dsh-coding-sidebar 1.0.0

package/src/prefs-shared.ts

@@ -0,0 +1,280 @@
+/**
+ * Shared "Side card" preference vocabulary (types + constants), consumed by
+ * BOTH halves: the host registers the schemastery schema over these values
+ * (config.ts) and the client reads/writes them through the settings RPC
+ * (client/prefs.ts, client/SideCardSection.tsx). Kept free of schemastery so
+ * the browser bundle never pulls the schema runtime in.
+ */
+
+/** The user-settings namespace holding the side card preferences. */
+export const SIDEBAR_PREFS_NS = 'dsh-coding-sidebar'
+
+/** User-facing side card preferences (new-conversation defaults). */
+export interface SidebarPrefs {
+  /** Whether a brand-new conversation opens the side card by default. */
+  openByDefault: boolean
+  /** Default panel width as a percent of the window width (20–60). */
+  defaultWidthPercent: number
+  /**
+   * Whether the sidebar auto-activates (opens the panel) and expands the
+   * Subagent page when the current conversation spawns a new subagent.
+   */
+  autoOpenSubagent: boolean
+  /**
+   * Whether the sidebar auto-activates (opens the panel) and expands the
+   * Jobs page when a NEW background job appears for the current
+   * conversation (any new job id, not just the first one).
+   */
+  autoOpenJobs: boolean
+  /**
+   * Whether the model-facing agent terminal tools (terminal_create / list /
+   * send / read / wait_for / resize / signal / close) are injected into the
+   * model's toolset. Off by default: the feature stays dormant until the
+   * user explicitly enables it in the side card settings.
+   */
+  agentTerminalTools: boolean
+  /**
+   * Whether the model-facing `sidebar_open` tool is injected into the
+   * model's toolset — one tool that lets the model actively open a local
+   * file, a local folder (as a tree rooted there), or an HTTP(S) page in
+   * the calling session's sidebar. Off by default: the feature stays
+   * dormant until the user explicitly enables it in the side card settings.
+   */
+  agentOpenTools: boolean
+  /**
+   * Custom terminal font-family stack (a CSS font-family value, e.g.
+   * `'JetBrains Mono', monospace`). Empty string follows the app's theme
+   * monospace font (`--ds-font-family-code`). Applied live to every
+   * terminal tab; configured under the terminal card's secondary settings.
+   */
+  terminalFontFamily: string
+  /**
+   * Custom terminal font size in px (9–32). Applied live to every terminal
+   * tab; configured under the terminal card's secondary settings.
+   */
+  terminalFontSize: number
+  /**
+   * Whether chat-side file opens (tool-row path links, the produced-files
+   * row, prose file mentions — every path that funnels through the client
+   * runtime's `ctx.workspaces.openPath`) open in the sidebar editor instead
+   * of the Host OS's default application. On by default; the editor tab's
+   * own enable switch gates it too (both must be on for the takeover).
+   */
+  interceptOpenPath: boolean
+  /**
+   * Whether the editor tab runs in merged mode: a path input replaces the
+   * plain header and a toggleable file-tree panel (with a global name
+   * search) docks at the tab's right edge. On by default; also makes brand
+   * new sessions seed an empty editor tab (tree panel open) instead of the
+   * explorer tab. The switch lives under the editor card's gear in the
+   * Side card settings; off restores the pre-merge editor exactly.
+   */
+  editorExplorer: boolean
+  /**
+   * The shell the UI and agent terminals spawn (absolute path or bare
+   * executable name). Empty (default) keeps the legacy resolution order:
+   * `cordis.patch.yml` `config.shell`, then `$SHELL` / login shell /
+   * `powershell.exe` on Windows. Set it from the terminal card's gear in
+   * the Side card settings (or the yaml) to pin a specific shell — takes
+   * effect for terminals opened afterwards.
+   */
+  terminalShell: string
+  /**
+   * Explicit arguments for `terminalShell`, space-separated (empty keeps
+   * the platform defaults; when set, they fully replace them — same
+   * contract as the yaml `shellArgs`).
+   */
+  terminalShellArgs: string
+  /**
+   * Title-bar / shell compatibility scheme (the "位置兼容模式" setting):
+   * - `auto` (default): CONSERVATIVE — only the standard Window Controls
+   *   Overlay API (present in frameless Chromium shells that draw the
+   *   native caption buttons over web content) contributes real geometry;
+   *   without it nothing is modified, so plain-browser (web) behavior is
+   *   untouched.
+   * - `web`: EXPLICIT "DSH official web" — never adapt, not even WCO
+   *   geometry (the user declares they run the plain web UI).
+   * - `preset`: apply the built-in shell preset named by
+   *   `titleBarPresetId` (data-driven, opt-in — see shell-presets.ts).
+   * - `custom`: apply the free-form `customCss` (and the legacy
+   *   `titleBarStripPx` strip).
+   */
+  titleBarScheme: TitleBarScheme
+  /**
+   * The built-in shell preset id applied while `titleBarScheme` is
+   * `preset` ('' = no preset — nothing extra is applied).
+   */
+  titleBarPresetId: string
+  /**
+   * Free-form CSS injected into the page (last in the cascade, so it can
+   * override the plugin's styles; use `!important` to override JS-written
+   * inline CSS variables). Applied while `titleBarScheme` is `custom`.
+   */
+  customCss: string
+  /**
+   * LEGACY (kept for read-migration and downgrade mirroring only): position
+   * compatibility mode flag. The UI writes `titleBarScheme` instead; a
+   * stored `true` without a scheme migrates to the `custom` scheme (with
+   * `titleBarStripPx` preserved).
+   */
+  titleBarCompat: boolean
+  /**
+   * LEGACY (kept for read-migration and downgrade mirroring only): the
+   * reserved top strip height in px used by the `custom` scheme (0–120,
+   * default 40). Drives the `--dsh-title-bar-strip` CSS variable: the
+   * toggle cluster drops `strip + 3px` and the right panel's content
+   * starts `strip` px below its top edge.
+   */
+  titleBarStripPx: number
+  /**
+   * Whether the HTML previewer drops its sandboxed iframe. Sandbox ON (the
+   * default) renders previewed HTML in an opaque-origin iframe that cannot
+   * touch the GUI; turning it OFF runs the previewed page with the GUI's
+   * own origin — full read/write access to session files and internal
+   * APIs. Only for trusted local content; the setting copy warns.
+   */
+  htmlViewerNoSandbox: boolean
+  /**
+   * Whether a newly opened HTML preview starts UNSANDBOXED (the per-surface
+   * temporary unlock pre-applied). Off by default: previews open sandboxed
+   * and the status row offers the one-tap unlock; when on, previews open
+   * in the red unsandboxed state and the status row offers a one-tap
+   * restore for the current file.
+   */
+  htmlViewerDefaultUnsafe: boolean
+  /**
+   * Whether the browser tab drops its sandboxed iframe. Sandbox ON (the
+   * default) keeps browsed sites in an opaque origin with no GUI access;
+   * turning it OFF runs any visited site with the GUI's own origin — it
+   * can read session data and act as the logged-in GUI. Only for trusted
+   * sites; the setting copy warns.
+   */
+  browserNoSandbox: boolean
+  /**
+   * MASTER switch: whether clicking an EXTERNAL link in the GUI (chat
+   * messages, tool rows, prose mentions) is taken over into the sidebar at
+   * all. On by default; the per-protocol granularity lives in
+   * `browserInterceptHttp` / `browserInterceptHttps` (the protocol flag
+   * must also be on), and the target tab's own enable switch gates it too.
+   * Ctrl/Cmd+click always bypasses the takeover. Kept as the master so old
+   * documents keep their meaning with no migration (an explicit `false`
+   * stays "never take over").
+   */
+  browserInterceptLinks: boolean
+  /**
+   * Whether clicking an http EXTERNAL link in the GUI opens the sidebar
+   * (the built-in browser tab, or a plugin tab that declares `urlTarget`)
+   * instead of a new browser tab. On by default; gated on the
+   * `browserInterceptLinks` master and the target tab's own enable switch.
+   */
+  browserInterceptHttp: boolean
+  /**
+   * Whether clicking an https EXTERNAL link in the GUI opens the sidebar
+   * instead of a new browser tab. OFF by default — most https sites (e.g.
+   * GitHub) refuse iframe embedding, so the system browser is the smoother
+   * default; gated on the `browserInterceptLinks` master and the target
+   * tab's own enable switch.
+   */
+  browserInterceptHttps: boolean
+  /**
+   * Comma-separated allowlist of local (loopback) authorities the browser
+   * tab may navigate to — `localhost`, `127.0.0.1`, `127.0.0.1:5174`, or
+   * host:port pairs. Empty by default: loopback addresses stay blocked so a
+   * browsed page cannot probe local services. Each entry is either a bare
+   * hostname (all ports) or host:port; the GUI's own origin is always
+   * allowed regardless. The iframe sandbox still renders allowed local
+   * pages in an opaque origin, exactly like any other site.
+   */
+  browserAllowedLoopback: string
+  /**
+   * Per-tab enable switches, keyed by tab descriptor id (`'explorer'`,
+   * `'my-plugin:db'`). An ABSENT key means enabled — only an explicit
+   * `false` disables a tab type (hidden from the + menu, `openTab` refuses,
+   * and derived flows like subagent auto-open / agent-terminal tabs stop).
+   * Already-open tabs of a disabled type keep rendering (closing one
+   * prevents reopening), matching the "existing conversations keep their
+   * own layouts" rule.
+   */
+  tabsEnabled: Record<string, boolean>
+  /**
+   * Per-viewer enable switches, keyed by file viewer descriptor id
+   * (`'image'`, `'my-plugin:csv'`). An ABSENT key means enabled; a disabled
+   * viewer is skipped by `matchFileViewer` so files fall through to the
+   * next matching viewer (or the download button when none match).
+   */
+  viewersEnabled: Record<string, boolean>
+  /**
+   * Plugin-owned settings blobs (v0.12.0+), keyed by descriptor id: each
+   * registered tab/viewer that declares `settings.pluginToggles` (or writes
+   * through `settings.render`'s `updatePluginSetting`) persists its values
+   * here — an open map, so third-party keys need no host PrefsSchema field.
+   * Values are JSON-serializable (the row controls produce strings /
+   * numbers / booleans; custom panels are responsible for their own).
+   */
+  pluginSettings: Record<string, Record<string, unknown>>
+}
+
+/** Range contract of {@link SidebarPrefs.defaultWidthPercent}. */
+export const WIDTH_PERCENT_MIN = 20
+export const WIDTH_PERCENT_MAX = 60
+export const WIDTH_PERCENT_DEFAULT = 35
+
+/** Range contract of {@link SidebarPrefs.terminalFontSize}. */
+export const TERMINAL_FONT_SIZE_MIN = 9
+export const TERMINAL_FONT_SIZE_MAX = 32
+export const TERMINAL_FONT_SIZE_DEFAULT = 13
+
+/** Range contract of {@link SidebarPrefs.titleBarStripPx}. */
+export const TITLE_BAR_STRIP_MIN = 0
+export const TITLE_BAR_STRIP_MAX = 120
+export const TITLE_BAR_STRIP_DEFAULT = 40
+
+/** The title-bar / shell compatibility schemes (see {@link SidebarPrefs.titleBarScheme}). */
+export const TITLE_BAR_SCHEMES = ['auto', 'web', 'preset', 'custom'] as const
+export type TitleBarScheme = typeof TITLE_BAR_SCHEMES[number]
+
+/** Fallback prefs used whenever the settings document is unreachable or malformed. */
+export const SIDEBAR_PREFS_DEFAULTS: SidebarPrefs = {
+  openByDefault: false,
+  defaultWidthPercent: WIDTH_PERCENT_DEFAULT,
+  autoOpenSubagent: true,
+  autoOpenJobs: true,
+  agentTerminalTools: false,
+  agentOpenTools: false,
+  terminalFontFamily: '',
+  terminalFontSize: TERMINAL_FONT_SIZE_DEFAULT,
+  interceptOpenPath: true,
+  editorExplorer: false,
+  terminalShell: '',
+  terminalShellArgs: '',
+  titleBarScheme: 'auto',
+  titleBarPresetId: '',
+  customCss: '',
+  titleBarCompat: false,
+  titleBarStripPx: TITLE_BAR_STRIP_DEFAULT,
+  htmlViewerNoSandbox: false,
+  htmlViewerDefaultUnsafe: false,
+  browserNoSandbox: false,
+  browserInterceptLinks: true,
+  browserInterceptHttp: true,
+  browserInterceptHttps: false,
+  browserAllowedLoopback: '',
+  tabsEnabled: {},
+  viewersEnabled: {},
+  pluginSettings: {},
+}
+
+/** Clamp one width percent into the contract range (shared by schema and client reads). */
+export function clampWidthPercent(value: number): number {
+  return Math.min(WIDTH_PERCENT_MAX, Math.max(WIDTH_PERCENT_MIN, Math.round(value)))
+}
+
+/** Clamp one terminal font size into the contract range (shared by schema and client reads). */
+export function clampTerminalFontSize(value: number): number {
+  return Math.min(TERMINAL_FONT_SIZE_MAX, Math.max(TERMINAL_FONT_SIZE_MIN, Math.round(value)))
+}
+
+/** Clamp one title-bar strip height into the contract range (shared by schema and client reads). */
+export function clampTitleBarStrip(value: number): number {
+  return Math.min(TITLE_BAR_STRIP_MAX, Math.max(TITLE_BAR_STRIP_MIN, Math.round(value)))
+}

package/src/pty-deps.ts

@@ -0,0 +1,240 @@
+/**
+ * node-pty dependency loading for the host half (issue #140, plugin side).
+ *
+ * The terminal surfaces (UI tabs + model-facing terminal_* tools) need
+ * node-pty, but the package must NEVER be imported statically at module
+ * top level: a missing or broken install (pnpm 11's strict-dep-builds
+ * skipping node-pty's install script, a pruned store entry, a failed
+ * prebuilt-binary download…) would then fail the plugin module load and —
+ * because a loader entry apply failure aborts the boot — take the whole
+ * `dsh web` server down with it.
+ *
+ * Instead the host half loads node-pty lazily (synchronously, via
+ * createRequire — the same resolution `ensureSpawnHelper` already uses in
+ * production). When the load fails the plugin stays mounted in a degraded
+ * state: the terminal tab shows a friendly error carrying a pasteable
+ * repair command (see scripts/install.sh / install.ps1 `--repair`), and the
+ * agent terminal tools are simply not registered.
+ *
+ * Version contract: the plugin must stay in sync with DSH core —
+ * `@deepseek-ai/dsh-subprocess-local` declares `"node-pty": "^1.1.0"` in
+ * its `dependencies`. Both sides then resolve the SAME pnpm store entry
+ * (same range, same integrity → one native binding, no drift). Do NOT
+ * switch to a fork (e.g. @lydell/node-pty) or a different range without
+ * re-checking the core declaration.
+ */
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { homedir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import type * as nodePtyNs from 'node-pty'
+import { SidebarError } from './wire.ts'
+
+/** The node-pty module surface the registries consume (spawn/kill/resize/…). */
+export type NodePtyModule = typeof nodePtyNs
+
+/**
+ * The node-pty version range this plugin ships. MUST stay identical to the
+ * range DSH core declares (`@deepseek-ai/dsh-subprocess-local`): the same
+ * range keeps pnpm resolving both to one physical package.
+ */
+export const DSH_NODE_PTY_RANGE = '^1.1.0'
+
+/**
+ * The WebSocket close-code-1011 reason the host sends when node-pty is
+ * unavailable. The client recognizes this exact marker and fetches the full
+ * repair details from `/sidebar/api/terminal.deps` (a WS close reason is
+ * capped at 123 bytes, so the command itself cannot ride the close frame).
+ */
+export const PTY_DEPS_MISSING = 'pty-deps-missing'
+
+/** A require-compatible loader, injectable for tests. */
+export type NodePtyRequire = (id: string) => unknown
+
+const defaultRequire: NodePtyRequire = createRequire(import.meta.url)
+
+type LoadResult = { ok: true; module: NodePtyModule } | { ok: false; cause: unknown }
+
+let cached: LoadResult | undefined
+
+/**
+ * Load node-pty once (synchronously) and cache the outcome. Returns null
+ * when the package or its native binding cannot be loaded; the cause stays
+ * queryable through {@link nodePtyLoadCause}. Never throws.
+ */
+export function loadNodePty(requireImpl: NodePtyRequire = defaultRequire): NodePtyModule | null {
+  if (cached === undefined) {
+    try {
+      cached = { ok: true, module: requireImpl('node-pty') as NodePtyModule }
+    } catch (cause) {
+      cached = { ok: false, cause }
+    }
+  }
+  return cached.ok ? cached.module : null
+}
+
+/** The recorded load failure (undefined when the load succeeded or never ran). */
+export function nodePtyLoadCause(): unknown {
+  return cached !== undefined && !cached.ok ? cached.cause : undefined
+}
+
+/** Forget the cached outcome (tests only — a real reload is otherwise one-shot). */
+export function resetNodePtyCache(): void {
+  cached = undefined
+}
+
+/** Load node-pty or throw the canonical degraded-mode error (class-constructor default). */
+export function loadRequiredNodePty(): NodePtyModule {
+  const module = loadNodePty()
+  if (module === null) {
+    const cause = describeCause(nodePtyLoadCause())
+    throw new SidebarError(
+      'pty-deps-missing',
+      `node-pty (${DSH_NODE_PTY_RANGE}) failed to load: ${cause} — run the repair command shown in the terminal tab`,
+      503,
+    )
+  }
+  return module
+}
+
+/** Resolve a directory to its physical location (symlinked/link: installs). */
+function realDir(file: string): string {
+  try {
+    return dirname(realpathSync(file))
+  } catch {
+    return dirname(file)
+  }
+}
+
+/** Walk up from `dir` looking for a DSH profile root (package.json + pnpm-workspace.yaml). */
+function walkUp(dir: string, isRoot: (dir: string) => boolean): string | null {
+  let current = dir
+  for (let depth = 0; depth < 16; depth += 1) {
+    if (isRoot(current)) return current
+    const parent = dirname(current)
+    if (parent === current) break
+    current = parent
+  }
+  return null
+}
+
+/** Whether `dir` looks like a DSH profile root (the plugin lives under its node_modules). */
+function isProfileRoot(dir: string): boolean {
+  return existsSync(join(dir, 'package.json')) && existsSync(join(dir, 'pnpm-workspace.yaml'))
+}
+
+/**
+ * Detect the DSH profile directory this plugin is installed into: the
+ * nearest ancestor of the plugin module that carries both `package.json`
+ * and `pnpm-workspace.yaml` (the profile root; the plugin resolves from the
+ * profile's node_modules). Falls back to `$DSH_HOME/profiles/web` (the
+ * standard web profile), then null.
+ */
+export function findProfileDir(fromFile: string = fileURLToPath(import.meta.url)): string | null {
+  const detected = walkUp(realDir(fromFile), isProfileRoot)
+  if (detected !== null) return detected
+  const home = process.env.DSH_HOME !== undefined && process.env.DSH_HOME.trim() !== ''
+    ? process.env.DSH_HOME
+    : join(homedir(), '.dsh')
+  const web = join(home, 'profiles', 'web')
+  return isProfileRoot(web) ? realpathSync(web) : null
+}
+
+/** Whether `dir`'s package.json declares this plugin's name. */
+function isPluginRoot(dir: string): boolean {
+  const file = join(dir, 'package.json')
+  if (!existsSync(file)) return false
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8')) as { name?: unknown }
+    return parsed.name === 'dsh-coding-sidebar'
+  } catch {
+    return false
+  }
+}
+
+/** The plugin package root (walk-up from the module; works for lib/ and src/ layouts). */
+export function findPluginRoot(fromFile: string = fileURLToPath(import.meta.url)): string | null {
+  return walkUp(realDir(fromFile), isPluginRoot)
+}
+
+/** Options for {@link buildRepairCommand}. */
+export interface RepairCommandOptions {
+  /** The plugin package root (where scripts/install.sh / install.ps1 live). */
+  pluginRoot: string | null
+  /** The detected profile directory (null → the standard `web` profile). */
+  profileDir: string | null
+  /** Platform override for tests; defaults to the live process. */
+  platform?: NodeJS.Platform
+}
+
+/**
+ * The pasteable repair command for a broken node-pty install: rerun the
+ * plugin's own installer in `--repair` mode (idempotent: it re-writes the
+ * profile's `allowBuilds: node-pty: true` and re-installs/rebuilds the
+ * dependency). Falls back to DSH's plugin command when the scripts are not
+ * shipped (exotic layouts).
+ */
+export function buildRepairCommand(options: RepairCommandOptions): { command: string; note?: string } {
+  const { pluginRoot, profileDir } = options
+  const platform = options.platform ?? process.platform
+  const profileName = profileDir !== null ? basename(profileDir) : null
+  const profileArg = profileName !== null
+    ? (platform === 'win32' ? ` -Profile "${profileName}"` : ` --profile "${profileName}"`)
+    : ''
+  if (pluginRoot !== null) {
+    if (platform === 'win32') {
+      const script = join(pluginRoot, 'scripts', 'install.ps1')
+      if (existsSync(script)) {
+        return { command: `powershell -ExecutionPolicy Bypass -File "${script}" -Repair${profileArg}` }
+      }
+    } else {
+      const script = join(pluginRoot, 'scripts', 'install.sh')
+      if (existsSync(script)) {
+        return { command: `bash "${script}" --repair${profileArg}` }
+      }
+    }
+  }
+  const name = profileName ?? 'web'
+  return {
+    command: `dsh plugin --profile "${name}" install`,
+    note: 'If pnpm 11 blocked node-pty\'s build script, ensure `allowBuilds: node-pty: true` in the profile\'s pnpm-workspace.yaml (the plugin\'s scripts/install.sh / install.ps1 --repair does this automatically).',
+  }
+}
+
+/** One-line human description of the recorded load cause. */
+function describeCause(cause: unknown): string {
+  if (cause instanceof Error) return cause.message
+  return String(cause)
+}
+
+/** Structured status served by the `/sidebar/api/terminal.deps` endpoint. */
+export type NodePtyDepsStatus =
+  | { ok: true }
+  | {
+    ok: false
+    /** The require-time error message (module missing, native binding broken…). */
+    cause: string
+    /** The pasteable repair command (terminal/cmd). */
+    command: string
+    /** The detected profile name (null when undetected → the command defaults to web). */
+    profile: string | null
+    /** Optional supplementary hint (fallback command only). */
+    note?: string
+  }
+
+/** Current node-pty dependency status (loaded vs degraded + repair info). */
+export function depsStatus(options: { fromFile?: string } = {}): NodePtyDepsStatus {
+  const module = loadNodePty()
+  if (module !== null) return { ok: true }
+  const pluginRoot = findPluginRoot(options.fromFile)
+  const profileDir = findProfileDir(options.fromFile)
+  const { command, note } = buildRepairCommand({ pluginRoot, profileDir })
+  return {
+    ok: false,
+    cause: describeCause(nodePtyLoadCause()),
+    command,
+    profile: profileDir !== null ? basename(profileDir) : null,
+    ...(note !== undefined ? { note } : {}),
+  }
+}