dsh-preview-blender 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 0.1.0 — 2026-10-20
+
+First release.
+
+- Register a document-preview renderer for `.blend` files in the DSH right Sidebar: clicking a scene opens an interactive 3D viewport instead of the binary-file empty state.
+- Host half: authenticated `GET|HEAD /api/preview/blender` route that exports one GLB plus a scene JSON per file version with `blender --background`, keyed by real path, size, mtime, export recipe and the modifier setting, cached under `~/.dsh/cache/preview-blender` and pruned to `cacheEntries`.
+- Browser half: dependency-free WebGL glTF 2.0 viewer (orbit / pan / zoom / double-click reset / wireframe / auto-rotate / contact shadow / axis triad) and a scene panel with per-object triangle counts, millimetre bounding boxes, material swatches, units and export facts.
+- Configuration: `enabled`, `routePath`, `extensions`, `blenderPath`, `cacheDir`, `timeoutMs`, `maxBytes`, `applyModifiers`, `cacheEntries`.
+- Blender discovery: `DSH_BLENDER`, `BLENDER_PATH`, `PATH`, Steam libraries, `Blender Foundation` installs; a missing binary produces an actionable `BLENDER_MISSING` error instead of a blank panel.
+- Verified on Blender 5.2.2 LTS / DSH Desktop 0.2.1-rc.2 with a real scene (22,960 triangles): 27 unit/adapter tests, cold conversion 2.1 s, warm 3 ms, headless browser e2e ready state with 16% non-background canvas pixels.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 439436269-ctrl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# dsh-preview-blender
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Preview Blender **`.blend`** files inside [DeepSeek Harness](https://github.com/deepseek-ai): the right-Sidebar document preview turns the scene into an interactive 3D viewport (orbit / zoom / wireframe) with a scene-information panel, instead of the built-in “binary file, no preview” empty state.
+
+![The preview inside the DSH right Sidebar](https://raw.githubusercontent.com/439436269-ctrl/dsh-preview-blender/main/docs/preview-blender.png)
+
+## What it does
+
+- Registers a document-preview renderer for `.blend` files, so clicking one in **Workspace files** opens it in the right Sidebar.
+- Runs `blender --background` once per file version to export a **GLB** plus a scene JSON (objects, triangles, materials, real-world size in mm, units, cameras, lights, collections).
+- Draws the GLB with a small **dependency-free WebGL viewer** written for this plugin: orbit, pan, wheel zoom, double-click reset, wireframe mode, auto-rotate, a soft contact shadow and an axis triad. No CDN, no three.js.
+- Caches conversions under `~/.dsh/cache/preview-blender`; the second open is instant (a few milliseconds).
+- Shows the scene facts that matter for CAD/3D-printing work: per-object triangle counts and bounding-box sizes in millimetres, material swatches, scene units.
+
+## Requirements
+
+- DeepSeek Harness 0.2.x (declared compatible with `0.2.0-rc.2` and `0.2.1-rc.2`).
+- **Blender 3.6 / 4.x / 5.x** installed. The plugin auto-detects `DSH_BLENDER`, `BLENDER_PATH`, `blender` on `PATH`, the Steam library, and `C:\Program Files\Blender Foundation\Blender*`. Set `blenderPath` if your install lives elsewhere.
+- A browser/GPU with WebGL (the DSH desktop app always has it).
+
+## Install
+
+```sh
+# into a normal (non-desktop) profile
+dsh plugin --profile <profile> add dsh-preview-blender
+
+# the desktop profile is owned by the Electron app; add it there through the
+# plugin manager UI, or compose it manually and restart the app
+```
+
+The package ships a `cordis.patch.yml`, so installation adds the plugin row automatically. Restart DSH after installing.
+
+## Configuration
+
+Settings → Plugins → **Blender preview** (namespace `preview-blender`):
+
+| Key | Default | Meaning |
+|---|---|---|
+| `enabled` | `true` | Register the renderer and the conversion route. |
+| `routePath` | `/api/preview/blender` | Authenticated conversion route. Must stay under `/api`; otherwise the authenticated fence is bypassed, so it falls back to the default. |
+| `extensions` | `["blend"]` | Suffixes that open in the 3D preview. |
+| `blenderPath` | `""` (auto) | Absolute path of `blender.exe` / `blender`. |
+| `cacheDir` | `""` → `~/.dsh/cache/preview-blender` | Where exported GLB files and scene JSON live. |
+| `timeoutMs` | `180000` | Wall-clock ceiling for one cold conversion. |
+| `maxBytes` | `1073741824` | Largest `.blend` converted (1 GiB). |
+| `applyModifiers` | `true` | Apply modifiers during export, so the preview matches what Blender renders. |
+| `cacheEntries` | `24` | Cached conversions kept on disk before the oldest are pruned. |
+
+## How it works
+
+```
+Workspace file click
+        │
+        ▼
+document preview body (lib/client.js)
+        │  GET /api/preview/blender?path=…&kind=info   (scene JSON)
+        │  GET /api/preview/blender?path=…&kind=glb    (model bytes)
+        ▼
+Host half (lib/index.js, lib/route.js)
+        │  cache key = sha1(realpath, size, mtime, recipe, modifiers)
+        ▼
+lib/blender.js ── spawn blender --background --python lib/scene.py
+        │            → model.glb + scene.json (+ meta.json)
+        ▼
+~/.dsh/cache/preview-blender/<key>/
+```
+
+- `lib/scene.py` exports with `export_apply`, `use_visible`, **Y-up**, no cameras/lights, and writes the scene description (world-space AABBs through the evaluated depsgraph, Principled base colours converted to sRGB swatches).
+- The route lives under `/api`, so the connection service authenticates every request (Host/Origin fence + session cookie). Arbitrary local files are not exposed.
+- The viewer is a hand-written glTF 2.0 subset renderer (POSITION + NORMAL, indexed triangles, PBR factors, node TRS/matrix). Textures, skinning and animation are out of scope; the Host only exports still scenes.
+
+## Development
+
+```
+dev/client-body.js   client UI (single CJS factory for the DSH module loader)
+dev/viewer.js        the WebGL renderer, spliced into the bundle at build time
+scripts/build-client.mjs   builds lib/client.js from the two files
+scripts/e2e-browser.mjs    Playwright end-to-end against a temporary DSH host
+scripts/live-selftest.mjs  cold/warm/concurrent conversion against a real .blend
+node --test test/*.test.js
+```
+
+`lib/client.js` is generated — edit the files under `dev/` and rebuild. The DSH client loader hands the bundle a `require` limited to the platform seed modules, so the package cannot pull a renderer dependency at runtime; the single generated file is the intended shape.
+
+## Notes and limits
+
+- A cold conversion takes roughly 2–10 s for a small scene (Blender startup dominates); it is cached per file version, so rotating/zooming never re-runs Blender.
+- Very large scenes (millions of triangles) export slowly and may exceed `timeoutMs`.
+- Textures are not shown in the viewport (base colours only); the Blender renders next to the file are still the reference.
+- Nothing is uploaded: Blender runs locally and the GLB stays in the local cache.

package/README.zh.md

@@ -0,0 +1,86 @@
+# dsh-preview-blender
+
+在 DeepSeek Harness 的右侧栏文档预览里直接打开 Blender **`.blend`** 文件：用 Blender 后台导出一份 GLB，再用插件自带的 WebGL 视口做可旋转、可缩放的 3D 预览，并列出场景信息。
+
+![右侧栏里的预览](https://raw.githubusercontent.com/439436269-ctrl/dsh-preview-blender/main/docs/preview-blender.png)
+
+## 它做什么
+
+- 给 `.blend` 注册文档预览渲染器：在工作区文件树里点一下，右侧栏就打开 3D 预览，而不是「二进制文件无法预览」。
+- 每个文件版本只跑一次 `blender --background`，导出 **GLB** + 场景 JSON（对象、三角面、材质、真实尺寸 mm、单位、相机、灯光、集合）。
+- 插件自带一个零依赖的 **WebGL 查看器**：拖动旋转、右键平移、滚轮缩放、双击复位、线框模式、自动旋转、接触阴影、坐标轴。不依赖 three.js，不走 CDN。
+- 转换结果缓存在 `~/.dsh/cache/preview-blender`，第二次打开是毫秒级。
+- 面板直接给建模/打印关心的数：每个对象的三角面数与包围盒尺寸（mm）、材质色块、场景单位。
+
+## 依赖
+
+- DeepSeek Harness 0.2.x（声明兼容 `0.2.0-rc.2` / `0.2.1-rc.2`）。
+- **Blender 3.6 / 4.x / 5.x**。会自动找 `DSH_BLENDER`、`BLENDER_PATH`、`PATH` 里的 `blender`、Steam 库、`C:\Program Files\Blender Foundation\Blender*`；装在别处就填 `blenderPath`。
+- 浏览器/显卡支持 WebGL（桌面版 DSH 天然满足）。
+
+## 安装
+
+```sh
+dsh plugin --profile <profile> add dsh-preview-blender
+```
+
+桌面版（desktop profile）由 Electron 应用管着，用设置页的插件管理器安装，或手工装入后重启应用。包内自带 `cordis.patch.yml`，装好即自动挂载。**装完重启 DSH。**
+
+## 配置
+
+设置 → 插件 → **Blender preview**（命名空间 `preview-blender`）：
+
+| 键 | 默认 | 含义 |
+|---|---|---|
+| `enabled` | `true` | 是否注册渲染器与转换路由。 |
+| `routePath` | `/api/preview/blender` | 带鉴权的转换路由；必须留在 `/api` 下，否则回落到默认值（防止裸路由读本地文件）。 |
+| `extensions` | `["blend"]` | 走 3D 预览的后缀。 |
+| `blenderPath` | `""`（自动） | `blender.exe` / `blender` 的绝对路径。 |
+| `cacheDir` | `""` → `~/.dsh/cache/preview-blender` | GLB 与场景 JSON 的缓存目录。 |
+| `timeoutMs` | `180000` | 单次冷转换的墙钟上限。 |
+| `maxBytes` | `1073741824` | 允许转换的最大 `.blend`（1 GiB）。 |
+| `applyModifiers` | `true` | 导出时应用修改器，预览与 Blender 渲染一致。 |
+| `cacheEntries` | `24` | 磁盘上保留多少个缓存条目，超出按最旧淘汰。 |
+
+## 工作原理
+
+```
+点击工作区里的 .blend
+        │
+        ▼
+文档预览 body（lib/client.js）
+        │  GET /api/preview/blender?path=…&kind=info   （场景 JSON）
+        │  GET /api/preview/blender?path=…&kind=glb    （模型字节）
+        ▼
+Host 半（lib/index.js、lib/route.js）
+        │  缓存键 = sha1(realpath, size, mtime, recipe, modifiers)
+        ▼
+lib/blender.js ── spawn blender --background --python lib/scene.py
+        │            → model.glb + scene.json（+ meta.json）
+        ▼
+~/.dsh/cache/preview-blender/<key>/
+```
+
+- `lib/scene.py` 以 `export_apply`、`use_visible`、**Y-up** 导出，不带相机/灯光；场景描述里的世界包围盒走 evaluated depsgraph（含修改器），材质底色从线性色转成 sRGB 色块。
+- 路由挂在 `/api` 下，请求先经过 connection 服务的鉴权（Host/Origin + 会话 cookie），不会把任意本地文件暴露成裸接口。
+- 查看器是手写的 glTF 2.0 子集渲染（POSITION + NORMAL、索引三角形、PBR 因子、节点 TRS/矩阵）。纹理、蒙皮、动画不在范围内——Host 只导出静帧场景。
+
+## 开发
+
+```
+dev/client-body.js   客户端 UI（DSH 模块加载器要求的单个 CJS 工厂）
+dev/viewer.js        WebGL 渲染器，构建时拼进 bundle
+scripts/build-client.mjs   由上面两个文件生成 lib/client.js
+scripts/e2e-browser.mjs    针对临时 DSH 实例的 Playwright 端到端
+scripts/live-selftest.mjs  真实 .blend 的冷/热/并发转换自检
+node --test test/*.test.js
+```
+
+`lib/client.js` 是生成物——改 `dev/` 下的文件后重新构建。DSH 客户端加载器只给 bundle 一枚受限的 `require`（平台种子模块），不能在运行时拉 three.js，所以「单文件产物」是刻意设计。
+
+## 已知边界
+
+- 冷转换小场景约 2–10 秒（Blender 启动为主），之后按文件版本命中缓存，旋转/缩放不会重跑 Blender。
+- 超大场景（数百万三角面）导出慢，可能超过 `timeoutMs`。
+- 视口只显示底色，不显示纹理；纹理效果仍以 Blender 渲染图为准。
+- 不上传任何文件：Blender 在本机跑，GLB 只留在本地缓存。

package/VERIFY.md

@@ -0,0 +1,159 @@
+# Verification record — dsh-preview-blender 0.1.0
+
+Date: 2026-10-20. Machine: Windows 11, DeepSeek Harness Desktop **0.2.1-rc.2**
+(`<DSH install>`), **Blender 5.2.2 LTS**
+(`<Blender install>\blender.exe`), Node 24.22.0.
+Scene under test: `<workspace>\plate-rack-base\out\plate_rack_base.blend`
+(280,645 bytes, 5 mesh objects, 22,960 triangles, 3 materials, 2 collections).
+
+## L1 — unit / adapter tests
+
+```
+node --test test/*.test.js
+# tests 27  pass 27  fail 0
+```
+
+| file | what it proves |
+|---|---|
+| `test/config.test.js` | defaults; route forced under `/api/`; suffix normalization; numeric clamps; `~` expansion; custom cache dir |
+| `test/blender.test.js` | candidate order (config → env → PATH → platform installs); cache-key sensitivity to size / mtime / modifiers; `runProcess` output + exit code + timeout; missing scene refused before spawning; a broken Blender run surfaces `BLEND_EXPORT_FAILED` with the log tail; a complete cache entry is returned without Blender; `BLENDER_MISSING` hint names `blenderPath` and the probed locations |
+| `test/route.test.js` | info JSON (scene + cache facts + Blender version); GLB bytes with `model/gltf-binary` and exact length; HEAD without a body; `path`/`kind`/suffix validation before any conversion; 404 for a missing file; `BLENDER_MISSING` → 503 with the hint |
+| `test/adapter.test.js` | the Host entry imports with a stub schemastery; `apply()` registers `GET|HEAD /api/preview/blender`, publishes `__DSH_PREVIEW_BLENDER_CONFIG__`, disposes both effects; `enabled: false` mounts nothing; the manifest ships `lib/**/*.py` and the client export |
+| `test/client.test.js` | the bundle evaluates in a browser-shaped sandbox, registers id `dsh-preview-blender`, exports `apply`/`inject`/`__createViewer`; `apply()` registers one renderer (`.blend`, extension priority, renderer-owned loading), one body slot and both dictionaries; the injected route path is honoured, and a missing injection falls back to `/api/preview/blender` |
+
+## L2 — live conversion (`scripts/live-selftest.mjs`)
+
+```
+file:   <workspace>/plate-rack-base/out/plate_rack_base.blend
+cache:  %TEMP%\blend-selftest-cache-*
+
+PASS  cold conversion produced a GLB  1050200 bytes
+PASS  cold conversion reports a Blender version  Blender 5.2.2 LTS
+PASS  scene JSON has objects and triangles  5 objects / 22960 tris
+PASS  scene bounds are in millimetres  322 × 144.809 × 182.555
+PASS  cold conversion was not a cache hit  1325 ms
+PASS  second call is a cache hit
+PASS  cache hit is much faster than the cold run  3 ms
+PASS  both calls share one cache key  fcff667d0558178e6981ed49
+PASS  concurrent requests share one in-flight job  1 job(s)
+PASS  concurrent callers get the same artifact
+PASS  cache stays within cacheEntries  1 entries
+
+ALL PASS
+```
+
+The exported GLB is 1,050,200 bytes; the scene JSON reports
+`Base_Full` 322 × 129 × 16 mm (9,092 tris), `Half_L` / `Half_R`
+161 × 129 × 16 mm (4,546 tris each), `Plate` 196 × 126.7 × 157.4 mm,
+`Rack_Proxy` 306 × 113 × 123 mm; units `MILLIMETERS (1000 mm/unit)`.
+
+## L3 — HTTP route on a real DSH host
+
+Temporary profile `blendverify` (web template + the packed tarball),
+`dsh --profile blendverify --no-open --port 0`, authenticated with the
+printed `?token=` cookie:
+
+```
+index: 200 len=35270
+boot has plugin: True
+__DSH_PREVIEW_BLENDER_CONFIG__ injected: True
+info:  200 in 1.4s len=2415
+scene: 22960 tris, blender=Blender 5.2.2 LTS, cached=False, glb=1050200
+glb:   200 bytes=1050200 type=model/gltf-binary
+```
+
+## L4 — headless browser end-to-end (`scripts/e2e-browser.mjs`)
+
+Flow: open the app with the token, start a conversation, open the right
+Sidebar, Workspace files, walk `codes → plate-rack-base → out`, open
+`plate_rack_base.blend`, wait for the preview, sample canvas pixels, toggle
+wireframe and the info panel.
+
+```
+tree segment codes: opened
+tree segment plate-rack-base: opened
+tree segment out: opened
+{
+  "state": "ready",
+  "triangles": "22960",
+  "canvasSize": { "width": 719, "height": 489 },
+  "pixels": { "lit": 8195, "total": 50228, "ratio": 0.1632 },
+  "objectNames": ["Base_Full", "Half_L", "Half_R", "Plate", "Rack_Proxy"],
+  "panelLen": 341,
+  "panelHasSize": true,
+  "panelHidden": "false",
+  "failure": "",
+  "errors": []
+}
+```
+
+The renderer-owned loading flag resolved (`data-blend-state="ready"`), the
+canvas is 719 × 489 device pixels, 16.3% of the sampled pixels are brighter
+than the background (the model is actually drawn, not a blank canvas), all
+five mesh objects appear in the panel, the panel shows `322 … mm`, there are
+no console errors, and the wireframe toggle changes the frame (screenshot).
+
+Screenshots: `scripts/shots/03-preview.png` (solid), `04-wireframe.png`
+(wireframe), `02-sidebar.png` (file tree), and the user-facing copy
+`docs/preview-blender.png`.
+
+## Desktop profile installation
+
+The running app owns its profile, so `dsh plugin --profile desktop …` is
+refused. Installed the same way the earlier media-preview plugin was:
+
+1. Backed up `package.json`, `pnpm-lock.yaml`, `cordis.patch.yml`
+   (`*.bak-blend-20261020-232354`).
+2. Added `"dsh-preview-blender": "file:<repo>/dsh-preview-blender-0.1.0.tgz"`
+   and appended `dsh-preview-blender` to `dsh.profile.bundles`.
+3. `node ~/.dsh/dsh-runtimes/dsh-primary-runtime/dependencies/pnpm/bin/pnpm.cjs install --dir ~/.dsh/profiles/desktop`
+   → `+ dsh-preview-blender 0.1.0`, done in 3.7 s.
+4. Composition proven on a copy of the desktop profile with a junctioned
+   `node_modules`: `--dump-config` contains one `id: preview-blender` row with
+   the shipped config; `--dump-config-schema` reports `status: schema`
+   (Config imported, no `Cannot find package`), then the copy was removed
+   (junction unlinked with `rmdir`, desktop `node_modules` untouched).
+5. Installed `lib/client.js` hash equals the built file
+   `19BDAC036C53637FA857EA638651FD5F82FBB8F5F9B83A787D63D012638A3F6C`.
+
+**Not yet exercised: the restarted desktop app.** The desktop host composes
+its plugin tree at boot, so the new row activates on the next launch. The
+same code and the same client API were exercised end-to-end on the 0.2.0
+web host above; 0.2.1-rc.2 is the release media-preview 0.1.2 already runs
+on, so the document-preview surface is unchanged.
+
+Side effect to know about: `pnpm install` also refreshed an unrelated
+satisfied range, `@vfvrpq/dsh-pinned-sessions` 0.4.0 → 0.4.1 (the profile
+already excludes that version from the release-age gate).
+
+## Pitfalls found
+
+| Symptom | Root cause | Fix |
+|---|---|---|
+| `preview-blender (dsh-preview-blender): failed to import` with no detail; `--dump-config-schema` says `Cannot find package '@deepseek-ai/schemastery' imported from <repo>\lib\schema.js` | `pnpm add <directory>` installs a **link**; Node resolves `@deepseek-ai/schemastery` from the real package path (`<workspace>\…`), which never reaches `~/.dsh/profiles/node_modules` | install from a packed tarball (`pnpm pack` → `dsh plugin add <tgz>`); the copy lives under the profile and resolves the shared `profiles/node_modules` |
+| Preview shows 「这个浏览器/显卡组合不支持 WebGL」 while the canvas is 300×150 | the viewer was created in a mount effect that ran while the component still rendered the “loading” branch (no canvas); it never retried when the canvas appeared | create the viewer from the canvas `ref` callback, dispose on `null`; the model fetch then finds a live viewer |
+| Wireframe toggle changes the button state but not the picture | the LINES pass drew with the triangle index buffer bound instead of the generated edge buffer | bind `primitive.lineIndices` for the edge pass; edges replace the surface (a 68k-edge overlay on top of the solid turned to mush) |
+| Blender reports success but no GLB appears | the glTF exporter rewrites the filepath to end in `.glb`, so `model.glb.part` became `model.glb.part.glb` | write `model.part.glb` and rename to `model.glb` |
+
+## Release — 0.1.0 (2026-10-21)
+
+| Item | Value |
+|---|---|
+| GitHub | https://github.com/439436269-ctrl/dsh-preview-blender (public, topics `dsh-plugin` + `blender`/`gltf`/`preview`/`3d`) |
+| Branch / tag | `main` at `71bb02e` (API-pushed; local `HEAD` is content-equivalent), tag `v0.1.0` → `71bb02e` |
+| CI | `ci` workflow **success** on `71bb02e` (Node 22 + 24) |
+| npm | `dsh-preview-blender@0.1.0`, `dist-tags.latest = 0.1.0` |
+| Published | 2026-10-21T02:40:51.801Z |
+| shasum / integrity | `4efc8df3aeb3fd1cf72dba88eb4a250d75a0d870` / `sha512-8BnUHbg/PFoX6v8uMAxTl+75US3Rs7KmZItBhpAF4GufiJPUOMD4znP9bnyZOBXMIGtle/GN58cK0XBbgwduUQ==` |
+| Tarball | 14 files, 137,744 B unpacked |
+| Install | `dsh plugin --profile <profile> add dsh-preview-blender@0.1.0` |
+
+Artifact read-back:
+
+- `GET /-/package/dsh-preview-blender/dist-tags` → `{"latest":"0.1.0"}`; both `GET /dsh-preview-blender/0.1.0` and `/latest` → 200.
+- Downloaded tarball sha1 == `dist.shasum`; sha512 integrity verified.
+- 13 of 14 files byte-identical to the source tree; the remaining `package.json` differs only in bytes (npm repacks it) while its parsed JSON is semantically equal. `lib/client.js` sha256 `19BDAC036C53637FA857EA638651FD5F82FBB8F5F9B83A787D63D012638A3F6C` matches the built file.
+- Desktop profile dependency switched from the local tarball to `dsh-preview-blender@0.1.0` (explicit version bypasses the 24 h release-age gate; pnpm recorded it in `minimumReleaseAgeExclude`). The installed `lib/client.js` hash still matches the build.
+
+Push note: `github.com:443` reset connections from this network (35 s timeout on `git ls-remote`), so the empty repository was seeded through the Contents API and the tree was pushed with the Git Data API. The server tree equals local `HEAD^{tree}` (`4a1b0c6`); the server commit SHA differs by design (different committer/time), so `git status` shows the local branch ahead until `git fetch` works again.
+

package/cordis.patch.yml

@@ -0,0 +1,31 @@
+# dsh-preview-blender bundle patch: one plugin row.
+#
+# A patch replaces the targeted row's whole `config`, so a profile that wants to
+# override one key must restate the others it cares about. Every key below also
+# has a code-side default in lib/config.js, so this file stays valid even when a
+# patch-side helper is unavailable.
+#
+# `routePath` must stay under /api: the connection service authenticates every
+# /api request (Host/Origin fence + browser session cookie) before the route
+# runs, which is what keeps an arbitrary local file from being readable by a
+# cross-site page.
+
+- insert:
+    - id: preview-blender
+      name: dsh-preview-blender
+      config:
+        enabled: true
+        routePath: /api/preview/blender
+        extensions:
+          - blend
+        # Empty means "detect": DSH_BLENDER / BLENDER_PATH, then PATH, then the
+        # usual Steam and Blender Foundation install locations.
+        blenderPath: ""
+        # Empty means ~/.dsh/cache/preview-blender.
+        cacheDir: ""
+        # A cold conversion runs one Blender process; a 300 MB scene takes
+        # tens of seconds, so the ceiling is generous.
+        timeoutMs: 180000
+        maxBytes: 1073741824
+        applyModifiers: true
+        cacheEntries: 24