dsh-glass-plugin 0.0.0-stage → 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wfz2006
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# dsh-glass-plugin
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DSH bundle for **DSH Status Bar** — a floating glass status bar for DeepSeek Harness.
+
+## What it does
+
+The plugin mounts one host row in DSH. At boot it waits for the local web server,
+asks the `connection` service for the authenticated host URL
+(`connection.authenticatedUrl(origin)`), and starts the desktop app with that link:
+
+```text
+electron <app dir> --dsh-link=<authenticated url> --launcher-pid=<host pid>
+```
+
+Glass connects with that link on launch, so nothing has to be pasted. The link
+travels only in the process arguments and is never logged — the plugin prints
+`[dsh-glass-plugin] Glass desktop companion launched (authenticated link redacted)`.
+The app rejects non-loopback links, credentials, hashes and sub-paths before it
+touches the network. `--launcher-pid` makes the companion exit when the DSH
+process it belongs to disappears; disposing the plugin kills the spawned tree.
+
+If Glass is already running, the second launch hits its single-instance lock: the
+existing window is focused and re-connected with the new link.
+
+## Install
+
+From npm, from the plugin market (once listed), or straight from the release
+tarball:
+
+```sh
+# npm: ~1.6 MB, fetches the 155 MB runtime once on first launch
+dsh plugin --profile web add dsh-glass-plugin
+
+# release tarball: 155 MB, self-contained, nothing downloaded later
+dsh plugin --profile web add https://github.com/wfz2006/dsh-status-bar/releases/latest/download/dsh-glass-plugin.tgz
+```
+
+Both end up as the same companion: the built desktop app plus an Electron
+runtime. The tarball carries them; the npm package downloads the very same
+tarball the first time DSH starts it (progress goes to the host log, roughly
+`[dsh-glass-plugin] downloading the Glass runtime: 40% of 155 MB`) and unpacks it
+into a per-version cache — `%LOCALAPPDATA%\dsh-glass-plugin\runtime-<version>` on
+Windows, `~/.cache/dsh-glass-plugin/runtime-<version>` elsewhere. Later launches
+reuse that cache, so the download happens once per version.
+
+### From a checkout (development)
+
+The desktop profile can link the package instead of installing it:
+
+```jsonc
+// <profile>/package.json
+"dependencies": { "dsh-glass-plugin": "link:D:/codexwork/dsh/dsh-glass-spec/packages/dsh-plugin" },
+"dsh": { "profile": { "bundles": [/* ... */ "dsh-glass-plugin"] } }
+```
+
+In a checkout the plugin uses `apps/desktop/out` as the app directory and the
+workspace `electron` package, so run `pnpm build` first. Point a junction or
+symlink at `node_modules/dsh-glass-plugin` if pnpm did not run, then restart DSH.
+
+## Configuration
+
+The bundle patch sets `autoLaunch: true`. To keep the plugin installed but stop it
+from starting Glass, override the row config in the profile patch:
+
+```yaml
+- id: dsh-glass-plugin
+  config:
+    autoLaunch: false
+```
+
+Other overrides, all optional:
+
+| key | meaning |
+|:--|:--|
+| `appDir` | directory holding `out/main/index.js` |
+| `electronBinary` | path to an Electron executable |
+| `autoReload` | relaunch the companion when the desktop bundle changes (default `true`) |
+
+`DSH_GLASS_APP` and `DSH_GLASS_ELECTRON` do the same two paths through the environment.
+
+## Requirements
+
+- Windows 11 x64 (the glass refraction reads the screen behind the window).
+- The desktop app is a separate Electron process; it needs a GPU-backed Electron
+  runtime, which the release tarball provides.
+
+## License
+
+MIT. The bundled Electron runtime keeps its own license files
+(`electron/dist/LICENSE`, `LICENSES.chromium.html`).

package/cordis.patch.yml

@@ -0,0 +1,12 @@
+# dsh-glass-plugin bundle patch
+#
+# This is the `dsh.bundle.patch` layer of the local bundle package. When the
+# package is declared in a profile's dependencies, adding it to
+# `dsh.profile.bundles` mounts the row below at boot. The row resolves
+# `dsh-glass-plugin` from the profile's node_modules, where the `link:`
+# dependency points back at this directory.
+- insert:
+    - id: dsh-glass-plugin
+      name: 'dsh-glass-plugin'
+      config:
+        autoLaunch: true

package/lib/index.js

@@ -0,0 +1,340 @@
+// DSH bundle entry for the Glass companion.
+//
+// The desktop app is its own Electron process. This host plugin starts it once
+// the local web server is up, handing over the authenticated URL through
+// `--dsh-link` so Glass connects without the user pasting anything. When Glass
+// is already running, its single-instance lock focuses the existing window and
+// re-connects it with the new link.
+//
+// Three install shapes have to work:
+//
+//   - the release tarball, which ships the built app in `app/` and an Electron
+//     runtime in `electron/dist/` (self-contained, nothing to build);
+//   - the npm package, which ships only this plugin and fetches the same
+//     tarball once into a cache directory on first launch;
+//   - a checkout of the repository, where both live outside this package
+//     (`apps/desktop/out` and the workspace `electron` dependency).
+//
+// The child also receives `--launcher-pid`; Glass exits when that host process
+// disappears, and disposal kills the spawned tree so the companion follows DSH.
+import { spawn, spawnSync } from 'node:child_process';
+import { createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from 'node:fs';
+import { get as httpsGet } from 'node:https';
+import { createRequire } from 'node:module';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const name = 'dsh-glass-plugin';
+export const inject = ['connection', 'webServer'];
+
+/** Package root: `lib/index.js` -> the directory that holds `package.json`. */
+const pluginRoot = fileURLToPath(new URL('../', import.meta.url));
+
+/** Where the light npm package writes the runtime it downloads on first run. */
+const DEFAULT_RUNTIME_URL = 'https://github.com/wfz2006/dsh-status-bar/releases/latest/download/dsh-glass-plugin.tgz';
+
+/** Electron's binary sits at these relative paths inside a `dist/` directory. */
+function electronExecutables() {
+  if (process.platform === 'win32') return ['electron.exe'];
+  if (process.platform === 'darwin') return [join('Electron.app', 'Contents', 'MacOS', 'Electron')];
+  return ['electron'];
+}
+
+function firstFile(candidates) {
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.length > 0 && existsSync(candidate)) return candidate;
+  }
+  return undefined;
+}
+
+function hasApp(candidate) {
+  return typeof candidate === 'string' && candidate.length > 0 && existsSync(join(candidate, 'out', 'main', 'index.js'));
+}
+
+function distBinary(distDir) {
+  return firstFile(electronExecutables().map(name => join(distDir, name)));
+}
+
+function packageVersion() {
+  try {
+    const manifest = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'));
+    return typeof manifest.version === 'string' ? manifest.version : '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+}
+
+/**
+ * The app directory holds `out/main/index.js`. The packaged copy wins, then an
+ * explicit override, then the checkout layout used while developing.
+ */
+function resolveAppDir(config) {
+  return firstFile([
+    config.appDir,
+    process.env.DSH_GLASS_APP,
+    join(pluginRoot, 'app'),
+    join(pluginRoot, '..', '..', 'apps', 'desktop'),
+  ].filter(hasApp));
+}
+
+function resolveElectron(config, appDir) {
+  const explicit = firstFile([config.electronBinary, process.env.DSH_GLASS_ELECTRON].filter(value => typeof value === 'string'));
+  if (explicit) return explicit;
+
+  // Release tarball: the runtime travels with the package.
+  const bundled = distBinary(join(pluginRoot, 'electron', 'dist'));
+  if (bundled) return bundled;
+
+  // Source install: use the `electron` package installed next to the app (the
+  // workspace checkout) or next to this package (a registry dependency).
+  for (const base of [appDir, pluginRoot]) {
+    if (!base) continue;
+    try {
+      const manifest = createRequire(join(base, 'package.json')).resolve('electron/package.json');
+      const binary = distBinary(join(dirname(manifest), 'dist'));
+      if (binary) return binary;
+    } catch {
+      // Not installed this way; try the next base.
+    }
+  }
+  return undefined;
+}
+
+/** A layout that already has both halves of the companion. */
+function resolveInstalled(config) {
+  const appDir = resolveAppDir(config);
+  if (!appDir) return undefined;
+  const electron = resolveElectron(config, appDir);
+  return electron ? { appDir, electron } : undefined;
+}
+
+function runtimeRoot(config) {
+  const base = config.runtimeDir
+    ?? process.env.DSH_GLASS_RUNTIME
+    ?? (process.platform === 'win32'
+      ? join(process.env.LOCALAPPDATA ?? join(homedir(), 'AppData', 'Local'), 'dsh-glass-plugin')
+      : join(process.env.XDG_CACHE_HOME ?? join(homedir(), '.cache'), 'dsh-glass-plugin'));
+  return join(base, `runtime-${packageVersion()}`);
+}
+
+function describeError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/** Follows redirects; GitHub's release download resolves to a CDN host. */
+function download(url, destination, { redirects = 5 } = {}) {
+  return new Promise((resolve, reject) => {
+    const request = httpsGet(url, (response) => {
+      const status = response.statusCode ?? 0;
+      if (status >= 300 && status < 400 && response.headers.location) {
+        response.resume();
+        if (redirects <= 0) {
+          reject(new Error(`too many redirects while downloading ${url}`));
+          return;
+        }
+        const next = new URL(response.headers.location, url).href;
+        download(next, destination, { redirects: redirects - 1 }).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) {
+        response.resume();
+        reject(new Error(`download failed with HTTP ${status}: ${url}`));
+        return;
+      }
+      const total = Number(response.headers['content-length'] ?? 0);
+      let received = 0;
+      let reported = 0;
+      const file = createWriteStream(destination);
+      response.on('data', (chunk) => {
+        received += chunk.length;
+        if (total > 0) {
+          const percent = Math.floor((received / total) * 100);
+          if (percent >= reported + 10) {
+            reported = percent - (percent % 10);
+            console.info(`[dsh-glass-plugin] downloading the Glass runtime: ${reported}% of ${Math.round(total / (1024 * 1024))} MB`);
+          }
+        }
+      });
+      response.pipe(file);
+      file.on('finish', () => file.close(() => resolve(received)));
+      file.on('error', (error) => {
+        rmSync(destination, { force: true });
+        reject(error);
+      });
+    });
+    request.on('error', (error) => {
+      rmSync(destination, { force: true });
+      reject(error);
+    });
+    request.setTimeout(15 * 60 * 1000, () => request.destroy(new Error(`timed out downloading ${url}`)));
+  });
+}
+
+/** `tar` ships with Windows 10+ (bsdtar), macOS and every mainstream Linux. */
+function extract(tarball, directory) {
+  const result = spawnSync('tar', ['-xzf', tarball, '-C', directory], { stdio: 'ignore', windowsHide: true });
+  if (result.status !== 0) {
+    throw new Error(`could not unpack ${tarball} (tar exited with ${result.status ?? result.signal}); extract it manually to ${directory}`);
+  }
+}
+
+/**
+ * Downloads and unpacks the release tarball into the per-version cache, then
+ * returns the same `{ appDir, electron }` shape as a bundled install.
+ */
+async function fetchRuntime(config) {
+  const url = config.downloadUrl ?? process.env.DSH_GLASS_RUNTIME_URL ?? DEFAULT_RUNTIME_URL;
+  const root = runtimeRoot(config);
+  const cached = { appDir: join(root, 'app'), electron: distBinary(join(root, 'electron', 'dist')) };
+  if (hasApp(cached.appDir) && cached.electron) return cached;
+
+  const staging = `${root}.staging`;
+  const tarball = join(tmpdir(), `dsh-glass-plugin-${process.pid}-${Date.now()}.tgz`);
+  rmSync(staging, { recursive: true, force: true });
+  mkdirSync(staging, { recursive: true });
+  console.info(`[dsh-glass-plugin] first run: fetching the ~155 MB Glass runtime from ${url}`);
+  try {
+    const bytes = await download(url, tarball);
+    console.info(`[dsh-glass-plugin] unpacking the Glass runtime (${Math.round(bytes / (1024 * 1024))} MB)`);
+    extract(tarball, staging);
+    const unpacked = join(staging, 'package');
+    if (!hasApp(join(unpacked, 'app')) || !distBinary(join(unpacked, 'electron', 'dist'))) {
+      throw new Error('the downloaded archive does not contain app/ and electron/dist/');
+    }
+    rmSync(root, { recursive: true, force: true });
+    mkdirSync(root, { recursive: true });
+    renameSync(join(unpacked, 'app'), join(root, 'app'));
+    renameSync(join(unpacked, 'electron'), join(root, 'electron'));
+  } finally {
+    rmSync(tarball, { force: true });
+    rmSync(staging, { recursive: true, force: true });
+  }
+
+  const electron = distBinary(join(root, 'electron', 'dist'));
+  if (!electron) throw new Error(`the runtime in ${root} has no Electron executable`);
+  return { appDir: join(root, 'app'), electron };
+}
+
+function killChild(child) {
+  if (!child || child.exitCode !== null || child.pid === undefined) return;
+  try { child.kill(); } catch { /* already gone */ }
+  if (process.platform === 'win32') spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore', windowsHide: true });
+}
+
+function bundleMtimeOf(appDir) {
+  try { return statSync(join(appDir, 'out', 'main', 'index.js')).mtimeMs; } catch { return 0; }
+}
+
+export function apply(ctx, config = {}) {
+  if (config.autoLaunch === false) return;
+  let child;
+  let launched = false;
+  let attempts = 0;
+  let timer;
+  let watcher;
+  let bundleStamp = 0;
+  let target = resolveInstalled(config);
+  let preparing = false;
+  let fatal;
+
+  const stopClock = () => {
+    if (timer) clearInterval(timer);
+    timer = undefined;
+  };
+
+  const startClock = () => {
+    if (!timer) timer = setInterval(tryLaunch, 250);
+  };
+
+  const useTarget = (next) => {
+    target = next;
+    bundleStamp = bundleMtimeOf(next.appDir);
+    startClock();
+  };
+
+  const prepare = () => {
+    if (preparing || target || fatal) return;
+    preparing = true;
+    fetchRuntime(config).then((next) => {
+      preparing = false;
+      console.info(`[dsh-glass-plugin] Glass runtime ready at ${next.appDir}`);
+      useTarget(next);
+    }, (error) => {
+      preparing = false;
+      fatal = `[dsh-glass-plugin] could not prepare the Glass runtime: ${describeError(error)}`;
+      console.warn(fatal);
+      stopClock();
+    });
+  };
+
+  const tryLaunch = () => {
+    if (fatal) return;
+    if (!target) {
+      // The npm build has no app yet: fetch it once, then keep waiting for the
+      // web server in the background instead of counting down against it.
+      prepare();
+      return;
+    }
+    attempts += 1;
+    if (attempts > 600) {
+      stopClock();
+      console.warn('[dsh-glass-plugin] no web server origin after 150s; the Glass companion was not started');
+      return;
+    }
+    let origin;
+    try { origin = ctx.webServer.getOrigin(); } catch { return; }
+    let link;
+    try { link = ctx.connection.authenticatedUrl(origin); } catch { return; }
+    if (!link || !/^https?:\/\//.test(link)) return;
+
+    const env = { ...process.env };
+    delete env.ELECTRON_RUN_AS_NODE;
+    const spawned = spawn(target.electron, [target.appDir, `--dsh-link=${link}`, `--launcher-pid=${process.pid}`], {
+      cwd: target.appDir,
+      detached: true,
+      stdio: 'ignore',
+      env,
+    });
+    child = spawned;
+    spawned.on('exit', () => { if (child === spawned) child = undefined; });
+    spawned.unref();
+    launched = true;
+    bundleStamp = bundleMtimeOf(target.appDir);
+    stopClock();
+    console.info('[dsh-glass-plugin] Glass desktop companion launched (authenticated link redacted)');
+  };
+
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => () => {
+      stopClock();
+      if (watcher) clearInterval(watcher);
+      watcher = undefined;
+      killChild(child);
+      child = undefined;
+    });
+  }
+
+  if (target) {
+    startClock();
+  } else {
+    prepare();
+  }
+
+  if (config.autoReload !== false) {
+    // Rebuild-and-reload loop: when the desktop bundle changes, relaunch the
+    // running companion with the current authenticated link. A user-initiated
+    // quit leaves `child` empty, so it is never resurrected by a build.
+    watcher = setInterval(() => {
+      if (!target) return;
+      const stamp = bundleMtimeOf(target.appDir);
+      if (!child || !stamp || bundleStamp === 0 || stamp === bundleStamp) return;
+      bundleStamp = stamp;
+      console.info('[dsh-glass-plugin] desktop bundle changed; relaunching the Glass companion');
+      killChild(child);
+      child = undefined;
+      launched = false;
+      startClock();
+    }, 1500);
+  }
+}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "dsh-glass-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.1",
+  "description": "Floating glass status bar for DeepSeek Harness: a frameless always-on-top window that shows session progress, pending approvals and questions.",
+  "license": "MIT",
+  "author": "wfz2006",
+  "type": "module",
+  "main": "lib/index.js",
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "glass",
+    "status-bar",
+    "desktop",
+    "electron",
+    "windows"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wfz2006/dsh-status-bar.git",
+    "directory": "packages/dsh-plugin"
+  },
+  "homepage": "https://github.com/wfz2006/dsh-status-bar",
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "assets",
+    "screenshots.json"
+  ],
+  "scripts": {
+    "pack:release": "node ../../scripts/pack-plugin-release.mjs"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "glass": {
+      "runtime": "https://github.com/wfz2006/dsh-status-bar/releases/latest/download/dsh-glass-plugin.tgz"
+    }
+  }
+}

package/screenshots.json

@@ -0,0 +1,7 @@
+[
+  "assets/capsule.png",
+  "assets/peek.png",
+  "assets/expanded.png",
+  "assets/approval.png",
+  "assets/settings.png"
+]