dsh-pocket 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 shaobeichen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# DSH Pocket
+
+把 **DeepSeek Harness 装进你的口袋**：一个包、一个设置页，手机扫二维码就实时看到电脑上的同一个界面——人在外面也能用。
+
+> EN: Put DeepSeek Harness in your pocket. One package, one settings tab — scan a QR code and your phone shows exactly what's on your computer screen, live, anywhere.
+
+## 这是什么
+
+`dsh web` 默认只允许本机访问（`127.0.0.1:3080`）。DSH Pocket 在它前面加一层**改头代理**，并直接在 **DSH 网页设置页**里给你二维码：
+
+```
+手机 ──扫码──> dsh-pocket 代理 ──> dsh web :3080
+                （改写 Host/Origin 为 loopback，DSH 信任栅栏放行）
+```
+
+- **局域网**：装好插件，设置 → 插件 → **手机访问**，打开就有一个局域网二维码——手机连同一 WiFi 扫码即用
+- **公网**：同一页点「**开启公网访问**」，出第二个二维码——人在外面（4G/公司网）也能访问
+- **实时同步**：DSH 的流式输出走 WebSocket，代理原样透传——**电脑上看到什么，手机上就是什么**
+
+## 安装
+
+```sh
+dsh plugin --profile web add dsh-pocket -w
+```
+
+重启 `dsh web` → 设置 → 插件 → **手机访问**。**就这一个包，没有核心/适配器要分开装。**
+
+## ⚠️ 安全（必读）
+
+- **DSH 能执行你电脑上的代码**。二维码/URL 就是钥匙，**请勿把二维码或 URL 发给任何人**
+- 公网 URL 由 cloudflared 随机分配，**每次重启 dsh web 会变化**（旧链接自动失效，相当于天然轮换）
+- 适合个人自用；多设备/分享场景后续会加访问令牌
+
+## 原理
+
+DSH 的 `/api` 浏览器信任栅栏只认 loopback 或 `--trusted-host`（官方还禁了 `0.0.0.0` 绑定，防止把远程执行代码暴露给网络）。Pocket 把入站请求的 `Host` / `Origin` 统一改写成 `127.0.0.1:<dsh端口>`，栅栏永远看到 loopback——**不需要改 dsh 的任何配置**。代理随插件自动启动，公网隧道按需开启（首次自动下载 cloudflared）。
+
+## 架构（单包）
+
+| 文件 | 说明 |
+|---|---|
+| `lib/index.js` | 插件入口：自动起代理 + 注册 RPC（`inject: connection, webServer`） |
+| `lib/service.mjs` | 服务：代理生命周期、公网隧道、状态快照（含二维码 data URL） |
+| `lib/proxy.mjs` | 改头反向代理：Host/Origin → loopback，HTTP + WebSocket 全透传 |
+| `lib/tunnel.mjs` | cloudflared 快速隧道：下载/启动/解析公网 URL |
+| `lib/web-rpc.js` | loopback RPC：`pocket.status` / `tunnel.start` / `tunnel.stop` |
+| `client/` | 设置页「手机访问」标签（React，esbuild 打包） |
+
+## 开发
+
+```sh
+npm install
+node client/build.mjs   # 改 client/index.jsx 后重新打包
+npm test                # 代理改写 + WS 透传 + 服务 + RPC（5 个测试）
+```
+
+## License
+
+MIT

package/bin/dsh-pocket.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// dsh-pocket — 把 DeepSeek Harness 装进你的口袋
+//
+// 用法：
+//   dsh-pocket                 # 局域网模式：手机同一 WiFi 扫码访问
+//   dsh-pocket --public        # 公网模式：cloudflared 隧道，人在外面也能访问
+//   dsh-pocket --port 3081     # 自定义代理端口（默认 3081；dsh web 保持 3080）
+//
+// 前提：dsh web 已在 127.0.0.1:3080 运行。
+// 手机看到的界面 = 电脑上的界面，实时同步（WebSocket 流式透传）。
+
+import { networkInterfaces } from 'node:os';
+import { createRequire } from 'node:module';
+import { createPocketProxy } from '../lib/proxy.mjs';
+import { startQuickTunnel } from '../lib/tunnel.mjs';
+
+const require = createRequire(import.meta.url);
+
+function parseArgs(argv) {
+  const args = { port: 3081, host: '0.0.0.0', public: false, upstream: { host: '127.0.0.1', port: 3080 } };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--public') args.public = true;
+    else if (a === '--port') args.port = Number(argv[++i]) || 3081;
+    else if (a === '--host') args.host = argv[++i] ?? '0.0.0.0';
+    else if (a === '--help' || a === '-h') { printHelp(); process.exit(0); }
+  }
+  return args;
+}
+
+function printHelp() {
+  console.log(`dsh-pocket — 手机访问电脑上的 DeepSeek Harness
+
+用法：
+  dsh-pocket             局域网模式（手机同一 WiFi）
+  dsh-pocket --public    公网模式（cloudflared 隧道，人在外面）
+  dsh-pocket --port 3081 自定义代理端口
+  dsh-pocket --help      帮助
+
+前提：dsh web 已在 127.0.0.1:3080 运行（npx @deepseek-ai/dsh web）。
+
+安全提醒：dsh web 能执行代码。二维码/URL 就是钥匙，请勿发给别人。
+`);
+}
+
+function lanIPv4() {
+  const addrs = [];
+  for (const ifaces of Object.values(networkInterfaces())) {
+    for (const i of ifaces ?? []) {
+      if (i.family === 'IPv4' && !i.internal) addrs.push(i.address);
+    }
+  }
+  return addrs[0] ?? null;
+}
+
+function printQr(url, label) {
+  const qrcodeTerminal = require('qrcode-terminal');
+  console.log(`\n${label}\n  ${url}`);
+  qrcodeTerminal.generate(url, { small: true }, (qr) => console.log(qr));
+  console.log('');
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+
+  console.log('🚀 dsh-pocket 启动中…');
+  const { port, close } = await createPocketProxy(args);
+
+  const lan = lanIPv4();
+  if (lan) {
+    printQr(`http://${lan}:${port}`, '📶 局域网访问（手机连同一 WiFi）：');
+  } else {
+    console.log('⚠️  未检测到局域网 IP，跳过局域网二维码');
+  }
+
+  if (args.public) {
+    console.log('🌐 正在建立公网隧道（cloudflared）…');
+    const controller = new AbortController();
+    process.on('SIGINT', () => controller.abort());
+    try {
+      const tunnel = await startQuickTunnel({ port, signal: controller.signal });
+      printQr(tunnel.url, '🌐 公网访问（人在外面也能用）：');
+      console.log('   隧道会持续运行；Ctrl+C 退出（下次启动会换新 URL）');
+      process.on('SIGINT', () => { tunnel.kill(); });
+    } catch (err) {
+      console.error(`❌ 公网隧道失败：${err.message}（局域网二维码仍可用）`);
+    }
+  } else {
+    console.log(`   （加 --public 开启公网隧道）`);
+  }
+
+  console.log(`✅ dsh-pocket 已就绪：手机扫码上面的二维码，看到的界面与电脑完全一致、实时同步。\n   按 Ctrl+C 停止。`);
+  await new Promise(() => {});
+}
+
+main().catch((err) => {
+  console.error(`❌ dsh-pocket: ${err?.message ?? err}`);
+  process.exit(1);
+});

package/client/api.js

@@ -0,0 +1,22 @@
+// dsh-pocket 设置页签 RPC 契约（client 与 host 共享）
+export const POCKET_RPC_CHANNEL = '/dsh-pocket';
+
+export const POCKET_ENDPOINTS = Object.freeze({
+  status: 'pocket.status',
+  tunnelStart: 'tunnel.start',
+  tunnelStop: 'tunnel.stop',
+});
+
+/** 浏览器可见的状态字段（无敏感信息；含二维码 data URL）。 */
+export function redactStatus(s) {
+  return {
+    proxyRunning: s?.proxyRunning === true,
+    proxyPort: s?.proxyPort ?? null,
+    lanUrl: s?.lanUrl ?? null,
+    lanQr: s?.lanQr ?? null,
+    tunnelRunning: s?.tunnelRunning === true,
+    tunnelUrl: s?.tunnelUrl ?? null,
+    tunnelQr: s?.tunnelQr ?? null,
+    dshPort: s?.dshPort ?? null,
+  };
+}

package/client/build.mjs

@@ -0,0 +1,40 @@
+// dsh-pocket 网页客户端打包：client/index.jsx → client/client.js
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const sourceDir = dirname(fileURLToPath(import.meta.url));
+const packageRoot = resolve(sourceDir, '..');
+const outputPath = resolve(packageRoot, 'client/client.js');
+const loaderId = process.env.DSH_POCKET_CLIENT_ID ?? 'dsh-pocket';
+
+const result = await build({
+  entryPoints: [resolve(sourceDir, 'index.jsx')],
+  bundle: true,
+  format: 'cjs',
+  platform: 'browser',
+  target: ['chrome100'],
+  external: ['react', 'react/jsx-runtime'],
+  write: false,
+  minify: process.env.NODE_ENV === 'production',
+  legalComments: 'none',
+});
+
+const bundled = result.outputFiles?.[0]?.text;
+if (!bundled) throw new Error('esbuild did not produce a client bundle');
+
+const wrapped = `window.__ModuleLoader__.load({
+  id: ${JSON.stringify(loaderId)},
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+${bundled}
+    return module.exports;
+  }
+});
+`;
+
+await mkdir(dirname(outputPath), { recursive: true });
+await writeFile(outputPath, wrapped, 'utf8');
+console.log(`Wrote ${outputPath}`);

package/client/client.js

@@ -0,0 +1,170 @@
+window.__ModuleLoader__.load({
+  id: "dsh-pocket",
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// client/index.jsx
+var index_exports = {};
+__export(index_exports, {
+  apply: () => apply,
+  inject: () => inject,
+  name: () => name,
+  redactStatus: () => redactStatus
+});
+module.exports = __toCommonJS(index_exports);
+var import_react = require("react");
+
+// client/api.js
+var POCKET_RPC_CHANNEL = "/dsh-pocket";
+var POCKET_ENDPOINTS = Object.freeze({
+  status: "pocket.status",
+  tunnelStart: "tunnel.start",
+  tunnelStop: "tunnel.stop"
+});
+function redactStatus(s) {
+  return {
+    proxyRunning: s?.proxyRunning === true,
+    proxyPort: s?.proxyPort ?? null,
+    lanUrl: s?.lanUrl ?? null,
+    lanQr: s?.lanQr ?? null,
+    tunnelRunning: s?.tunnelRunning === true,
+    tunnelUrl: s?.tunnelUrl ?? null,
+    tunnelQr: s?.tunnelQr ?? null,
+    dshPort: s?.dshPort ?? null
+  };
+}
+
+// client/index.jsx
+var name = "dsh-pocket";
+var inject = ["slots", "connection"];
+var styles = {
+  card: { background: "var(--dsw-alias-bg-layer-1,#fff)", border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", borderRadius: 12, padding: "14px 16px", maxWidth: 480 },
+  block: { borderTop: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", marginTop: 12, paddingTop: 12 },
+  muted: { color: "var(--dsw-alias-label-tertiary,#8b93a1)", fontSize: 12 },
+  code: { fontFamily: "ui-monospace,Menlo,monospace", fontSize: 12, wordBreak: "break-all", margin: "4px 0 8px" },
+  primary: { font: "inherit", cursor: "pointer", border: "none", background: "var(--dsw-alias-brand-primary,#4f6ef7)", color: "#fff", borderRadius: 8, padding: "6px 14px", fontSize: 13 },
+  btn: { font: "inherit", cursor: "pointer", border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", background: "var(--dsw-alias-bg-layer-1,#fff)", borderRadius: 8, padding: "6px 14px", fontSize: 13 },
+  qr: { width: 220, height: 220, borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2,#e5e7eb)", margin: "6px 0" },
+  warn: { color: "var(--dsw-alias-state-warn-primary,#b45309)", fontSize: 12 }
+};
+function PocketSettingsTab({ rpcCall }) {
+  const [status, setStatus] = (0, import_react.useState)(null);
+  const [busy, setBusy] = (0, import_react.useState)(false);
+  const [error, setError] = (0, import_react.useState)(null);
+  const call = async (endpoint, payload) => {
+    const res = await rpcCall(endpoint, payload);
+    if (!res?.ok) throw new Error(res?.error?.message ?? "RPC failed");
+    return res.value;
+  };
+  const load = async () => {
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.status, {}));
+    } catch {
+    }
+  };
+  (0, import_react.useEffect)(() => {
+    load();
+    const t = setInterval(load, 3e3);
+    return () => clearInterval(t);
+  }, []);
+  const startTunnel = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.tunnelStart, {}));
+    } catch (err) {
+      setError(err.message);
+    } finally {
+      setBusy(false);
+    }
+  };
+  const stopTunnel = async () => {
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.tunnelStop, {}));
+    } catch {
+    }
+  };
+  const lanUrl = status?.lanUrl;
+  const tunnelUrl = status?.tunnelUrl;
+  return (0, import_react.createElement)(
+    "div",
+    { style: styles.card },
+    (0, import_react.createElement)(
+      "div",
+      null,
+      (0, import_react.createElement)("strong", null, "\u{1F4F1} \u624B\u673A\u8BBF\u95EE | Phone access"),
+      (0, import_react.createElement)("div", { style: styles.muted }, "\u624B\u673A\u626B\u7801\u6253\u5F00\u7684\u5C31\u662F\u7535\u8111\u4E0A\u7684\u8FD9\u4E2A\u754C\u9762\uFF0C\u5B9E\u65F6\u540C\u6B65 | the phone shows this exact screen, live")
+    ),
+    // 局域网
+    (0, import_react.createElement)(
+      "div",
+      { style: styles.block },
+      (0, import_react.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, "\u{1F4F6} \u5C40\u57DF\u7F51\uFF08\u540C\u4E00 WiFi\uFF09| LAN"),
+      lanUrl ? (0, import_react.createElement)(
+        "div",
+        null,
+        (0, import_react.createElement)("img", { src: status.lanQr, alt: "LAN QR", style: styles.qr }),
+        (0, import_react.createElement)("div", { style: styles.code }, lanUrl),
+        (0, import_react.createElement)("div", { style: styles.muted }, "\u624B\u673A\u8FDE\u63A5\u540C\u4E00 WiFi \u540E\u626B\u7801\u5373\u53EF\u6253\u5F00")
+      ) : (0, import_react.createElement)("div", { style: styles.muted }, "\u4EE3\u7406\u672A\u5C31\u7EEA\u2026 | proxy starting\u2026")
+    ),
+    // 公网
+    (0, import_react.createElement)(
+      "div",
+      { style: styles.block },
+      (0, import_react.createElement)("div", { style: { fontWeight: 600, fontSize: 13 } }, "\u{1F310} \u516C\u7F51\uFF08\u4EBA\u5728\u5916\u9762\uFF09| Anywhere"),
+      tunnelUrl ? (0, import_react.createElement)(
+        "div",
+        null,
+        (0, import_react.createElement)("img", { src: status.tunnelQr, alt: "Tunnel QR", style: styles.qr }),
+        (0, import_react.createElement)("div", { style: styles.code }, tunnelUrl),
+        (0, import_react.createElement)("div", { style: styles.muted }, "\u4EFB\u4F55\u7F51\u7EDC\u626B\u7801\u5373\u7528\uFF08URL \u6BCF\u6B21\u91CD\u542F\u4F1A\u53D8\uFF09"),
+        (0, import_react.createElement)("button", { style: styles.btn, onClick: stopTunnel }, "\u5173\u95ED\u516C\u7F51 | Stop")
+      ) : (0, import_react.createElement)(
+        "div",
+        null,
+        (0, import_react.createElement)("button", { style: styles.primary, onClick: startTunnel, disabled: busy }, busy ? "\u5F00\u542F\u4E2D\u2026\uFF08\u9996\u6B21\u9700\u4E0B\u8F7D cloudflared\uFF09" : "\u5F00\u542F\u516C\u7F51\u8BBF\u95EE | Enable anywhere"),
+        (0, import_react.createElement)("div", { style: styles.warn, marginTop: 8 }, "\u26A0\uFE0F DSH \u80FD\u6267\u884C\u7535\u8111\u4EE3\u7801\uFF1A\u4E8C\u7EF4\u7801/URL \u5C31\u662F\u94A5\u5319\uFF0C\u8BF7\u52FF\u53D1\u7ED9\u522B\u4EBA")
+      )
+    ),
+    error ? (0, import_react.createElement)("div", { style: { color: "var(--dsw-alias-state-error-primary,#dc2626)", fontSize: 12, marginTop: 8 } }, `\u274C ${error}`) : null
+  );
+}
+function apply(ctx) {
+  const rpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(POCKET_RPC_CHANNEL, endpoint, payload, signal);
+  ctx.slots.inject(
+    "settings.plugins.tab",
+    () => ctx.slots.register(
+      {
+        name: "settings.plugins.tab",
+        id: "pocket",
+        order: 10,
+        label: "\u624B\u673A\u8BBF\u95EE",
+        inject: () => ({ rpcCall })
+      },
+      PocketSettingsTab
+    )
+  );
+}
+
+    return module.exports;
+  }
+});

package/client/index.jsx

@@ -0,0 +1,120 @@
+// dsh-pocket 网页设置页签（设置 → 插件 → 手机访问）
+//
+// 打开即显示局域网二维码；点「开启公网」出公网二维码。
+// 手机扫码打开的就是电脑上的 dsh web，实时同步。
+
+import { createElement as h, useEffect, useState } from 'react';
+
+import { POCKET_RPC_CHANNEL, POCKET_ENDPOINTS, redactStatus } from './api.js';
+
+const name = 'dsh-pocket';
+const inject = ['slots', 'connection'];
+
+const styles = {
+  card: { background: 'var(--dsw-alias-bg-layer-1,#fff)', border: '1px solid var(--dsw-alias-border-l2,#e5e7eb)', borderRadius: 12, padding: '14px 16px', maxWidth: 480 },
+  block: { borderTop: '1px solid var(--dsw-alias-border-l2,#e5e7eb)', marginTop: 12, paddingTop: 12 },
+  muted: { color: 'var(--dsw-alias-label-tertiary,#8b93a1)', fontSize: 12 },
+  code: { fontFamily: 'ui-monospace,Menlo,monospace', fontSize: 12, wordBreak: 'break-all', margin: '4px 0 8px' },
+  primary: { font: 'inherit', cursor: 'pointer', border: 'none', background: 'var(--dsw-alias-brand-primary,#4f6ef7)', color: '#fff', borderRadius: 8, padding: '6px 14px', fontSize: 13 },
+  btn: { font: 'inherit', cursor: 'pointer', border: '1px solid var(--dsw-alias-border-l2,#e5e7eb)', background: 'var(--dsw-alias-bg-layer-1,#fff)', borderRadius: 8, padding: '6px 14px', fontSize: 13 },
+  qr: { width: 220, height: 220, borderRadius: 8, border: '1px solid var(--dsw-alias-border-l2,#e5e7eb)', margin: '6px 0' },
+  warn: { color: 'var(--dsw-alias-state-warn-primary,#b45309)', fontSize: 12 },
+};
+
+function PocketSettingsTab({ rpcCall }) {
+  const [status, setStatus] = useState(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState(null);
+
+  const call = async (endpoint, payload) => {
+    const res = await rpcCall(endpoint, payload);
+    if (!res?.ok) throw new Error(res?.error?.message ?? 'RPC failed');
+    return res.value;
+  };
+
+  const load = async () => {
+    try { setStatus(await call(POCKET_ENDPOINTS.status, {})); } catch { /* 忽略瞬时失败 */ }
+  };
+
+  useEffect(() => {
+    load();
+    const t = setInterval(load, 3000);
+    return () => clearInterval(t);
+  }, []);
+
+  const startTunnel = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      setStatus(await call(POCKET_ENDPOINTS.tunnelStart, {}));
+    } catch (err) {
+      setError(err.message);
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const stopTunnel = async () => {
+    try { setStatus(await call(POCKET_ENDPOINTS.tunnelStop, {})); } catch { /* 忽略 */ }
+  };
+
+  const lanUrl = status?.lanUrl;
+  const tunnelUrl = status?.tunnelUrl;
+
+  return h('div', { style: styles.card },
+    h('div', null,
+      h('strong', null, '📱 手机访问 | Phone access'),
+      h('div', { style: styles.muted }, '手机扫码打开的就是电脑上的这个界面，实时同步 | the phone shows this exact screen, live'),
+    ),
+
+    // 局域网
+    h('div', { style: styles.block },
+      h('div', { style: { fontWeight: 600, fontSize: 13 } }, '📶 局域网（同一 WiFi）| LAN'),
+      lanUrl
+        ? h('div', null,
+          h('img', { src: status.lanQr, alt: 'LAN QR', style: styles.qr }),
+          h('div', { style: styles.code }, lanUrl),
+          h('div', { style: styles.muted }, '手机连接同一 WiFi 后扫码即可打开'),
+        )
+        : h('div', { style: styles.muted }, '代理未就绪… | proxy starting…'),
+    ),
+
+    // 公网
+    h('div', { style: styles.block },
+      h('div', { style: { fontWeight: 600, fontSize: 13 } }, '🌐 公网（人在外面）| Anywhere'),
+      tunnelUrl
+        ? h('div', null,
+          h('img', { src: status.tunnelQr, alt: 'Tunnel QR', style: styles.qr }),
+          h('div', { style: styles.code }, tunnelUrl),
+          h('div', { style: styles.muted }, '任何网络扫码即用（URL 每次重启会变）'),
+          h('button', { style: styles.btn, onClick: stopTunnel }, '关闭公网 | Stop'),
+        )
+        : h('div', null,
+          h('button', { style: styles.primary, onClick: startTunnel, disabled: busy }, busy ? '开启中…（首次需下载 cloudflared）' : '开启公网访问 | Enable anywhere'),
+          h('div', { style: styles.warn, marginTop: 8 }, '⚠️ DSH 能执行电脑代码：二维码/URL 就是钥匙，请勿发给别人'),
+        ),
+    ),
+
+    error ? h('div', { style: { color: 'var(--dsw-alias-state-error-primary,#dc2626)', fontSize: 12, marginTop: 8 } }, `❌ ${error}`) : null,
+  );
+}
+
+export function apply(ctx) {
+  const rpcCall = (endpoint, payload, signal) =>
+    ctx.connection.rpc.call(POCKET_RPC_CHANNEL, endpoint, payload, signal);
+
+  ctx.slots.inject('settings.plugins.tab', () =>
+    ctx.slots.register(
+      {
+        name: 'settings.plugins.tab',
+        id: 'pocket',
+        order: 10,
+        label: '手机访问',
+        inject: () => ({ rpcCall }),
+      },
+      PocketSettingsTab,
+    ),
+  );
+}
+
+export { name, inject, redactStatus };

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# dsh-pocket bundle patch（dsh.bundle manifest 要求的加载配置）
+# 单包单插件：装一次，设置页「手机访问」全部功能到位。
+- insert:
+    - id: dsh-pocket
+      name: dsh-pocket

package/lib/index.js

@@ -0,0 +1,43 @@
+// dsh-pocket 插件入口（单包单插件：手机扫码访问 DSH，全在这一个包里）
+//
+// 设置页「设置 → 插件 → 手机访问」：
+//   - 局域网二维码：自动显示（代理随插件启动）
+//   - 公网二维码：点「开启公网」→ cloudflared 隧道 → 扫码即用，人在外面也能访问
+// 手机看到的界面 = 电脑上的 dsh web，实时同步（WebSocket 透传）。
+
+import { createPocketService } from './service.mjs';
+import { installPocketRpc } from './web-rpc.js';
+
+const name = 'dsh-pocket';
+const inject = ['connection', 'webServer'];
+
+export function apply(ctx, config = {}, internals = {}) {
+  const logger = ctx.logger?.(name) ?? console;
+  const dshPort = internals.dshPort ?? ctx.webServer?.port;
+  if (!dshPort) {
+    logger.error('dsh-pocket: webServer port unavailable — cannot start proxy | 拿不到 dsh web 端口，无法启动代理');
+    return () => {};
+  }
+
+  const service = internals.service ?? createPocketService({
+    dshPort,
+    port: internals.port ?? config.port ?? 3081,
+    internals,
+  });
+
+  const disposeRpc = installPocketRpc(ctx, { service, log: logger });
+
+  // 代理随插件自动启动（局域网二维码开箱即用，零配置）
+  void service.startProxy().then((proxy) => {
+    logger.info('dsh-pocket: proxy ready on :%d | 局域网代理已就绪', proxy.port);
+  }).catch((err) => {
+    logger.error('dsh-pocket: proxy start failed | 代理启动失败: %s', err?.message ?? err);
+  });
+
+  ctx.effect(() => async () => {
+    disposeRpc();
+    await service.dispose();
+  }, 'dsh-pocket: stop proxy and tunnel');
+}
+
+export { name, inject };

package/lib/proxy.mjs

@@ -0,0 +1,87 @@
+// dsh-pocket 核心：Host/Origin 改写反向代理
+//
+// 为什么需要它：DSH 的 /api 浏览器信任栅栏只认 loopback（127.0.0.1）或
+// `--trusted-host` 白名单（且官方禁了 0.0.0.0 绑定，防止把远程执行代码暴露给网络）。
+// 本代理把入站请求的 Host / Origin 统一改写成 loopback 权威（127.0.0.1:3080），
+// 转发给本机 dsh web——栅栏永远看到 loopback，于是：
+//   - 局域网：手机直接访问 http://<电脑IP>:端口
+//   - 公网：cloudflared 隧道指到本代理，任意域名都能进
+// 都不需要改 dsh 的任何配置。
+//
+// 同步保证：普通请求与 WebSocket upgrade（/api/events.host 流式推送）都原样透传，
+// 手机看到的界面与电脑完全一致、实时。
+
+import { createServer } from 'node:http';
+import { request as httpRequest } from 'node:http';
+
+const DEFAULT_UPSTREAM = { host: '127.0.0.1', port: 3080 };
+
+/** 把浏览器可见的权威改写成 loopback 权威（Host 和 Origin 都改）。 */
+function loopbackAuthority(headers, upstream) {
+  const authority = `${upstream.host}:${upstream.port}`;
+  headers.Host = authority;
+  if (headers.origin) headers.origin = `http://${authority}`;
+  if (headers.Origin) headers.Origin = `http://${authority}`;
+  return headers;
+}
+
+/**
+ * 启动 dsh-pocket 代理。
+ * @param {object} opts
+ * @param {number} [opts.port]      监听端口（默认 3081；dsh web 保持 3080）
+ * @param {string} [opts.host]      监听地址（默认 0.0.0.0：LAN 与隧道都能到）
+ * @param {{host:string,port:number}} [opts.upstream] 上游 dsh web（默认 127.0.0.1:3080）
+ * @returns {Promise<{server:import('node:http').Server, close:()=>Promise<void>}>}
+ */
+export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM } = {}) {
+  const server = createServer((req, res) => {
+    const headers = loopbackAuthority({ ...req.headers }, upstream);
+    const proxyReq = httpRequest(
+      { host: upstream.host, port: upstream.port, method: req.method, path: req.url, headers, agent: false },
+      (proxyRes) => {
+        res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+        proxyRes.pipe(res);
+      },
+    );
+    proxyReq.on('error', (err) => {
+      if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+      res.end(`dsh-pocket: 无法连接上游 dsh web（${upstream.host}:${upstream.port}）——先启动 dsh web | ${err.message}`);
+    });
+    req.pipe(proxyReq);
+  });
+
+  // WebSocket upgrade（DSH 的 /api/events.host 流式通道）原样透传
+  server.on('upgrade', (req, socket, head) => {
+    const headers = loopbackAuthority({ ...req.headers }, upstream);
+    const proxyReq = httpRequest({
+      host: upstream.host, port: upstream.port, method: req.method, path: req.url, headers, agent: false,
+    });
+    proxyReq.on('upgrade', (proxyRes, proxySocket, proxyHead) => {
+      socket.write('HTTP/1.1 101 Switching Protocols\r\n');
+      // 原样回传上游的 upgrade 头（Sec-WebSocket-Accept 等）
+      const raw = [];
+      for (const [k, v] of Object.entries(proxyRes.headers)) {
+        raw.push(`${k}: ${Array.isArray(v) ? v.join(', ') : v}`);
+      }
+      socket.write(`${raw.join('\r\n')}\r\n\r\n`);
+      socket.write(proxyHead);
+      proxySocket.pipe(socket);
+      socket.pipe(proxySocket);
+    });
+    proxyReq.on('error', () => socket.destroy());
+    proxyReq.end();
+    socket.on('error', () => socket.destroy());
+  });
+
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, host, () => {
+      const actualPort = server.address().port;
+      resolve({
+        server,
+        port: actualPort,
+        close: () => new Promise((r) => server.close(() => r())),
+      });
+    });
+  });
+}

package/lib/service.mjs

@@ -0,0 +1,111 @@
+// dsh-pocket 服务：在 dsh web 进程内跑改头代理 + 公网隧道
+//
+// - 代理：监听 0.0.0.0:<port>（默认 3081），把入站 Host/Origin 改写成
+//   127.0.0.1:<dshPort>（dsh web 实际端口），HTTP + WebSocket 全透传。
+//   这样 DSH 的 /api 浏览器信任栅栏永远看到 loopback，局域网/公网都能进，
+//   且不需要改 dsh 的任何配置（0.0.0.0 绑定被 dsh 官方禁用）。
+// - 隧道：cloudflared 快速隧道（可选），公网 https URL，供人在外面访问。
+
+import { networkInterfaces } from 'node:os';
+import { createRequire } from 'node:module';
+import { createPocketProxy } from './proxy.mjs';
+import { startQuickTunnel } from './tunnel.mjs';
+
+const require = createRequire(import.meta.url);
+
+/** URL → 二维码 data URL（浏览器 <img> 直接显示，全本地不依赖第三方）。 */
+export async function qrDataUrl(text, { width = 220, margin = 1 } = {}) {
+  const QRCode = require('qrcode');
+  return QRCode.toDataURL(text, { errorCorrectionLevel: 'M', margin, width, type: 'image/png' });
+}
+
+function lanIPv4() {
+  for (const ifaces of Object.values(networkInterfaces())) {
+    for (const i of ifaces ?? []) {
+      if (i.family === 'IPv4' && !i.internal) return i.address;
+    }
+  }
+  return null;
+}
+
+/**
+ * 创建 Pocket 服务。
+ * @param {object} opts
+ * @param {number} opts.dshPort   dsh web 实际端口（从 ctx.webServer.port 取）
+ * @param {number} [opts.port]    代理端口（默认 3081）
+ * @param {object} [opts.internals] 测试注入：createProxy / startTunnel / lanIPv4
+ * @returns {PocketService}
+ */
+export function createPocketService({
+  dshPort,
+  port = 3081,
+  internals = {},
+} = {}) {
+  const createProxy = internals.createProxy ?? createPocketProxy;
+  const startTunnel = internals.startTunnel ?? startQuickTunnel;
+  const getLan = internals.lanIPv4 ?? lanIPv4;
+
+  let proxy = null;
+  let tunnel = null;
+  let tunnelAbort = null;
+
+  return {
+    /** 启动局域网代理（幂等）。 */
+    async startProxy() {
+      if (proxy) return proxy;
+      proxy = await createProxy({
+        port,
+        host: '0.0.0.0',
+        upstream: { host: '127.0.0.1', port: dshPort },
+      });
+      return proxy;
+    },
+
+    /** 启动公网隧道（幂等；返回公网 URL）。 */
+    async startTunnel() {
+      await this.startProxy();
+      if (tunnel) return tunnel.url;
+      tunnelAbort = new AbortController();
+      const result = await startTunnel({ port: proxy.port, signal: tunnelAbort.signal });
+      // 归一化：startTunnel 契约返回 {url, kill}（字符串也兼容）
+      tunnel = typeof result === 'string' ? { url: result, kill: () => {} } : result;
+      return tunnel.url;
+    },
+
+    /** 停止公网隧道（代理保持）。 */
+    stopTunnel() {
+      tunnelAbort?.abort();
+      tunnelAbort = null;
+      if (tunnel) tunnel.kill();
+      tunnel = null;
+    },
+
+    /** 状态快照（RPC 返回，不含敏感信息；二维码 data URL 本地生成）。 */
+    async status() {
+      const lan = getLan();
+      const proxyPort = proxy?.port ?? null;
+      const lanUrl = lan && proxyPort ? `http://${lan}:${proxyPort}` : null;
+      const encode = internals.encodeQr ?? qrDataUrl;
+      return {
+        proxyRunning: proxy !== null,
+        proxyPort,
+        lanUrl,
+        lanQr: lanUrl ? await encode(lanUrl) : null,
+        tunnelRunning: tunnel !== null,
+        tunnelUrl: tunnel?.url ?? null,
+        tunnelQr: tunnel?.url ? await encode(tunnel.url) : null,
+        dshPort,
+      };
+    },
+
+    /** 停止一切（插件卸载时）。 */
+    async dispose() {
+      this.stopTunnel();
+      if (proxy) {
+        const p = proxy;
+        proxy = null;
+        await p.close();
+      }
+    },
+  };
+}

package/lib/tunnel.mjs

@@ -0,0 +1,109 @@
+// cloudflared 快速隧道：把本机代理暴露成公网 https URL
+//
+// 手机在任何网络都能访问；URL 由 cloudflared 随机分配（每次重启会变）。
+// 无密码模式：URL 即钥匙（dsh web 能执行代码，请勿把二维码/URL 发给别人）。
+
+import { spawn, execSync } from 'node:child_process';
+import { mkdtemp, chmod } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+import { createWriteStream } from 'node:fs';
+
+const QUICK_TUNNEL_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+
+function platformBinary() {
+  const archMap = { x64: 'amd64', arm64: 'arm64' };
+  const a = archMap[process.arch] ?? process.arch;
+  const os = process.platform === 'darwin' ? 'darwin' : process.platform === 'win32' ? 'windows' : 'linux';
+  return { os, a, ext: os === 'windows' ? '.exe' : '' };
+}
+
+async function downloadCloudflared(target) {
+  const { os, a, ext } = platformBinary();
+  const url = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-${os}-${a}${ext}`;
+  console.log(`⬇️  正在下载 cloudflared（首次运行，之后跳过）…`);
+  const res = await fetch(url);
+  if (!res.ok) throw new Error(`cloudflared 下载失败（HTTP ${res.status}）`);
+  await pipeline(Readable.fromWeb(res.body), createWriteStream(target));
+  if (os !== 'windows') await chmod(target, 0o755);
+}
+
+/** PATH 里是否已有 cloudflared。 */
+function cloudflaredOnPath() {
+  try {
+    execSync(process.platform === 'win32' ? 'where cloudflared' : 'command -v cloudflared', { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** 拿一个可用的 cloudflared 路径（PATH 没有就下载到临时目录）。 */
+async function resolveCloudflared() {
+  if (cloudflaredOnPath()) return 'cloudflared';
+  const dir = await mkdtemp(join(tmpdir(), 'dsh-pocket-'));
+  const bin = join(dir, `cloudflared${platformBinary().ext}`);
+  await downloadCloudflared(bin);
+  return bin;
+}
+
+/**
+ * 启动 cloudflared 快速隧道，返回公网 URL。
+ * @param {object} opts
+ * @param {number} opts.port  本机代理端口
+ * @param {AbortSignal} [opts.signal]
+ * @returns {Promise<{url:string, kill:()=>void}>}
+ */
+export async function startQuickTunnel({ port, signal }) {
+  const bin = await resolveCloudflared();
+  const child = spawn(bin, ['tunnel', '--url', `http://127.0.0.1:${port}`, '--no-autoupdate'], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  const url = await new Promise((resolve, reject) => {
+    let buf = '';
+    const onData = (chunk) => {
+      buf += String(chunk);
+      const m = buf.match(QUICK_TUNNEL_URL_RE);
+      if (m) {
+        cleanup();
+        resolve(m[0]);
+      }
+    };
+    const onExit = (code) => {
+      cleanup();
+      reject(new Error(`cloudflared 退出（code=${code}）`));
+    };
+    const cleanup = () => {
+      child.stdout.off('data', onData);
+      child.stderr.off('data', onData);
+      child.off('exit', onExit);
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+    };
+    const onAbort = () => {
+      cleanup();
+      child.kill();
+      reject(new Error('已取消 | cancelled'));
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      child.kill();
+      reject(new Error('cloudflared 启动超时（30s）'));
+    }, 30_000);
+
+    child.stdout.on('data', onData);
+    child.stderr.on('data', onData);
+    child.once('exit', onExit);
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
+
+  return {
+    url,
+    kill: () => {
+      try { child.kill(); } catch { /* 忽略 */ }
+    },
+  };
+}

package/lib/web-rpc.js

@@ -0,0 +1,40 @@
+// dsh-pocket Web RPC（loopback-only）：设置页 ⇄ Host 的手机访问通道
+
+import { POCKET_RPC_CHANNEL, POCKET_ENDPOINTS, redactStatus } from '../client/api.js';
+
+function ok(value) {
+  return { ok: true, value };
+}
+
+function fail(code, message) {
+  return { ok: false, error: { code, message } };
+}
+
+/** 注册 /dsh-pocket 逻辑通道（仅本机 loopback 可调）。 */
+export function installPocketRpc(ctx, { service, log = console }) {
+  if (!ctx?.connection?.rpc?.handle) {
+    log.warn?.('dsh-pocket: DSH Host Connection RPC unavailable — settings tab disabled | 无 Connection RPC，设置页不可用');
+    return () => {};
+  }
+  return ctx.connection.rpc.handle(POCKET_RPC_CHANNEL, async (endpoint, _payload = {}, signal) => {
+    if (signal?.aborted) return fail('cancelled', 'The request was cancelled.');
+
+    try {
+      if (endpoint === POCKET_ENDPOINTS.status) {
+        return ok(redactStatus(await service.status()));
+      }
+      if (endpoint === POCKET_ENDPOINTS.tunnelStart) {
+        await service.startTunnel();
+        return ok(redactStatus(await service.status()));
+      }
+      if (endpoint === POCKET_ENDPOINTS.tunnelStop) {
+        service.stopTunnel();
+        return ok(redactStatus(await service.status()));
+      }
+      return fail('bad-request', `Unknown endpoint: ${endpoint}`);
+    } catch (err) {
+      log.error?.('dsh-pocket: rpc %s failed | RPC 失败: %s', endpoint, err?.message ?? err);
+      return fail('internal', err?.message ?? String(err));
+    }
+  }, { authority: 'loopback' });
+}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "dsh-pocket",
+  "version": "0.1.0",
+  "description": "把 DeepSeek Harness 装进你的口袋：一个包、一个设置页，手机扫码即同步访问电脑上的 DSH（局域网 + 公网，实时同屏）。",
+  "type": "module",
+  "main": "lib/index.js",
+  "bin": {
+    "dsh-pocket": "bin/dsh-pocket.mjs"
+  },
+  "exports": {
+    ".": {
+      "default": "./lib/index.js"
+    },
+    "./client": "./client/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "client",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build:client": "node client/build.mjs",
+    "test": "node --test --test-timeout=30000 \"test/*.test.js\""
+  },
+  "dependencies": {
+    "qrcode": "^1.5.4",
+    "qrcode-terminal": "^0.12.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.9",
+    "ws": "^8.18.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "license": "MIT",
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "mobile",
+    "remote",
+    "qr",
+    "tunnel"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ],
+      "platform": "web"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shaobeichen/dsh-pocket.git"
+  },
+  "bugs": {
+    "url": "https://github.com/shaobeichen/dsh-pocket/issues"
+  },
+  "homepage": "https://github.com/shaobeichen/dsh-pocket",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}