dsh-browser-plus 0.5.0 → 0.5.1

package/lib/client.js

@@ -0,0 +1,185 @@
+/**
+ * dsh-browser-plus — client half.
+ *
+ * One right-sidebar tab whose whole job is to put the shared browser window on
+ * screen: picking it from the rightbar's add list opens the window, and the
+ * panel keeps a button for raising it again. It is named after the plugin and
+ * carries the plugin's own mark, so it is not confused with the product's
+ * built-in browser tab. It talks to the plugin's own
+ * HTTP route (`src/http-browser/index.ts`), because a third-party client bundle
+ * has no generated Remote surface to call a server-side method through.
+ *
+ * This file is the browser bundle's source in the client-modules factory
+ * format: running it only registers the factory, and the module body runs when
+ * the plugin is first materialized. `scripts/build-client.mjs` copies it to
+ * `lib/client.js` — it is one file with no imports beyond the platform table,
+ * so no bundler is involved.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-browser-plus',
+  factory: (require) => {
+    var module = { exports: {} }
+    var exports = module.exports
+    Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' })
+    const React = require('react')
+
+    /** Implementation identity; also the key its body registers under. */
+    const IMPLEMENTATION_ID = 'dsh-browser-plus'
+    /** Tab kind: a page type, opened by kind and recognizing no address. */
+    const KIND = 'dsh-browser-plus'
+    const OPEN_PATH = '/api/dsh-browser-plus/open'
+    const STATUS_PATH = '/api/dsh-browser-plus/status'
+
+    const COPY = {
+      zh: {
+        title: 'DSH-Browser-Plus',
+        description: '打开共享浏览器窗口',
+        open: '打开浏览器窗口',
+        busy: '正在打开…',
+        opened: '浏览器窗口已打开。',
+        failed: '打开失败：',
+        tasks: (count) => (count > 0 ? '当前有 ' + String(count) + ' 个浏览器任务' : '还没有浏览器任务'),
+      },
+      en: {
+        title: 'DSH-Browser-Plus',
+        description: 'Open the shared browser window',
+        open: 'Open browser window',
+        busy: 'Opening…',
+        opened: 'The browser window is open.',
+        failed: 'Could not open it: ',
+        tasks: (count) => (count > 0 ? String(count) + ' browser task(s) open' : 'no browser task yet'),
+      },
+    }
+
+    /** The panel's copy, read at render so a language switch needs no reload. */
+    function copy() {
+      try {
+        const declared = String(document.documentElement.getAttribute('lang') || navigator.language || '')
+        return declared.toLowerCase().indexOf('zh') === 0 ? COPY.zh : COPY.en
+      } catch (error) {
+        return COPY.zh
+      }
+    }
+
+    /** POST the open endpoint; resolve to a message, never throw at the renderer. */
+    function requestOpen() {
+      return fetch(OPEN_PATH, { method: 'POST' }).then((response) => response.json().catch(() => null).then((body) => {
+        if (!response.ok || body === null || body.ok !== true) {
+          throw new Error(body !== null && typeof body.error === 'string' ? body.error : 'HTTP ' + String(response.status))
+        }
+        return true
+      }))
+    }
+
+    /** Read the task count for the status line; a failure is not worth a notice. */
+    function requestStatus() {
+      return fetch(STATUS_PATH).then((response) => response.json()).then((body) => (body !== null && body.ok === true && typeof body.tasks === 'number' ? body.tasks : null)).catch(() => null)
+    }
+
+    /**
+     * The plugin's own mark, inlined from assets/dsh-browser-plus.svg so the
+     * bundle keeps requiring nothing but the platform table. The plate is part
+     * of the art: it is what keeps a white outline legible on a light surface.
+     */
+    function BrowserIcon(props) {
+      const size = props !== null && props !== undefined && props.size !== undefined ? props.size : 36
+      return React.createElement('svg', {
+        width: size,
+        height: size,
+        className: props !== null && props !== undefined ? props.className : undefined,
+        'aria-hidden': 'true',
+        viewBox: '0 0 256 256',
+        xmlns: 'http://www.w3.org/2000/svg',
+      },
+        React.createElement('rect', { x: 10, y: 10, width: 236, height: 236, rx: 54, fill: '#202124' }),
+        React.createElement('g', { transform: 'translate(20 20) scale(9)', fill: 'none', stroke: '#ffffff', strokeWidth: 1.8, strokeLinecap: 'round', strokeLinejoin: 'round' },
+          React.createElement('rect', { x: 3.25, y: 4.75, width: 17.5, height: 14.5, rx: 3.25 }),
+          React.createElement('path', { d: 'M3.25 9.4h17.5' }),
+          React.createElement('circle', { cx: 6.15, cy: 7.05, r: 0.9, fill: '#ffffff', stroke: 'none' }),
+          React.createElement('circle', { cx: 8.75, cy: 7.05, r: 0.9, fill: '#ffffff', stroke: 'none' }),
+        ),
+      )
+    }
+
+    const PANEL_STYLE = {
+      display: 'flex',
+      flexDirection: 'column',
+      gap: '10px',
+      padding: '16px',
+      color: 'inherit',
+      font: 'inherit',
+    }
+    const BUTTON_STYLE = {
+      alignSelf: 'flex-start',
+      padding: '6px 14px',
+      border: '1px solid currentColor',
+      borderRadius: '6px',
+      background: 'transparent',
+      color: 'inherit',
+      font: 'inherit',
+      cursor: 'pointer',
+    }
+    const NOTE_STYLE = { opacity: 0.7, fontSize: '12px' }
+
+    /** The panel body: it opens the window as soon as it is mounted. */
+    function BrowserPanel() {
+      const t = copy()
+      const [busy, setBusy] = React.useState(false)
+      const [note, setNote] = React.useState(null)
+      const [tasks, setTasks] = React.useState(null)
+
+      const open = React.useCallback(() => {
+        setBusy(true)
+        setNote(null)
+        requestOpen()
+          .then(() => {
+            setBusy(false)
+            setNote({ ok: true, text: t.opened })
+            return requestStatus().then((count) => setTasks(count))
+          })
+          .catch((error) => {
+            setBusy(false)
+            setNote({ ok: false, text: t.failed + String(error !== null && error !== undefined && error.message !== undefined ? error.message : error) })
+          })
+      }, [t])
+
+      // The tab itself is the affordance: opening it opens the window.
+      React.useEffect(() => {
+        open()
+        requestStatus().then((count) => setTasks(count))
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+      }, [])
+
+      return React.createElement('div', { style: PANEL_STYLE },
+        React.createElement('button', { type: 'button', style: BUTTON_STYLE, disabled: busy, onClick: open }, busy ? t.busy : t.open),
+        note !== null ? React.createElement('div', { style: NOTE_STYLE, role: 'status' }, note.text) : null,
+        tasks !== null ? React.createElement('div', { style: NOTE_STYLE }, t.tasks(tasks)) : null,
+      )
+    }
+
+    exports.inject = ['slots', 'sidebarRightTabs']
+    exports.apply = (ctx) => {
+      const slots = ctx.get('slots')
+      const tabs = ctx.get('sidebarRightTabs')
+      if (slots === undefined || tabs === undefined) return
+      ctx.effect(() => tabs.register({
+        id: IMPLEMENTATION_ID,
+        kind: KIND,
+        priority: 'extension',
+        title: () => copy().title,
+        guide: [{
+          id: 'open',
+          order: 40,
+          title: () => copy().title,
+          description: () => copy().description,
+          icon: BrowserIcon,
+        }],
+      }), 'dsh-browser-plus:type')
+      ctx.effect(() => slots.inject('sidebar.right.pane.tab', () => slots.register({
+        name: 'sidebar.right.pane.tab',
+        key: IMPLEMENTATION_ID,
+      }, BrowserPanel)), 'dsh-browser-plus:body')
+    }
+    return module.exports
+  },
+})

package/lib/command-browser/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Human-facing `/browser` command: puts the shared browser window on screen
+ * without going through the model.
+ *
+ * The window is normally created as a side effect of the first browser tool
+ * call, so a human who wants to browse (or take over) before any agent call had
+ * no way to raise it. `/browser` is that way in: it spawns the host and shows
+ * the window when nothing is open, and raises the existing window otherwise.
+ *
+ * The command registry is declared structurally instead of imported from
+ * `@deepseek-ai/dsh-commands`: the registry is a peer service the profile
+ * provides, and depending on that package only for its types would make this
+ * row fail to load wherever the service exists but the dependency does not.
+ * @module dsh-browser-plus/command-browser
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "browser-command";
+export declare const inject: string[];
+/** Register the command. */
+export declare function apply(ctx: Context, _config?: unknown): void;

package/lib/command-browser/index.js

@@ -0,0 +1,35 @@
+/**
+ * Human-facing `/browser` command: puts the shared browser window on screen
+ * without going through the model.
+ *
+ * The window is normally created as a side effect of the first browser tool
+ * call, so a human who wants to browse (or take over) before any agent call had
+ * no way to raise it. `/browser` is that way in: it spawns the host and shows
+ * the window when nothing is open, and raises the existing window otherwise.
+ *
+ * The command registry is declared structurally instead of imported from
+ * `@deepseek-ai/dsh-commands`: the registry is a peer service the profile
+ * provides, and depending on that package only for its types would make this
+ * row fail to load wherever the service exists but the dependency does not.
+ * @module dsh-browser-plus/command-browser
+ */
+export const name = 'browser-command';
+export const inject = ['browser', 'commands'];
+/** Register the command. */
+export function apply(ctx, _config = {}) {
+    const commands = ctx.commands;
+    commands.register({
+        name: 'browser',
+        description: '打开并前置共享浏览器窗口',
+        handler: async () => {
+            try {
+                await ctx.browser.ensureWindowVisible();
+                return { kind: 'success', text: '浏览器窗口已打开。' };
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                return { kind: 'error', text: `打开浏览器窗口失败：${detail}` };
+            }
+        },
+    });
+}

package/lib/http-browser/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The HTTP bridge the browser panel talks to.
+ *
+ * The panel lives in the Web GUI, the window lives in the DSH process, and a
+ * client bundle has no way to call a server-side plugin method directly: the
+ * generated Remote/Typert surface exists for product packages, not for a
+ * third-party plugin built with plain tsc. The DSH web server, however, is a
+ * service this plugin can register routes on, and the GUI is served from that
+ * same origin — so one POST is the whole bridge.
+ *
+ * Routes (all JSON, no-store):
+ *   POST /api/dsh-browser-plus/open   -> { ok: true } once the window is up
+ *   GET  /api/dsh-browser-plus/status -> { ok: true, tasks: number }
+ *
+ * The `webServer` service is declared structurally rather than imported from
+ * `@deepseek-ai/dsh-host-webserver`: this row must load wherever the service
+ * exists, without taking a build-time dependency on the package that owns it.
+ * @module dsh-browser-plus/http-browser
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Absolute path of the "open the window" endpoint. */
+export declare const OPEN_PATH = "/api/dsh-browser-plus/open";
+/** Absolute path of the status endpoint. */
+export declare const STATUS_PATH = "/api/dsh-browser-plus/status";
+export declare const name = "browser-http";
+export declare const inject: string[];
+/** Register the browser-panel bridge. */
+export declare function apply(ctx: Context, _config?: unknown): void;

package/lib/http-browser/index.js

@@ -0,0 +1,110 @@
+/**
+ * The HTTP bridge the browser panel talks to.
+ *
+ * The panel lives in the Web GUI, the window lives in the DSH process, and a
+ * client bundle has no way to call a server-side plugin method directly: the
+ * generated Remote/Typert surface exists for product packages, not for a
+ * third-party plugin built with plain tsc. The DSH web server, however, is a
+ * service this plugin can register routes on, and the GUI is served from that
+ * same origin — so one POST is the whole bridge.
+ *
+ * Routes (all JSON, no-store):
+ *   POST /api/dsh-browser-plus/open   -> { ok: true } once the window is up
+ *   GET  /api/dsh-browser-plus/status -> { ok: true, tasks: number }
+ *
+ * The `webServer` service is declared structurally rather than imported from
+ * `@deepseek-ai/dsh-host-webserver`: this row must load wherever the service
+ * exists, without taking a build-time dependency on the package that owns it.
+ * @module dsh-browser-plus/http-browser
+ */
+/** Absolute path of the "open the window" endpoint. */
+export const OPEN_PATH = '/api/dsh-browser-plus/open';
+/** Absolute path of the status endpoint. */
+export const STATUS_PATH = '/api/dsh-browser-plus/status';
+export const name = 'browser-http';
+export const inject = ['browser', 'webServer'];
+/** Write one JSON response. */
+function sendJson(res, status, payload) {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json; charset=utf-8');
+    res.setHeader('cache-control', 'no-store');
+    res.end(JSON.stringify(payload));
+}
+/** Read one request header as a single string. */
+function headerValue(req, name) {
+    const raw = req.headers?.[name];
+    return Array.isArray(raw) ? (raw[0] ?? '') : (raw ?? '');
+}
+/**
+ * Refuse a request that a page on another site made.
+ *
+ * These two endpoints are unauthenticated and only open a window / report a task
+ * count — but any web page can POST to localhost without a preflight, so without
+ * this check a random site could pop our browser window open. The panel's own
+ * fetch is same-origin, so its Origin always matches the Host we were reached on.
+ */
+function fromAnotherSite(req) {
+    const origin = headerValue(req, 'origin');
+    if (origin === '')
+        return false;
+    try {
+        const parsed = new URL(origin);
+        const host = headerValue(req, 'host');
+        return host === '' || parsed.host !== host;
+    }
+    catch {
+        return true;
+    }
+}
+/** One line for the panel to show; never a stack. */
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Register the browser-panel bridge. */
+export function apply(ctx, _config = {}) {
+    const server = ctx.webServer;
+    if (server === undefined)
+        return;
+    ctx.effect(() => server.register({
+        kind: 'exact',
+        path: OPEN_PATH,
+        handler: async (req, res) => {
+            if (req.method !== 'POST') {
+                sendJson(res, 405, { ok: false, error: 'method not allowed' });
+                return;
+            }
+            if (fromAnotherSite(req)) {
+                sendJson(res, 403, { ok: false, error: 'cross-site request refused' });
+                return;
+            }
+            try {
+                await ctx.browser.ensureWindowVisible();
+                sendJson(res, 200, { ok: true });
+            }
+            catch (error) {
+                sendJson(res, 500, { ok: false, error: describe(error) });
+            }
+        },
+    }), 'dsh-browser-plus:open route');
+    ctx.effect(() => server.register({
+        kind: 'exact',
+        path: STATUS_PATH,
+        handler: async (req, res) => {
+            if (req.method !== 'GET') {
+                sendJson(res, 405, { ok: false, error: 'method not allowed' });
+                return;
+            }
+            if (fromAnotherSite(req)) {
+                sendJson(res, 403, { ok: false, error: 'cross-site request refused' });
+                return;
+            }
+            try {
+                const tasks = await ctx.browser.listTasks();
+                sendJson(res, 200, { ok: true, tasks: tasks.length });
+            }
+            catch (error) {
+                sendJson(res, 500, { ok: false, error: describe(error) });
+            }
+        },
+    }), 'dsh-browser-plus:status route');
+}

package/lib/index.d.ts

@@ -6,8 +6,19 @@
  *   - `dsh-browser-plus/tool-browser`     -> the model-facing browser_* tools
  * This root entry only re-exports for programmatic use; the loader rows are
  * the composition surface.
+ *
+ * It IS also mounted as a row of its own — an empty one — because the client
+ * module system only scans Loader rows whose specifier is an exact package root
+ * (`exactPackageSpecifier` in `@deepseek-ai/dsh-client-modules` returns
+ * undefined for a subpath). Without a root row the package's `dsh.client`
+ * declaration is never read and the browser panel never reaches the GUI, no
+ * matter how many subpath rows the bundle patch adds.
  * @module dsh-browser-plus
  */
+/** Plugin name for the root row. */
+export declare const name = "browser-plus";
+/** The root row has no behaviour of its own; it exists to carry the package identity. */
+export declare function apply(): void;
 export { BrowserError } from './browser/types.ts';
 export type { BrowserChallenge, BrowserContentFormat, BrowserControlOwner, BrowserContentRequest, BrowserContentResult, BrowserDragRequest, BrowserDragResult, BrowserExecuteRequest, BrowserPointerResult, BrowserPointerTarget, BrowserExecuteResult, BrowserFillField, BrowserFillRequest, BrowserFillResult, BrowserHandoffState, BrowserNavigateRequest, BrowserOpenRequest, BrowserProvider, BrowserRefRequest, BrowserScreenshotRequest, BrowserScrollIntoViewRequest, BrowserScrollRequest, BrowserScrollResult, BrowserScreenshotResult, BrowserSessionId, BrowserSnapshotElement, BrowserSnapshotResult, BrowserTab, BrowserTaskInfo, BrowserTaskStatus, BrowserTaskUpdate, BrowserTypeRequest, ExportedCookie, } from './browser/types.ts';
 export { BrowserRuntime } from './browser/runtime.ts';

package/lib/index.js

@@ -6,8 +6,19 @@
  *   - `dsh-browser-plus/tool-browser`     -> the model-facing browser_* tools
  * This root entry only re-exports for programmatic use; the loader rows are
  * the composition surface.
+ *
+ * It IS also mounted as a row of its own — an empty one — because the client
+ * module system only scans Loader rows whose specifier is an exact package root
+ * (`exactPackageSpecifier` in `@deepseek-ai/dsh-client-modules` returns
+ * undefined for a subpath). Without a root row the package's `dsh.client`
+ * declaration is never read and the browser panel never reaches the GUI, no
+ * matter how many subpath rows the bundle patch adds.
  * @module dsh-browser-plus
  */
+/** Plugin name for the root row. */
+export const name = 'browser-plus';
+/** The root row has no behaviour of its own; it exists to carry the package identity. */
+export function apply() { }
 export { BrowserError } from "./browser/types.js";
 export { BrowserRuntime } from "./browser/runtime.js";
 export { ElectronBrowserProvider } from "./browser-electron/provider.js";

package/lib/task-todos/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Bridge between the Agent's todo list and the shared browser window.
+ *
+ * DSH keeps each Agent's plan as a session projection (`todos`, written by
+ * `todo_write` and folded from `todo/write` events). The floating orb in the
+ * browser window renders that plan, but the browser host is a child process that
+ * can only see what the parent hands it — so this row subscribes to the
+ * projection change feed and mirrors the plan into the browser provider.
+ *
+ * Every dependency here is optional on purpose. A deployment without the
+ * projection registry, or without the todo tool mounted at all, must still get a
+ * working browser: the orb then simply has no plan to show and falls back to the
+ * task's own status and last browser action.
+ * @module dsh-browser-plus/task-todos
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis plugin name used by loader diagnostics. */
+export declare const name = "browser-task-todos";
+/** The browser seam; the projection registry is injected optionally below. */
+export declare const inject: string[];
+/**
+ * Register the bridge.
+ * @param ctx - plugin context carrying the browser seam.
+ */
+export declare function apply(ctx: Context): void;

package/lib/task-todos/index.js

@@ -0,0 +1,100 @@
+/**
+ * Bridge between the Agent's todo list and the shared browser window.
+ *
+ * DSH keeps each Agent's plan as a session projection (`todos`, written by
+ * `todo_write` and folded from `todo/write` events). The floating orb in the
+ * browser window renders that plan, but the browser host is a child process that
+ * can only see what the parent hands it — so this row subscribes to the
+ * projection change feed and mirrors the plan into the browser provider.
+ *
+ * Every dependency here is optional on purpose. A deployment without the
+ * projection registry, or without the todo tool mounted at all, must still get a
+ * working browser: the orb then simply has no plan to show and falls back to the
+ * task's own status and last browser action.
+ * @module dsh-browser-plus/task-todos
+ */
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'browser-task-todos';
+/** The browser seam; the projection registry is injected optionally below. */
+export const inject = ['browser'];
+/** Keep at most this many entries — the orb shows a short list, not a backlog. */
+const MAX_ITEMS = 40;
+/** Keep one entry short enough to read in a popover. */
+const MAX_CONTENT = 160;
+/**
+ * Normalize whatever the projection holds into the orb's three states. Anything
+ * unrecognized becomes `pending` rather than being dropped: a plan line the UI
+ * cannot classify is still a line the human asked to see.
+ * @param value - the projection's raw `todos` value.
+ * @returns the entries to forward.
+ */
+function normalize(value) {
+    if (!Array.isArray(value))
+        return [];
+    const items = [];
+    for (const raw of value) {
+        const entry = raw;
+        if (typeof entry?.content !== 'string')
+            continue;
+        const content = entry.content.trim();
+        if (content === '')
+            continue;
+        const status = entry.status === 'completed' || entry.status === 'in_progress' ? entry.status : 'pending';
+        items.push({ content: content.slice(0, MAX_CONTENT), status });
+        if (items.length >= MAX_ITEMS)
+            break;
+    }
+    return items;
+}
+/**
+ * Register the bridge.
+ * @param ctx - plugin context carrying the browser seam.
+ */
+export function apply(ctx) {
+    // 只在**失败**路径上留话：这条链横跨「会话投影 → 桥接行 → provider → 宿主 → 页面」，
+    // 任一环断掉在页面上都只表现为「球上没有清单」，正常路径一声不响。
+    const trace = (line) => { try {
+        process.stderr.write('[browser-task-todos] ' + line + '\n');
+    }
+    catch { /* no stderr */ } };
+    const browser = ctx.browser;
+    if (browser === undefined || typeof browser.pushTaskTodos !== 'function') {
+        trace('skip: the browser seam has no pushTaskTodos');
+        return;
+    }
+    const push = browser.pushTaskTodos.bind(browser);
+    // `ctx.inject` keeps the row loadable when the registry is absent: the
+    // callback simply never runs and the browser keeps working without a plan.
+    ctx.inject(['sessionProjections'], (scoped) => {
+        const registry = scoped.sessionProjections;
+        if (registry === undefined || typeof registry.onChanged !== 'function') {
+            trace('sessionProjections arrived without onChanged');
+            return;
+        }
+        // 每个会话最后一份清单。宿主重启会丢掉它内存里那份，而桥接只在**变化**时推 ——
+        // 存一份就能在「这个会话又发生了什么」时顺手补推（见下面的 !isTodos 分支）。
+        const lastTodos = new Map();
+        const off = registry.onChanged((session, key, value) => {
+            const taskKey = typeof session?.id === 'string' ? session.id : '';
+            if (taskKey === '')
+                return;
+            if (key !== 'todos') {
+                // 该会话的**其它**投影变了 —— 说明它活着，把手里那份计划补推一次。
+                // 这覆盖「DSH 重启后 / 宿主重启后球上一直空着」：只要会话再有任何活动，清单就回来。
+                const known = lastTodos.get(taskKey);
+                if (known !== undefined)
+                    void push(taskKey, known).catch(() => undefined);
+                return;
+            }
+            // The tool layer keys browser tasks by the calling Agent's id, which is the
+            // session id — so a plan written by an Agent lands on that Agent's task.
+            const todos = normalize(value);
+            lastTodos.set(taskKey, todos);
+            void push(taskKey, todos).catch(() => undefined);
+        });
+        // 监听器挂在 registry 自己的 fiber 上，插件被卸载/重载时要自己摘掉，
+        // 否则会残留一条绑在旧 seam 上的推送（review 报的 L5）。
+        if (typeof off === 'function')
+            ctx.effect(() => off);
+    });
+}