dsh-desktop-link 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 lzlrt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,159 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# dsha-desktop-link
+
+在 **DeepSeek Harness（DSH）** 的侧栏底部加一个按钮：点一下就在系统浏览器 / 新标签页里打开**桌面版 DSH** 的 Web GUI。
+
+专门为 **DSHA（DeepSeek Harness 安卓启动器）** 设计 —— 在手机上的 DSHA 里点这个按钮，会交给系统浏览器打开你电脑上的 DSH，而 DSHA 自己那套 agent 照常独立运行。
+
+```
+🖥 →  桌面版
+```
+
+---
+
+## 它解决什么
+
+DSHA 的内置浏览器只导航它自己的 `http://127.0.0.1:<端口>`，没有「填个网址去连别的机器」的入口。
+但 DSHA 本来就有这条规则：**顶层导航离开本机 DSH 服务时，交给系统浏览器**（`WebPreviewActivity.shouldOverrideUrlLoading` → `ACTION_VIEW`）。
+
+这个插件就是给这条已有规则加一个按钮入口 —— 不改 DSHA、不需要 root、不需要 `am start`。
+
+---
+
+## 行为
+
+| 点击环境 | 结果 |
+|---|---|
+| **手机**（DSHA 的 WebView 或手机浏览器） | 导航离开 DSH 服务 → DSHA 交给系统浏览器 → 打开桌面版 GUI |
+| **电脑浏览器** | `target="_blank"` 开新标签页，当前 GUI 不受影响 |
+
+未配置地址时按钮变灰并提示怎么配，不会跳到一个死链。
+
+---
+
+## 安装
+
+### 从 npm（推荐）
+
+```sh
+dsh plugin --profile web add dsh-desktop-link
+```
+
+### 从本仓库（开发循环）
+
+```sh
+git clone https://github.com/lzlrt/dsha-desktop-link
+dsh plugin --profile web add link:$(pwd)/dsha-desktop-link
+```
+
+### 从打包好的 tgz
+
+```sh
+dsh plugin --profile web add /path/to/dsh-desktop-link-1.0.0.tgz
+```
+
+### 装到手机上的 DSHA
+
+DSHA → 插件 → 添加 → 粘贴一个能下到这个包的 URL，例如：
+
+```
+https://registry.npmjs.org/dsh-desktop-link/-/dsh-desktop-link-1.0.0.tgz
+```
+
+或在 DSHA 插件页直接填包名 `dsh-desktop-link`。
+
+或从本地导入（`adb push` 到 `/sdcard/Download/` 后在插件页选文件）。
+
+装完在插件管理页点「重启 Web」。
+
+---
+
+## 配置地址
+
+插件自身不带默认地址 —— 它从下面这些地方按顺序找，命中即停：
+
+| 优先级 | 来源 |
+|---|---|
+| 1 | 本行 `config.desktopUrl` / `config.launchUrl`（profile 补丁里） |
+| 2 | 环境变量 `DSH_DESKTOP_URL` / `DSH_DESKTOP_LAUNCH_URL` |
+| 3 | `$DSH_HOME/desktop-url.txt` 第 1 行（桌面地址）/ 第 2 行（点击时打开的地址） |
+| 4 | `$DSH_HOME/remote-web-ui-registry/web.json` 的 `id` → `https://<id>.dsh-market.com`（仅当装了 `dsh-remote-web-ui` 并开了固定域名中继） |
+
+`desktop-url.txt` 是最好改的一个 —— **改完刷新页面即生效**，不用重启：
+
+```text
+# 第一行：桌面版长期地址（书签、复制链接用）
+https://your-desktop.example.com
+
+# 第二行（可选）：点按钮时真正打开的地址。
+# 指向一个「每次铸新配对码」的端点，未配对的手机也能一次进。
+https://your-desktop.example.com/pair-entry
+```
+
+只写一行 = 按钮直接开那一行。删掉文件 = 退回优先级 4。
+
+### 两种地址的区别
+
+| 字段 | 用途 |
+|---|---|
+| `desktopUrl` | 长期地址。锚点的 `href` 用它，中间键 / 复制链接 / 收藏都按这个走 |
+| `launchUrl` | 点击时实际打开的地址。可以是一个会临时铸码的端点，让从未配对过的设备也能一次进入 |
+
+没配 `launchUrl` 时它等于 `desktopUrl`。
+
+---
+
+## 未配对的手机会看到 401
+
+DSH 的远程访问是要配对的。未配对设备直接打开桌面地址会被 harness 的认证栅栏拒绝 —— 这是配对机制正常工作，不是这个插件的 bug。
+
+三种处理方式：
+
+1. **先配对一次**：配对 cookie 默认有效期一年，之后点按钮直接进。
+2. **配 `launchUrl` 指向铸码端点**：每次点击拿新码，永远有效。
+3. **手机端自动铸码**：若本机装了 `dsh-remote-web-ui`，手机点击时插件会先调同源 `/api/pair/issue` 铸一枚一次性码再跳转（该接口只应答回环，所以页面能直接调）。没装则自动退回直接打开 `desktopUrl`。
+
+---
+
+## 接口
+
+| 方法 | 路径 | 说明 |
+|---|---|---|
+| GET | `/api/desktop-link/info` | `{"ok":true,"launchUrl":"…","desktopUrl":"…","source":"…"}` |
+
+每次请求重新解析地址，所以改配置文件不需要重启。
+另外 Host 半区会在 `webserver/index-inject` 里注入 `globalThis.__DSHA_DESKTOP_LINK__`，让按钮首帧就能拿到地址；全局缺失时 Client 半区回退到上面那个接口。
+
+---
+
+## 结构
+
+```
+package.json          清单：dsh.bundle.patch + dsh.client(platform: web)
+cordis.patch.yml      插入一行 dsha-desktop-link
+index.js              Host 半区：地址解析 + /api/desktop-link/info + index 全局
+client.js             Client 半区：注册 sidebar.footer.action
+icon.svg              显示器 + 外跳箭头
+locale/{zh,en}.json   meta.title / meta.description
+```
+
+### 实现要点
+
+- 只注册 `sidebar.footer.action` 一个槽位（`replaceRisk: none`），`order: 10`，排在官方「远程访问」之后。
+- 图标 18×18 内联在 `client.js` 里，与 `icon.svg` 同款，少一次请求。
+- 不做 `Config` 导出：装完即用，配置全走文件/环境变量。
+- 手机与电脑的分支靠 `navigator.userAgent` 判定；桌面侧完全走原生锚点行为，不拦点击。
+
+---
+
+## 已知限制
+
+1. **Host 半区（`index.js`）改动需要重启 `dsh web`**；Client 半区（`client.js`）HMR 即时生效。
+2. 侧栏折叠成 56px 轨道时只显示图标，展开后才显示「桌面版」文字。
+3. 手机端「点击时铸码」依赖本机装了 `dsh-remote-web-ui`（本插件不声明这个依赖，装不装都能用，只是没有自动铸码）。
+4. 需要 DSH `>= 0.2.1-rc.2`（`webserver/index-inject` 事件与 `sidebar.footer.action` 槽位）。
+
+---
+
+## License
+
+MIT

package/client.js

@@ -0,0 +1,232 @@
+window.__ModuleLoader__.load({
+  id: 'dsh-desktop-link',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+
+    /** Locale namespace owned by this plugin. */
+    const NS = 'dsha-desktop-link'
+
+    const zh = {
+      'action': '打开桌面版 DSH',
+      'action.short': '桌面版',
+      'hint.unset': '还没配桌面地址：把地址写进 ~/.dsh/desktop-url.txt（一行一个 URL）',
+    }
+    const en = {
+      'action': 'Open desktop DSH',
+      'action.short': 'Desktop',
+      'hint.unset': 'No desktop address yet: put one in ~/.dsh/desktop-url.txt (one URL per line)',
+    }
+
+    /* 18×18 monitor with an out-arrow — same artwork as icon.svg, inlined so
+       the button costs no extra request. */
+    function Mark() {
+      return h('svg', {
+        viewBox: '0 0 64 64', width: 18, height: 18, 'aria-hidden': true,
+        focusable: false,
+        style: { display: 'block', flex: 'none' },
+      },
+      h('rect', {
+        x: 8, y: 10, width: 48, height: 30, rx: 5,
+        fill: 'none', stroke: 'currentColor', strokeWidth: 4.5,
+      }),
+      h('path', {
+        d: 'M26 54h12M32 46v8', fill: 'none', stroke: 'currentColor',
+        strokeWidth: 4.5, strokeLinecap: 'round',
+      }),
+      h('path', {
+        d: 'M24 25h14M32 18l7 7-7 7', fill: 'none', stroke: 'currentColor',
+        strokeWidth: 4.5, strokeLinecap: 'round', strokeLinejoin: 'round',
+      }))
+    }
+
+    /**
+     * The addresses the host published so far. Both empty means the host half
+     * resolved nothing — the button then renders disabled with a hint instead
+     * of sending the browser to an address nobody configured.
+     */
+    function published() {
+      const injected = window.__DSHA_DESKTOP_LINK__
+      const desktopUrl = injected && typeof injected.desktopUrl === 'string' ? injected.desktopUrl : ''
+      const launchUrl = injected && typeof injected.launchUrl === 'string' ? injected.launchUrl : ''
+      return { desktopUrl, launchUrl }
+    }
+
+    /**
+     * Fill in from the info route when the index global is absent.
+     *
+     * The global comes from `webserver/index-inject`, so it only appears on an
+     * index rendered after the Host half loaded; the route answers on the
+     * running Host either way. Cached on the window so later renders and clicks
+     * agree without another request.
+     * @returns the published addresses, once known.
+     */
+    function hydrate() {
+      const injected = window.__DSHA_DESKTOP_LINK__
+      if (injected && injected.desktopUrl) return Promise.resolve(published())
+      return fetch('/api/desktop-link/info', {
+        credentials: 'same-origin',
+        headers: { accept: 'application/json' },
+      }).then((res) => (res.ok ? res.json() : null))
+        .then((body) => {
+          if (!body || typeof body.desktopUrl !== 'string' || !body.desktopUrl) return published()
+          const merged = {
+            desktopUrl: body.desktopUrl,
+            launchUrl: typeof body.launchUrl === 'string' ? body.launchUrl : '',
+            paired: Boolean(body.paired),
+          }
+          window.__DSHA_DESKTOP_LINK__ = merged
+          return merged
+        })
+        .catch(() => published())
+    }
+
+    /** Whether this page runs on a handset (DSHA's WebView or a phone browser). */
+    function isHandset() {
+      const ua = navigator.userAgent || ''
+      return /Android|iPhone|iPad|iPod|HarmonyOS|Mobile/i.test(ua)
+    }
+
+    /**
+     * Mint a one-shot pair URL from this instance's own pairing service.
+     *
+     * This page is same-origin on the loopback listener and `/api/pair/issue`
+     * answers loopback only, so the browser can ask on the phone's behalf. A
+     * phone that has never paired would otherwise open the published origin and
+     * meet the harness 401 fence; after one pairing the cookie lasts a year.
+     * An instance without the pairing plugin answers 404 — a handled miss.
+     * @returns the pair-accept URL, or an empty string.
+     */
+    function mintPairUrl() {
+      return fetch('/api/pair/issue', {
+        method: 'POST',
+        credentials: 'same-origin',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: '{}',
+      }).then((res) => (res.ok ? res.json() : null))
+        .then((body) => (body && typeof body.url === 'string' ? body.url : ''))
+        .catch(() => '')
+    }
+
+    /**
+     * The URL the anchor carries, so middle-click and "copy link" stay
+     * meaningful. A configured `launchUrl` wins, else the desktop origin.
+     * @returns the absolute URL.
+     */
+    function linkHref() {
+      const { desktopUrl, launchUrl } = published()
+      return launchUrl || desktopUrl
+    }
+
+    /**
+     * Handset click: navigate this page to a freshly minted pair URL.
+     *
+     * A top-level navigation needs no user gesture, so this survives the await
+     * that the popup-blocked `window.open` variant did not. The DSHA WebView
+     * sees the navigation leave its own service and hands it to the system
+     * browser, which is exactly the desired jump.
+     * @param fallback - the URL to use when minting is unavailable.
+     */
+    function openOnHandset(fallback) {
+      mintPairUrl().then((url) => { window.location.assign(url || fallback) })
+    }
+
+    /**
+     * Sidebar-foot button: "open the desktop DSH".
+     *
+     * Two paths, both deterministic:
+     * - Handset: no second window exists, so a top-level navigation is the
+     *   answer. It is issued after a short mint call, which a navigation (unlike
+     *   `window.open`) tolerates, and DSHA then hands it to the system browser.
+     * - Desktop: a plain `target="_blank"` anchor opens a second tab and leaves
+     *   the current GUI alone. No script runs, so nothing can be blocked.
+     */
+    function DesktopLinkButton(props) {
+      const wide = props.wide !== false
+      const t = props.t || ((key) => zh[key] || en[key] || key)
+      const [href, setHref] = React.useState(() => linkHref())
+      React.useEffect(() => {
+        let alive = true
+        hydrate().then(() => { if (alive) setHref(linkHref()) })
+        return () => { alive = false }
+      }, [])
+
+      const onClick = (event) => {
+        // Nothing configured: stay inert and let the title/hint explain why.
+        if (!href) { event.preventDefault(); return }
+        // Let modifier-clicks and middle-clicks fall through to the anchor.
+        if (event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return
+        if (!isHandset()) return   // desktop keeps the plain _blank anchor
+        event.preventDefault()
+        // A configured minting endpoint already hands out a fresh token, so
+        // navigating there is enough; otherwise mint here.
+        const { desktopUrl, launchUrl } = published()
+        if (launchUrl && launchUrl !== desktopUrl) {
+          window.location.assign(launchUrl)
+          return
+        }
+        openOnHandset(desktopUrl)
+      }
+
+      const style = {
+        display: 'inline-flex',
+        alignItems: 'center',
+        justifyContent: wide ? 'flex-start' : 'center',
+        flex: 'none',
+        height: 28,
+        minWidth: 28,
+        padding: wide ? '0 8px' : 0,
+        boxSizing: 'border-box',
+        borderRadius: 'var(--dsw-radius-sm, 6px)',
+        color: 'var(--dsw-alias-label-secondary)',
+        background: 'transparent',
+        border: 'none',
+        cursor: 'pointer',
+        fontSize: 13,
+        fontFamily: 'inherit',
+        textDecoration: 'none',
+        whiteSpace: 'nowrap',
+      }
+
+      return h('a', {
+        href,
+        target: '_blank',
+        rel: 'noopener noreferrer',
+        style: { ...style, opacity: href ? 1 : 0.45 },
+        title: href || t('hint.unset'),
+        'aria-label': t('action'),
+        'aria-disabled': href ? undefined : 'true',
+        onClick,
+        onMouseEnter: (e) => {
+          e.currentTarget.style.background = 'var(--dsw-alias-interactive-bg-hover, rgba(127,127,127,.12))'
+        },
+        onMouseLeave: (e) => { e.currentTarget.style.background = 'transparent' },
+      },
+      h(Mark),
+      wide
+        ? h('span', {
+          style: { marginLeft: 8, overflow: 'hidden', textOverflow: 'ellipsis', fontSize: 13 },
+        }, t('action.short'))
+        : null)
+    }
+
+    return {
+      inject: ['slots', 'locale'],
+      apply(ctx) {
+        ctx.effect(() => {
+          const offZh = ctx.locale.register(NS, 'zh', zh)
+          const offEn = ctx.locale.register(NS, 'en', en)
+          return () => { offZh(); offEn() }
+        }, 'dsha-desktop-link: dictionaries')
+
+        ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({
+          name: 'sidebar.footer.action',
+          id: 'dsha-desktop-link',
+          order: 10,
+          label: () => ctx.locale.bind(NS)('action'),
+          locale: NS,
+        }, DesktopLinkButton))
+      },
+    }
+  },
+})

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsha-desktop-link
+      name: 'dsh-desktop-link'

package/icon.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Desktop DSH">
+  <rect x="3" y="4" width="58" height="56" rx="14" fill="#0f172a"/>
+  <!-- monitor -->
+  <rect x="12" y="14" width="40" height="26" rx="4" fill="none" stroke="#5eead4" stroke-width="3.2"/>
+  <path d="M24 47h16M32 40v7" fill="none" stroke="#5eead4" stroke-width="3.2" stroke-linecap="round"/>
+  <!-- arrow out of the screen, i.e. "jump to desktop" -->
+  <path d="M25 27h13M33 21l7 6-7 6" fill="none" stroke="#f0abfc" stroke-width="3.2"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/index.js

@@ -0,0 +1,164 @@
+/**
+ * dsh-desktop-link —— 宿主半区。
+ *
+ * 只做一件事：把两个地址交给浏览器半区。
+ * 唯一的路由是一条只读 JSON：
+ *
+ *   GET /api/desktop-link/info
+ *     → { ok, launchUrl, desktopUrl, source }
+ *
+ *   launchUrl   点按钮时真正打开的地址（可以是中转的一次性链接）
+ *   desktopUrl  桌面版 GUI 的长期地址（书签用，也是 launchUrl 的兜底）
+ *
+ * desktopUrl 的来源优先级（命中即停）：
+ *   1. 本行 config.desktopUrl
+ *   2. 环境变量 DSH_DESKTOP_URL
+ *   3. $DSH_HOME/desktop-url.txt 第一行
+ *   4. $DSH_HOME/remote-web-ui-registry/web.json 的 id → https://<id>.dsh-market.com
+ *
+ * launchUrl 额外支持 config.launchUrl / 环境变量 DSH_DESKTOP_LAUNCH_URL，
+ * 用来指向 dsha-pair/bridge.py 的 /open.html（每次点都铸一枚新码）。
+ * 没配 launchUrl 时，launchUrl 恒等于 desktopUrl。
+ */
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+function dshHome() {
+  const fromEnv = process.env.DSH_HOME
+  if (typeof fromEnv === 'string' && fromEnv.trim()) return fromEnv.trim()
+  return join(homedir(), '.dsh')
+}
+
+function urlish(value) {
+  return typeof value === 'string' && /^https?:\/\/\S+$/i.test(value.trim()) ? value.trim() : ''
+}
+
+/**
+ * Every URL in a hand-edited comment-friendly file under the DSH home.
+ *
+ * `desktop-url.txt` takes up to two lines, in this order:
+ *   line 1 = desktopUrl, the long-lived desktop origin (bookmark target)
+ *   line 2 = launchUrl, what a click actually opens (a minting endpoint)
+ * A single line therefore means "open this one thing". `#` comments and blank
+ * lines are skipped, and anything that is not http(s) is ignored rather than
+ * returned half-parsed.
+ * @param name - file name inside the DSH home.
+ * @returns the URLs found, in file order.
+ */
+function readUrlLines(name) {
+  try {
+    const file = join(dshHome(), name)
+    if (!existsSync(file)) return []
+    const found = []
+    for (const raw of readFileSync(file, 'utf8').split(/\r?\n/)) {
+      const line = raw.trim()
+      if (!line || line.startsWith('#')) continue
+      const value = urlish(line)
+      if (value) found.push(value)
+    }
+    return found
+  } catch {
+    return []
+  }
+}
+
+function readRelayOrigin() {
+  try {
+    const file = join(dshHome(), 'remote-web-ui-registry', 'web.json')
+    if (!existsSync(file)) return ''
+    const parsed = JSON.parse(readFileSync(file, 'utf8'))
+    const id = typeof parsed?.id === 'string' ? parsed.id.trim() : ''
+    return /^[A-Za-z0-9-]{8,}$/.test(id) ? `https://${id}.dsh-market.com` : ''
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * Whether this instance has ever paired a device.
+ *
+ * The roster is `dsh-remote-web-ui`'s own persisted store
+ * (`$DSH_HOME/remote-web-ui-devices.json`, 0600, its documented default). It is
+ * read only for this boolean — no ids, no credentials — and a missing or
+ * unreadable file simply means "nothing paired yet", which is the safe answer:
+ * the button then mints a token instead of opening a URL that would 401.
+ * @returns whether at least one device session exists on disk.
+ */
+function hasPairedDevice() {
+  try {
+    const file = join(dshHome(), 'remote-web-ui-devices.json')
+    if (!existsSync(file)) return false
+    const parsed = JSON.parse(readFileSync(file, 'utf8'))
+    const rows = Array.isArray(parsed) ? parsed : (parsed?.devices ?? [])
+    return Array.isArray(rows) ? rows.length > 0 : Boolean(rows && Object.keys(rows).length)
+  } catch {
+    return false
+  }
+}
+
+function resolveUrls(config) {
+  const fileUrls = readUrlLines('desktop-url.txt')
+  const chain = [
+    ['config', () => urlish(config?.desktopUrl)],
+    ['env', () => urlish(process.env.DSH_DESKTOP_URL)],
+    ['desktop-url.txt', () => fileUrls[0] ?? ''],
+    ['relay-registry', readRelayOrigin],
+  ]
+  let desktopUrl = ''
+  let source = 'unset'
+  for (const [label, read] of chain) {
+    const value = read()
+    if (value) { desktopUrl = value; source = label; break }
+  }
+  // launchUrl is what a click opens. In order: the row's config, the
+  // environment, line 2 of desktop-url.txt (a local minting endpoint such as
+  // dsha-pair/bridge.py's /open.html?k=…), then the desktop origin itself.
+  const launchUrl =
+    urlish(config?.launchUrl) ||
+    urlish(process.env.DSH_DESKTOP_LAUNCH_URL) ||
+    fileUrls[1] ||
+    desktopUrl
+  return { launchUrl, desktopUrl, source }
+}
+
+/** Host half: publish the desktop address. */
+export const inject = ['webServer']
+
+/**
+ * Register the info route, the launch route, and the index global.
+ *
+ * The browser half reads `globalThis.__DSHA_DESKTOP_LINK__` synchronously, so
+ * the button is usable on first paint. `paired` tells it whether this instance
+ * ever paired a device: when it never has, the client mints a token itself
+ * through `/api/pair/issue` (same-origin, loopback, so the pairing service
+ * answers) instead of opening a URL that would hit the harness 401 fence.
+ * @param ctx - host plugin context carrying webServer.
+ * @param config - the row's config (`{ desktopUrl?, launchUrl? }`).
+ */
+export function apply(ctx, config) {
+  const disposeGlobal = ctx.on('webserver/index-inject', (table) => {
+    table.push({ kind: 'global', name: '__DSHA_DESKTOP_LINK__', value: resolveUrls(config) })
+  })
+
+  const info = ctx.webServer.register({
+    kind: 'exact',
+    path: '/api/desktop-link/info',
+    handler(_req, res) {
+      // Re-read per request: editing desktop-url.txt takes effect on the next
+      // click without restarting the profile.
+      const body = JSON.stringify({ ok: true, ...resolveUrls(config) })
+      res.writeHead(200, {
+        'content-type': 'application/json; charset=utf-8',
+        'content-length': Buffer.byteLength(body),
+        'cache-control': 'no-store',
+      })
+      res.end(body)
+    },
+  })
+
+  ctx.effect(() => () => {
+    if (typeof disposeGlobal === 'function') disposeGlobal()
+    if (typeof info === 'function') info()
+  }, 'dsha-desktop-link: info route + index global')
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Desktop DSH shortcut",
+    "description": "Adds one sidebar-foot button that opens the desktop DSH Web GUI in the system browser or a new tab."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "桌面版 DSH 快捷入口",
+    "description": "在侧栏底部加一个按钮：点一下就在系统浏览器 / 新标签页里打开桌面版 DSH 的 Web GUI。"
+  }
+}

package/package.json

@@ -1,6 +1,59 @@
-{
-  "name": "dsh-desktop-link",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+{
+  "name": "dsh-desktop-link",
+  "version": "1.0.0",
+  "type": "module",
+  "icon": "./icon.svg",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "icon.svg",
+    "locale"
+  ],
+  "dsh": {
+    "engines": {
+      "dsh": ">=0.2.1-rc.2"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    }
+  },
+  "license": "MIT",
+  "author": "lzlrt",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek",
+    "deepseek-harness",
+    "dsha",
+    "remote",
+    "sidebar",
+    "mobile"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lzlrt/dsha-desktop-link.git"
+  },
+  "homepage": "https://github.com/lzlrt/dsha-desktop-link#readme",
+  "bugs": {
+    "url": "https://github.com/lzlrt/dsha-desktop-link/issues"
+  },
+  "description": "DSH sidebar button: open the desktop DSH Web GUI from DSHA on your phone, in one tap.",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  }
 }