dsh-quick-actions 0.1.0-rc.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 lovvvve
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,199 @@
+# dsh-quick-actions
+
+*中文：[README.md](./README.md)*
+
+Global Quick Actions next to every ordinary, session-backed **Resident Composer** in DSH. One press sends a piece of text you wrote in advance.
+
+Preset Quick Actions ship with the package and are read-only — you can hide or clone them. Custom Quick Actions are entirely yours. Everything is persisted through DSH's local Settings and survives restarts.
+
+## What it does
+
+- **Send Actions**: load a piece of static text into the draft and submit it through the official path. There is exactly one loading path, `setDraft(text)` → `submit()`.
+- **Three layouts**: a ribbon above the input, a bar inside it, or a single launcher opening a searchable panel. Switch at any time.
+- **Per-action send confirmation**, on by default and yours to change.
+- **Text starting with `/` is a valid Command Send Action**, adjudicated by DSH itself.
+- Presets and customs are capped at **50 combined**. At the cap, adding and cloning stop; if an upgrade or a config change pushes existing state past it, **no data is lost** — adding and cloning are simply refused until you are back under it.
+
+This release has **no insert action** (insert at the selection, keep the editing context): DSH has not published `insertText`, and this release neither detects nor depends on it. Action text is static — no variables, templates or scripts. Every action is global, with no per-Agent or per-conversation visibility rules and no cross-device sync, import or export. Quick Actions never appear next to a no-session, hero or takeover composer.
+
+## Compatibility
+
+| Item | Value |
+|---|---|
+| Verified baseline | DSH core packages at `0.1.5-rc.1`. Note that `dsh --version` on the desktop build prints its dependency-set label, a different number from the core package version |
+| DSH peers | `>=0.1.5-rc.1` |
+| Cordis | `^4.0.2` |
+| Schemastery | `^3.18.2` |
+| React and React DOM (browser side) | `^18.3.1`, supplied by the web shell's module table rather than installed into the profile |
+| DSH UI primitives (browser side) | `>=0.1.5-rc.1`, also supplied by the module table |
+| Platform | `web` profile only |
+
+Nothing is capability-detected at install or at runtime, so there is no feature tiering that varies with the DSH version: either the whole plugin installs and runs, or it does not.
+
+The floor is the DSH release whose Input contract this plugin reads. **Do not run it against anything older**: `0.1.5-rc.1` renamed `imageIds` to `attachmentIds` in the published snapshot, and this plugin reads the new name.
+
+No upper bound is declared, but **that is not a promise of forward compatibility**. Two things to know:
+
+- **The rc line does break published contracts.** Between `0.1.2-rc.1` and `0.1.5-rc.1`, the very field this plugin uses as its only send precondition was renamed, and the whole Quick Actions area rendered an error boundary after the upgrade. Every DSH upgrade may need a follow-up release of this plugin; if the area shows an error after one, suspect another contract change and please open an issue.
+- **`>=0.1.5-rc.1` does not match the next prerelease under semver.** A prerelease version only satisfies a comparator with the same major.minor.patch, so `0.1.6-rc.1` does not satisfy `>=0.1.5-rc.1` — and every DSH version published so far is a prerelease. The moment DSH ships a new rc, package managers report an unmet peer dependency even when the plugin is fine. That is semver's rule for prereleases rather than this plugin being picky: if `dsh plugin add` installs it, keep using it, and judge breakage by the point above. (The `Issues with peer dependencies found` note under "What a good install looks like" below has a different cause; the two show up together.)
+
+## Install
+
+```sh
+dsh plugin --profile web add dsh-quick-actions
+```
+
+Then restart the web profile. One package is the whole thing: it carries `dsh.bundle.patch`, which inserts its Host half into the profile, while its `dsh.client` declaration makes the web app load the browser half.
+
+### Local / offline install
+
+```sh
+mkdir -p /tmp/quick-actions
+pnpm --filter dsh-quick-actions pack --pack-destination /tmp/quick-actions
+dsh plugin --profile web add /tmp/quick-actions/dsh-quick-actions-0.1.0-rc.3.tgz
+```
+
+The `--filter` form works from anywhere in the repository; from the package directory itself, `pnpm pack --pack-destination /tmp/quick-actions` is the same thing.
+
+Use an **absolute path** for the tarball: `dsh plugin` is a pnpm forwarder and pnpm runs in the profile directory, so a relative path resolves under `<DSH_HOME>/profiles/web/` and fails with `ENOENT`.
+
+### What a good install looks like
+
+- `<DSH_HOME>/profiles/web/package.json` gains `dsh-quick-actions` both under `dependencies` and at the end of `dsh.profile.bundles`. Both are maintained by `dsh plugin` — do not hand-edit them.
+- You can check without starting a server:
+
+  ```sh
+  dsh --profile web --dump-config | grep -A1 'id: composer-quick-actions'
+  ```
+
+  You should see `- id: composer-quick-actions` / `name: dsh-quick-actions`. That row takes effect on the **next profile boot**.
+
+- pnpm prints `Issues with peer dependencies found`. **That is expected**: DSH's own packages live in DSH's install anchor, where the profile's pnpm cannot see them. Every other third-party DSH plugin in the same profile behaves the same way.
+
+### The install fails with `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`
+
+The install may end like this, with **not one of the named packages being this plugin**:
+
+```text
+ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION  4 lockfile entries failed verification:
+  some-other-plugin@1.2.3 was published at ..., within the minimumReleaseAge cutoff (...)
+```
+
+pnpm enforces a supply-chain policy that rejects dependencies published inside a cooling-off window (24 hours by default), and it checks the **whole profile lockfile** rather than only the package you are adding. So if any plugin already in the profile shipped a release in the last day without an exemption, adding anything at all is refused.
+
+To confirm it has nothing to do with this plugin, run a bare `pnpm install` in the profile directory, adding nothing; the same error means exactly that. Three ways out:
+
+1. Pass a flag for this one command, affecting nothing else:
+
+   ```sh
+   dsh plugin --profile web add dsh-quick-actions --config.minimumReleaseAge=0
+   ```
+
+2. Wait the window out. Each line of the error gives a publish time and the cutoff; once the newest is 24 hours old the install works unchanged.
+3. Add each named `name@version` to `minimumReleaseAgeExclude` in `<DSH_HOME>/profiles/web/pnpm-workspace.yaml`, at the cost of giving up that protection for those packages.
+
+## Configuring Preset Quick Actions
+
+The preset catalog is two parts in order: the list built into the package, then whatever the Host composition appends through `Config.presets`. That is the only channel for declaring presets — there is no runtime registration API.
+
+Put `config` on the plugin's row:
+
+```yaml
+# <DSH_HOME>/profiles/web/cordis.patch.yml
+- id: composer-quick-actions
+  config:
+    presets:
+      - id: run-tests
+        label: Run tests
+        text: Run the test suite and paste the failures.
+        icon: ✅
+      - id: add-tests
+        label: Add tests
+        text: Add tests for that change, failing ones first.
+        confirm: false
+```
+
+Field rules:
+
+- `id` is required, unique across the catalog and **permanent**. Label, icon and text may change under the same `id`; `confirm` is part of the safety signature, so changing it needs a new `id` — and so does making the text start with `/`, or stop starting with it.
+- `label` and `text` are required; `icon` and `confirm` are optional, and `confirm` defaults to `true`.
+- An invalid preset (a missing field, a duplicate `id`, a catalog over 50 entries) makes **plugin loading fail loudly** and lists every problem at once, rather than truncating silently.
+
+Users can hide or clone a preset but never edit or delete it; a clone becomes an ordinary Custom Quick Action.
+
+## Three layouts
+
+Layout is a global persisted setting, switched in the management panel:
+
+| Value | Name | Where |
+|---|---|---|
+| `ribbon` (default) | Action ribbon | One row above the input, matching its width |
+| `bar` | Action bar | One row inside the input; whatever does not fit folds into "more" |
+| `launcher` | Single launcher | One entry button opening a searchable panel |
+
+`bar` and `launcher` share the same searchable panel, and the search matches labels and texts only. The management panel is where you reorder, hide, restore and clone presets, create, edit, enable and delete custom actions, and switch layout.
+
+## Command Send Action
+
+Static text whose first non-whitespace character is `/` is marked as a command.
+
+- It travels **exactly the same path** as any other Send Action, and the command is adjudicated by DSH itself; this plugin never parses or rewrites command semantics.
+- Confirmation is on by default and **can be turned off**. The `confirm` you set is never rewritten.
+- With confirmation on, the panel shows precisely what will be submitted. **The native candidate menu you get when typing `/` in the composer does not appear here**, so adjudication may differ from typing the same command by hand.
+- With confirmation off, the command is submitted in one press with no preview.
+- The management form warns you when text becomes a command, but locks no control.
+
+## Settings paths
+
+User data lives in `<DSH_HOME>/settings.yaml` (`~/.dsh` when `DSH_HOME` is unset):
+
+- `composer-quick-actions` — the **only** persisted namespace: layout, custom actions, the shared order and preset differences.
+- `composer-quick-actions-catalog` — the preset catalog. Read-only, never written to the user layer, so it does **not** appear in that file.
+
+The Host is the single validation authority and normalizes stored data idempotently at boot. Every change made in the UI carries an expected revision; on a conflict the panel refreshes to the latest state and asks you to confirm again, never silently overwriting someone else's write. Data written by a higher `schemaVersion` is kept as-is, so a downgrade round-trip loses nothing.
+
+## Upgrade, downgrade and uninstall
+
+**Upgrade / downgrade**:
+
+```sh
+dsh plugin --profile web add dsh-quick-actions@<version>
+```
+
+With a local tarball, `add` the tarball of the version you want. Restart the profile afterwards. Re-adding the same version is idempotent.
+
+Cross-version data compatibility is the Host's job: new presets are appended to the end of the existing order and nothing stored is rewritten.
+
+**Uninstall**:
+
+```sh
+dsh plugin --profile web remove dsh-quick-actions
+```
+
+Both the dependency and the layer in `dsh.profile.bundles` go away. After a profile restart the actions are gone.
+
+**Full manual cleanup** (uninstalling does none of this, because a reinstall should restore your actions):
+
+1. Delete the `composer-quick-actions` section from `<DSH_HOME>/settings.yaml` — the only place user data lives.
+2. Remove any entry you added for this plugin from `<DSH_HOME>/profiles/web/pnpm-workspace.yaml`.
+3. Delete any `config` you wrote for `composer-quick-actions` in the profile's `cordis.patch.yml`.
+4. Restart the profile.
+
+## Development
+
+```sh
+pnpm install
+pnpm build          # Host ESM plus the single-file lazy-CJS Client
+pnpm watch:client   # rebuild the Client bundle only
+pnpm test
+pnpm typecheck
+pnpm lint
+```
+
+Output: the Host is `lib/index.js` and `lib/types.js` (plain Node ESM); the Client is `lib/client.js` plus a sourcemap, a browser-only single-file lazy-CJS bundle; types are `lib/types/**/*.d.ts`, declarations only.
+
+`pnpm watch:client` is **not** DSH GUI HMR. For a change to reach a running page, three things must hold: the profile is loading the checkout you are watching (an offline install loads a copy of the tarball), that checkout's watcher is running and has produced one complete build, and the page has refetched the new output. The Client artifact is published atomically, so a failed watch build keeps the last successful one and the page may still be running old code.
+
+## License
+
+MIT

package/README.md

@@ -0,0 +1,199 @@
+# dsh-quick-actions
+
+*English: [README.en.md](./README.en.md)*
+
+在 DSH 每个常规、由会话支持的**常驻消息编辑器（Resident Composer）**旁提供全局快捷动作。按一下按钮，把预先写好的一段文本发出去。
+
+预置动作（Preset Quick Action）随包提供、只读，你可以隐藏或克隆它；自定义动作（Custom Quick Action）完全归你。所有数据经 DSH 本地 Settings 持久化，跨重启保留。
+
+## 能做什么
+
+- **发送动作**：把一段静态文本装载进草稿并按官方路径提交，装载路径只有一条 `setDraft(text)` → `submit()`。
+- **三种布局**：输入框上方的动作带、输入框内的操作栏、单入口的可搜索面板，随时切换。
+- **每个动作可单独设置发送确认**，默认开启，之后由你决定。
+- **`/` 开头的文本是合法的命令发送动作**，交给 DSH 官方裁决。
+- 预置与自定义**合计上限 50 个**。达到上限后不能再新增或克隆；若升级或配置变化把既有状态推过上限，**已有数据一个都不会丢**，只是在回到上限以内之前禁止新增和克隆。
+
+本版**不提供插入动作**（按选区插入、保留编辑上下文）：DSH 尚未公开 `insertText`，本版既不检测也不依赖它。动作文本是静态的，没有变量、模板或脚本。所有动作全局生效，暂无按 Agent 或按对话的可见性规则，也没有跨设备同步与导入导出。快捷动作不会出现在 no-session、hero 或 takeover 消息编辑器旁。
+
+## 兼容性
+
+| 项目 | 值 |
+|---|---|
+| 验证基线 | DSH 核心包 `0.1.5-rc.1`。桌面端 `dsh --version` 打印的是依赖集标签，与核心包版本不是同一个数字 |
+| DSH peer | `>=0.1.5-rc.1` |
+| Cordis | `^4.0.2` |
+| Schemastery | `^3.18.2` |
+| React 与 React DOM（浏览器侧） | `^18.3.1`，由 web shell 的模块表提供，不从 profile 安装 |
+| DSH UI primitives（浏览器侧） | `>=0.1.5-rc.1`，同样由模块表提供 |
+| 平台 | 只支持 `web` profile |
+
+安装与运行都不检测 DSH 能力，因此不存在随版本变化的功能分档：要么整个插件能装能跑，要么装不上。
+
+下界取的是本插件读取其 Input 契约的那个 DSH 版本。**不要在更低版本上使用**：`0.1.5-rc.1` 把公开快照里的 `imageIds` 改名为 `attachmentIds`，本插件按新名读取。
+
+上界不设，但**这不等于向后兼容有保障**，两点需要知道：
+
+- **rc 阶段会破坏公开契约。** `0.1.2-rc.1` 到 `0.1.5-rc.1` 之间，被本插件用作唯一发送判据的那个字段就被改了名，升级 DSH 后整个快捷动作区域会显示错误边界。每次 DSH 升级都可能需要本插件跟一版；升级后若该区域出错，多半又是契约变更，请提 issue。
+- **`>=0.1.5-rc.1` 在 semver 里匹配不到下一个预发布版本。** 预发布版本只满足「主次修订号完全相同」的比较符，因此 `0.1.6-rc.1` 不满足 `>=0.1.5-rc.1`；而 DSH 至今发布的每个版本都是预发布。DSH 一旦发出新的 rc，包管理器就会报未满足的 peer 依赖，即使插件本身没问题。这是 semver 对预发布的规定，不是本插件挑版本——`dsh plugin add` 装得上就可以继续用，出错时按上一条判断。（下面「装好之后」里那条 `Issues with peer dependencies found` 说的是另一个原因，两者会一起出现。）
+
+## 安装
+
+```sh
+dsh plugin --profile web add dsh-quick-actions
+```
+
+然后重启 web profile。一个包就是全部：它自带 `dsh.bundle.patch` 把自己的 Host 半边插进 profile，`dsh.client` 声明让 web 端加载浏览器半边。
+
+### 本地 / 离线安装
+
+```sh
+mkdir -p /tmp/quick-actions
+pnpm --filter dsh-quick-actions pack --pack-destination /tmp/quick-actions
+dsh plugin --profile web add /tmp/quick-actions/dsh-quick-actions-0.1.0-rc.3.tgz
+```
+
+上面的 `--filter` 形式在仓库任意位置都能用；如果你已经在包目录里，`pnpm pack --pack-destination /tmp/quick-actions` 即可。
+
+tarball 路径要用**绝对路径**：`dsh plugin` 是 pnpm 的转发器，pnpm 在 profile 目录里运行，相对路径会解析到 `<DSH_HOME>/profiles/web/` 下并以 `ENOENT` 失败。
+
+### 装好之后
+
+- `<DSH_HOME>/profiles/web/package.json` 的 `dependencies` 与 `dsh.profile.bundles` 末尾都会多出 `dsh-quick-actions`。这两处由 `dsh plugin` 维护，不要手工编辑。
+- 不启动服务器也能检查：
+
+  ```sh
+  dsh --profile web --dump-config | grep -A1 'id: composer-quick-actions'
+  ```
+
+  应当看到 `- id: composer-quick-actions` / `name: dsh-quick-actions`。这条 row 在**下一次 profile 启动**时生效。
+
+- pnpm 会打印 `Issues with peer dependencies found`。**这是正常的**：DSH 核心包装在 DSH 自己的安装锚点里，profile 的 pnpm 看不到它们。同一 profile 里其它第三方 DSH 插件也是同样表现。
+
+### 安装报 `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`
+
+安装可能以这样的错误结束，而**被点名的包一个都不是本插件**：
+
+```text
+ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION  4 lockfile entries failed verification:
+  some-other-plugin@1.2.3 was published at ..., within the minimumReleaseAge cutoff (...)
+```
+
+pnpm 有一条供应链策略：拒绝发布时间在冷却窗口内（默认 24 小时）的依赖。它校验的是**整个 profile 的 lockfile**，不只是你这次要装的包——所以只要 profile 里任何一个已装插件在最近一天发过新版且没拿到豁免，装任何东西都会被拦下。
+
+想确认与本插件无关，在 profile 目录里单跑一次 `pnpm install`，什么都不加；报同样的错就说明如此。三种处理方式：
+
+1. 给这一次命令加个标志，只影响本次：
+
+   ```sh
+   dsh plugin --profile web add dsh-quick-actions --config.minimumReleaseAge=0
+   ```
+
+2. 等冷却期过去。错误信息里写了每一条的发布时间与截止时间，等最晚的那个满 24 小时即可。
+3. 把被点名的 `名字@版本` 逐条加进 `<DSH_HOME>/profiles/web/pnpm-workspace.yaml` 的 `minimumReleaseAgeExclude`，代价是对这些包放弃这层保护。
+
+## 配置预置动作
+
+预置目录由两部分拼成：先是随包内置的清单，然后是 Host composition 在 `Config.presets` 里追加的条目。`Config.presets` 是预置的唯一声明通道，没有运行时注册 API。
+
+在插件那条 row 上写 `config`：
+
+```yaml
+# <DSH_HOME>/profiles/web/cordis.patch.yml
+- id: composer-quick-actions
+  config:
+    presets:
+      - id: run-tests
+        label: 跑测试
+        text: 把测试跑一遍，把失败项贴出来。
+        icon: ✅
+      - id: add-tests
+        label: 补测试
+        text: 给刚才的改动补上测试，先写失败用例。
+        confirm: false
+```
+
+字段规则：
+
+- `id` 必填、全目录唯一且**永久**。标签、图标、文本可以在同一个 `id` 下改；`confirm` 属于安全行为签名，要改就得换新 `id`——把文本改成以 `/` 开头（或改掉这一点）同样算。
+- `label`、`text` 必填；`icon`、`confirm` 可选，`confirm` 默认 `true`。
+- 预置无效（缺字段、`id` 重复、目录超过 50 条）会让**插件加载响亮失败**并一次列出所有问题，而不是静默截断。
+
+用户对预置只能隐藏或克隆，不能编辑或删除；克隆出来的是一条普通的自定义动作。
+
+## 三种布局
+
+布局是全局持久化设置，在管理面板里切换：
+
+| 值 | 名称 | 位置 |
+|---|---|---|
+| `ribbon`（默认） | 上方动作带 | 输入框上方一行，与输入框等宽 |
+| `bar` | 下方操作栏 | 输入框内部下方一行，装不下的折进「更多」 |
+| `launcher` | 单入口面板 | 一个入口按钮，点开可搜索的动作面板 |
+
+`bar` 与 `launcher` 共用同一个可搜索面板，搜索只匹配标签和文本。管理面板里可以给预置排序、隐藏、恢复、克隆，增删改自定义动作并启停它们，以及切换布局。
+
+## 命令发送动作（Command Send Action）
+
+首个非空白字符是 `/` 的静态文本会被标记为「命令」。
+
+- 它与普通发送动作走**完全相同**的一条路径，命令一律交给 DSH 官方裁决；本插件不解析、不改写命令语义。
+- 确认默认开启，**可以关闭**。你设定的 `confirm` 不会被改写。
+- 确认开启时，面板展示的就是最终提交内容。**但这里不会出现你在原生输入框敲 `/` 时的候选菜单**，因此裁决结果可能与逐字输入同一条命令时不同。
+- 确认关闭时，命令一键提交、没有预览。
+- 管理表单在文本成为命令时给出警示，但不锁定任何控件。
+
+## Settings 路径
+
+用户数据落在 `<DSH_HOME>/settings.yaml`（`DSH_HOME` 未设置时是 `~/.dsh`）：
+
+- `composer-quick-actions` — **唯一的持久化命名空间**，存放布局、自定义动作、统一顺序和预置差异。
+- `composer-quick-actions-catalog` — 预置目录，只读，不写用户层，因此**不会**出现在这个文件里。
+
+Host 是校验的唯一权威，启动时按当前目录对存放的数据做一次幂等规范化。界面的每次修改都带上预期 revision；发生冲突时会刷新到最新状态并请你确认后重试，绝不静默覆盖别人的写入。更高 `schemaVersion` 写下的数据原样保留，因此降级往返无损。
+
+## 升级、降级与卸载
+
+**升级 / 降级**：
+
+```sh
+dsh plugin --profile web add dsh-quick-actions@<version>
+```
+
+本地 tarball 则 `add` 指向目标版本的那个 tarball。之后重启 profile。重复 `add` 同一版本是幂等的。
+
+跨版本的数据兼容由 Host 负责：新增预置只追加到既有顺序末尾，不改写任何已存数据。
+
+**卸载**：
+
+```sh
+dsh plugin --profile web remove dsh-quick-actions
+```
+
+依赖与 `dsh.profile.bundles` 里的那一层会同时去掉，重启 profile 后动作不再出现。
+
+**手工彻底清理**（卸载不做这些，因为重装应当恢复你的动作）：
+
+1. 从 `<DSH_HOME>/settings.yaml` 删掉 `composer-quick-actions` section，这是唯一保存用户数据的地方。
+2. 如果 `<DSH_HOME>/profiles/web/pnpm-workspace.yaml` 里有为本插件加过的条目，一并删掉。
+3. 如果在 profile 的 `cordis.patch.yml` 里给 `composer-quick-actions` 写过 `config`，把那段删掉。
+4. 重启 profile。
+
+## 开发
+
+```sh
+pnpm install
+pnpm build          # Host ESM + Client 单文件 lazy-CJS
+pnpm watch:client   # 只重建 Client bundle
+pnpm test
+pnpm typecheck
+pnpm lint
+```
+
+产物：Host 为 `lib/index.js` 与 `lib/types.js`（标准 Node ESM）；Client 为 `lib/client.js` 加 sourcemap，browser-only 单文件 lazy-CJS；类型为 `lib/types/**/*.d.ts`，只有声明。
+
+`pnpm watch:client` **不等于** DSH GUI 的 HMR。要让改动落到运行中的页面，先确认三件事：被 profile 实际加载的是你正在 watch 的那个 checkout（离线安装装的是 tarball 的副本）；该 checkout 的 watcher 正在跑且已成功产出过一次；页面重新拉取了新产物。Client 产物是原子发布的，watch 构建失败时保留上一次成功的产物，所以页面可能仍在跑旧代码。
+
+## 许可证
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,29 @@
+# The `dsh.bundle.patch` layer of this package.
+#
+# `dsh plugin --profile web add dsh-quick-actions` installs this package as a profile
+# dependency; because the manifest declares `dsh.bundle`, the CLI appends the package to
+# `dsh.profile.bundles`, and profile boot then applies this layer over the bundles ahead of
+# it. The single `insert` mounts this package's own Host half — `name` points at this very
+# package — while its `dsh.client` declaration is what makes the web app load `./client` as
+# the browser half. No profile file needs editing by hand.
+#
+# One package carries both halves and this patch, which is what every other third-party DSH
+# plugin does (ticket 28). An earlier design split the patch into a second `-bundle` package;
+# that only made an offline install need two tarballs plus a profile `overrides` entry,
+# because a direct dependency does not satisfy a transitive one.
+#
+# `id` is the loader entry id and is part of the installed identity: it is what `cordis`
+# reports, what a `disabled` expression in a later layer would target, and what an aggregate
+# bundle would collide with. It stays `composer-quick-actions` even though the package is
+# named `dsh-quick-actions` — the two are different identity axes, and the id matches the
+# domain term (Composer Quick Actions) and the Settings namespaces (spec 19).
+#
+# The plugin takes no required config. To declare additional Preset Quick Actions, add a
+# `config.presets` block for the `composer-quick-actions` id in the PROFILE's own patch
+# layer — `<DSH_HOME>/profiles/<name>/cordis.patch.yml`, which is applied after every bundle
+# layer. Never edit this file in an installed `node_modules`: an install replaces it. An
+# invalid preset there fails plugin loading loudly rather than shipping a partial catalog.
+# The readme has a worked example.
+- insert:
+    - id: composer-quick-actions
+      name: dsh-quick-actions