dsh-plugin-marketplace 0.1.1 → 0.2.2

package/client.js

@@ -19,6 +19,7 @@ window.__ModuleLoader__.load({
 
     // ── CSS (theme tokens) ────────────────────────────────────────────────
     var CSS = ".__mp_grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:10px;padding:0;margin:0;list-style:none}" +
+      ".__mp_item{display:flex;flex-direction:column;gap:8px}" +
       ".__mp_card{border:1px solid var(--dsw-alias-border-l2);border-radius:10px;padding:12px 14px;display:flex;flex-direction:column;gap:6px;background:var(--dsw-alias-bg-layer-2);cursor:pointer;text-align:left;font:inherit;color:inherit}" +
       ".__mp_card:hover{border-color:var(--dsw-alias-brand-primary)}" +
       ".__mp_cardHead{display:flex;align-items:center;gap:8px;min-width:0}" +
@@ -38,6 +39,7 @@ window.__ModuleLoader__.load({
       ".__mp_readme{font-size:12px;line-height:1.6;color:var(--dsw-alias-label-secondary);white-space:pre-wrap;word-break:break-word;max-height:260px;overflow:auto;width:100%;box-sizing:border-box;min-width:0}" +
       ".__mp_code{display:block;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:6px;padding:8px 10px;font-family:ui-monospace,Consolas,monospace;font-size:12px;color:var(--dsw-alias-label-primary);white-space:pre-wrap;word-break:break-all;width:100%;box-sizing:border-box;min-width:0}" +
       ".__mp_link{color:var(--dsw-alias-brand-primary);font-size:12px;text-decoration:none}" +
+      ".__mp_btnPrimary{border-color:var(--dsw-alias-state-business-primary, #679efe);background:var(--dsw-alias-state-business-primary, #679efe);color:#fff}" +
       ".__mp_error{color:var(--dsw-alias-label-error);font-size:12px;margin:8px 0 0}";
     var tagId = "dsh-plugin-marketplace/main.css";
     if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
@@ -50,7 +52,7 @@ window.__ModuleLoader__.load({
 
     // ── locale ────────────────────────────────────────────────────────────
     var NS = "marketplace";
-    var inject = ["slots", "locale"];
+    var inject = ["slots", "locale", "settingsScope", "connection"];
     var zh = {
       nav: "插件市场",
       search: "搜索插件（关键词或留空浏览全部）…",
@@ -68,7 +70,14 @@ window.__ModuleLoader__.load({
       openNpm: "在 npm 搜索同名包 ↗",
       updated: "更新",
       total: "共 {count} 个插件",
-      ghError: "GitHub API 请求失败（未认证限流 60 次/小时），请稍后再试"
+      ghError: "GitHub API 请求失败（未认证限流 60 次/小时），请稍后再试",
+      installBtn: "一键安装",
+      confirmInstall: "确认安装 {pkg}？",
+      installing: "安装中…",
+      installOk: "已安装：{msg}",
+      installErr: "安装失败：{msg}",
+      installIdle: "",
+      installingHint: "正在后台执行 dsh plugin add，请稍候…"
     };
     var en = {
       nav: "Plugin Marketplace",
@@ -87,7 +96,14 @@ window.__ModuleLoader__.load({
       openNpm: "Search npm ↗",
       updated: "Updated",
       total: "{count} plugins",
-      ghError: "GitHub API rate-limited (60/hr unauthenticated), try again later"
+      ghError: "GitHub API rate-limited (60/hr unauthenticated), try again later",
+      installBtn: "Install",
+      confirmInstall: "Install {pkg}?",
+      installing: "Installing…",
+      installOk: "Installed: {msg}",
+      installErr: "Install failed: {msg}",
+      installIdle: "",
+      installingHint: "Running dsh plugin add in the background…"
     };
 
     // ── GitHub API ────────────────────────────────────────────────────────
@@ -128,7 +144,11 @@ window.__ModuleLoader__.load({
     async function fetchReadme(fullName) {
       var url = "https://api.github.com/repos/" + fullName + "/readme";
       var res = await fetch(url, { headers: { Accept: "application/vnd.github+json" } });
-      if (!res.ok) throw new Error("no readme");
+      if (!res.ok) {
+        var e = new Error("readme http " + res.status);
+        e.status = res.status;
+        throw e;
+      }
       var data = await res.json();
       var bin = atob(data.content.replace(/\s+/g, ""));
       var bytes = new Uint8Array(bin.length);
@@ -156,6 +176,32 @@ window.__ModuleLoader__.load({
     function DetailPanel(props) {
       var p = props.plugin;
       var installName = p.fullName.split("/")[1];
+      var st = props.installState; // {status, message, pkg} from the settings scope
+      var active = st && st.pkg === installName;
+      var status = active ? st.status : "idle";
+      var [confirming, setConfirming] = react.useState(false);
+      var statusNode = null;
+      if (status === "running") {
+        statusNode = h("div", { className: "__mp_status" }, props.t("installingHint"));
+      } else if (status === "ok") {
+        statusNode = h("div", { className: "__mp_status" }, props.t("installOk").replace("{msg}", st.message || ""));
+      } else if (status === "error") {
+        statusNode = h("div", { className: "__mp_error" }, props.t("installErr").replace("{msg}", st.message || ""));
+      }
+      var btn;
+      if (status === "running") {
+        btn = h("button", { type: "button", className: "__mp_more", disabled: true }, props.t("installing"));
+      } else if (confirming) {
+        btn = h("button", {
+          type: "button", className: "__mp_btnPrimary __mp_more",
+          onClick: function () { setConfirming(false); props.onInstall(installName); }
+        }, props.t("confirmInstall").replace("{pkg}", installName));
+      } else {
+        btn = h("button", {
+          type: "button", className: "__mp_btnPrimary __mp_more",
+          onClick: function () { setConfirming(true); }
+        }, props.t("installBtn"));
+      }
       return h("div", { className: "__mp_detail" },
         h("div", { className: "__mp_detailTitle" }, p.fullName),
         h("div", { className: "__mp_meta" },
@@ -175,9 +221,12 @@ window.__ModuleLoader__.load({
           "# then in $DSH_HOME/profiles/web/cordis.patch.yml:\n" +
           "- insert:\n    - id: " + installName + "\n      name: '" + installName + "'"
         ),
+        btn,
+        statusNode,
         h("div", { className: "__mp_detailTitle" }, props.t("readme")),
         h("div", { className: "__mp_readme" },
           props.readmeLoading ? props.t("loading")
+            : props.readmeRateLimited ? props.ghError
             : props.readmeError ? props.t("readmeEmpty")
             : (props.readme || "")
         )
@@ -186,8 +235,33 @@ window.__ModuleLoader__.load({
 
     function MarketplaceSection(props) {
       var t = props.t;
-      var state = react.useState({ q: "", sort: "stars", page: 1, items: [], loading: false, error: null, total: 0, open: null, readme: null, readmeLoading: false, readmeError: false });
+      var scope = props.scope;
+      var api = props.api;
+      var state = react.useState({ q: "", sort: "stars", page: 1, items: [], loading: false, error: null, total: 0, open: null, readme: null, readmeLoading: false, readmeError: false, readmeRateLimited: false });
       var s = state[0], set = state[1];
+      // install-state subscription (stable pattern: useState + subscribe, never
+      // depend on getSnapshot() reference identity).
+      var [installState, setInstallState] = react.useState(null);
+      react.useEffect(function () {
+        var alive = true;
+        var sync = function () { if (alive) setInstallState(scope.getSnapshot()); };
+        sync();
+        var un = typeof scope.subscribe === "function" ? scope.subscribe(sync) : null;
+        return function () { alive = false; if (un) un(); if (scope.dispose) scope.dispose(); };
+      }, [scope]);
+      var onInstall = react.useCallback(function (pkg) {
+        api.settings.mutate({
+          ns: "plugin-marketplace",
+          ops: [{ op: "set", path: ["install"], value: { pkg: pkg, ts: Date.now() } }]
+        }).then(function (response) {
+          if (!response.result.ok) {
+            var detail = response.result.error || {};
+            set(function (prev) { return Object.assign({}, prev, { installError: String(detail.message || detail.code || "unknown") }); });
+          }
+        }).catch(function (e) {
+          set(function (prev) { return Object.assign({}, prev, { installError: String(e && e.message || e) }); });
+        });
+      }, [api]);
       var load = react.useCallback(function (q, sort, page, append) {
         set(function (prev) { return Object.assign({}, prev, { loading: true, error: null }); });
         fetchPage(q, sort, page).then(function (out) {
@@ -204,16 +278,23 @@ window.__ModuleLoader__.load({
       }, [load]);
       var openDetail = react.useCallback(function (plugin) {
         if (s.open && s.open.fullName === plugin.fullName) { set(function (prev) { return Object.assign({}, prev, { open: null }); }); return; }
-        set(function (prev) { return Object.assign({}, prev, { open: plugin, readme: null, readmeError: false, readmeLoading: true }); });
+        set(function (prev) { return Object.assign({}, prev, { open: plugin, readme: null, readmeError: false, readmeRateLimited: false, readmeLoading: true }); });
+        // Detail expands inline under the clicked card; scroll minimally
+        // (nearest) only when it would fall outside the viewport.
+        setTimeout(function () {
+          var el = document.querySelector(".__mp_detail");
+          if (el) el.scrollIntoView({ behavior: "smooth", block: "nearest" });
+        }, 50);
         fetchReadme(plugin.fullName).then(function (text) {
           set(function (prev) {
             if (!prev.open || prev.open.fullName !== plugin.fullName) return prev;
-            return Object.assign({}, prev, { readme: text.slice(0, 1200), readmeLoading: false });
+            return Object.assign({}, prev, { readme: text.slice(0, 1200), readmeLoading: false, readmeError: false, readmeRateLimited: false });
           });
-        }).catch(function () {
+        }).catch(function (err) {
           set(function (prev) {
             if (!prev.open || prev.open.fullName !== plugin.fullName) return prev;
-            return Object.assign({}, prev, { readmeLoading: false, readmeError: true });
+            var rateLimited = err && (err.status === 403 || err.status === 429);
+            return Object.assign({}, prev, { readmeLoading: false, readmeError: !rateLimited, readmeRateLimited: rateLimited });
           });
         });
       }, [s.open]);
@@ -232,13 +313,21 @@ window.__ModuleLoader__.load({
         ),
         s.total > 0 ? h("p", { className: "__mp_status" }, t("total").replace("{count}", String(s.total))) : null,
         h("ul", { className: "__mp_grid" },
-          s.items.map(function (p) { return h(PluginCard, { key: p.fullName, plugin: p, t: t, onOpen: function () { openDetail(p); } }); })
+          s.items.map(function (p) {
+            // Detail expands INLINE right under the clicked card, so there is
+            // no jumping around the page.
+            var open = s.open && s.open.fullName === p.fullName;
+            return h("div", { key: p.fullName, className: "__mp_item" },
+              h(PluginCard, { plugin: p, t: t, onOpen: function () { openDetail(p); } }),
+              open ? h(DetailPanel, { plugin: s.open, t: t, readme: s.readme, readmeLoading: s.readmeLoading, readmeError: s.readmeError, readmeRateLimited: s.readmeRateLimited, lang: s.open.lang, installState: installState && installState.status === "ready" ? installState.value.installState : null, onInstall: onInstall, ghError: t("ghError") }) : null
+            );
+          })
         ),
         s.loading ? h("p", { className: "__mp_status" }, t("loading")) : null,
         s.error ? h("p", { className: "__mp_error" }, s.error) : null,
         s.items.length === 0 && !s.loading && !s.error ? h("p", { className: "__mp_status" }, t("empty")) : null,
         s.items.length > 0 ? h("button", { type: "button", className: "__mp_more", onClick: more, disabled: s.loading }, t("loadMore")) : null,
-        s.open ? h(DetailPanel, { plugin: s.open, t: t, readme: s.readme, readmeLoading: s.readmeLoading, readmeError: s.readmeError, lang: s.open.lang }) : null
+        s.installError ? h("p", { className: "__mp_error" }, s.installError) : null
       );
     }
 
@@ -246,6 +335,8 @@ window.__ModuleLoader__.load({
     function apply(ctx) {
       var t = ctx.locale.bind(NS);
       ctx.effect(function () { return ctx.locale.register(NS, { zh: zh, en: en }); }, "dsh-plugin-marketplace: dictionaries");
+      var scope = ctx.settingsScope.bind({ namespace: "plugin-marketplace" });
+      var api = ctx.connection.api;
       ctx.slots.inject("settings.section", function () {
         return ctx.slots.register({
           name: "settings.section",
@@ -253,7 +344,9 @@ window.__ModuleLoader__.load({
           order: 20,
           label: function () { return t("nav"); },
           locale: NS
-        }, MarketplaceSection);
+        }, function (props) {
+          return h(MarketplaceSection, Object.assign({}, props, { scope: scope, api: api }));
+        });
       });
     }
 

package/index.js

@@ -1,11 +1,162 @@
 /**
  * dsh-plugin-marketplace — node half.
  *
- * The empty apply exists so the plugin appears in the host Loader; the
- * browser half owns the marketplace section through exports["./client"],
- * discovered from the package.json `dsh.client` declaration.
+ * Host side of the marketplace: owns a `plugin-marketplace` settings
+ * namespace used as a message channel between the browser UI and this
+ * process. The client writes an `install` request; the settings watch here
+ * spawns `dsh plugin --profile <p> add <pkg>` (npm install into the profile)
+ * and appends the mount row to the profile's cordis.patch.yml, then reports
+ * progress/result back through `installState`.
+ *
+ * The settings section UI itself lives in the browser half (exports["./client"]).
  */
-/** Host plugin body — no host-side behavior for this surface plugin. */
-function apply() {}
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import os from "node:os";
+import z from "@deepseek-ai/schemastery";
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+import { ensureSettingsNamespaceExposed } from "./vendor/dsh-settings-expose.js";
+
+/** Cordis plugin name. */
+const name = "plugin-marketplace";
+/** Settings namespace owned by this plugin (Web UI settings section + install channel). */
+const NS = settingsNamespace("plugin-marketplace");
+
+/** Runtime schema: the install request + the install state report. */
+const Config = z.object({
+  install: z.object({
+    /** npm package name to install ("" = no pending request). */
+    pkg: z.string().default(""),
+    /** client-set timestamp; host dedups on it. */
+    ts: z.number().default(0),
+  }),
+  installState: z.object({
+    status: z.string().default("idle"), // idle | running | ok | error
+    message: z.string().default(""),
+    ts: z.number().default(0),
+  }),
+});
+
+/** npm package-name shape (scope/name, no spaces, no path chars). */
+const PKG_NAME = /^@?[a-z0-9][a-z0-9-._]*(?:\/[a-z0-9][a-z0-9-._]*)?$/;
+
+function apply(ctx, config) {
+  let sourceGetter = null;
+  let lastTs = 0;
+
+  // ── settings-backed configuration ─────────────────────────────────────────
+  // The browser half edits this namespace; `onChange` fires on every write,
+  // which is what turns an `install` request into a real install.
+  installSettingsSection(ctx, NS, Config, config, {
+    setSource: (getter) => {
+      sourceGetter = getter;
+    },
+    onChange: () => {
+      void maybeRunInstall();
+    },
+  });
+
+  // dsh-host-apiproxy hard-codes which namespaces the Web client may touch;
+  // patch the allowlist idempotently so the client can write install requests.
+  ensureSettingsNamespaceExposed(ctx, "plugin-marketplace", ctx.logger);
+
+  /** Resolved current config (settings layer over the entry). */
+  function current() {
+    return sourceGetter ? sourceGetter() : config;
+  }
+
+  /** Write the install-state report (and clear the consumed request). */
+  async function report(status, message, pkg) {
+    const settings = ctx.get("settings");
+    if (!settings) return;
+    const ts = Date.now();
+    await settings.update(NS, {
+      installState: { status, message, ts, pkg: pkg || "" },
+      install: { pkg: "", ts: 0 },
+    }).catch((error) => {
+      ctx.logger.warn(`[plugin-marketplace] state write failed: ${String(error)}`);
+    });
+  }
+
+  /** Find the active profile name from the process args ("web" default). */
+  function profileName() {
+    const argv = process.argv;
+    const i = argv.indexOf("--profile");
+    if (i >= 0 && argv[i + 1]) return argv[i + 1];
+    return "web";
+  }
+
+  /** The dsh CLI entry used to boot this process (its own bin.js). */
+  function dshBin() {
+    return process.argv[1];
+  }
+
+  /** Append a mount row for `pkg` to cordis.patch.yml (idempotent). */
+  function ensureMounted(pkg, profile) {
+    const dshHome = process.env.DSH_HOME || join(os.homedir(), ".dsh");
+    const patchPath = join(dshHome, "profiles", profile, "cordis.patch.yml");
+    if (!existsSync(patchPath)) return " (patch file not found; mount manually)";
+    const id = pkg.replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]/g, "-") || pkg;
+    let src = readFileSync(patchPath, "utf8");
+    if (src.includes(`name: '${pkg}'`) || src.includes(`name: "${pkg}"`)) return " (already mounted)";
+    // Append under the first `- insert:` list; match its indentation (4 spaces
+    // is the convention used by dsh profiles).
+    const insertAt = src.search(/^- insert:\s*$/m);
+    const row = `\n    - id: ${id}\n      name: '${pkg}'`;
+    if (insertAt >= 0) {
+      src = src.slice(0, insertAt + "- insert:".length) + row + src.slice(insertAt + "- insert:".length);
+    } else {
+      src += `\n- insert:${row}\n`;
+    }
+    writeFileSync(patchPath, src, "utf8");
+    return " (mounted in cordis.patch.yml)";
+  }
+
+  /** Run the install; resolve {code, stdout, stderr}. */
+  function runInstall(pkg, profile) {
+    const bin = dshBin();
+    const node = process.execPath;
+    return new Promise((resolve) => {
+      execFile(node, [bin, "plugin", "--profile", profile, "add", pkg], {
+        timeout: 5 * 60 * 1000,
+        maxBuffer: 8 * 1024 * 1024,
+        windowsHide: true,
+      }, (error, stdout, stderr) => {
+        resolve({ code: error ? (error.code ?? 1) : 0, stdout, stderr });
+      });
+    });
+  }
+
+  async function maybeRunInstall() {
+    try {
+      const cfg = current();
+      const req = cfg?.install;
+      if (!req || !req.pkg || req.ts === lastTs || req.ts === 0) return;
+      lastTs = req.ts;
+      const pkg = String(req.pkg).trim();
+      if (!PKG_NAME.test(pkg)) {
+        await report("error", `invalid package name: ${pkg}`, pkg);
+        return;
+      }
+      const profile = profileName();
+      ctx.logger.info(`[plugin-marketplace] installing ${pkg} (profile=${profile})…`);
+      await report("running", `installing ${pkg}…`, pkg);
+      const result = await runInstall(pkg, profile);
+      if (result.code !== 0) {
+        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
+        ctx.logger.warn(`[plugin-marketplace] install failed (${result.code}): ${tail}`);
+        await report("error", `install failed: ${tail || "unknown error"}`, pkg);
+        return;
+      }
+      const mountNote = ensureMounted(pkg, profile);
+      ctx.logger.info(`[plugin-marketplace] ${pkg} installed${mountNote}`);
+      await report("ok", `${pkg} installed${mountNote}. Restart dsh web to load it.`, pkg);
+    } catch (error) {
+      ctx.logger.warn(`[plugin-marketplace] install flow failed: ${String(error)}`);
+      await report("error", String(error instanceof Error ? error.message : error));
+    }
+  }
+}
 
-export { apply };
+export { Config, apply, name };

package/package.json

@@ -1,46 +1,51 @@
-{
-  "name": "dsh-plugin-marketplace",
-  "version": "0.1.1",
-  "description": "DeepSeek Harness Web UI 内置插件市场：在设置页直接浏览 github.com/topics/dsh-plugin，支持搜索、按 Star 排序、查看安装方式。",
-  "type": "module",
-  "main": "index.js",
-  "exports": {
-    ".": "./index.js",
-    "./client": "./client.js",
-    "./package.json": "./package.json"
-  },
-  "dsh": {
-    "client": {
-      "platform": "web"
-    }
-  },
-  "files": [
-    "index.js",
-    "client.js",
-    "README.md",
-    "README.zh.md",
-    "LICENSE"
-  ],
-  "homepage": "https://github.com/Scorp1o117/dsh-plugin-marketplace",
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "marketplace",
-    "web-ui"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=20.18"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Scorp1o117/dsh-plugin-marketplace.git"
-  },
-  "bugs": {
-    "url": "https://github.com/Scorp1o117/dsh-plugin-marketplace/issues"
-  },
-  "peerDependencies": {
-    "react": "^18.2.0"
-  }
-}
+{
+    "name":  "dsh-plugin-marketplace",
+    "version":  "0.2.2",
+    "description":  "DeepSeek Harness Web UI 内置插件市场：在设置页直接浏览 github.com/topics/dsh-plugin，支持搜索、按 Star 排序、查看安装方式。",
+    "type":  "module",
+    "main":  "index.js",
+    "exports":  {
+                    ".":  "./index.js",
+                    "./client":  "./client.js",
+                    "./package.json":  "./package.json"
+                },
+    "dsh":  {
+                "client":  {
+                               "platform":  "web"
+                           }
+            },
+    "files":  [
+                  "index.js",
+                  "client.js",
+                  "README.md",
+                  "README.zh.md",
+                  "LICENSE",
+                  "vendor"
+              ],
+    "homepage":  "https://github.com/Scorp1o117/dsh-plugin-marketplace",
+    "keywords":  [
+                     "dsh",
+                     "dsh-plugin",
+                     "deepseek-harness",
+                     "marketplace",
+                     "web-ui"
+                 ],
+    "license":  "MIT",
+    "engines":  {
+                    "node":  "\u003e=20.18"
+                },
+    "repository":  {
+                       "type":  "git",
+                       "url":  "git+https://github.com/Scorp1o117/dsh-plugin-marketplace.git"
+                   },
+    "bugs":  {
+                 "url":  "https://github.com/Scorp1o117/dsh-plugin-marketplace/issues"
+             },
+    "peerDependencies":  {
+                             "react":  "^18.2.0",
+                             "@deepseek-ai/dsh-settings":  "^0.1.0-rc.6"
+                         },
+    "dependencies":  {
+                         "@deepseek-ai/schemastery":  "^3.18.1"
+                     }
+}

package/vendor/dsh-settings-expose.js

@@ -0,0 +1,75 @@
+/**
+ * dsh-host-apiproxy exposes only namespaces listed in its hard-coded
+ * WEB_SETTINGS_NAMESPACES allowlist to the Web settings client. A namespace
+ * registered by a third-party plugin answers `settings-not-exposed` even
+ * though it is registered — upstream explicitly defers letting plugins
+ * expose their own configuration.
+ *
+ * This module idempotently patches that allowlist in the dsh installation
+ * actually loaded by the host process, so the plugin's settings section
+ * becomes visible in the Web UI without manual edits. A dsh update
+ * overwrites the file; the next plugin start re-patches it.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join, sep } from "node:path";
+
+/**
+ * Ensure `nsName` is present in dsh-host-apiproxy's WEB_SETTINGS_NAMESPACES.
+ * No-op when already exposed or when the file cannot be located/patched.
+ * @param {import("cordis").Context} ctx
+ * @param {string} nsName - settings namespace short name (e.g. "tdai-memory").
+ * @param {{info?: Function, warn?: Function}} logger - dsh logger.
+ */
+export function ensureSettingsNamespaceExposed(ctx, nsName, logger) {
+  void ctx;
+  try {
+    const target = findApiproxyIndex();
+    if (!target) {
+      logger?.warn?.(`[settings-expose] could not locate dsh-host-apiproxy; add "${nsName}" to WEB_SETTINGS_NAMESPACES in dsh-host-apiproxy/lib/index.js to get a Web settings section`);
+      return;
+    }
+    let src;
+    try {
+      src = readFileSync(target, "utf8");
+    } catch (error) {
+      logger?.warn?.(`[settings-expose] cannot read ${target}: ${String(error)}`);
+      return;
+    }
+    const body = src.match(/const WEB_SETTINGS_NAMESPACES = \[([\s\S]*?)\];/)?.[1] ?? "";
+    if (body.includes(`"${nsName}"`)) return; // already exposed (manual or previous patch)
+    const patched = src.replace(/(const WEB_SETTINGS_NAMESPACES = \[[\s\S]*?)(\n\s*\];)/, (_, pre, post) => {
+      const trailingComma = /,\s*$/.test(pre) ? "" : ",";
+      const sep2 = pre.trimEnd().endsWith("[") ? "" : trailingComma;
+      return `${pre}${sep2}\n\t"${nsName}"${post}`;
+    });
+    if (patched === src) {
+      logger?.warn?.(`[settings-expose] allowlist pattern not found in ${target}; add "${nsName}" to WEB_SETTINGS_NAMESPACES manually`);
+      return;
+    }
+    writeFileSync(target, patched, "utf8");
+    logger?.info?.(`[settings-expose] added "${nsName}" to WEB_SETTINGS_NAMESPACES (${target}) — restart dsh web for the settings section to appear`);
+  } catch (error) {
+    logger?.warn?.(`[settings-expose] failed: ${String(error)}`);
+  }
+}
+
+function findApiproxyIndex() {
+  // 1) The host process has already loaded dsh-host-apiproxy: read the real
+  //    module path from the CommonJS module cache (any install layout).
+  try {
+    const Module = createRequire(import.meta.url)("module");
+    const cache = Module._cache ?? {};
+    for (const key of Object.keys(cache)) {
+      if (key.includes(`${sep}dsh-host-apiproxy${sep}`) && key.endsWith(`${sep}index.js`)) return key;
+    }
+  } catch { /* fall through */ }
+  // 2) Fallback: sibling of @deepseek-ai/dsh-settings (dsh's nested layout).
+  try {
+    const require = createRequire(import.meta.url);
+    const settingsEntry = require.resolve("@deepseek-ai/dsh-settings");
+    const candidate = join(dirname(dirname(dirname(settingsEntry))), "dsh-host-apiproxy", "lib", "index.js");
+    if (existsSync(candidate)) return candidate;
+  } catch { /* fall through */ }
+  return "";
+}