dsh-plugin-exe 0.1.1 → 0.2.0

package/README.md

@@ -61,6 +61,28 @@ exe trust <调用方地址>
 没有沙箱也没有确认；每次调用都是一次中继往返，能一条命令做完就别拆成十条；
 **状态为 `lost` 的调用可能已经执行过，不要盲目重试**。
 
+## 侧边栏页面
+
+装好后 dsh 的侧边栏会多一行 **eXe**（图标是一台设备的提示符），点开是一页：
+
+- **本机调用方地址** — 这台 harness 签名用的那把公钥地址，大字显示、可复制，下面直接给出
+  `exe trust <地址>`，抄到任意设备上执行即可。钥匙来源与中继入口也在这一行。
+- **本机作为设备** — 如果这台机器自己也跑着 `exe`（有 `config.toml`），显示它的地址，
+  以及**谁能在这台机器上执行命令**：信任列表逐条可取消，也可以加新地址（要填两遍，防手滑）。
+  设备每 2 秒热读配置，改完即生效，不用重启。
+- **可访问的设备** — 这台 harness 记得的设备（`mcp.toml` 的 `[devices]`），可加可删。
+  设备那侧还要把上面的调用方地址加进它的信任列表，两边都成立才通。
+
+页面读写的就是 `exe mcp` 和 `exe` 用的那两个文件（`~/.config/exe/mcp.toml`、
+`~/.config/exe/config.toml`），所以 `exe status`、`exe trust` 与这个页面永远说同一件事。
+写入是规范化的 TOML 重写（和 CLI 的行为一致，行内注释会丢），旧文件留在 `<文件名>.bak`。
+
+技术上它是这个包的第二半：`package.json` 里的 `dsh.client` 声明 + `./client` 导出，
+由 dsh 的模块系统作为浏览器插件加载；页面数据来自插件在 harness 自己的 web server 上
+注册的两条只读/单写路由（`/exe/api/state`、`/exe/api/edit`）。这两条路由**只接受同源请求**
+且**只接受 JSON**，跨源写一律 403——它们写的是你的配置，不是随便一个网页能碰的东西。
+没有 web server 的 profile（headless/tui）不会注册路由，三个工具照常工作。
+
 ## 配置
 
 装好后零配置即可用。需要改的时候，在自己的 profile 的 `cordis.patch.yml` 里覆盖，

package/lib/client.js

@@ -0,0 +1,415 @@
+window.__ModuleLoader__.load({ id: "dsh-plugin-exe", factory: (require) => { var module = { exports: {} }; var exports = module.exports;
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.tsx
+var index_exports = {};
+__export(index_exports, {
+  PANEL_ID: () => PANEL_ID,
+  apply: () => apply,
+  inject: () => inject
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/client/icon.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+function ExeIcon(props) {
+  const size = props.size ?? 18;
+  const opacity = props.active === false ? 0.72 : 1;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", "aria-hidden": "true", style: { opacity }, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("rect", { x: "3", y: "4.5", width: "18", height: "15", rx: "3", stroke: "currentColor", strokeWidth: "1.6" }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      "path",
+      {
+        d: "M7.5 10l2.6 2.1-2.6 2.1M12.4 14.4h4.1",
+        stroke: "currentColor",
+        strokeWidth: "1.6",
+        strokeLinecap: "round",
+        strokeLinejoin: "round"
+      }
+    )
+  ] });
+}
+
+// src/client/panel.tsx
+var import_react2 = require("react");
+
+// src/client/view.tsx
+var import_react = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var mono = "ui-monospace, SFMono-Regular, Menlo, Consolas, monospace";
+var border = "1px solid color-mix(in srgb, currentColor 16%, transparent)";
+var s = {
+  page: {
+    height: "100%",
+    overflowY: "auto",
+    padding: "24px 28px 48px",
+    fontSize: 13,
+    lineHeight: 1.55
+  },
+  header: {
+    display: "flex",
+    alignItems: "baseline",
+    gap: 12,
+    marginBottom: 4
+  },
+  title: { fontSize: 20, fontWeight: 600, margin: 0 },
+  subtitle: { opacity: 0.6 },
+  toolbar: { marginLeft: "auto", display: "flex", gap: 8 },
+  card: {
+    border,
+    borderRadius: 10,
+    padding: "16px 18px",
+    marginTop: 18,
+    display: "grid",
+    gap: 10
+  },
+  cardTitle: { fontSize: 13, fontWeight: 600, margin: 0, letterSpacing: "0.01em" },
+  hint: { opacity: 0.65, margin: 0 },
+  address: { fontFamily: mono, fontSize: 15, wordBreak: "break-all", letterSpacing: "0.01em" },
+  code: {
+    fontFamily: mono,
+    fontSize: 12.5,
+    background: "color-mix(in srgb, currentColor 7%, transparent)",
+    borderRadius: 6,
+    padding: "6px 8px",
+    overflowX: "auto",
+    whiteSpace: "pre"
+  },
+  row: {
+    display: "flex",
+    alignItems: "center",
+    gap: 10,
+    padding: "6px 0",
+    borderTop: "1px solid color-mix(in srgb, currentColor 10%, transparent)"
+  },
+  label: { minWidth: 96, fontWeight: 500 },
+  rowAddress: { fontFamily: mono, fontSize: 12, opacity: 0.85, wordBreak: "break-all", flex: 1 },
+  form: { display: "flex", flexWrap: "wrap", gap: 8, marginTop: 2 },
+  input: {
+    flex: "1 1 160px",
+    minWidth: 120,
+    padding: "6px 9px",
+    borderRadius: 6,
+    border,
+    background: "transparent",
+    color: "inherit",
+    font: "inherit"
+  },
+  button: {
+    padding: "5px 11px",
+    borderRadius: 6,
+    border,
+    background: "transparent",
+    color: "inherit",
+    font: "inherit",
+    cursor: "pointer"
+  },
+  primary: {
+    padding: "5px 12px",
+    borderRadius: 6,
+    border,
+    background: "color-mix(in srgb, currentColor 10%, transparent)",
+    color: "inherit",
+    font: "inherit",
+    cursor: "pointer"
+  },
+  danger: {
+    padding: "3px 9px",
+    borderRadius: 6,
+    border: "1px solid color-mix(in srgb, #d33 45%, transparent)",
+    background: "transparent",
+    color: "inherit",
+    font: "inherit",
+    cursor: "pointer"
+  },
+  banner: {
+    marginTop: 14,
+    border: "1px solid color-mix(in srgb, #d33 45%, transparent)",
+    borderRadius: 8,
+    padding: "9px 12px",
+    whiteSpace: "pre-wrap"
+  },
+  badge: { fontSize: 11, opacity: 0.6, fontFamily: mono }
+};
+function CopyButton({ value, label = "\u590D\u5236" }) {
+  const [copied, setCopied] = (0, import_react.useState)(false);
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+    "button",
+    {
+      type: "button",
+      style: s.button,
+      onClick: () => {
+        void navigator.clipboard?.writeText(value).then(() => {
+          setCopied(true);
+          setTimeout(() => setCopied(false), 1500);
+        }).catch(() => void 0);
+      },
+      children: copied ? "\u5DF2\u590D\u5236" : label
+    }
+  );
+}
+function AddForm(props) {
+  const [first, setFirst] = (0, import_react.useState)("");
+  const [second, setSecond] = (0, import_react.useState)("");
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
+    "form",
+    {
+      style: s.form,
+      onSubmit: (event) => {
+        event.preventDefault();
+        if (first.trim().length === 0 || second.trim().length === 0) return;
+        props.onSubmit(first.trim(), second.trim());
+        setFirst("");
+        setSecond("");
+      },
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+          "input",
+          {
+            style: s.input,
+            placeholder: props.first,
+            value: first,
+            disabled: props.busy,
+            onChange: (event) => setFirst(event.target.value),
+            "aria-label": props.first
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+          "input",
+          {
+            style: s.input,
+            placeholder: props.second,
+            value: second,
+            disabled: props.busy,
+            onChange: (event) => setSecond(event.target.value),
+            "aria-label": props.second
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { style: s.primary, type: "submit", disabled: props.busy, children: props.action })
+      ]
+    }
+  );
+}
+function Address({ value }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("code", { style: s.address, children: value });
+}
+function CallerCard(props) {
+  const { caller } = props.state;
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("section", { style: s.card, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h2", { style: s.cardTitle, children: "\u672C\u673A\u8C03\u7528\u65B9\u5730\u5740" }),
+    caller.address === void 0 ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { style: s.hint, children: "\u8FD8\u6CA1\u6709\u8C03\u7528\u65B9\u94A5\u5319\uFF0C\u5176\u5B83\u8BBE\u5907\u6682\u65F6\u65E0\u5904\u53EF\u4FE1\u4EFB\u3002" }),
+      caller.error !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { style: s.banner, children: caller.error }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("pre", { style: s.code, children: "exe mcp init" })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { style: s.hint, children: "\u628A\u8FD9\u884C\u5730\u5740\u52A0\u5230\u6BCF\u53F0\u8BBE\u5907\u4E0A\uFF08\u5728\u8BBE\u5907\u4E0A\u6267\u884C\uFF09\uFF0C\u5B83\u4EEC\u4FBF\u63A5\u53D7\u8FD9\u53F0 harness \u7684\u6307\u4EE4\u3002" }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { style: s.row, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Address, { value: caller.address }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(CopyButton, { value: caller.address })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("pre", { style: s.code, children: `exe trust ${caller.address}` }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("span", { style: s.badge, children: [
+        "\u94A5\u5319\u6765\u6E90\uFF1A",
+        caller.source ?? "\u2014",
+        " \xB7 \u4E2D\u7EE7\uFF1A",
+        caller.endpoints.join(" , ") || "\u2014"
+      ] })
+    ] })
+  ] });
+}
+function DeviceCard(props) {
+  const { device } = props.state;
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("section", { style: s.card, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h2", { style: s.cardTitle, children: "\u672C\u673A\u4F5C\u4E3A\u8BBE\u5907" }),
+    !device.available ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { style: s.hint, children: [
+        "\u8FD9\u53F0\u673A\u5668\u8FD8\u4E0D\u662F eXe \u8BBE\u5907\uFF08\u6CA1\u6709 ",
+        device.path,
+        "\uFF09\u3002"
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("pre", { style: s.code, children: "exe" })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+      device.address !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { style: s.hint, children: "\u5B83\u7684\u5730\u5740\u2014\u2014\u5176\u5B83\u8C03\u7528\u65B9\u8981 reach \u5B83\uFF0C\u5C31\u586B\u8FD9\u4E32\u3002" }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { style: s.row, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Address, { value: device.address }),
+          /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(CopyButton, { value: device.address })
+        ] })
+      ] }),
+      device.error !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { style: s.banner, children: device.error }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("p", { style: s.hint, children: [
+        "\u4FE1\u4EFB\u7684\u8C03\u7528\u65B9\uFF08",
+        device.trust.length,
+        "\uFF09\uFF1A\u53EA\u6709\u8FD9\u91CC\u7684\u5730\u5740\u80FD\u5728\u8FD9\u53F0\u673A\u5668\u4E0A\u6267\u884C\u547D\u4EE4\u3002\u8BBE\u5907\u6BCF 2 \u79D2\u70ED\u8BFB\u914D\u7F6E\uFF0C\u6539\u5B8C\u5373\u751F\u6548\u3002"
+      ] }),
+      device.trust.length === 0 && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.badge, children: "\u8FD8\u6CA1\u6709\u4FE1\u4EFB\u4EFB\u4F55\u8C03\u7528\u65B9" }),
+      device.trust.map((address) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { style: s.row, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.rowAddress, children: address }),
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+          "button",
+          {
+            type: "button",
+            style: s.danger,
+            disabled: props.busy,
+            onClick: () => props.onEdit({ op: "trust.remove", address }),
+            children: "\u53D6\u6D88\u4FE1\u4EFB"
+          }
+        )
+      ] }, address)),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+        AddForm,
+        {
+          busy: props.busy,
+          first: "\u8C03\u7528\u65B9\u5730\u5740\uFF08base58\uFF09",
+          second: "\u518D\u586B\u4E00\u6B21\u4EE5\u786E\u8BA4",
+          action: "\u4FE1\u4EFB",
+          onSubmit: (address, confirm) => {
+            if (address !== confirm) return;
+            props.onEdit({ op: "trust.add", address });
+          }
+        }
+      )
+    ] })
+  ] });
+}
+function DevicesCard(props) {
+  const { devices } = props.state;
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("section", { style: s.card, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h2", { style: s.cardTitle, children: "\u53EF\u8BBF\u95EE\u7684\u8BBE\u5907" }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { style: s.hint, children: "\u8FD9\u53F0 harness \u8BB0\u5F97\u7684\u8BBE\u5907\uFF08\u5199\u6210\u6807\u7B7E\uFF0C\u6A21\u578B\u8C03\u7528\u65F6\u7528\u5B83\uFF09\u3002\u8BBE\u5907\u90A3\u4FA7\u8FD8\u8981\u628A\u8FD9\u4E2A\u9875\u9762\u4E0A\u7684\u8C03\u7528\u65B9\u5730\u5740\u52A0\u8FDB\u5B83\u7684\u4FE1\u4EFB\u5217\u8868\u3002" }),
+    devices.length === 0 && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.badge, children: "\u8FD8\u6CA1\u6709\u914D\u7F6E\u8BBE\u5907" }),
+    devices.map((row) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { style: s.row, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.label, children: row.label }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.rowAddress, children: row.address }),
+      row.source === "config" ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.badge, children: "\u6765\u81EA\u63D2\u4EF6\u914D\u7F6E" }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+        "button",
+        {
+          type: "button",
+          style: s.danger,
+          disabled: props.busy,
+          onClick: () => props.onEdit({ op: "device.remove", label: row.label }),
+          children: "\u79FB\u9664"
+        }
+      )
+    ] }, row.label)),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
+      AddForm,
+      {
+        busy: props.busy,
+        first: "\u6807\u7B7E\uFF08\u5982 macmini\uFF09",
+        second: "\u8BBE\u5907\u5730\u5740\uFF08base58\uFF09",
+        action: "\u6DFB\u52A0",
+        onSubmit: (label, address) => props.onEdit({ op: "device.set", label, address })
+      }
+    )
+  ] });
+}
+function ExeView(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { style: s.page, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("header", { style: s.header, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h1", { style: s.title, children: "eXe" }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.subtitle, children: "\u8FD9\u53F0 harness \u7684\u94A5\u5319\uFF0C\u4E0E\u5B83\u591F\u5F97\u7740\u7684\u8BBE\u5907" }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: s.toolbar, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", style: s.button, onClick: props.onReload, disabled: props.busy, children: props.busy ? "\u5904\u7406\u4E2D\u2026" : "\u5237\u65B0" }) })
+    ] }),
+    props.error !== null && /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { style: s.banner, children: props.error }),
+    props.state === null ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { style: s.hint, children: "\u8F7D\u5165\u4E2D\u2026" }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(CallerCard, { state: props.state, busy: props.busy }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(DeviceCard, { state: props.state, busy: props.busy, onEdit: props.onEdit }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(DevicesCard, { state: props.state, busy: props.busy, onEdit: props.onEdit })
+    ] })
+  ] });
+}
+
+// src/client/panel.tsx
+var import_jsx_runtime3 = require("react/jsx-runtime");
+var STATE_URL = "/exe/api/state";
+var EDIT_URL = "/exe/api/edit";
+function reason(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function failure(response) {
+  try {
+    const body = await response.json();
+    if (typeof body.error === "string" && body.error.length > 0) return body.error;
+  } catch {
+  }
+  return `\u8BF7\u6C42\u5931\u8D25\uFF08HTTP ${response.status}\uFF09`;
+}
+function ExePanel() {
+  const [state, setState] = (0, import_react2.useState)(null);
+  const [error, setError] = (0, import_react2.useState)(null);
+  const [busy, setBusy] = (0, import_react2.useState)(false);
+  const load = (0, import_react2.useCallback)(async () => {
+    try {
+      const response = await fetch(STATE_URL, { cache: "no-store", headers: { accept: "application/json" } });
+      if (!response.ok) throw new Error(await failure(response));
+      setState(await response.json());
+      setError(null);
+    } catch (loadError) {
+      setError(reason(loadError));
+    }
+  }, []);
+  (0, import_react2.useEffect)(() => {
+    void load();
+  }, [load]);
+  const edit = (0, import_react2.useCallback)((op) => {
+    void (async () => {
+      setBusy(true);
+      try {
+        const response = await fetch(EDIT_URL, {
+          method: "POST",
+          headers: { "content-type": "application/json", accept: "application/json" },
+          body: JSON.stringify(op)
+        });
+        if (!response.ok) throw new Error(await failure(response));
+        setState(await response.json());
+        setError(null);
+      } catch (editError) {
+        setError(reason(editError));
+      } finally {
+        setBusy(false);
+      }
+    })();
+  }, []);
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
+    ExeView,
+    {
+      state,
+      error,
+      busy,
+      onEdit: edit,
+      onReload: () => {
+        void load();
+      }
+    }
+  );
+}
+
+// src/client/index.tsx
+var inject = ["slots"];
+var PANEL_ID = "exe";
+function apply(ctx) {
+  ctx.slots.inject("main", () => ctx.slots.register({ name: "main", key: PANEL_ID }, ExePanel));
+  ctx.slots.inject(
+    "sidebar.panellist",
+    () => ctx.slots.register({ name: "sidebar.panellist", id: PANEL_ID, order: 40, label: "eXe" }, ExeIcon)
+  );
+}
+return module.exports; } });

package/lib/index.js

@@ -765,7 +765,190 @@ function parse(toml, options = {}) {
 }
 
 // ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/stringify.js
+var BARE_KEY = /^[a-z0-9-_]+$/i;
 var HAS_WELLFORMED = !!"".isWellFormed;
+function extendedTypeOf(obj) {
+  let type = typeof obj;
+  if (type === "object") {
+    if (Array.isArray(obj))
+      return "array";
+    if (typeof obj.getUTCDate === "function" && obj instanceof Date)
+      return "date";
+    if (globalThis.Temporal) {
+      if (obj.until) {
+        if (obj instanceof Temporal.ZonedDateTime)
+          return "temporal/tz+uc";
+        if (obj instanceof Temporal.PlainDateTime || obj instanceof Temporal.PlainDate)
+          return "temporal/uc";
+        if (obj instanceof Temporal.PlainTime || obj instanceof Temporal.Instant)
+          return "temporal";
+        if (obj instanceof Temporal.PlainYearMonth)
+          return "temporal/x";
+      } else if (obj.toPlainDate && obj instanceof Temporal.PlainMonthDay || obj.negated && obj instanceof Temporal.Duration) {
+        return "temporal/x";
+      }
+    }
+  }
+  return type;
+}
+function isArrayOfTables(obj) {
+  for (let i = 0; i < obj.length; i++) {
+    if (extendedTypeOf(obj[i]) !== "object")
+      return false;
+  }
+  return obj.length != 0;
+}
+function formatWellFormedStringUnchecked(s) {
+  return JSON.stringify(s).replaceAll("\x7F", "\\u007f");
+}
+function formatString(s) {
+  return formatWellFormedStringUnchecked(HAS_WELLFORMED ? s.toWellFormed() : s);
+}
+function formatKey(s) {
+  if (BARE_KEY.test(s))
+    return s;
+  if (HAS_WELLFORMED && !s.isWellFormed())
+    throw new RangeError("key contains illegal lone surrogates");
+  return formatWellFormedStringUnchecked(s);
+}
+function stringifyValue(val, type, depth, numberAsFloat, strictTemporal) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  switch (type) {
+    // @ts-expect-error -- intentional fallthrough case
+    case "number":
+      if (isNaN(val))
+        return "nan";
+      if (val === Infinity)
+        return "inf";
+      if (val === -Infinity)
+        return "-inf";
+      if (Number.isInteger(val) && (numberAsFloat || !Number.isSafeInteger(val)))
+        return val.toFixed(1);
+    case "bigint":
+    case "boolean":
+    case "temporal":
+      return val.toString();
+    case "string":
+      return formatString(val);
+    case "date":
+      if (isNaN(val.getTime()))
+        throw new TypeError("cannot serialize invalid date");
+      return val.toISOString();
+    case "object":
+      return stringifyInlineTable(val, depth, numberAsFloat, strictTemporal);
+    case "array":
+      return stringifyArray(val, depth, numberAsFloat, strictTemporal);
+    // @ts-expect-error -- intentional fallthrough case
+    case "temporal/tz+uc":
+      if (strictTemporal) {
+        let tz = val.timeZoneId;
+        let tzc = tz.charCodeAt(0);
+        if (
+          // Classic offset
+          tzc !== 43 && tzc !== 45 && // Fast pre-check pass; see below for the actually accepted values
+          (tzc !== 85 && tzc !== 71 && tzc !== 90 && tzc !== 69 || // UTC and its aliases; Temporal implementations don't all canonicalise unfortunately
+          tz !== "UTC" && tz !== "UCT" && tz !== "Universal" && tz !== "Zulu" && // GMT is a TZ but it's for all intents and purposes equivalent to UTC. Safe to downgrade.
+          !tz.startsWith("GMT") && tz !== "Greenwich" && // Etc/* are all safe to downgrade to offset (either UTC, GMT, or offset)
+          !tz.startsWith("Etc/"))
+        ) {
+          throw new TypeError("Temporal objects with an IANA timezone are not allowed in Temporal strict mode");
+        }
+      }
+    case "temporal/uc":
+      if (strictTemporal && val.calendarId !== "iso8601")
+        throw new TypeError("Temporal objects with a non-default calendar are not allowed in Temporal strict mode");
+      return val.toString({
+        calendarName: "never",
+        timeZoneName: "never"
+      });
+    case "temporal/x":
+      throw new TypeError("Unsupported " + val[Symbol.toStringTag]);
+  }
+}
+function stringifyInlineTable(obj, depth, numberAsFloat, strictTemporal) {
+  let keys = Object.keys(obj);
+  if (keys.length === 0)
+    return "{}";
+  let res = "{ ";
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (i)
+      res += ", ";
+    res += formatKey(k) + " = " + stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat, strictTemporal);
+  }
+  return res + " }";
+}
+function stringifyArray(array, depth, numberAsFloat, strictTemporal) {
+  if (array.length === 0)
+    return "[]";
+  let res = "[ ";
+  for (let i = 0; i < array.length; i++) {
+    if (i)
+      res += ", ";
+    if (array[i] === null || array[i] === void 0) {
+      throw new TypeError("arrays cannot contain null or undefined values");
+    }
+    res += stringifyValue(array[i], extendedTypeOf(array[i]), depth - 1, numberAsFloat, strictTemporal);
+  }
+  return res + " ]";
+}
+function stringifyArrayTable(array, key, depth, numberAsFloat, strictTemporal) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let res = "";
+  for (let i = 0; i < array.length; i++) {
+    res += `${res && "\n"}[[${key}]]
+`;
+    res += stringifyTable(0, array[i], key, depth, numberAsFloat, strictTemporal);
+  }
+  return res;
+}
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat, strictTemporal) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let preamble = "";
+  let tables = "";
+  let keys = Object.keys(obj);
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (obj[k] !== null && obj[k] !== void 0) {
+      let type = extendedTypeOf(obj[k]);
+      if (type === "symbol" || type === "function") {
+        throw new TypeError(`cannot serialize values of type '${type}'`);
+      }
+      let key = formatKey(k);
+      if (type === "array" && isArrayOfTables(obj[k])) {
+        tables += (tables && "\n") + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat, strictTemporal);
+      } else if (type === "object") {
+        let tblKey = prefix ? `${prefix}.${key}` : key;
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat, strictTemporal);
+      } else {
+        preamble += key;
+        preamble += " = ";
+        preamble += stringifyValue(obj[k], type, depth, numberAsFloat, strictTemporal);
+        preamble += "\n";
+      }
+    }
+  }
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
+}
+function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false, strictTemporal = false } = {}) {
+  if (extendedTypeOf(obj) !== "object") {
+    throw new TypeError("stringify can only be called with an object");
+  }
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat, strictTemporal);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
+}
 
 // ../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js
 var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
@@ -4322,12 +4505,18 @@ function openResult(input) {
 
 // src/config.ts
 var DEFAULT_ENDPOINTS = ["https://exe.ntnl.io", "https://exe.ntnl.top"];
-function defaultConfigPath(env = process.env) {
+function configDir(env = process.env) {
   const override = env.EXE_CONFIG_DIR?.trim();
-  if (override) return join(override, "mcp.toml");
-  if (process.platform === "win32" && env.APPDATA?.trim()) return join(env.APPDATA.trim(), "exe", "mcp.toml");
+  if (override) return override;
+  if (process.platform === "win32" && env.APPDATA?.trim()) return join(env.APPDATA.trim(), "exe");
   const home = env.HOME?.trim() || env.USERPROFILE?.trim() || homedir();
-  return join(home, ".config", "exe", "mcp.toml");
+  return join(home, ".config", "exe");
+}
+function defaultConfigPath(env = process.env) {
+  return join(configDir(env), "mcp.toml");
+}
+function deviceConfigPath(env = process.env) {
+  return join(configDir(env), "config.toml");
 }
 function splitEndpoints(value) {
   const entries = Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
@@ -4628,6 +4817,233 @@ var Relay = class {
   }
 };
 
+// src/routes.ts
+var ROUTE_PREFIX = "/exe/api";
+var MAX_BODY_BYTES = 64 * 1024;
+function send(res, status, body) {
+  const text2 = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(text2),
+    "cache-control": "no-store"
+  });
+  res.end(text2);
+}
+function sameOrigin(req) {
+  const origin = req.headers.origin;
+  if (origin === void 0) return true;
+  const host = req.headers.host;
+  if (host === void 0) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+async function readJson(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.length;
+    if (size > MAX_BODY_BYTES) throw new Error("request body is too large");
+    chunks.push(buffer);
+  }
+  const text2 = Buffer.concat(chunks).toString("utf8").trim();
+  if (text2.length === 0) throw new Error("empty request body");
+  try {
+    return JSON.parse(text2);
+  } catch (error) {
+    throw new Error(`body is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function registerExeRoutes(webServer, store) {
+  const handler = async (req, res) => {
+    try {
+      if (!sameOrigin(req)) {
+        send(res, 403, { error: "cross-origin request refused" });
+        return;
+      }
+      const url = new URL(req.url ?? "/", "http://localhost");
+      if (url.pathname === `${ROUTE_PREFIX}/state`) {
+        if (req.method !== "GET") {
+          send(res, 405, { error: "use GET" });
+          return;
+        }
+        send(res, 200, store.state());
+        return;
+      }
+      if (url.pathname === `${ROUTE_PREFIX}/edit`) {
+        if (req.method !== "POST") {
+          send(res, 405, { error: "use POST" });
+          return;
+        }
+        if (!(req.headers["content-type"] ?? "").includes("application/json")) {
+          send(res, 415, { error: "send application/json" });
+          return;
+        }
+        const body = await readJson(req);
+        if (typeof body !== "object" || body === null || typeof body.op !== "string") {
+          send(res, 400, { error: "an edit names its `op`" });
+          return;
+        }
+        send(res, 200, store.edit(body));
+        return;
+      }
+      send(res, 404, { error: `no route for ${req.method} ${url.pathname}` });
+    } catch (error) {
+      send(res, 400, { error: error instanceof Error ? error.message : String(error) });
+    }
+  };
+  return webServer.register({ kind: "prefix", path: ROUTE_PREFIX, handler });
+}
+
+// src/state.ts
+import { copyFileSync, existsSync as existsSync2, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+function reason2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function readToml(path) {
+  if (!existsSync2(path)) return void 0;
+  try {
+    return parse(readFileSync2(path, "utf8"));
+  } catch (error) {
+    throw new Error(`${path} is not valid TOML: ${reason2(error)}`);
+  }
+}
+function writeToml(path, value) {
+  const text2 = stringify(value);
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, text2, { mode: 384 });
+  if (existsSync2(path)) copyFileSync(path, `${path}.bak`);
+  renameSync(temporary, path);
+}
+function labelOf(value) {
+  const label = typeof value === "string" ? value.trim() : "";
+  if (label.length === 0 || label.length > 64 || /[\u0000-\u001f]/.test(label)) {
+    throw new Error("a device label is 1 to 64 printable characters");
+  }
+  return label;
+}
+function addressOfText(value) {
+  const address = typeof value === "string" ? value.trim() : "";
+  if (!isAddress(address)) {
+    throw new Error(`not an eXe address: ${JSON.stringify(address)}`);
+  }
+  return address;
+}
+function trustOf(file) {
+  const trust = file?.trust;
+  if (trust === void 0) return [];
+  if (!Array.isArray(trust)) throw new Error("`trust` in the device config must be a list of addresses");
+  return trust.filter((entry) => typeof entry === "string");
+}
+function createStateStore(options = {}, env = process.env) {
+  const callerPath = options.configPath?.trim() || defaultConfigPath(env);
+  const devicePath = deviceConfigPath(env);
+  const inline = options.devices ?? {};
+  const callerView = () => {
+    const view = { endpoints: [], configPath: callerPath };
+    try {
+      const file = readToml(callerPath);
+      const inlineSecret = options.secret?.trim();
+      const secret = inlineSecret ?? (typeof file?.secret === "string" ? file.secret.trim() : void 0);
+      if (secret === void 0 || secret.length === 0) {
+        view.error = `no caller key yet: run \`exe mcp init\`, or set \`secret\` in this plugin's config`;
+        return view;
+      }
+      view.address = addressOf(decodeSecret(secret));
+      view.source = inlineSecret === void 0 ? callerPath : "plugin config";
+      view.endpoints = splitEndpoints(options.endpoints).length > 0 ? splitEndpoints(options.endpoints) : splitEndpoints(file?.endpoints).length > 0 ? splitEndpoints(file?.endpoints) : splitEndpoints(file?.cloud);
+    } catch (error) {
+      view.error = reason2(error);
+    }
+    return view;
+  };
+  const devicesView = () => {
+    const rows = [];
+    try {
+      const table = readToml(callerPath)?.devices;
+      if (table !== void 0 && (typeof table !== "object" || table === null || Array.isArray(table))) {
+        throw new Error("`devices` in the caller config must be a table of label = address");
+      }
+      for (const [label, address] of Object.entries(table ?? {})) {
+        if (typeof address === "string") rows.push({ label, address, source: "file" });
+      }
+    } catch {
+    }
+    for (const [label, address] of Object.entries(inline)) {
+      if (rows.some((row) => row.label === label)) continue;
+      rows.push({ label, address, source: "config" });
+    }
+    return rows.sort((left, right) => left.label.localeCompare(right.label));
+  };
+  const deviceView = () => {
+    const view = { available: false, path: devicePath, endpoints: [], trust: [] };
+    if (!existsSync2(devicePath)) return view;
+    view.available = true;
+    try {
+      const file = readToml(devicePath);
+      const secret = typeof file?.secret === "string" ? file.secret.trim() : "";
+      if (secret.length === 0) throw new Error(`${devicePath} has no secret`);
+      view.address = addressOf(decodeSecret(secret));
+      view.endpoints = splitEndpoints(file?.endpoints).length > 0 ? splitEndpoints(file?.endpoints) : splitEndpoints(file?.cloud);
+      view.trust = trustOf(file);
+    } catch (error) {
+      view.error = reason2(error);
+    }
+    return view;
+  };
+  const state = () => ({ caller: callerView(), devices: devicesView(), device: deviceView() });
+  const edit = (op) => {
+    switch (op.op) {
+      case "device.set": {
+        const label = labelOf(op.label);
+        const address = addressOfText(op.address);
+        if (Object.hasOwn(inline, label)) {
+          throw new Error(`\`${label}\` is set in this plugin's own config; change it there, not in ${callerPath}`);
+        }
+        const file = readToml(callerPath) ?? {};
+        const table = file.devices;
+        const devices = typeof table === "object" && table !== null && !Array.isArray(table) ? { ...table } : {};
+        devices[label] = address;
+        writeToml(callerPath, { ...file, devices });
+        break;
+      }
+      case "device.remove": {
+        const label = labelOf(op.label);
+        if (Object.hasOwn(inline, label)) {
+          throw new Error(`\`${label}\` is set in this plugin's own config; remove it there, not in ${callerPath}`);
+        }
+        const file = readToml(callerPath);
+        if (file === void 0) throw new Error(`no caller config at ${callerPath}`);
+        const devices = { ...file.devices ?? {} };
+        delete devices[label];
+        writeToml(callerPath, { ...file, devices });
+        break;
+      }
+      case "trust.add":
+      case "trust.remove": {
+        const address = addressOfText(op.address);
+        const file = readToml(devicePath);
+        if (file === void 0) {
+          throw new Error(`this machine is not an eXe device: ${devicePath} does not exist (run \`exe\`)`);
+        }
+        const trust = trustOf(file);
+        const next = op.op === "trust.add" ? [.../* @__PURE__ */ new Set([...trust, address])] : trust.filter((entry) => entry !== address);
+        writeToml(devicePath, { ...file, trust: next });
+        break;
+      }
+      default: {
+        const never = op;
+        throw new Error(`unknown edit ${JSON.stringify(never)}`);
+      }
+    }
+    return state();
+  };
+  return { state, edit };
+}
+
 // src/answers.ts
 function whole(outcome) {
   if (outcome.attachment !== void 0) {
@@ -4728,7 +5144,7 @@ var Config = Schema.object({
 function shQuote(value) {
   return `'${value.replaceAll("'", `'\\''`)}'`;
 }
-function reason2(error) {
+function reason3(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function mediaTypeOf(bytes, path, allowed) {
@@ -4823,7 +5239,7 @@ function apply(ctx, config) {
               if (status.last_seen_at !== void 0) row.last_seen_at = status.last_seen_at;
               return row;
             } catch (error) {
-              return { device: label, address, error: reason2(error) };
+              return { device: label, address, error: reason3(error) };
             }
           })
         );
@@ -4975,6 +5391,11 @@ function apply(ctx, config) {
       }
     })
   );
+  ctx.inject(["webServer"], (scoped) => {
+    const webServer = scoped.webServer;
+    const store = createStateStore(config);
+    scoped.effect(() => registerExeRoutes(webServer, store), "dsh-plugin-exe: panel routes");
+  });
 }
 export {
   Config,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-exe",
-  "version": "0.1.1",
-  "description": "Operate your own devices from DeepSeek Harness through eXe: a shell on remote machines, screenshots as images",
+  "version": "0.2.0",
+  "description": "eXe for DeepSeek Harness: shell and screenshots on your own devices, plus a sidebar page that carries the caller key other devices must trust",
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -18,16 +18,22 @@
     "directory": "plugins/dsh"
   },
   "exports": {
-    ".": "./lib/index.js"
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js"
   },
   "files": [
     "lib/index.js",
+    "lib/client.js",
     "cordis.patch.yml",
     "README.md"
   ],
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": []
     }
   },
   "engines": {
@@ -35,7 +41,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.client.json",
     "test": "node --experimental-strip-types --test tests/*.test.ts",
     "check": "pnpm build && pnpm typecheck && pnpm test"
   },
@@ -58,7 +64,11 @@
     "@noble/curves": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@types/node": "^24.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
     "esbuild": "^0.28.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
     "smol-toml": "^1.9.1",
     "typescript": "^7.0.2"
   }