@morlay/dsh-desktopify 0.1.0

package/dist/cli/index.mjs

@@ -0,0 +1,1252 @@
+#!/usr/bin/env node
+import { a as writeAppConfig, t as SEED_HASH_NAME } from "../seed-Ca0AMFtp.mjs";
+import { createRequire } from "node:module";
+import { chmod, readFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { cpSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { Command } from "commander";
+import { build } from "electron-builder";
+import sharp from "sharp";
+import { createHash } from "node:crypto";
+import { pipeline } from "node:stream/promises";
+import extractZip from "extract-zip";
+import { extract } from "tar";
+//#region src/cli/electron-builder.ts
+/**
+* Electron 壳打包（静态、无签名）：electron-builder 的 `--dir` 语义 —— 产出
+* 未打包的应用目录（macOS `.app` / Linux 目录 / Windows 目录），不做签名、
+* notarize 或安装器，无需开发者账号。后端运行时（随包的 Node.js）与 profile
+* 种子作为 `extraResources` 一起打包。
+*
+* 这里直接调用 electron-builder 的 Node API，壳配置以 TS 收敛在工具内部
+* （不再有独立的 `electron-builder.config.mjs`，也不需要经环境变量回读工作区）。
+*/
+/** 已安装 Electron 的版本；本机存在未打包发行版时一并给出（作为打包源）。 */
+function installedElectron() {
+	const manifestPath = createRequire(import.meta.url).resolve("electron/package.json");
+	const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+	if (typeof manifest.version !== "string") throw new Error("dsh-desktopify: installed electron has no version");
+	const dist = join(dirname(manifestPath), "dist");
+	return {
+		version: manifest.version,
+		...existsSync(dist) ? { dist } : {}
+	};
+}
+/**
+* electron-builder 的 app 目录：只放运行时文件（`dist/` 壳产物 + 最小
+* manifest）。工具包自身的 package.json 声明了 electron / electron-builder
+* 等构建依赖，而 electron-builder 拒绝把它们当运行时依赖，因此壳以独立
+* 目录打包；app 版本取目标工作区的版本。
+*/
+function prepareShellAppDirectory(options) {
+	const { appRoot, buildRoot, appConfig } = options;
+	const appDir = join(buildRoot, "shell");
+	rmSync(appDir, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(appDir, { recursive: true });
+	cpSync(join(appRoot, "dist"), join(appDir, "dist"), { recursive: true });
+	const renderer = join(appRoot, "renderer");
+	if (existsSync(renderer)) cpSync(renderer, join(appDir, "renderer"), { recursive: true });
+	const tool = JSON.parse(readFileSync(join(appRoot, "package.json"), "utf8"));
+	writeFileSync(join(appDir, "package.json"), `${JSON.stringify({
+		name: tool.name ?? "dsh-desktop-shell",
+		version: appConfig.version,
+		...tool.description === void 0 ? {} : { description: tool.description },
+		...tool.author === void 0 ? {} : { author: tool.author },
+		main: "dist/index.mjs"
+	}, void 0, 2)}\n`);
+	return appDir;
+}
+/** 打包壳应用，返回 electron-builder 写出的产物路径。 */
+async function buildDesktopApp(options) {
+	const { buildRoot, appConfig, icons, dir } = options;
+	const appDir = prepareShellAppDirectory(options);
+	const electron = installedElectron();
+	console.log(`desktop bundle: electron-builder appId=${appConfig.id} productName=${appConfig.name} version=${appConfig.version} electron=${electron.version}`);
+	const config = {
+		appId: appConfig.id,
+		productName: appConfig.name,
+		artifactName: "${productName}-${version}-${os}-${arch}.${ext}",
+		electronVersion: electron.version,
+		...electron.dist === void 0 ? {} : { electronDist: electron.dist },
+		directories: { output: join(buildRoot, "artifacts") },
+		asar: true,
+		files: [
+			"dist/**",
+			"renderer/**/*",
+			"package.json"
+		],
+		extraResources: [
+			{
+				from: join(buildRoot, "runtime"),
+				to: "runtime"
+			},
+			{
+				from: join(buildRoot, "seed"),
+				to: "seed"
+			},
+			{
+				from: join(buildRoot, "runtime", "appconfig.json"),
+				to: "appconfig.json"
+			}
+		],
+		mac: {
+			category: "public.app-category.developer-tools",
+			identity: null,
+			target: ["dir"],
+			...icons.mac === void 0 ? {} : { icon: icons.mac }
+		},
+		linux: {
+			category: "Development",
+			target: ["dir"],
+			...icons.linux === void 0 ? {} : { icon: icons.linux }
+		},
+		win: {
+			target: ["dir"],
+			...icons.win === void 0 ? {} : { icon: icons.win }
+		}
+	};
+	return build({
+		projectDir: appDir,
+		config,
+		publish: "never",
+		dir
+	});
+}
+//#endregion
+//#region src/cli/icon.ts
+/**
+* Prepare platform icons from the workspace `dsh.desktop.icon` (an SVG):
+* rasterize with sharp into the sizes each platform needs, and build the
+* macOS `.icns` with `iconutil`. Results are written under the build root's
+* `icon/` directory and summarized in `icon.json` for electron-builder.
+*/
+/** macOS iconset sizes: [pixel, filename]. */
+const MAC_ICONSET_SIZES = [
+	[16, "icon_16x16.png"],
+	[32, "icon_16x16@2x.png"],
+	[32, "icon_32x32.png"],
+	[64, "icon_32x32@2x.png"],
+	[128, "icon_128x128.png"],
+	[256, "icon_128x128@2x.png"],
+	[256, "icon_256x256.png"],
+	[512, "icon_256x256@2x.png"],
+	[512, "icon_512x512.png"],
+	[1024, "icon_512x512@2x.png"]
+];
+/** Transparent canvas letterboxing（sharp `fit: "contain"` 默认黑底，SVG 上下会透出黑边）。 */
+const CONTAIN_BACKGROUND = {
+	r: 0,
+	g: 0,
+	b: 0,
+	alpha: 0
+};
+/**
+* Rasterize the workspace icon for the current platform.
+* @param workspace - app workspace directory.
+* @param buildRootDir - the tool's build cache root.
+* @param icon - `dsh.desktop.icon` value (relative to the workspace).
+* @returns the prepared icon paths (empty when no icon is declared).
+*/
+async function prepareIcons(workspace, buildRootDir, icon) {
+	if (icon === void 0 || icon === "") return {};
+	const source = resolve(workspace, icon);
+	if (!existsSync(source)) throw new Error(`desktop bundle: workspace icon ${source} does not exist`);
+	const outDir = join(buildRootDir, "icon");
+	rmSync(outDir, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(outDir, { recursive: true });
+	const png512 = join(outDir, "icon-512.png");
+	await sharp(source).resize(512, 512, {
+		fit: "contain",
+		background: CONTAIN_BACKGROUND
+	}).png().toFile(png512);
+	let icons = {
+		linux: png512,
+		win: png512
+	};
+	if (process.platform === "darwin") {
+		const iconset = join(outDir, "icon.iconset");
+		mkdirSync(iconset, { recursive: true });
+		for (const [size, name] of MAC_ICONSET_SIZES) await sharp(source).resize(size, size, {
+			fit: "contain",
+			background: CONTAIN_BACKGROUND
+		}).png().toFile(join(iconset, name));
+		const icns = join(outDir, "icon.icns");
+		execFileSync("iconutil", [
+			"-c",
+			"icns",
+			iconset,
+			"-o",
+			icns
+		]);
+		icons = {
+			...icons,
+			mac: icns
+		};
+	}
+	writeFileSync(join(outDir, "icon.json"), `${JSON.stringify(icons, void 0, 2)}\n`);
+	return icons;
+}
+/** Official packages the tool injects into every runtime project it assembles. */
+const OFFICIAL_RUNTIME_PACKAGES = [
+	"@deepseek-ai/dsh",
+	"@deepseek-ai/dsh-desktop-host",
+	...[
+		"@deepseek-ai/cordis-plugin-group",
+		"@deepseek-ai/dsh-authorization",
+		"@deepseek-ai/dsh-bash-local",
+		"@deepseek-ai/dsh-code-runtime",
+		"@deepseek-ai/dsh-compaction",
+		"@deepseek-ai/dsh-fs",
+		"@deepseek-ai/dsh-hook-protocol",
+		"@deepseek-ai/dsh-jobs",
+		"@deepseek-ai/dsh-output-retention",
+		"@deepseek-ai/dsh-sandbox",
+		"@deepseek-ai/dsh-sdk-protocol",
+		"@deepseek-ai/dsh-session-query",
+		"@deepseek-ai/dsh-session-telemetry",
+		"@deepseek-ai/dsh-session-title-llm",
+		"@deepseek-ai/dsh-shell",
+		"@deepseek-ai/dsh-spill",
+		"@deepseek-ai/dsh-subagent-in-process-driver",
+		"@deepseek-ai/dsh-util-time",
+		"@deepseek-ai/dsh-util-workspace-path",
+		"@deepseek-ai/dsh-workflow"
+	]
+];
+/** Official profile bundles merged ahead of the app's own bundles. */
+const OFFICIAL_PROFILE_BUNDLES = ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"];
+//#endregion
+//#region src/cli/workspace.ts
+/**
+* Shared workspace resolution for the desktopify scripts: the workspace is
+* never hardcoded — it comes from `DSH_DESKTOP_WORKSPACE` (or the CLI
+* positional argument, which the CLI forwards through that variable) and
+* defaults to the current directory. Also carries the app-facing contract:
+* `dsh.desktop` identity and the merged profile bundle list.
+* @module @morlay/dsh-desktopify
+*/
+/** The dsh profile the desktop shell hosts (upstream desktop semantics). */
+const PROFILE_NAME = "desktop";
+/** Resolve the app workspace directory (default: the current directory). */
+function resolveWorkspace() {
+	return resolve(process.cwd());
+}
+/** Read and validate the workspace manifest. */
+function workspaceManifest(workspace) {
+	const value = JSON.parse(readFileSync(join(workspace, "package.json"), "utf8"));
+	if (typeof value.name !== "string" || value.name === "") throw new Error(`dsh-desktopify: workspace ${workspace} has no package name`);
+	return {
+		...value,
+		name: value.name
+	};
+}
+/**
+* The `@deepseek-ai/dsh` dependency spec the app targets (`dsh.version`): a
+* concrete release (`0.1.5-rc.1`), a range, or the `workspace:` protocol when
+* the app lives in the same workspace as the vendored dsh.
+*/
+function dshVersion(manifest) {
+	const version = manifest.dsh?.version;
+	if (version === void 0) return void 0;
+	if (typeof version !== "string" || version === "") throw new Error(`dsh-desktopify: workspace ${String(manifest.name)} has an invalid dsh.version (expected a dependency spec such as "0.1.5-rc.1" or "workspace:^")`);
+	return version;
+}
+/** The app's `dsh.desktop` configuration with tool defaults. */
+function desktopConfig(manifest) {
+	const desktop = manifest.dsh?.desktop ?? {};
+	const window = desktop.window ?? {};
+	return {
+		id: desktop.id ?? "ai.deepseek.dsh.custom",
+		version: manifest.version ?? "0.0.1",
+		dshHome: desktop.dshHome ?? "xdg",
+		window: {
+			width: window.width ?? 1280,
+			height: window.height ?? 800,
+			minWidth: window.minWidth ?? 800,
+			minHeight: window.minHeight ?? 600
+		},
+		...desktop.icon === void 0 ? {} : { icon: desktop.icon }
+	};
+}
+/** The app's declared profile bundles (validated). */
+function appProfileBundles(manifest) {
+	const bundles = manifest.dsh?.profile?.bundles;
+	if (!Array.isArray(bundles) || !bundles.every((bundle) => typeof bundle === "string")) throw new Error(`dsh-desktopify: workspace ${String(manifest.name)} has no dsh.profile.bundles`);
+	return bundles;
+}
+/** Official bundles merged ahead of the app's own bundles. */
+function mergedProfileBundles(manifest) {
+	return [...OFFICIAL_PROFILE_BUNDLES, ...appProfileBundles(manifest)];
+}
+/** Find the pnpm workspace root above a directory. */
+function findWorkspaceRoot(workspace) {
+	let current = resolve(workspace);
+	for (;;) {
+		if (existsSync(join(current, "pnpm-workspace.yaml"))) return current;
+		const parent = dirname(current);
+		if (parent === current) throw new Error(`dsh-desktopify: no pnpm-workspace.yaml found above ${workspace}`);
+		current = parent;
+	}
+}
+/** The tool's build cache root inside the target workspace. */
+function buildRoot(workspace) {
+	return join(workspace, "node_modules", ".dsh-desktopify");
+}
+//#endregion
+//#region src/cli/prepare-runtime.ts
+/**
+* Download and verify the upstream Node.js runtime for the packaged backend.
+* The backend runs under this bundled Node executable; the shell spawns it
+* directly (no user Node required). Downloads are cached under the target
+* workspace's `node_modules/.dsh-desktopify/downloads` and verified against
+* the official SHASUMS256.
+*/
+const NODE_VERSION = "24.17.0";
+function target() {
+	const rawPlatform = process.env.DSH_DESKTOP_TARGET_PLATFORM ?? process.platform;
+	const rawArch = process.env.DSH_DESKTOP_TARGET_ARCH ?? process.arch;
+	const platform = rawPlatform === "win32" ? "win" : rawPlatform;
+	if (platform !== "darwin" && platform !== "linux" && platform !== "win") throw new Error(`desktop runtime: unsupported platform ${rawPlatform}`);
+	if (rawArch !== "arm64" && rawArch !== "x64") throw new Error(`desktop runtime: unsupported architecture ${rawArch}`);
+	return {
+		platform,
+		arch: rawArch
+	};
+}
+async function download(url, path) {
+	const response = await fetch(url);
+	if (!response.ok) throw new Error(`desktop runtime: ${url} returned HTTP ${String(response.status)}`);
+	writeFileSync(path, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+}
+async function prepareNode(platform, arch, buildRootDir) {
+	const extension = platform === "win" ? "zip" : "tar.gz";
+	const folder = `node-v${NODE_VERSION}-${platform}-${arch}`;
+	const archiveName = `${folder}.${extension}`;
+	const releaseRoot = `https://nodejs.org/download/release/v${NODE_VERSION}`;
+	const downloadRoot = join(buildRootDir, "downloads");
+	const archive = join(downloadRoot, archiveName);
+	const sums = join(downloadRoot, `node-v${NODE_VERSION}-SHASUMS256.txt`);
+	if (!existsSync(archive)) await download(`${releaseRoot}/${archiveName}`, archive);
+	if (!existsSync(sums)) await download(`${releaseRoot}/SHASUMS256.txt`, sums);
+	const line = (await readFile(sums, "utf8")).split(/\r?\n/u).find((candidate) => candidate.endsWith(`  ${archiveName}`));
+	if (line === void 0) throw new Error(`desktop runtime: ${archiveName} is absent from Node.js SHASUMS256.txt`);
+	const expected = line.split(/\s+/u)[0];
+	if (createHash("sha256").update(await readFile(archive)).digest("hex") !== expected) throw new Error(`desktop runtime: checksum mismatch for ${archiveName}`);
+	const extraction = join(buildRootDir, "node-extract");
+	rmSync(extraction, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(extraction, { recursive: true });
+	if (platform === "win") await extractZip(archive, { dir: extraction });
+	else await extract({
+		cwd: extraction,
+		file: archive
+	});
+	const source = join(extraction, folder, platform === "win" ? "node.exe" : "bin/node");
+	const destinationRoot = join(buildRootDir, "runtime", "node");
+	const destination = join(destinationRoot, platform === "win" ? "node.exe" : "node");
+	rmSync(destinationRoot, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(destinationRoot, { recursive: true });
+	await pipeline(createReadStream(source), createWriteStream(destination, { flags: "wx" }));
+	if (platform !== "win") await chmod(destination, 493);
+	if (platform === (process.platform === "win32" ? "win" : process.platform) && (arch === process.arch || platform === "darwin" && arch === "x64" && process.arch === "arm64")) {
+		const result = spawnSync(destination, ["--version"], { encoding: "utf8" });
+		if (result.error !== void 0 || result.status !== 0 || result.stdout.trim() !== `v${NODE_VERSION}`) {
+			const detail = result.error?.message ?? result.signal ?? result.stderr.trim();
+			const outcome = detail === "" ? `exit ${String(result.status)}` : detail;
+			throw new Error(`desktop runtime: prepared Node.js ${NODE_VERSION} failed executable verification: ${outcome}`);
+		}
+	}
+	rmSync(extraction, {
+		recursive: true,
+		force: true
+	});
+}
+async function runPrepareRuntime(options) {
+	const { platform, arch } = target();
+	const buildRootDir = buildRoot(resolve(options.workspace ?? resolveWorkspace()));
+	const runtimeRoot = join(buildRootDir, "runtime");
+	mkdirSync(join(buildRootDir, "downloads"), { recursive: true });
+	mkdirSync(runtimeRoot, { recursive: true });
+	await prepareNode(platform, arch, buildRootDir);
+	writeFileSync(join(runtimeRoot, "versions.json"), `${JSON.stringify({
+		schemaVersion: 1,
+		node: NODE_VERSION
+	}, void 0, 2)}\n`);
+	console.log(`desktop runtime: prepared Node.js ${NODE_VERSION} for ${platform}-${arch}`);
+}
+//#endregion
+//#region src/cli/official-deps.ts
+/**
+* Official `@deepseek-ai/*` dependency resolution for one target workspace.
+*
+* The app declares only its own dependencies plus `dsh.version` (the
+* `@deepseek-ai/dsh` dependency spec it targets); the tool maintains the
+* official surface (`../official.ts`). Specs are derived from the packages
+* actually installed — the app workspace first, then the tool's own install —
+* so nothing hardcodes the `workspace:` protocol and an app outside this
+* repository resolves the same way:
+*   - `@deepseek-ai/dsh` → `dsh.version` when declared (concrete version,
+*     range, or `workspace:` in-tree), else `^<resolved>`;
+*   - `@deepseek-ai/dsh-desktop-host` → `link:<dir>`, or a staged `file:`
+*     copy when the host lives outside the app workspace (the host is not
+*     published, so it always comes from the tool);
+*   - every other official package → `^<resolved>`.
+*
+* `hasTsx` reports whether the workspace can load TypeScript sources directly;
+* the tool only injects `--import=tsx/esm` when it can.
+* @module @morlay/dsh-desktopify
+*/
+/** Installation anchor the upstream desktop host resolves profile bundles from. */
+const DSH_PACKAGE = "@deepseek-ai/dsh";
+/** Private byte-pipe backend installed beside dsh; never published to a registry. */
+const DESKTOP_HOST_PACKAGE = "@deepseek-ai/dsh-desktop-host";
+/**
+* `node_modules` roots searched for the official surface, in priority order:
+* the app's own install, its pnpm virtual store, the tool's install, and the
+* tool's surrounding install (the repository store in-tree, the app's
+* `node_modules` when the tool is installed as a dependency).
+*/
+function officialSearchDirs(input) {
+	return [.../* @__PURE__ */ new Set([
+		join(input.workspace, "node_modules"),
+		join(input.workspaceRoot, "node_modules", ".pnpm", "node_modules"),
+		join(input.toolRoot, "node_modules"),
+		resolve(input.toolRoot, "..", ".."),
+		resolve(input.toolRoot, "..", "..", "node_modules", ".pnpm", "node_modules")
+	])];
+}
+/** Resolve one official package from the workspace, then the tool. */
+function resolveOfficialPackage(packageName, input) {
+	for (const modulesDir of officialSearchDirs(input)) {
+		const dir = join(modulesDir, ...packageName.split("/"));
+		const manifestPath = join(dir, "package.json");
+		if (!existsSync(manifestPath)) continue;
+		try {
+			const value = JSON.parse(readFileSync(manifestPath, "utf8"));
+			if (typeof value.version === "string" && value.version !== "") return {
+				dir: realpathSync(dir),
+				version: value.version
+			};
+		} catch {}
+	}
+}
+/**
+* The tool's own `node_modules` root holding the official surface, used as a
+* dev fallback for an app that declares only `dsh.version` and has not
+* installed the official packages itself. Prefers the surrounding store (the
+* repository virtual store in-tree, the app store when installed as a
+* dependency) over the tool's direct dependencies.
+*/
+function toolModulesDir(input) {
+	for (const modulesDir of [
+		resolve(input.toolRoot, "..", "..", "node_modules", ".pnpm", "node_modules"),
+		resolve(input.toolRoot, "..", ".."),
+		join(input.toolRoot, "node_modules")
+	]) if (existsSync(join(modulesDir, "@deepseek-ai"))) return modulesDir;
+}
+/**
+* Dependency specs for the complete official surface of one workspace.
+* Throws when a package cannot be located, naming the missing package.
+*/
+function officialDependencySpecs(input) {
+	const specs = {};
+	const missing = [];
+	for (const packageName of OFFICIAL_RUNTIME_PACKAGES) {
+		const resolved = resolveOfficialPackage(packageName, input);
+		if (packageName === "@deepseek-ai/dsh" && input.dshVersion !== void 0) {
+			specs[packageName] = input.dshVersion;
+			continue;
+		}
+		if (resolved === void 0) {
+			missing.push(packageName);
+			continue;
+		}
+		if (packageName === "@deepseek-ai/dsh-desktop-host") {
+			specs[packageName] = `link:${resolved.dir}`;
+			continue;
+		}
+		specs[packageName] = `^${resolved.version}`;
+	}
+	if (missing.length > 0) throw new Error(`dsh-desktopify: cannot resolve official packages ${missing.join(", ")}; install them in the workspace or run from the tool's own install`);
+	return specs;
+}
+/** Whether `candidate` is `root` itself or nested under it. */
+function isInside(root, candidate) {
+	const rel = relative(resolve(root), resolve(candidate));
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+/**
+* Dependency spec for the private desktop host in a `pnpm deploy` closure.
+*
+* In-repo the host lives inside the same pnpm workspace, so a `link:` spec is
+* copied by deploy. When the app workspace is elsewhere, `pnpm deploy` refuses
+* paths outside it: stage a copy inside the app workspace (with the host's
+* `workspace:` dependencies rewritten to the specs already computed) and use a
+* `file:` spec. The staged directory is temporary and removed by the caller.
+*/
+function stageDesktopHost(input, specs) {
+	const host = resolveOfficialPackage(DESKTOP_HOST_PACKAGE, input);
+	if (host === void 0) throw new Error(`dsh-desktopify: cannot resolve ${DESKTOP_HOST_PACKAGE}`);
+	if (isInside(input.workspaceRoot, host.dir)) return `link:${host.dir}`;
+	const staged = join(input.workspace, ".dsh-desktopify-host");
+	rmSync(staged, {
+		recursive: true,
+		force: true
+	});
+	cpSync(host.dir, staged, {
+		recursive: true,
+		dereference: true,
+		filter: (source) => {
+			const rel = relative(host.dir, source);
+			return rel === "" || !rel.split(/[\\/]/u).includes("node_modules");
+		}
+	});
+	const manifestPath = join(staged, "package.json");
+	const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+	for (const field of ["dependencies", "peerDependencies"]) {
+		const dependencies = manifest[field];
+		if (typeof dependencies !== "object" || dependencies === null) continue;
+		for (const [name, spec] of Object.entries(dependencies)) {
+			if (typeof spec !== "string" || !spec.startsWith("workspace:")) continue;
+			const resolved = resolveOfficialPackage(name, input);
+			const configured = specs[name];
+			const replacement = configured === void 0 || configured.startsWith("workspace:") ? resolved === void 0 ? void 0 : `^${resolved.version}` : configured;
+			if (replacement !== void 0 && !replacement.startsWith("link:")) dependencies[name] = replacement;
+		}
+	}
+	writeFileSync(manifestPath, `${JSON.stringify(manifest, void 0, 2)}\n`);
+	return "file:./.dsh-desktopify-host";
+}
+/** Whether the workspace can load TypeScript sources through tsx. */
+function hasTsx(workspace, workspaceRoot) {
+	for (const dir of [workspace, workspaceRoot]) try {
+		createRequire(join(dir, "package.json")).resolve("tsx/esm");
+		return true;
+	} catch {}
+	return false;
+}
+//#endregion
+//#region src/cli/prepare-seed.ts
+/**
+* Build the packaged profile seed: export the workspace's production
+* dependency closure with `pnpm deploy`, then assemble `dsh-home/profiles/desktop`
+* from the workspace whitelist (package.json, cordis.patch.yml, declared
+* `files`) plus the flattened closure as `node_modules`, stamped with a
+* `.seed-hash` fingerprint. The shell forces the runtime home's profile to
+* this seed at startup.
+*
+* The fingerprint covers what can change under a bundled application without
+* a version bump: the whitelisted workspace content, the root lockfile (the
+* resolved dependency graph), and the closure content of every local source
+* package — `workspace:^` dependencies resolve to the workspace tree
+* (`@morlay/*`, vendored `@deepseek-ai/*`), so their sources can change while
+* every version string stays the same.
+*
+* The official `@deepseek-ai/*` dependency surface is maintained by the tool:
+* the official packages are injected into the workspace manifest before
+* deploy (and removed afterwards), so the deploy closure carries the
+* complete official tree (dsh, dsh-base, dsh-web-app, the peer packages).
+* The closure is then flattened with pnpm's `nodeLinker: hoisted` — a
+* traditional node_modules layout with every package at the top level, no
+* virtual store, no external links — so the seed is fully self-contained.
+*/
+/** 工具包根（源码形态 `src/cli` 与构建形态 `dist/cli` 同深度）。 */
+const APP_ROOT$4 = resolve(import.meta.dirname, "..", "..");
+function runPnpm(args, cwd) {
+	return new Promise((resolvePromise, reject) => {
+		const child = spawn("pnpm", args, {
+			cwd,
+			stdio: "inherit"
+		});
+		child.once("error", reject);
+		child.once("close", (code, signal) => {
+			if (code === 0) resolvePromise();
+			else reject(/* @__PURE__ */ new Error(`desktop seed: pnpm ${args.join(" ")} exited with ${String(code ?? signal)}`));
+		});
+	});
+}
+/**
+* Export the workspace production closure into the deploy staging directory.
+* The official packages are injected into the workspace manifest (specs
+* derived from `dsh.version` and the installed packages, never a hardcoded
+* `workspace:` protocol) and the root lockfile is refreshed
+* (`--lockfile-only`) so the deploy resolves them; both are restored
+* afterwards. The deploy closure is then flattened: `nodeLinker: hoisted`
+* reinstalls it as a traditional node_modules layout (every package at the
+* top level, no virtual store, no external links).
+*/
+async function deployClosure(workspace, name, destination, input) {
+	const root = findWorkspaceRoot(workspace);
+	const manifestPath = join(workspace, "package.json");
+	const lockfilePath = join(root, "pnpm-lock.yaml");
+	const originalManifest = readFileSync(manifestPath, "utf8");
+	const originalLockfile = readFileSync(lockfilePath, "utf8");
+	const manifest = JSON.parse(originalManifest);
+	const specs = officialDependencySpecs(input);
+	specs[DESKTOP_HOST_PACKAGE] = stageDesktopHost(input, specs);
+	const dependencies = {
+		...manifest.dependencies,
+		...specs
+	};
+	writeFileSync(manifestPath, `${JSON.stringify({
+		...manifest,
+		dependencies
+	}, void 0, 2)}\n`);
+	try {
+		await runPnpm(["install", "--lockfile-only"], root);
+		rmSync(destination, {
+			recursive: true,
+			force: true
+		});
+		mkdirSync(destination, { recursive: true });
+		await runPnpm([
+			...root !== resolve(workspace) ? ["--filter", name] : [],
+			"deploy",
+			"--prod",
+			"--ignore-scripts",
+			destination
+		], root);
+		if (!existsSync(join(destination, "node_modules"))) throw new Error(`desktop seed: pnpm deploy did not produce ${join(destination, "node_modules")}`);
+		const workspaceFile = join(destination, "pnpm-workspace.yaml");
+		if (existsSync(workspaceFile)) {
+			let content = readFileSync(workspaceFile, "utf8").replaceAll(": set this to true or false", ": true");
+			if (!content.includes("minimumReleaseAge")) content = `${content.trimEnd()}\nminimumReleaseAge: 0\n`;
+			if (!content.includes("nodeLinker")) content = `${content.trimEnd()}\nnodeLinker: hoisted\n`;
+			writeFileSync(workspaceFile, content);
+		}
+		await runPnpm([
+			"install",
+			"--no-frozen-lockfile",
+			"--ignore-scripts"
+		], destination);
+	} finally {
+		writeFileSync(manifestPath, originalManifest);
+		writeFileSync(lockfilePath, originalLockfile);
+		rmSync(join(workspace, ".dsh-desktopify-host"), {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Whitelisted workspace files that enter the seed and the fingerprint. */
+function seedEntries(workspace, manifest) {
+	const entries = /* @__PURE__ */ new Set(["package.json", "cordis.patch.yml"]);
+	for (const file of manifest.files ?? []) {
+		const cleaned = file.replaceAll("\\", "/").replace(/^\.\//u, "");
+		if (cleaned === "" || cleaned === "." || cleaned.startsWith("/") || cleaned.startsWith("../")) continue;
+		entries.add(cleaned);
+	}
+	return [...entries].sort();
+}
+/** Directories never walked when hashing seed content (installs, caches, VCS). */
+const TREE_SKIP_DIRS = /* @__PURE__ */ new Set([
+	".bin",
+	".cache",
+	".git",
+	".dsh-store",
+	".pnpm-store",
+	".turbo",
+	"node_modules"
+]);
+/** Depth limit for the local package scan (vendored trees nest a few levels). */
+const LOCAL_PACKAGE_SCAN_DEPTH = 6;
+/** Feed one path (file, or directory expanded recursively) into the hash. */
+function hashPath(hash, root, relativePath) {
+	const path = join(root, ...relativePath.split("/"));
+	if (!existsSync(path)) return;
+	const stat = statSync(path);
+	if (stat.isDirectory()) {
+		for (const entry of readdirSync(path).sort()) {
+			if (TREE_SKIP_DIRS.has(entry)) continue;
+			hashPath(hash, root, `${relativePath}/${entry}`);
+		}
+		return;
+	}
+	if (!stat.isFile()) return;
+	hash.update(relativePath);
+	hash.update("\0");
+	hash.update(readFileSync(path));
+	hash.update("\0");
+}
+/** Read a package name, tolerating unreadable or nameless manifests. */
+function packageName(manifestPath) {
+	try {
+		const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+		return typeof manifest.name === "string" && manifest.name !== "" ? manifest.name : void 0;
+	} catch {
+		return;
+	}
+}
+/** Local source packages under the workspace root: package name → directory. */
+function localPackageDirs(root) {
+	const found = /* @__PURE__ */ new Map();
+	const visit = (dir, depth) => {
+		if (depth > LOCAL_PACKAGE_SCAN_DEPTH) return;
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (!entry.isDirectory() || entry.name.startsWith(".") || TREE_SKIP_DIRS.has(entry.name)) continue;
+			const child = join(dir, entry.name);
+			const manifestPath = join(child, "package.json");
+			if (existsSync(manifestPath)) {
+				const name = packageName(manifestPath);
+				if (name !== void 0 && !found.has(name)) found.set(name, child);
+			}
+			visit(child, depth + 1);
+		}
+	};
+	visit(root, 0);
+	return found;
+}
+/** Top-level package names of a flattened (hoisted) closure. */
+function closurePackageNames(modulesDir) {
+	const names = [];
+	for (const entry of readdirSync(modulesDir, { withFileTypes: true })) {
+		if (entry.name.startsWith(".") || TREE_SKIP_DIRS.has(entry.name)) continue;
+		if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+		if (entry.name.startsWith("@")) {
+			for (const scoped of readdirSync(join(modulesDir, entry.name)).sort()) if (!scoped.startsWith(".")) names.push(`${entry.name}/${scoped}`);
+			continue;
+		}
+		names.push(entry.name);
+	}
+	return names.sort();
+}
+/**
+* Seed fingerprint: whitelisted workspace content, the root lockfile (the
+* resolved dependency graph), and the closure content of every local source
+* package — `workspace:^` dependencies keep their version while their content
+* changes, so the closure itself is the only reliable signal.
+*/
+function seedFingerprint(input) {
+	const hash = createHash("sha256");
+	hash.update("workspace\0");
+	for (const entry of input.entries) hashPath(hash, input.workspace, entry);
+	hash.update("lockfile\0");
+	const lockfile = join(input.workspaceRoot, "pnpm-lock.yaml");
+	if (existsSync(lockfile)) {
+		hash.update(readFileSync(lockfile));
+		hash.update("\0");
+	}
+	hash.update("local-closure\0");
+	const local = localPackageDirs(input.workspaceRoot);
+	for (const name of closurePackageNames(input.closureModulesDir)) {
+		if (!local.has(name)) continue;
+		hash.update(`${name}\0`);
+		hashPath(hash, input.closureModulesDir, name);
+	}
+	return hash.digest("hex");
+}
+async function runPrepareSeed(options) {
+	const workspace = resolve(options.workspace ?? resolveWorkspace());
+	const manifest = workspaceManifest(workspace);
+	const workspaceRoot = findWorkspaceRoot(workspace);
+	const dshVersion$2 = dshVersion(manifest);
+	const input = {
+		workspace,
+		workspaceRoot,
+		toolRoot: APP_ROOT$4,
+		...dshVersion$2 === void 0 ? {} : { dshVersion: dshVersion$2 }
+	};
+	const buildRootDir = buildRoot(workspace);
+	const seedOutputRoot = join(buildRootDir, "seed");
+	const deployRoot = join(buildRootDir, "deploy");
+	const entries = seedEntries(workspace, manifest);
+	console.log(`desktop seed: workspace ${workspace} (${manifest.name})`);
+	console.log(`desktop seed: whitelist ${entries.join(", ")}`);
+	await deployClosure(workspace, manifest.name, deployRoot, input);
+	const fingerprint = seedFingerprint({
+		workspace,
+		workspaceRoot,
+		entries,
+		closureModulesDir: join(deployRoot, "node_modules")
+	});
+	rmSync(seedOutputRoot, {
+		recursive: true,
+		force: true
+	});
+	const profileDir = join(seedOutputRoot, "profiles", PROFILE_NAME);
+	mkdirSync(profileDir, { recursive: true });
+	for (const entry of entries) {
+		const source = join(workspace, ...entry.split("/"));
+		if (!existsSync(source)) continue;
+		const target = join(profileDir, ...entry.split("/"));
+		mkdirSync(dirname(target), { recursive: true });
+		cpSync(source, target, { recursive: true });
+	}
+	writeFileSync(join(profileDir, "package.json"), `${JSON.stringify({
+		...JSON.parse(readFileSync(join(profileDir, "package.json"), "utf8")),
+		dsh: {
+			...manifest.dsh,
+			profile: {
+				...manifest.dsh?.profile,
+				bundles: mergedProfileBundles(manifest)
+			}
+		}
+	}, void 0, 2)}\n`);
+	cpSync(join(deployRoot, "node_modules"), join(profileDir, "node_modules"), {
+		recursive: true,
+		verbatimSymlinks: true
+	});
+	switchToPublishedExports(join(profileDir, "node_modules"));
+	writeFileSync(join(profileDir, SEED_HASH_NAME), fingerprint);
+	console.log(`desktop seed: wrote ${seedOutputRoot} (${fingerprint.slice(0, 12)})`);
+}
+/**
+* Rewrite `@morlay/*` package exports to their published dist form. The
+* flattened closure has every package at the top level.
+*/
+function switchToPublishedExports(modulesDir) {
+	const scoped = join(modulesDir, "@morlay");
+	if (!existsSync(scoped)) return;
+	for (const entry of readdirSync(scoped, { withFileTypes: true })) {
+		if (!entry.isDirectory()) continue;
+		const manifestPath = join(scoped, entry.name, "package.json");
+		if (!existsSync(manifestPath)) continue;
+		const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+		const published = manifest.publishConfig?.exports;
+		if (published === void 0) continue;
+		writeFileSync(manifestPath, `${JSON.stringify({
+			...manifest,
+			exports: published
+		}, void 0, 2)}\n`);
+	}
+}
+//#endregion
+//#region src/cli/shell.ts
+/** 工具包根（源码形态 `src/cli` 与构建形态 `dist/cli` 同深度）。 */
+const APP_ROOT$3 = resolve(import.meta.dirname, "..", "..");
+/** 壳入口产物（Electron 加载的主进程）。 */
+const SHELL_ENTRY = join(APP_ROOT$3, "dist", "index.mjs");
+/** 构建壳产物；发布形态没有源码时直接使用随包构建结果。 */
+async function buildShell() {
+	if (!existsSync(join(APP_ROOT$3, "src", "index.ts"))) {
+		if (!existsSync(SHELL_ENTRY)) throw new Error(`dsh-desktopify: packaged shell build is missing ${SHELL_ENTRY}`);
+		console.log("dsh-desktopify: using the packaged shell build");
+		return;
+	}
+}
+//#endregion
+//#region src/cli/bundle.ts
+/**
+* Bundle the workspace into a static, unsigned desktop application for the
+* current platform: build the shell, prepare the Node.js runtime and the
+* profile seed, then run electron-builder `--dir` (unpacked application
+* directory — no signing, no notarization, no developer account).
+*
+* `--install` additionally installs the unpacked application into the
+* platform's application directory (macOS `/Applications`, Linux
+* `~/.local/lib` + a desktop entry, Windows `%LOCALAPPDATA%\Programs`).
+*
+* The workspace is read from `DSH_DESKTOP_WORKSPACE` (the CLI forwards its
+* positional argument there) and defaults to the current directory. The
+* shell configuration is written beside the executable as `appconfig.json`
+* and passed to the in-process electron-builder run.
+*/
+const APP_ROOT$2 = resolve(import.meta.dirname, "..", "..");
+/** Install the unpacked application into the platform's application directory. */
+function installApp(workspace, name) {
+	const buildRootDir = buildRoot(workspace);
+	const artifacts = join(buildRootDir, "artifacts");
+	if (process.platform === "darwin") {
+		const source = join(artifacts, "mac-arm64", `${name}.app`);
+		if (!existsSync(source)) throw new Error(`desktop bundle: missing built application ${source}`);
+		const target = join("/Applications", `${name}.app`);
+		rmSync(target, {
+			recursive: true,
+			force: true
+		});
+		cpSync(source, target, {
+			recursive: true,
+			verbatimSymlinks: true
+		});
+		console.log(`desktop bundle: installed ${target}`);
+		return;
+	}
+	if (process.platform === "linux") {
+		const source = join(artifacts, "linux-unpacked");
+		if (!existsSync(source)) throw new Error(`desktop bundle: missing built application ${source}`);
+		const target = join(homedir(), ".local", "lib", name);
+		rmSync(target, {
+			recursive: true,
+			force: true
+		});
+		cpSync(source, target, { recursive: true });
+		const applicationsDir = join(homedir(), ".local", "share", "applications");
+		mkdirSync(applicationsDir, { recursive: true });
+		writeFileSync(join(applicationsDir, `${name}.desktop`), [
+			"[Desktop Entry]",
+			"Type=Application",
+			`Name=${name}`,
+			`Exec=${join(target, name)}`,
+			"Terminal=false",
+			""
+		].join("\n"));
+		console.log(`desktop bundle: installed ${target} with desktop entry`);
+		return;
+	}
+	if (process.platform === "win32") {
+		const source = join(artifacts, "win-unpacked");
+		if (!existsSync(source)) throw new Error(`desktop bundle: missing built application ${source}`);
+		const localAppData = process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local");
+		const target = join(localAppData, "Programs", name);
+		rmSync(target, {
+			recursive: true,
+			force: true
+		});
+		cpSync(source, target, { recursive: true });
+		console.log(`desktop bundle: installed ${target}`);
+		return;
+	}
+	throw new Error(`desktop bundle: unsupported platform ${process.platform}`);
+}
+async function runBundle(options) {
+	const workspace = resolve(options.workspace ?? resolveWorkspace());
+	const manifest = workspaceManifest(workspace);
+	const buildRootDir = buildRoot(workspace);
+	const desktop = desktopConfig(manifest);
+	const appConfig = {
+		name: manifest.name,
+		id: desktop.id,
+		version: desktop.version,
+		dshHome: desktop.dshHome,
+		window: desktop.window,
+		profile: PROFILE_NAME
+	};
+	console.log(`desktop bundle: workspace ${workspace} (${appConfig.name}@${appConfig.version})`);
+	await buildShell();
+	await runPrepareRuntime({ workspace });
+	await runPrepareSeed({ workspace });
+	const icons = await prepareIcons(workspace, buildRootDir, desktop.icon);
+	mkdirSync(join(buildRootDir, "runtime"), { recursive: true });
+	writeAppConfig(join(buildRootDir, "runtime"), appConfig);
+	await buildDesktopApp({
+		appRoot: APP_ROOT$2,
+		buildRoot: buildRootDir,
+		appConfig,
+		icons,
+		dir: options.dir
+	});
+	console.log(`desktop bundle: artifacts in ${join(buildRootDir, "artifacts")}`);
+	if (options.install) installApp(workspace, appConfig.name);
+}
+//#endregion
+//#region src/cli/dev.ts
+/**
+* Development launcher: build the shell, prepare a disposable project that
+* links the current workspace (dsh CLI, desktop host, and the dependency
+* closure), then launch the unpackaged Electron shell against it. The backend
+* runs under the current Node.js executable in node mode
+* (`ELECTRON_RUN_AS_NODE=1`) and loads the workspace's TypeScript plugin
+* sources through `--import=tsx/esm` — only when the workspace actually has
+* tsx installed.
+*
+* `--web` runs the web mode instead: prepare the `web` profile (merged
+* bundles + linked dependency closure) and boot `dsh web` in the browser.
+*
+* The workspace is read from `DSH_DESKTOP_WORKSPACE` (the CLI forwards its
+* positional argument there) and defaults to the current directory. The
+* official `@deepseek-ai/*` dependency surface and the official profile
+* bundles are maintained by the tool; the app declares its own dependencies,
+* its `dsh.version`, and its bundles. Official packages are resolved from the
+* app workspace first, so an app outside this repository works the same.
+*/
+const APP_ROOT$1 = resolve(import.meta.dirname, "..", "..");
+function debugPort(name, fallback) {
+	const value = process.env[name];
+	if (value === void 0 || value === "") return fallback;
+	const port = Number(value);
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error(`desktop development: ${name} must be an integer from 1 through 65535`);
+	return port;
+}
+/** Official resolution context for one workspace (app first, then the tool). */
+function officialInput(workspace, workspaceRoot, manifest) {
+	const dshVersion$1 = dshVersion(manifest);
+	return {
+		workspace,
+		workspaceRoot,
+		toolRoot: APP_ROOT$1,
+		...dshVersion$1 === void 0 ? {} : { dshVersion: dshVersion$1 }
+	};
+}
+/** The dsh CLI entry the profile boot and web server run from. */
+function cliEntry(input) {
+	const dsh = resolveOfficialPackage(DSH_PACKAGE, input);
+	if (dsh === void 0) throw new Error(`desktop development: cannot resolve ${DSH_PACKAGE}`);
+	return join(dsh.dir, "lib", "bin.js");
+}
+async function run(command, args, cwd, environment = process.env) {
+	await new Promise((resolvePromise, reject) => {
+		const child = spawn(command, args, {
+			cwd,
+			env: environment,
+			stdio: "inherit"
+		});
+		child.once("error", reject);
+		child.once("exit", (code, signal) => {
+			if (code === 0) resolvePromise();
+			else reject(/* @__PURE__ */ new Error(`desktop development: ${args.join(" ")} exited with ${String(code ?? signal)}`));
+		});
+	});
+}
+function removeOwnedPath(path) {
+	let stat;
+	try {
+		stat = lstatSync(path);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	if (stat.isSymbolicLink()) {
+		unlinkSync(path);
+		return;
+	}
+	if (stat.isDirectory()) {
+		rmSync(path, { recursive: true });
+		return;
+	}
+	unlinkSync(path);
+}
+function linkDirectory(source, destination, skipExisting = false) {
+	if (skipExisting) try {
+		lstatSync(destination);
+		return;
+	} catch {}
+	mkdirSync(dirname(destination), { recursive: true });
+	symlinkSync(realpathSync(source), destination, process.platform === "win32" ? "junction" : "dir");
+}
+/** Mirror one dependency directory (virtual store or hoisted node_modules). */
+function mirrorDependencyLinks(sourceRoot, destinationRoot, skipExisting = false) {
+	for (const entry of readdirSync(sourceRoot, { withFileTypes: true })) {
+		if (entry.name.startsWith(".")) continue;
+		const source = join(sourceRoot, entry.name);
+		if (entry.name.startsWith("@") && (entry.isDirectory() || entry.isSymbolicLink())) {
+			mkdirSync(join(destinationRoot, entry.name), { recursive: true });
+			for (const scoped of readdirSync(source, { withFileTypes: true })) {
+				if (!scoped.isDirectory() && !scoped.isSymbolicLink()) continue;
+				linkDirectory(join(source, scoped.name), join(destinationRoot, entry.name, scoped.name), skipExisting);
+			}
+			continue;
+		}
+		if (entry.isDirectory() || entry.isSymbolicLink()) linkDirectory(source, join(destinationRoot, entry.name), skipExisting);
+	}
+}
+/** Replace the disposable project with links to the current built workspace. */
+function prepareDevelopmentProject(projectDir, workspace, input) {
+	const manifest = workspaceManifest(workspace);
+	const dsh = resolveOfficialPackage(DSH_PACKAGE, input);
+	const host = resolveOfficialPackage(DESKTOP_HOST_PACKAGE, input);
+	if (dsh === void 0) throw new Error(`desktop development: cannot resolve ${DSH_PACKAGE}`);
+	if (host === void 0) throw new Error(`desktop development: cannot resolve ${DESKTOP_HOST_PACKAGE}`);
+	const virtualStore = join(input.workspaceRoot, "node_modules", ".pnpm", "node_modules");
+	const workspaceDependencyDir = existsSync(virtualStore) ? virtualStore : join(workspace, "node_modules");
+	if (!existsSync(workspaceDependencyDir)) throw new Error(`desktop development: workspace dependency links are missing under ${workspaceDependencyDir}; run pnpm install`);
+	if (!existsSync(join(host.dir, "lib", "index.js"))) throw new Error(`desktop development: ${DESKTOP_HOST_PACKAGE} is not built (${join(host.dir, "lib", "index.js")} is missing)`);
+	const officialDependencies = officialDependencySpecs(input);
+	removeOwnedPath(projectDir);
+	mkdirSync(projectDir, { recursive: true });
+	writeFileSync(join(projectDir, "package.json"), `${JSON.stringify({
+		name: manifest.name,
+		private: true,
+		version: "0.0.0",
+		dependencies: officialDependencies,
+		dsh: { profile: { bundles: mergedProfileBundles(manifest) } }
+	}, void 0, 2)}\n`);
+	writeFileSync(join(projectDir, "desktop.cordis.yml"), "# Development composition root; the launcher owns this file.\n[]\n");
+	const destinationModules = join(projectDir, "node_modules");
+	mkdirSync(destinationModules, { recursive: true });
+	mirrorDependencyLinks(workspaceDependencyDir, destinationModules);
+	const toolStore = toolModulesDir(input);
+	if (toolStore !== void 0 && resolve(toolStore) !== resolve(workspaceDependencyDir)) mirrorDependencyLinks(toolStore, destinationModules, true);
+	const dshLink = join(destinationModules, "@deepseek-ai", "dsh");
+	removeOwnedPath(dshLink);
+	linkDirectory(dsh.dir, dshLink);
+	const hostLink = join(destinationModules, "@deepseek-ai", "dsh-desktop-host");
+	removeOwnedPath(hostLink);
+	linkDirectory(host.dir, hostLink);
+	return projectDir;
+}
+/**
+* Prepare the `web` profile for browser mode: install the workspace's own
+* dependencies into `{workspace}/.dsh-store/profiles/web` with
+* `dsh plugin --profile web add <pkg>@link:<path>` (the upstream command
+* initializes the profile with the official bundles and reconciles the
+* bundle list). Returns the profile directory.
+*/
+async function prepareWebProfile(workspace, input) {
+	const manifest = workspaceManifest(workspace);
+	const home = join(workspace, ".dsh-store");
+	const entry = cliEntry(input);
+	if (!existsSync(entry)) throw new Error(`desktop development: missing built artifact ${entry}`);
+	for (const packageName of Object.keys(manifest.dependencies ?? {})) {
+		const link = resolveLinkTarget(workspace, packageName);
+		await run(process.execPath, [
+			entry,
+			"plugin",
+			"--profile",
+			"web",
+			"add",
+			`${packageName}@link:${link}`
+		], workspace, {
+			...process.env,
+			DSH_HOME: home
+		});
+	}
+	return join(home, "profiles", "web");
+}
+/** Resolve a workspace dependency to its package directory (link target). */
+function resolveLinkTarget(workspace, packageName) {
+	const resolved = createRequire(join(workspace, "package.json")).resolve(packageName);
+	const marker = `${sep}src${sep}index`;
+	const boundary = resolved.indexOf(marker);
+	return boundary < 0 ? dirname(dirname(resolved)) : resolved.slice(0, boundary);
+}
+async function launchElectron(projectDir, buildRootDir, tsxImport) {
+	const electron = createRequire(import.meta.url)("electron");
+	if (typeof electron !== "string") throw new Error("desktop development: electron executable is unavailable");
+	const mainPort = debugPort("DSH_DESKTOP_MAIN_INSPECT_PORT", 9229);
+	const rendererPort = debugPort("DSH_DESKTOP_RENDERER_DEBUG_PORT", 9222);
+	const hostPort = debugPort("DSH_DESKTOP_HOST_INSPECT_PORT", 9230);
+	const developmentRoot = join(buildRootDir, "development");
+	const home = resolve(join(developmentRoot, "home"));
+	const userData = join(developmentRoot, "electron-user-data");
+	const systemNode = process.env.DSH_DESKTOP_NODE_BINARY ?? process.env.npm_node_execpath ?? "node";
+	const environment = {
+		...process.env,
+		DSH_HOME: home,
+		DSH_DESKTOP_APPCONFIG_DIR: join(buildRootDir, "runtime"),
+		DSH_DESKTOP_DEV_PROJECT_DIR: projectDir,
+		DSH_DESKTOP_HOST_INSPECT_PORT: String(hostPort),
+		DSH_DESKTOP_NODE_BINARY: systemNode,
+		DSH_DESKTOP_TSX_IMPORT: tsxImport ? "tsx/esm" : "",
+		DSH_DESKTOP_OPEN_DEVTOOLS: process.env.DSH_DESKTOP_OPEN_DEVTOOLS ?? "1",
+		ELECTRON_ENABLE_LOGGING: process.env.ELECTRON_ENABLE_LOGGING ?? "1"
+	};
+	console.log(`desktop development: DSH_HOME=${home}`);
+	console.log(`desktop development: inspectors main=${String(mainPort)}, renderer=${String(rendererPort)}, host=${String(hostPort)}`);
+	await run(electron, [
+		`--inspect=127.0.0.1:${String(mainPort)}`,
+		`--remote-debugging-port=${String(rendererPort)}`,
+		`--user-data-dir=${userData}`,
+		APP_ROOT$1
+	], APP_ROOT$1, environment);
+}
+async function runDev(options) {
+	const workspace = resolve(options.workspace ?? resolveWorkspace());
+	const repositoryRoot = findWorkspaceRoot(workspace);
+	const manifest = workspaceManifest(workspace);
+	const input = officialInput(workspace, repositoryRoot, manifest);
+	const buildRootDir = buildRoot(workspace);
+	if (!options.skipBuild) await buildShell();
+	if (options.web) {
+		const home = join(workspace, ".dsh-store");
+		const profileDir = await prepareWebProfile(workspace, input);
+		const port = process.env.PORT ?? "3080";
+		const entry = cliEntry(input);
+		if (!existsSync(entry)) throw new Error(`desktop development: missing built artifact ${entry}`);
+		console.log(`desktop development: web mode DSH_HOME=${home} profile=${profileDir} port=${port}`);
+		const nodeOptions = hasTsx(workspace, repositoryRoot) ? [process.env.NODE_OPTIONS, "--import=tsx/esm"].filter(Boolean).join(" ") : process.env.NODE_OPTIONS;
+		await run(process.execPath, [
+			entry,
+			"web",
+			"--port",
+			port
+		], repositoryRoot, {
+			...process.env,
+			DSH_HOME: home,
+			...nodeOptions === void 0 ? {} : { NODE_OPTIONS: nodeOptions }
+		});
+		return;
+	}
+	if (!existsSync(SHELL_ENTRY)) throw new Error(`desktop development: missing built artifact ${SHELL_ENTRY}`);
+	const projectDir = prepareDevelopmentProject(join(buildRootDir, "development", "project"), workspace, input);
+	const desktop = desktopConfig(manifest);
+	mkdirSync(join(buildRootDir, "runtime"), { recursive: true });
+	writeAppConfig(join(buildRootDir, "runtime"), {
+		name: manifest.name,
+		id: desktop.id,
+		version: desktop.version,
+		dshHome: "env",
+		window: desktop.window,
+		profile: PROFILE_NAME
+	});
+	await launchElectron(projectDir, buildRootDir, hasTsx(projectDir, projectDir));
+}
+//#endregion
+//#region src/cli/index.ts
+/**
+* dsh-desktopify CLI: package and run a dsh workspace as a desktop
+* application. The workspace is the first positional argument (default: the
+* current directory); `DSH_DESKTOP_WORKSPACE` overrides it.
+*
+*   dsh-desktopify dev [--web] [--skip-build] [workspace]
+*                                            launch the Electron shell against
+*                                            the workspace (TS sources loaded
+*                                            directly, no packaging); --web
+*                                            boots `dsh web` in the browser
+*                                            instead
+*   dsh-desktopify bundle [--dir] [--install] [workspace]
+*                                            build a static, unsigned desktop
+*                                            application for the current
+*                                            platform
+*   dsh-desktopify build                     build the shell (tsdown)
+*   dsh-desktopify prepare:runtime [workspace] download and verify the bundled
+*                                            Node.js runtime
+*   dsh-desktopify prepare:seed [workspace]   prepare the packaged profile seed
+* @module @morlay/dsh-desktopify
+*/
+/** 工具包根（源码形态 `src/cli` 与构建形态 `dist/cli` 同深度）。 */
+const APP_ROOT = resolve(import.meta.dirname, "..", "..");
+/** 包版本（读取包根 package.json，源码形态与发布形态一致）。 */
+function packageVersion() {
+	return JSON.parse(readFileSync(resolve(APP_ROOT, "package.json"), "utf8")).version ?? "0.0.0";
+}
+/** Resolve the workspace argument (default: current directory) and expose it to child processes. */
+function resolveWorkspaceArg(workspace) {
+	const resolved = resolve(workspace ?? process.cwd());
+	process.env.DSH_DESKTOP_WORKSPACE = resolved;
+	return resolved;
+}
+const program = new Command();
+program.name("dsh-desktopify").description("package and run a dsh workspace as a desktop application").version(packageVersion());
+program.command("dev").description("launch the Electron shell against the workspace (or `dsh web` with --web)").option("--web", "boot `dsh web` in the browser instead of the Electron shell").option("--skip-build", "skip rebuilding the shell").argument("[workspace]", "app workspace directory (default: current directory)").action(async (workspace, options) => {
+	await runDev({
+		workspace: resolveWorkspaceArg(workspace),
+		web: options.web === true,
+		skipBuild: options.skipBuild === true
+	});
+});
+program.command("bundle").description("build a static, unsigned desktop application for the current platform").option("--dir", "produce an unpacked application directory (no installer)").option("--install", "install the built application into the platform application directory").argument("[workspace]", "app workspace directory (default: current directory)").action(async (workspace, options) => {
+	await runBundle({
+		workspace: resolveWorkspaceArg(workspace),
+		dir: options.dir === true,
+		install: options.install === true
+	});
+});
+program.command("build").description("build the shell (tsdown)").action(buildShell);
+program.command("prepare:runtime").description("download and verify the bundled Node.js runtime").argument("[workspace]", "app workspace directory (default: current directory)").action(async (workspace) => {
+	await runPrepareRuntime({ workspace: resolveWorkspaceArg(workspace) });
+});
+program.command("prepare:seed").description("prepare the packaged profile seed").argument("[workspace]", "app workspace directory (default: current directory)").action(async (workspace) => {
+	await runPrepareSeed({ workspace: resolveWorkspaceArg(workspace) });
+});
+await program.parseAsync(process.argv);
+//#endregion
+export {};