
+# Other fields: stateDir (default $DSH_HOME/mobile-bridge), gatewayEnabled (default true),
+# gatewayPort (default 3543), gatewayHosts (fixed IPv4 listen addresses instead of auto-detection),
+# hostLabel (default: computer name), previewMaxChars (default 400).
+- insert:
+    - id: mobile-bridge
+      name: '@kinocode/dsh-mobile-bridge'
+      config: {}

package/lib/auth.mjs

@@ -0,0 +1,180 @@
+// Device authentication for control requests (docs/PROTOCOL.md §2-§3).
+
+import { createHash, createPublicKey, randomBytes, timingSafeEqual, verify } from 'node:crypto'
+
+export const SIGNATURE_VERSION = 'DSHMB1'
+export const MAX_CLOCK_SKEW_MS = 5 * 60 * 1000
+export const NONCE_TTL_MS = 10 * 60 * 1000
+export const REGISTRATION_CODE_TTL_MS = 300 * 1000
+
+const DEVICE_ID = /^[a-f0-9]{32}$/
+const NONCE = /^[A-Za-z0-9_-]{22,128}$/
+const B64URL = /^[A-Za-z0-9_-]+$/
+
+/**
+ * Build the exact string a device signs.
+ * @param {{method: string, path: string, hostId: string, deviceId: string, timestamp: string, nonce: string, body: Buffer|string}} input
+ * @returns {string}
+ */
+export function canonicalString({ method, path, hostId, deviceId, timestamp, nonce, body }) {
+  const digest = createHash('sha256').update(body ?? '').digest('hex')
+  return [SIGNATURE_VERSION, method.toUpperCase(), path, hostId, deviceId, timestamp, nonce, digest].join('\n')
+}
+
+/**
+ * Parse and validate an SPKI DER (base64url) EC P-256 public key.
+ * @param {string} encoded
+ * @returns {import('node:crypto').KeyObject}
+ */
+export function parseDevicePublicKey(encoded) {
+  if (typeof encoded !== 'string' || encoded.length < 80 || encoded.length > 400 || !B64URL.test(encoded)) {
+    throw new AuthError(400, 'invalid_request', 'publicKey must be SPKI DER base64url')
+  }
+  let key
+  try {
+    key = createPublicKey({ key: Buffer.from(encoded, 'base64url'), format: 'der', type: 'spki' })
+  } catch {
+    throw new AuthError(400, 'invalid_request', 'publicKey is not a valid SPKI key')
+  }
+  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
+    throw new AuthError(400, 'invalid_request', 'publicKey must be EC P-256')
+  }
+  return key
+}
+
+/** Typed failure mapped to an HTTP status and stable error code. */
+export class AuthError extends Error {
+  /**
+   * @param {number} status
+   * @param {string} code
+   * @param {string} [message]
+   */
+  constructor(status, code, message = code) {
+    super(message)
+    this.status = status
+    this.code = code
+  }
+}
+
+/** Short-lived nonce memory that rejects replays inside the clock-skew window. */
+export class NonceCache {
+  constructor(now = Date.now) {
+    this.now = now
+    /** @type {Map<string, number>} */
+    this.seen = new Map()
+  }
+
+  /**
+   * Record a nonce; returns false when it was already seen.
+   * @param {string} key
+   */
+  remember(key) {
+    const now = this.now()
+    if (this.seen.size > 10_000 || this.seen.size % 256 === 0) {
+      for (const [k, expiry] of this.seen) if (expiry <= now) this.seen.delete(k)
+    }
+    const existing = this.seen.get(key)
+    if (existing !== undefined && existing > now) return false
+    this.seen.set(key, now + NONCE_TTL_MS)
+    return true
+  }
+}
+
+/** One-time pairing codes shown in the desktop QR. */
+export class RegistrationCodes {
+  constructor(now = Date.now, ttlMs = REGISTRATION_CODE_TTL_MS) {
+    this.now = now
+    this.ttlMs = ttlMs
+    /** @type {Map<string, {owner: string, expiresAt: number}>} */
+    this.codes = new Map()
+  }
+
+  /**
+   * Issue a code. Issuing again for the same `owner` invalidates that owner's earlier unused
+   * code, so only the QR currently on screen works.
+   * @param {string} owner
+   * @returns {{code: string, expiresAt: number}}
+   */
+  issue(owner) {
+    this.prune()
+    for (const [digest, entry] of this.codes) if (entry.owner === owner) this.codes.delete(digest)
+    if (this.codes.size >= 64) throw new AuthError(429, 'too_many_codes')
+    const code = randomBytes(32).toString('base64url')
+    const expiresAt = this.now() + this.ttlMs
+    this.codes.set(digestOf(code), { owner, expiresAt })
+    return { code, expiresAt }
+  }
+
+  /**
+   * Consume a code exactly once.
+   * @param {unknown} code
+   * @returns {string} the owner the code was issued for
+   */
+  consume(code) {
+    if (typeof code !== 'string' || code.length !== 43 || !B64URL.test(code)) throw new AuthError(401, 'invalid_code')
+    this.prune()
+    const digest = digestOf(code)
+    const entry = this.codes.get(digest)
+    if (entry === undefined) throw new AuthError(401, 'invalid_code')
+    this.codes.delete(digest)
+    return entry.owner
+  }
+
+  prune() {
+    const now = this.now()
+    for (const [digest, entry] of this.codes) if (entry.expiresAt <= now) this.codes.delete(digest)
+  }
+}
+
+function digestOf(value) {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+/**
+ * Verify one signed control request.
+ * @param {object} input
+ * @param {string} input.method
+ * @param {string} input.path
+ * @param {Record<string, string|undefined>} input.headers - lower-case header names
+ * @param {Buffer|string} input.body
+ * @param {string} input.hostId
+ * @param {(deviceId: string) => {publicKey: string, revoked?: boolean} | undefined} input.lookup
+ * @param {NonceCache} input.nonces
+ * @param {() => number} [input.now]
+ * @returns {string} the authenticated device id
+ */
+export function verifySignedRequest({ method, path, headers, body, hostId, lookup, nonces, now = Date.now }) {
+  const deviceId = headers['x-dshmb-device']
+  const timestamp = headers['x-dshmb-timestamp']
+  const nonce = headers['x-dshmb-nonce']
+  const signature = headers['x-dshmb-signature']
+  if (typeof deviceId !== 'string' || !DEVICE_ID.test(deviceId)) throw new AuthError(401, 'unknown_device')
+  if (typeof timestamp !== 'string' || !/^\d{12,16}$/.test(timestamp)) throw new AuthError(401, 'stale_request')
+  if (typeof nonce !== 'string' || !NONCE.test(nonce)) throw new AuthError(401, 'bad_signature')
+  if (typeof signature !== 'string' || signature.length > 200 || !B64URL.test(signature)) throw new AuthError(401, 'bad_signature')
+  const device = lookup(deviceId)
+  if (device === undefined || device.revoked === true) throw new AuthError(401, 'unknown_device')
+  if (Math.abs(now() - Number(timestamp)) > MAX_CLOCK_SKEW_MS) throw new AuthError(401, 'stale_request')
+  const data = Buffer.from(canonicalString({ method, path, hostId, deviceId, timestamp, nonce, body }), 'utf8')
+  let ok = false
+  try {
+    ok = verify('sha256', data, { key: parseDevicePublicKey(device.publicKey), dsaEncoding: 'der' }, Buffer.from(signature, 'base64url'))
+  } catch {
+    ok = false
+  }
+  if (!ok) throw new AuthError(401, 'bad_signature')
+  // Only a correctly signed request consumes its nonce, so garbage cannot evict real ones.
+  if (!nonces.remember(`${deviceId}:${nonce}`)) throw new AuthError(401, 'replayed_request')
+  return deviceId
+}
+
+/**
+ * Constant-time string comparison for secrets of equal expected length.
+ * @param {string} a
+ * @param {string} b
+ */
+export function safeEqual(a, b) {
+  const left = Buffer.from(a)
+  const right = Buffer.from(b)
+  return left.length === right.length && timingSafeEqual(left, right)
+}

package/lib/client.js

@@ -0,0 +1,219 @@
+// dsh-mobile-bridge — browser half, loaded into the DSH Web UI.
+// 1. Adds a sidebar footer button 「スマホを接続」 that shows the pairing QR and the paired phones
+//    (data from the owner-only /api/dsh-mobile-bridge/* routes; docs/PROTOCOL.md v2 §2.1).
+// 2. Lets the DSH Mobile app open a session: the app's page script dispatches
+//    `dsh-mobile-bridge:open-session` and this calls the Client Workspace service.
+window.__ModuleLoader__.load({
+  id: "@kinocode/dsh-mobile-bridge",
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+    Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+
+    const react = require("react");
+    const inject = ["slots"];
+    const SESSION_ID = /^[A-Za-z0-9_:.-]{1,200}$/;
+    const API = "/api/dsh-mobile-bridge";
+    const PANEL_ID = "dsh-mobile-bridge-panel";
+
+    const STYLE = `
+#${PANEL_ID}{position:fixed;inset:0;z-index:2147483000;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.45);font:14px/1.6 system-ui,-apple-system,"Hiragino Sans",sans-serif}
+#${PANEL_ID} .dmb-card{background:#fff;color:#1a1a1a;border-radius:16px;width:min(420px,calc(100vw - 32px));max-height:calc(100vh - 32px);overflow:auto;padding:20px 22px;box-shadow:0 20px 60px rgba(0,0,0,.25)}
+#${PANEL_ID} h2{font-size:17px;margin:0 0 4px}
+#${PANEL_ID} .dmb-sub{color:#666;font-size:12.5px;margin:0 0 14px}
+#${PANEL_ID} .dmb-qr{display:flex;justify-content:center;background:#fff;border-radius:12px;padding:8px;margin:6px 0 8px}
+#${PANEL_ID} .dmb-qr svg{width:260px;height:260px}
+#${PANEL_ID} .dmb-row{display:flex;align-items:center;justify-content:space-between;gap:8px;padding:8px 0;border-top:1px solid #eee}
+#${PANEL_ID} .dmb-muted{color:#777;font-size:12px}
+#${PANEL_ID} button{font:inherit;border-radius:8px;border:1px solid #ccc;background:#f6f6f6;padding:5px 12px;cursor:pointer}
+#${PANEL_ID} button.dmb-primary{background:#0e6e62;border-color:#0e6e62;color:#fff}
+#${PANEL_ID} .dmb-err{color:#b00020;margin:8px 0}
+#${PANEL_ID} .dmb-actions{display:flex;justify-content:flex-end;gap:8px;margin-top:14px}
+@media (prefers-color-scheme: dark){#${PANEL_ID} .dmb-card{background:#1f1f1f;color:#eee}#${PANEL_ID} .dmb-row{border-color:#333}#${PANEL_ID} button{background:#2b2b2b;border-color:#444;color:#eee}#${PANEL_ID} .dmb-sub,#${PANEL_ID} .dmb-muted{color:#aaa}}
+.dmb-trigger{display:flex;align-items:center;gap:8px;width:100%;border:0;background:transparent;color:inherit;font:inherit;padding:6px 10px;border-radius:8px;cursor:pointer}
+.dmb-trigger:hover{background:rgba(127,127,127,.12)}
+.dmb-trigger.is-rail{justify-content:center;padding:8px 0}`;
+
+    function el(tag, attrs, children) {
+      const node = document.createElement(tag);
+      for (const [k, v] of Object.entries(attrs || {})) {
+        if (k === "text") node.textContent = v;
+        else if (k.startsWith("on")) node.addEventListener(k.slice(2), v);
+        else node.setAttribute(k, v);
+      }
+      for (const child of children || []) if (child) node.append(child);
+      return node;
+    }
+
+    async function api(path, init) {
+      // Same shape as DSH's own connection RPC (no `cache` option: the desktop app forwards
+      // `/api` through its dsh-app:// protocol handler; the routes already send no-store).
+      let response;
+      try {
+        response = await fetch(API + path, Object.assign({ headers: { "content-type": "application/json" } }, init || {}));
+      } catch (e) {
+        console.error("[dsh-mobile-bridge] fetch failed", API + path, e);
+        throw new Error("通信できませんでした（" + (e && e.message ? e.message : String(e)) + "）");
+      }
+      let body = {};
+      try { body = await response.json(); } catch (e) { /* empty body */ }
+      if (!response.ok) throw new Error(body && typeof body.error === "string" ? body.error : "HTTP " + response.status);
+      return body;
+    }
+
+    function formatTime(ms) {
+      if (!ms) return "—";
+      try { return new Date(ms).toLocaleString("ja-JP", { month: "numeric", day: "numeric", hour: "2-digit", minute: "2-digit" }); } catch (e) { return "—"; }
+    }
+
+    const ERRORS = {
+      gateway_not_listening: "接続口が起動していません。Wi-Fi か Tailscale に接続しているか確認してください。",
+    };
+
+    function openPanel() {
+      if (document.getElementById(PANEL_ID)) return;
+      let timer = 0;
+      const qrBox = el("div", { class: "dmb-qr" }, [el("span", { class: "dmb-muted", text: "QR を準備しています…" })]);
+      let currentLink = "";
+      const copyButton = el("button", { type: "button", text: "リンクをコピー", title: "カメラが使えないときは、このリンクをアプリの「URL を貼り付け」に入れてください", onclick: async () => {
+        if (!currentLink) return;
+        try {
+          await navigator.clipboard.writeText(currentLink);
+          copyButton.textContent = "コピーしました";
+          setTimeout(() => { copyButton.textContent = "リンクをコピー"; }, 2000);
+        } catch (e) {
+          window.prompt("このリンクをコピーしてください", currentLink);
+        }
+      } });
+      const expiry = el("p", { class: "dmb-muted" });
+      const error = el("p", { class: "dmb-err" });
+      const devices = el("div");
+      const status = el("p", { class: "dmb-muted" });
+      const close = () => { clearInterval(timer); overlay.remove(); document.removeEventListener("keydown", onKey); };
+      const onKey = (e) => { if (e.key === "Escape") close(); };
+      const card = el("div", { class: "dmb-card", role: "dialog", "aria-modal": "true", "aria-label": "スマホを接続" }, [
+        el("h2", { text: "スマホを接続" }),
+        el("p", { class: "dmb-sub", text: "DSH Mobile アプリの「コンピューターを追加」でこの QR を読み取ってください。QR は 5 分間・1 回だけ使えます。" }),
+        qrBox, expiry, error, status,
+        el("h2", { text: "接続中の端末", style: "margin-top:16px;font-size:15px" }),
+        devices,
+        el("div", { class: "dmb-actions" }, [
+          copyButton,
+          el("button", { type: "button", text: "新しい QR", onclick: () => refreshQr() }),
+          el("button", { type: "button", class: "dmb-primary", text: "閉じる", onclick: close }),
+        ]),
+      ]);
+      const overlay = el("div", { id: PANEL_ID, onclick: (e) => { if (e.target === overlay) close(); } }, [card]);
+      document.body.append(overlay);
+      document.addEventListener("keydown", onKey);
+
+      async function refreshQr() {
+        error.textContent = "";
+        try {
+          const pairing = await api("/pairing", { method: "POST", body: "{}" });
+          qrBox.innerHTML = pairing.qrSvg;
+          currentLink = pairing.qr;
+          const until = pairing.expiresAt;
+          clearInterval(timer);
+          const tick = () => {
+            const left = Math.max(0, Math.round((until - Date.now()) / 1000));
+            expiry.textContent = left > 0 ? "有効期限まで " + Math.floor(left / 60) + " 分 " + (left % 60) + " 秒（接続先: " + pairing.origins.join(", ") + "）" : "期限切れです。「新しい QR」を押してください。";
+            if (left === 0) clearInterval(timer);
+          };
+          tick();
+          timer = setInterval(tick, 1000);
+        } catch (e) {
+          qrBox.textContent = "";
+          error.textContent = ERRORS[e.message] || ("QR を作れませんでした: " + e.message);
+        }
+      }
+
+      async function refreshDevices() {
+        try {
+          const [list, st] = await Promise.all([api("/devices"), api("/status")]);
+          status.textContent = "PC 名: " + st.hostLabel + " ／ 通知: " + (st.relay.configured ? (st.relay.connected ? "リレー接続中" : "リレー未接続") : "リレー未設定（アプリ内の承認のみ）");
+          devices.replaceChildren();
+          if (list.devices.length === 0) devices.append(el("p", { class: "dmb-muted", text: "まだ端末はありません。" }));
+          for (const d of list.devices) {
+            devices.append(el("div", { class: "dmb-row" }, [
+              el("div", {}, [
+                el("div", { text: d.label || "Android" }),
+                el("div", { class: "dmb-muted", text: "最終接続 " + formatTime(d.lastSeenAt) + (d.hasPush ? " ・ 通知あり" : " ・ 通知なし") }),
+              ]),
+              el("button", { type: "button", text: "削除", onclick: async () => {
+                if (!window.confirm((d.label || "この端末") + " の接続を削除しますか？")) return;
+                try { await api("/devices/revoke", { method: "POST", body: JSON.stringify({ deviceId: d.deviceId }) }); } catch (e) { error.textContent = "削除できませんでした: " + e.message; }
+                refreshDevices();
+              } }),
+            ]));
+          }
+        } catch (e) {
+          error.textContent = "状態を取得できませんでした: " + e.message;
+        }
+      }
+
+      refreshQr();
+      refreshDevices();
+    }
+
+    function PhoneIcon(size) {
+      return react.createElement("svg", { "aria-hidden": true, width: size, height: size, viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: 1.5, strokeLinecap: "round", strokeLinejoin: "round" },
+        react.createElement("rect", { x: 4, y: 1.5, width: 8, height: 13, rx: 1.6 }),
+        react.createElement("path", { d: "M7 12.2h2" }));
+    }
+
+    function Trigger(props) {
+      const wide = props && props.wide;
+      return react.createElement("button", {
+        type: "button",
+        className: "dmb-trigger" + (wide ? "" : " is-rail"),
+        title: "スマホを接続",
+        "aria-label": "スマホを接続",
+        onClick: openPanel,
+      }, PhoneIcon(wide ? 16 : 18), wide ? react.createElement("span", null, "スマホを接続") : null);
+    }
+
+    /**
+     * @param ctx - client root context.
+     */
+    function apply(ctx) {
+      ctx.effect(() => {
+        const style = document.createElement("style");
+        style.dataset.plugin = "dsh-mobile-bridge";
+        style.textContent = STYLE;
+        document.head.append(style);
+        const onOpen = (event) => {
+          const sessionId = event && event.detail && event.detail.sessionId;
+          if (typeof sessionId !== "string" || !SESSION_ID.test(sessionId)) return;
+          const workspace = ctx.get("uiWorkspace");
+          try {
+            if (workspace) workspace.openSession(sessionId);
+          } catch (error) {
+            console.warn("[dsh-mobile-bridge] openSession failed", error && error.message);
+          }
+        };
+        window.addEventListener("dsh-mobile-bridge:open-session", onOpen);
+        window.__dshMobileBridgeClient = 1;
+        return () => {
+          window.removeEventListener("dsh-mobile-bridge:open-session", onOpen);
+          if (window.__dshMobileBridgeClient === 1) delete window.__dshMobileBridgeClient;
+          style.remove();
+          const panel = document.getElementById(PANEL_ID);
+          if (panel) panel.remove();
+        };
+      }, "mobile-bridge: page hooks");
+
+      // The pairing button only makes sense on the desktop, not inside the phone's WebView.
+      if (navigator.userAgent.indexOf("DSHMobile/") === -1) {
+        ctx.effect(() => ctx.slots.inject("sidebar.footer.action", () => ctx.slots.register({
+          name: "sidebar.footer.action",
+          id: "dsh-mobile-bridge",
+        }, Trigger)), "mobile-bridge: sidebar button");
+      }
+    }
+
+    exports.apply = apply;
+    exports.inject = inject;
+    return module.exports;
+  }
+});