dsh-browser-application 0.37.0

package/LICENSE

@@ -0,0 +1,19 @@
+MIT License
+
+Copyright (c) 2026 Yuxiang Lin
+Copyright (c) 2026 youbaiyun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,27 @@
+# dsh-browser-application
+
+The desktop half of the dsh browser extension. It mounts a token-authenticated
+WebSocket bridge on the desktop app's own webserver, exposes the `browser_*` tools to
+the model, and relays image recognition to the model the user configured.
+
+Part of [dsh-browser-application](https://github.com/youbaiyun/dsh-browser-application).
+Install it into a dsh profile rather than by hand:
+
+```sh
+dsh plugin --profile web add dsh-browser-application
+```
+
+Its settings page carries every knob — `visionBaseUrl`, `visionModel`,
+`visionThinking`, `visionTimeoutMs`, the session workspace, the tool timeout — each
+with a one-line description. The repository README has the table.
+
+Three things worth knowing before you enable anything:
+
+- **The bearer token** is generated on first boot and persisted at
+  `~/.dsh/ext-bridge-token` with mode 0600. `DSH_EXT_TOKEN` pins a fixed one.
+- **Image recognition is off** until the user enables a tier in the extension's panel.
+  When it is on, the extension fetches the image the user asked about and this plugin
+  sends it to the model configured above.
+- **The bridge answers on loopback only**, regardless of the token.
+
+MIT. The upstream notice is preserved in `LICENSE`.

package/cordis.patch.yml

@@ -0,0 +1,29 @@
+# Browser bridge layer for the dsh `web` profile.
+#
+# `dsh plugin --profile web add` registers this package's `dsh.bundle`
+# manifest, so both the repository launcher and `npx @deepseek-ai/dsh@0.2.0-rc.2 web`
+# apply this patch without an extra command-line option.
+#
+# On first boot the plugin generates a bearer token and persists it at
+# ~/.dsh/ext-bridge-token (chmod 0600). Local extensions discover the bridge
+# without manual token entry. To pin a fixed token for a remote deployment,
+# set DSH_EXT_TOKEN and reference it below.
+# Extension-created sessions default to the ~/.dsh/browser-sessions workspace.
+# Set DSH_BROWSER_SESSION_WORKSPACE to choose another path, or to an empty
+# string to keep those sessions Ungrouped.
+# Sessions materialize only on the first message (deferSessionCreate defaults
+# to true): opening the side panel without chatting leaves no session behind.
+#
+# Security: the bridge path carries its own token auth and refuses privileged
+# gateway methods (settings/credentials/open-*) for non-loopback remotes. Do
+# not run `dsh web --host 0.0.0.0` on untrusted networks with this layer.
+
+- insert:
+    - id: bridge-browser
+      name: 'dsh-browser-application'
+      config:
+        token: !!js process.env.DSH_EXT_TOKEN
+        sessionWorkspacePath: !!js process.env.DSH_BROWSER_SESSION_WORKSPACE
+        toolTimeoutMs: 90000
+        snapshotMaxChars: 32000
+        maxInteractiveItems: 60