dsh-chat-embed 0.0.0-stage → 0.6.0

package/tools/shell-patch/patch-asar.cjs

@@ -0,0 +1,272 @@
+/**
+ * patch-asar.cjs - two idempotent patches for the desktop shell's embedded
+ * browser partitions (resources/app.asar -> lib/main.js).
+ *
+ * Patch 1 (persistent login): the shell names each workspace's partition
+ *   `dsh-sidebar-browser-<random uuid>` - no `persist:` prefix (memory only) and
+ *   a fresh uuid every launch, so every embedded webview is signed out on
+ *   restart. Hashing the workspace identity instead makes it stable on disk.
+ *
+ * Patch 2 (no disk cache, optional): the same partition is created with
+ *   `{ cache: false }`, so Chromium keeps Cookies / Local Storage / IndexedDB
+ *   (the login) but stops writing the multi-megabyte HTTP and code caches.
+ *
+ * Both steps are idempotent: run build against the original asar or against an
+ * already patched one and the result is the same file.
+ *
+ * Usage:
+ *   node patch-asar.cjs build [--from <asar>] [--out <asar>] [--no-cache-patch]
+ *   node patch-asar.cjs verify [--from <asar>] [--out <asar>]
+ */
+
+const crypto = require('node:crypto')
+const fs = require('node:fs')
+const path = require('node:path')
+const os = require('node:os')
+
+/**
+ * Install locations tried in order when neither --resources nor DSH_RESOURCES
+ * is given, so the tool works without an edit on any machine.
+ */
+const RESOURCES_CANDIDATES = [
+  process.env.DSH_RESOURCES,
+  process.env.LOCALAPPDATA === undefined || process.env.LOCALAPPDATA === ''
+    ? undefined
+    : path.join(process.env.LOCALAPPDATA, 'Programs', 'DeepSeek Harness', 'resources'),
+  'C:\\Program Files\\DeepSeek Harness\\resources',
+  'C:\\Program Files (x86)\\DeepSeek Harness\\resources',
+]
+
+const LOG = path.join(os.tmpdir(), 'dsh-chat-embed-patch-asar.log')
+
+/** @returns {string | undefined} the resources directory that holds app.asar */
+function detectResources() {
+  for (const candidate of RESOURCES_CANDIDATES) {
+    if (typeof candidate !== 'string' || candidate === '') continue
+    if (fs.existsSync(path.join(candidate, 'app.asar'))) return candidate
+  }
+  return undefined
+}
+
+const PERSIST_OLD = 'partition = `dsh-sidebar-browser-${randomUUID()}`;'
+const PERSIST_NEW =
+  'partition = `persist:dsh-sidebar-${createHash("sha256").update(workspace).digest("hex").slice(0, 24)}`;'
+const CACHE_OLD = 'this.configureSession(session.fromPartition(partition));'
+const CACHE_NEW = 'this.configureSession(session.fromPartition(partition, { cache: false }));'
+
+function log(message) {
+  const line = `[${new Date().toISOString()}] ${message}`
+  console.log(line)
+  try {
+    fs.appendFileSync(LOG, line + '\n')
+  } catch (error) {
+    void error
+  }
+}
+
+/**
+ * @param {string[]} argv
+ * @returns {{ mode: string, from?: string, out?: string, cachePatch: boolean, help: boolean }}
+ */
+function parseArgs(argv) {
+  const options = { mode: 'build', from: undefined, out: undefined, cachePatch: true, help: false }
+  const rest = argv.slice(2)
+  let resources
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i]
+    if (arg === 'build' || arg === 'verify') options.mode = arg
+    else if (arg === '--resources') resources = rest[++i]
+    else if (arg === '--from') options.from = rest[++i]
+    else if (arg === '--out') options.out = rest[++i]
+    else if (arg === '--no-cache-patch') options.cachePatch = false
+    else if (arg === '--help' || arg === '-h') options.help = true
+    else {
+      console.error('unknown argument: ' + arg)
+      options.help = true
+    }
+  }
+  const resolved = resources === undefined ? detectResources() : resources
+  if (options.from === undefined && resolved !== undefined) options.from = path.join(resolved, 'app.asar')
+  if (options.out === undefined) {
+    options.out = resolved !== undefined ? path.join(resolved, 'app.asar.new') : undefined
+  }
+  return options
+}
+
+function usage() {
+  console.log(
+    [
+      'patch-asar.cjs — persistent partitions + no disk cache for the embedded browser',
+      '',
+      'Usage:',
+      '  node patch-asar.cjs build  [--resources <dir>] [--from <asar>] [--out <asar>] [--no-cache-patch]',
+      '  node patch-asar.cjs verify [--resources <dir>] [--from <asar>] [--out <asar>]',
+      '',
+      '--resources  the install directory that contains app.asar (default: $DSH_RESOURCES,',
+      '             then %LOCALAPPDATA%\\Programs\\DeepSeek Harness\\resources, then Program Files)',
+      '',
+      'build writes <resources>/app.asar.new; replace app.asar with it while the app is closed.',
+    ].join('\n'),
+  )
+}
+
+function readAsar(file) {
+  const buf = fs.readFileSync(file)
+  const jsonLen = buf.readUInt32LE(12)
+  const headerStart = 16
+  const header = JSON.parse(buf.toString('utf8', headerStart, headerStart + jsonLen))
+  const pad = (4 - (jsonLen % 4)) % 4
+  const dataStart = headerStart + jsonLen + pad
+  return { buf, header, dataStart, data: buf.subarray(dataStart) }
+}
+
+function collect(header) {
+  const files = []
+  const walk = (node, prefix) => {
+    for (const [name, child] of Object.entries(node.files || {})) {
+      const p = prefix === '' ? name : prefix + '/' + name
+      if (child.files !== undefined) {
+        walk(child, p)
+        continue
+      }
+      files.push({ path: p, node: child })
+    }
+  }
+  walk(header, '')
+  return files
+}
+
+function integrityFor(content) {
+  const blockSize = 4194304
+  const blocks = []
+  for (let offset = 0; offset < content.length; offset += blockSize) {
+    blocks.push(
+      crypto
+        .createHash('sha256')
+        .update(content.subarray(offset, Math.min(offset + blockSize, content.length)))
+        .digest('hex'),
+    )
+  }
+  if (blocks.length === 0) blocks.push(crypto.createHash('sha256').update(Buffer.alloc(0)).digest('hex'))
+  return {
+    algorithm: 'SHA256',
+    hash: crypto.createHash('sha256').update(content).digest('hex'),
+    blockSize,
+    blocks,
+  }
+}
+
+function applyPatches(source, cachePatch) {
+  let text = source
+  const applied = []
+  if (text.includes(PERSIST_OLD)) {
+    text = text.replace(PERSIST_OLD, PERSIST_NEW)
+    applied.push('persist-partition')
+  }
+  if (cachePatch && text.includes(CACHE_OLD)) {
+    text = text.replace(CACHE_OLD, CACHE_NEW)
+    applied.push('no-disk-cache')
+  }
+  const ok = text.includes(PERSIST_NEW) && (cachePatch === false || text.includes(CACHE_NEW))
+  return { text, applied, ok }
+}
+
+function build(options) {
+  const { header, data } = readAsar(options.from)
+  const files = collect(header)
+  log(`source: ${options.from} (${files.length} entries, data ${data.length} bytes)`)
+
+  const packed = files
+    .filter((file) => file.node.unpacked !== true)
+    .sort((a, b) => Number(a.node.offset) - Number(b.node.offset))
+
+  const chunks = []
+  let cursor = 0
+  let patched = false
+
+  for (const file of packed) {
+    const offset = Number(file.node.offset)
+    const size = Number(file.node.size)
+    let content = data.subarray(offset, offset + size)
+
+    if (file.path === 'lib/main.js') {
+      const source = content.toString('utf8')
+      const result = applyPatches(source, options.cachePatch)
+      if (!result.ok) throw new Error('lib/main.js does not contain the expected patch sites')
+      content = Buffer.from(result.text, 'utf8')
+      file.node.size = content.length
+      file.node.integrity = integrityFor(content)
+      patched = true
+      log(`lib/main.js: applied [${result.applied.join(', ') || 'nothing (already patched)'}], ${content.length} bytes`)
+    }
+
+    file.node.offset = String(cursor)
+    chunks.push(content)
+    cursor += content.length
+  }
+
+  if (!patched) throw new Error('lib/main.js not found')
+
+  const newData = Buffer.concat(chunks)
+  const headerJson = JSON.stringify(header)
+  const headerBuf = Buffer.from(headerJson, 'utf8')
+  const pad = (4 - (headerBuf.length % 4)) % 4
+  const prefix = Buffer.alloc(16)
+  prefix.writeUInt32LE(4, 0)
+  prefix.writeUInt32LE(headerBuf.length + 8, 4)
+  prefix.writeUInt32LE(headerBuf.length + 4, 8)
+  prefix.writeUInt32LE(headerBuf.length, 12)
+
+  const out = Buffer.concat([prefix, headerBuf, Buffer.alloc(pad), newData])
+  fs.writeFileSync(options.out, out)
+  log(`wrote ${options.out} (${out.length} bytes)`)
+  verify(options)
+}
+
+function verify(options) {
+  if (!fs.existsSync(options.out)) throw new Error(options.out + ' is missing')
+  const base = readAsar(options.from)
+  const built = readAsar(options.out)
+  const baseFiles = collect(base.header)
+  const builtFiles = collect(built.header)
+
+  if (baseFiles.length !== builtFiles.length) {
+    throw new Error(`entry count changed: ${baseFiles.length} -> ${builtFiles.length}`)
+  }
+
+  const baseByPath = new Map(baseFiles.map((file) => [file.path, file]))
+  let compared = 0
+  let patchedSeen = false
+
+  for (const file of builtFiles) {
+    const before = baseByPath.get(file.path)
+    if (before === undefined) throw new Error(`new entry appeared: ${file.path}`)
+    if (file.node.unpacked === true || before.node.unpacked === true) {
+      if (Number(file.node.size) !== Number(before.node.size)) throw new Error(`size drift on unpacked ${file.path}`)
+      continue
+    }
+    const builtBytes = built.data.subarray(Number(file.node.offset), Number(file.node.offset) + Number(file.node.size))
+    if (file.path === 'lib/main.js') {
+      const text = builtBytes.toString('utf8')
+      if (!text.includes(PERSIST_NEW)) throw new Error('persist patch missing in rebuilt asar')
+      if (options.cachePatch !== false && !text.includes(CACHE_NEW)) throw new Error('cache patch missing in rebuilt asar')
+      patchedSeen = true
+      continue
+    }
+    const beforeBytes = base.data.subarray(Number(before.node.offset), Number(before.node.offset) + Number(before.node.size))
+    if (!builtBytes.equals(beforeBytes)) throw new Error(`content drift: ${file.path}`)
+    compared += 1
+  }
+
+  if (!patchedSeen) throw new Error('patched file not found during verification')
+  log(`verified: ${compared} files byte-identical, lib/main.js patched, ${builtFiles.length} entries total`)
+}
+
+const options = parseArgs(process.argv)
+if (options.help === true || options.from === undefined || options.out === undefined) {
+  usage()
+  process.exit(options.help === true ? 0 : 1)
+}
+if (options.mode === 'build') build(options)
+else verify(options)
+log('done: ' + options.mode)

package/tools/shell-patch/watchdog.ps1

@@ -0,0 +1,124 @@
+param(
+  [string]$Resources = $env:DSH_RESOURCES,
+  [string]$Exe
+)
+
+$ErrorActionPreference = 'Continue'
+
+# Find the install without a hard-coded path, so the same script works on any
+# machine. -Resources / DSH_RESOURCES override the search.
+if (-not $Resources) {
+  $candidates = @()
+  if ($env:LOCALAPPDATA) { $candidates += (Join-Path $env:LOCALAPPDATA 'Programs\DeepSeek Harness\resources') }
+  $candidates += 'C:\Program Files\DeepSeek Harness\resources'
+  $candidates += 'C:\Program Files (x86)\DeepSeek Harness\resources'
+  foreach ($candidate in $candidates) {
+    if (Test-Path (Join-Path $candidate 'app.asar')) { $Resources = $candidate; break }
+  }
+}
+if (-not $Resources) {
+  Write-Host 'watchdog: cannot find the DSH install. Pass -Resources <dir> or set DSH_RESOURCES.'
+  exit 1
+}
+if (-not $Exe) { $Exe = Join-Path (Split-Path -Parent $Resources) 'DeepSeek Harness.exe' }
+
+$res  = $Resources
+$asar = Join-Path $res 'app.asar'
+$new  = Join-Path $res 'app.asar.new'
+$orig = Join-Path $res 'app.asar.orig'
+$log  = Join-Path $env:TEMP 'dsh-chat-embed-watchdog.log'
+$mark = Join-Path $env:TEMP 'dsh-chat-embed-patched.txt'
+$app  = 'DeepSeek Harness'
+
+function Log($message) {
+  Add-Content -Path $log -Value ("[{0}] {1}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $message)
+}
+
+Log ('watchdog v4 started (pid ' + $PID + ', event-driven)')
+
+if (Test-Path $mark) { Log 'already patched; exiting'; exit 0 }
+if (-not (Test-Path $new)) { Log 'app.asar.new missing; exiting'; exit 1 }
+
+# Pick the Electron main process: a DeepSeek Harness process whose parent is not
+# itself another DeepSeek Harness process. Everything else is a child worker.
+$alive = @(Get-CimInstance Win32_Process -Filter "Name='DeepSeek Harness.exe'" -ErrorAction SilentlyContinue)
+$mainPid = 0
+foreach ($proc in $alive) {
+  $parent = @($alive | Where-Object { $_.ProcessId -eq $proc.ParentProcessId })
+  if ($parent.Count -eq 0) { $mainPid = $proc.ProcessId; break }
+}
+if ($mainPid -eq 0 -and $alive.Count -gt 0) { $mainPid = ($alive | Select-Object -First 1).ProcessId }
+
+if ($mainPid -ne 0) {
+  Log ('waiting on the main process handle (pid ' + $mainPid + ')')
+  # Blocks on the process handle (WaitForSingleObject). No polling, no CPU, and
+  # no -Timeout (its ceiling on Windows PowerShell is 32767 seconds).
+  while ($true) {
+    if (-not (Get-Process -Id $mainPid -ErrorAction SilentlyContinue)) { break }
+    try {
+      Wait-Process -Id $mainPid -ErrorAction Stop
+    } catch {
+      if (-not (Get-Process -Id $mainPid -ErrorAction SilentlyContinue)) { break }
+      Start-Sleep -Milliseconds 200
+    }
+  }
+  Log 'main process exited (handle event)'
+} else {
+  Log 'the app is not running; patching immediately'
+}
+
+# Children can outlive the main process by a moment; wait for the tree to clear.
+$deadline = (Get-Date).AddSeconds(30)
+while ((Get-Date) -lt $deadline) {
+  if (-not (Get-Process -Name $app -ErrorAction SilentlyContinue)) { break }
+  Start-Sleep -Milliseconds 200
+}
+if (Get-Process -Name $app -ErrorAction SilentlyContinue) {
+  Log 'processes still alive after 30s; nothing changed'
+  exit 1
+}
+
+# Let Windows drop the memory-mapped asar, then swap with retries.
+Start-Sleep -Milliseconds 600
+
+# Pre-flight: re-verify the staged archive against the original before touching it.
+$verifyScript = Join-Path $PSScriptRoot 'patch-asar.cjs'
+try {
+  & 'node' $verifyScript 'verify' '--resources' $res *> $null
+  if ($LASTEXITCODE -ne 0) {
+    Log 'pre-flight verification failed; nothing changed'
+    exit 1
+  }
+  Log 'pre-flight verification passed (byte-identical except lib/main.js)'
+} catch {
+  Log ('pre-flight verification unavailable: ' + $_.Exception.Message + '; continuing')
+}
+$swapped = $false
+for ($attempt = 1; $attempt -le 30; $attempt++) {
+  try {
+    if (Test-Path $orig) { Move-Item -Force $orig ($orig + '.' + (Get-Date -Format 'yyyyMMdd-HHmmss')) }
+    Move-Item -Force $asar $orig
+    Move-Item -Force $new $asar
+    $swapped = $true
+    break
+  } catch {
+    Log ('attempt ' + $attempt + ' failed: ' + $_.Exception.Message)
+    if ((-not (Test-Path $asar)) -and (Test-Path $orig)) { Move-Item -Force $orig $asar }
+    Start-Sleep -Milliseconds 400
+  }
+}
+
+if (-not $swapped) { Log 'could not swap app.asar; original preserved'; exit 1 }
+
+$size = (Get-Item $asar).Length
+if ($size -lt 213202950) {
+  Log ('patched file looks wrong (' + $size + ' bytes); restoring original')
+  Move-Item -Force $asar ($asar + '.broken')
+  Move-Item -Force $orig $asar
+  exit 1
+}
+
+Set-Content -Path $mark -Value ('patched ' + (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'))
+Log ('patched: app.asar is now ' + $size + ' bytes; original kept as app.asar.orig')
+Log 'done; the app was NOT started - open it yourself when ready'
+exit 0

package//346/270/205/347/220/206/350/201/212/345/244/251/347/274/223/345/255/230.cmd

@@ -0,0 +1,12 @@
+@echo off
+rem Free the disposable Chromium caches of the embedded browser, keep the logins.
+rem
+rem Usage:  清理聊天缓存.cmd [partitions-dir]
+rem The directory may also come from DSH_PARTITIONS; the usual locations are
+rem tried otherwise. Close DSH before running this.
+if "%~1"=="" (
+  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0tools\shell-patch\clean-cache.ps1"
+) else (
+  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0tools\shell-patch\clean-cache.ps1" -Partitions "%~1"
+)
+pause