dsh-stop-service 0.3.0

package/LICENSE

@@ -0,0 +1,64 @@
+MIT License
+
+Copyright (c) 2026 KhaosGx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+--------------------------------------------------------------------------------
+THIRD-PARTY NOTICES
+--------------------------------------------------------------------------------
+
+This project includes source code adapted from dsh-client-ui-skill-explorer
+(https://github.com/zhu1090093659/dsh-web): the loopback request fence in
+lib/index.js (isIPv4Loopback / isLoopbackAddress / isLoopbackHostname /
+isLoopbackRequest). That portion retains its original license, reproduced
+below verbatim as required by its terms:
+
+BSD 3-Clause License
+
+Copyright (c) 2026, zhu1090093659
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Modifications to that portion, and all other files in this repository, are
+Copyright (c) 2026 KhaosGx and licensed under the project MIT license above.

package/README.md

@@ -0,0 +1,67 @@
+# dsh-stop-service
+
+A stop-service button for DeepSeek Harness (DSH) Web: one confirmed click gracefully terminates the running dsh host — no more orphaned background processes after closing a terminal. · 为 DeepSeek Harness (DSH) Web 提供「终止服务」按钮：一次带确认的点击即可优雅停止当前 dsh 宿主进程，告别关终端后残留的后台孤儿进程。
+
+## 功能 / Features
+
+- **实时服务信息**：进程 PID、启动时间、运行时长、活跃会话数、内存占用、CPU 占用、Node / DSH 宿主 / 插件版本、平台——每 5 秒自动刷新，附内存趋势迷你图
+- **复制诊断信息**：一键复制版本与运行状态摘要，提 issue 时直接粘贴
+- 带**确认弹窗**的「终止服务」按钮：确认框显示将断开的活跃会话数；宿主进程收到 SIGTERM 优雅退出——会话落盘、端口释放，效果与在终端执行 `kill <pid>` 完全一致
+- **服务回归自动刷新**：停止后持续探测，终端里重启完成时页面自动刷新接回
+- 界面适配 `--dsw-*` 主题变量，跟随皮肤切换；中英双语文案
+
+- Live service info: PID, start time, uptime, active sessions, memory, CPU, Node/DSH/plugin versions, platform — auto-refreshed every 5s, with a memory sparkline.
+- Copy-diagnostics button for issue reports.
+- Confirm-guarded stop button that names the live session count; SIGTERM graceful shutdown, identical to `kill <pid>` from a terminal.
+- Auto-reload once the restarted host comes back.
+- Theme-aware via `--dsw-*` tokens; bilingual (zh/en).
+
+## 兼容性 / Compatibility
+
+- DeepSeek Harness `>= 0.1.2-rc.1`（在 0.1.2-rc.1 实测 / verified on 0.1.2-rc.1）
+- Web profile（`platform: web`）
+
+## 安装 / Install
+
+> [!IMPORTANT]
+> 本插件**未发布到 npm**——`npm install dsh-stop-service` 与 `dsh plugin add dsh-stop-service` 均不可用，请使用下方 Git 安装方式。
+> This plugin is **NOT published on npm** — the npm-based install commands will not work. Use the Git-based methods below.
+
+方式一 / Option 1 — GitHub 直装（实测于 dsh 0.1.2-rc.1 / verified on dsh 0.1.2-rc.1）:
+
+```sh
+dsh plugin --profile web add github:KhaosGx/dsh-stop-service
+```
+
+方式二 / Option 2 — 克隆后本地 link（适合参与开发 / for development）:
+
+```sh
+git clone https://github.com/KhaosGx/dsh-stop-service.git
+cd dsh-stop-service
+dsh plugin --profile web add link:$(pwd)
+```
+
+安装后重启 `dsh web`，按钮位于 **设置 → 服务控制**。/ Restart `dsh web`, then find it under **Settings → Service**.
+
+## 工作原理 / How it works
+
+| 文件 | 职责 |
+|---|---|
+| `lib/index.js` | 宿主侧：注册三个仅限 loopback 的路由——`GET /health`（存活探测）、`GET /info`（服务与 profile 信息）、`POST /stop`（应答后 300ms 自发 SIGTERM） |
+| `lib/client.js` | 浏览器侧：通过官方 `settings.section` 槽位注册设置分区与 React 组件，确认弹窗 → POST stop → 显示重启指引 |
+| `cordis.patch.yml` | bundle 层自登记（`dsh.bundle.patch`） |
+
+## 安全模型 / Security
+
+- 路由仅接受**本机 loopback** 请求：socket 环回地址 + 环回 Host 头 + 浏览器同源标记三者齐备才放行；`X-Forwarded-For` 永不信任，其余一律 `403 forbidden: loopback-only`
+- `stop` 仅接受 POST；动作等价于终端 `kill`，无额外能力，不做持久化、不触网
+
+## 致谢 / Attribution
+
+loopback 请求围栏的实现参考并改编自 [zhu1090093659/dsh-web](https://github.com/zhu1090093659/dsh-web) 的 `dsh-client-ui-skill-explorer`（BSD 3-Clause, © 2026 zhu1090093659），其版权与许可声明保留于 [LICENSE](LICENSE) 的第三方声明部分。
+
+The loopback request fence is adapted from `dsh-client-ui-skill-explorer` by zhu1090093659 (BSD 3-Clause); see the third-party notice in [LICENSE](LICENSE).
+
+## 许可 / License
+
+[MIT](LICENSE) © 2026 KhaosGx

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+# bundle patch for dsh-stop-service: inserts its plugin row into the web
+# profile roster. Applied as a profile bundle layer (the `dsh.bundle.patch`
+# manifest field); install with
+# `dsh plugin --profile web add link:<repo>/dsh-stop-service`.
+- insert:
+    - id: ui-stop-service
+      name: dsh-stop-service

package/lib/client.js

@@ -0,0 +1,379 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 KhaosGx
+
+/**
+ * Browser side of dsh-stop-service.
+ *
+ * Adds a top-level "服务控制 / Service" section to Settings showing live
+ * service info (PID, versions, uptime, memory, loaded bundles) and a
+ * confirm-guarded stop button. The button POSTs /api/dsh-stop-service/stop;
+ * the host replies, then SIGTERMs itself. After the host dies this page
+ * keeps running in the browser and shows the restart hint.
+ */
+window.__ModuleLoader__.load({
+	id: "dsh-stop-service",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		var react = require("react");
+		var jsx_runtime = require("react/jsx-runtime");
+		const jsx = jsx_runtime.jsx;
+
+		/** Dictionary namespace owned by this plugin. */
+		const NS = "stopService";
+		/** Client services required by the settings registration. */
+		const inject = [
+			"slots",
+			"locale"
+		];
+
+		const rowStyle = {
+			display: "flex",
+			justifyContent: "space-between",
+			gap: 16,
+			padding: "6px 0",
+			fontSize: 13,
+			borderBottom: "1px solid var(--dsw-border, rgba(128,128,128,0.18))",
+		};
+		const labelStyle = { opacity: 0.65, flexShrink: 0 };
+		const valueStyle = {
+			fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace",
+			textAlign: "right",
+			wordBreak: "break-all",
+		};
+		/** Theme-aware card frame; fallbacks keep it legible on any theme. */
+		const cardStyle = {
+			border: "1px solid var(--dsw-border, rgba(128,128,128,0.28))",
+			borderRadius: 10,
+			padding: 20,
+			background: "var(--dsw-card-bg, transparent)",
+		};
+
+		function formatUptime(ms, t) {
+			const s = Math.floor(ms / 1000);
+			const d = Math.floor(s / 86400);
+			const h = Math.floor((s % 86400) / 3600);
+			const m = Math.floor((s % 3600) / 60);
+			const sec = s % 60;
+			if (d > 0) return `${d}${t("dayUnit")}${h}${t("hourUnit")}`;
+			if (h > 0) return `${h}${t("hourUnit")}${m}${t("minUnit")}`;
+			if (m > 0) return `${m}${t("minUnit")}${sec}${t("secUnit")}`;
+			return `${sec}${t("secUnit")}`;
+		}
+
+		const InfoCard = ({ t }) => {
+			const [info, setInfo] = react.useState(null);
+			const [history, setHistory] = react.useState([]);
+			const [copied, setCopied] = react.useState(false);
+
+			const copyDiagnostics = async () => {
+				if (info === null) return;
+				const lines = [
+					`DSH host: ${info.hostVersion ?? "-"}`,
+					`Plugin: dsh-stop-service ${info.pluginVersion ?? "-"}`,
+					`Node: ${info.node ?? "-"}`,
+					`Platform: ${info.platform ?? "-"}`,
+					`PID: ${info.pid} · Uptime: ${formatUptime(info.uptimeMs, t)}`,
+					`Memory (RSS): ${info.memoryRssMb} MB · CPU: ${typeof info.cpuPercent === "number" ? `${info.cpuPercent}%` : "-"} · Sessions: ${typeof info.sessionCount === "number" ? info.sessionCount : "-"}`,
+				];
+				try {
+					await navigator.clipboard.writeText(lines.join("\n"));
+					setCopied(true);
+					window.setTimeout(() => setCopied(false), 2000);
+				} catch {
+					// Clipboard denied; ignore.
+				}
+			};
+
+			react.useEffect(() => {
+				let alive = true;
+				const load = async () => {
+					try {
+						const res = await fetch("/api/dsh-stop-service/info");
+						const data = await res.json();
+						if (alive && data?.ok) {
+							setInfo(data);
+							if (typeof data.memoryRssMb === "number") {
+								setHistory((prev) => [...prev, data.memoryRssMb].slice(-36));
+							}
+						}
+					} catch {
+						// Host unreachable (e.g. stopping); keep the last snapshot.
+					}
+				};
+				load();
+				const timer = window.setInterval(load, 5000);
+				return () => {
+					alive = false;
+					window.clearInterval(timer);
+				};
+			}, []);
+
+			if (info === null) {
+				return jsx("p", { style: { fontSize: 13, opacity: 0.6 }, children: t("loading") });
+			}
+
+			const rows = [
+				[t("infoPid"), String(info.pid)],
+				[t("infoStartedAt"), new Date(info.startedAt).toLocaleString()],
+				[t("infoUptime"), formatUptime(info.uptimeMs, t)],
+				[t("infoSessions"), typeof info.sessionCount === "number" ? String(info.sessionCount) : "-"],
+				[t("infoMemory"), `${info.memoryRssMb} MB`],
+				[t("infoCpu"), typeof info.cpuPercent === "number" ? `${info.cpuPercent}%` : "-"],
+				[t("infoNode"), info.node ?? "-"],
+				[t("infoHostVersion"), info.hostVersion ?? "-"],
+				[t("infoPluginVersion"), info.pluginVersion ?? "-"],
+				[t("infoPlatform"), info.platform ?? "-"],
+			];
+
+			return jsx("div", {
+				style: { marginBottom: 20 },
+				children: [
+					jsx("div", {
+						key: "header",
+						style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: 10 },
+						children: [
+							jsx("h3", {
+								key: "title",
+								style: { margin: 0, fontSize: 15 },
+								children: t("infoTitle")
+							}),
+							jsx("button", {
+								key: "copy",
+								onClick: copyDiagnostics,
+								style: {
+									padding: "4px 12px",
+									fontSize: 12,
+									borderRadius: 7,
+									border: "1px solid var(--dsw-border, rgba(128,128,128,0.35))",
+									background: "transparent",
+									color: "inherit",
+									cursor: "pointer",
+								},
+								children: copied ? t("copied") : t("copyDiag")
+							})
+						]
+					}),
+				...rows.map(([label, value]) => jsx("div", { style: rowStyle, children: [
+					jsx("span", { style: labelStyle, children: label }),
+					jsx("span", { style: valueStyle, children: value })
+				] }, label)),
+				history.length >= 2
+					? jsx("div", { key: "sparkline", style: { marginTop: 10 }, children: [
+							jsx("div", { key: "label", style: { fontSize: 11, opacity: 0.55, marginBottom: 4 }, children: `${t("memTrend")} (${history.length * 5}s)` }),
+							jsx("svg", {
+								key: "svg",
+								width: "100%",
+								height: 28,
+								viewBox: "0 0 100 28",
+								preserveAspectRatio: "none",
+								style: { display: "block" },
+								children: jsx("polyline", {
+									points: (() => {
+										const min = Math.min(...history);
+										const max = Math.max(...history);
+										const span = max - min || 1;
+										const step = 100 / (history.length - 1);
+										return history
+											.map((v, i) => `${(i * step).toFixed(1)},${(25 - ((v - min) / span) * 22).toFixed(1)}`)
+											.join(" ");
+									})(),
+									fill: "none",
+									stroke: "var(--dsw-accent, #4a90d9)",
+									strokeWidth: 1.4,
+									vectorEffect: "non-scaling-stroke"
+								})
+							})
+						] })
+					: null,
+			]
+		});
+	};
+
+		const StopCard = ({ t }) => {
+			const [state, setState] = react.useState("idle");
+
+			// After the host dies, watch for its successor and auto-reload so the
+			// user does not have to refresh manually after restarting the service.
+			react.useEffect(() => {
+				if (state !== "stopped") return;
+				let watching = true;
+				const probe = async () => {
+					try {
+						const res = await fetch("/api/dsh-stop-service/health");
+						if (!watching) return;
+						if (res.ok) window.location.reload();
+					} catch {
+						// Still down; keep watching.
+					}
+				};
+				const timer = window.setInterval(probe, 2000);
+				return () => {
+					watching = false;
+					window.clearInterval(timer);
+				};
+			}, [state]);
+
+		const onStop = async () => {
+			// One-shot info fetch so the confirmation can name the live session count.
+			let confirmText = t("confirm");
+			try {
+				const res = await fetch("/api/dsh-stop-service/info");
+				const data = await res.json();
+				if (data?.ok && typeof data.sessionCount === "number") {
+					confirmText = t("confirmN").replace("{n}", String(data.sessionCount));
+				}
+			} catch {
+				// Info unavailable; fall back to the generic confirmation.
+			}
+			if (!window.confirm(confirmText)) return;
+				setState("stopping");
+				try {
+					await fetch("/api/dsh-stop-service/stop", { method: "POST" });
+				} catch {
+					// The host dies right after replying; a network error here
+					// still means the stop request went through.
+				}
+				setState("stopped");
+			};
+
+			if (state === "stopped") {
+				return jsx("p", {
+					style: { fontSize: 14, lineHeight: 1.8, whiteSpace: "pre-line" },
+					children: t("stopped")
+				});
+			}
+
+			return jsx("div", {
+				style: cardStyle,
+				children: [
+					jsx("h3", {
+						key: "title",
+						style: { margin: "0 0 8px", fontSize: 15 },
+						children: t("title")
+					}),
+					jsx("p", {
+						key: "desc",
+						style: { margin: "0 0 4px", fontSize: 13, opacity: 0.85, lineHeight: 1.7 },
+						children: t("desc")
+					}),
+					jsx("p", {
+						key: "hint",
+						style: { margin: "0 0 16px", fontSize: 12, opacity: 0.6, lineHeight: 1.7 },
+						children: t("hint")
+					}),
+					jsx("button", {
+						key: "button",
+						onClick: onStop,
+						disabled: state === "stopping",
+						style: {
+							padding: "8px 18px",
+							fontSize: 13,
+							borderRadius: 8,
+							border: "1px solid var(--dsw-danger, #d33)",
+							background: state === "stopping" ? "transparent" : "var(--dsw-danger, #d33)",
+							color: state === "stopping" ? "var(--dsw-danger, #d33)" : "var(--dsw-danger-text, #fff)",
+							cursor: state === "stopping" ? "default" : "pointer",
+						},
+						children: state === "stopping" ? t("stopping") : t("stop")
+					}),
+				]
+			});
+		};
+
+		const StopServiceTab = ({ t }) => {
+			return jsx("div", {
+				style: { padding: "24px 8px", maxWidth: 560 },
+				children: [
+					jsx(InfoCard, { key: "info", t: t }),
+					jsx(StopCard, { key: "stop", t: t }),
+				]
+			});
+		};
+
+		/**
+		 * Contribute the settings section.
+		 * @param {any} ctx - client context carrying slots/locale.
+		 */
+		function apply(ctx) {
+			ctx.effect(() => ctx.locale.register(NS, {
+				zh: {
+					tab: "服务控制",
+					infoTitle: "服务信息",
+					copyDiag: "复制诊断信息",
+					copied: "已复制 ✓",
+					loading: "读取服务信息…",
+					infoPid: "进程 PID",
+					infoStartedAt: "启动时间",
+					infoUptime: "运行时长",
+					infoSessions: "活跃会话",
+					infoMemory: "内存占用 (RSS)",
+					infoCpu: "CPU 占用",
+					memTrend: "内存趋势",
+					infoNode: "Node 版本",
+					infoHostVersion: "DSH 宿主版本",
+					infoPluginVersion: "插件版本",
+					infoPlatform: "平台",
+					dayUnit: "天",
+					hourUnit: "小时",
+					minUnit: "分",
+					secUnit: "秒",
+					title: "终止服务",
+					desc: "优雅停止当前 DeepSeek Harness 宿主进程（SIGTERM，与终端 kill 相同）：会话落盘、端口释放，不会留下后台孤儿进程。",
+					hint: "停止后需要重启：在终端运行 npx @deepseek-ai/dsh web，服务回归后本页自动刷新。",
+					stop: "终止服务",
+					stopping: "正在停止…",
+					confirm: "确定要终止当前 DeepSeek Harness 服务吗？所有会话将断开（已保存的会话不受影响）。",
+					confirmN: "确定要终止当前 DeepSeek Harness 服务吗？{n} 个活跃会话将断开（已保存的会话不受影响）。",
+					stopped: "服务已停止。\n\n重启方法：在终端运行 npx @deepseek-ai/dsh web。检测到服务重新启动后本页将自动刷新。"
+				},
+				en: {
+					tab: "Service",
+					infoTitle: "Service Info",
+					copyDiag: "Copy diagnostics",
+					copied: "Copied ✓",
+					loading: "Loading service info…",
+					infoPid: "PID",
+					infoStartedAt: "Started at",
+					infoUptime: "Uptime",
+					infoSessions: "Active sessions",
+					infoMemory: "Memory (RSS)",
+					infoCpu: "CPU",
+					memTrend: "Memory trend",
+					infoNode: "Node",
+					infoHostVersion: "DSH host",
+					infoPluginVersion: "Plugin",
+					infoPlatform: "Platform",
+					dayUnit: "d ",
+					hourUnit: "h ",
+					minUnit: "m ",
+					secUnit: "s",
+					title: "Stop Service",
+					desc: "Gracefully stops the current DeepSeek Harness host process (SIGTERM, same as a terminal kill): sessions flush and the port is released — no orphaned background process.",
+					hint: "To start it again, run npx @deepseek-ai/dsh web in a terminal; this page reloads automatically once it is back.",
+					stop: "Stop Service",
+					stopping: "Stopping…",
+					confirm: "Stop the current DeepSeek Harness service? All sessions disconnect (saved sessions are unaffected).",
+					confirmN: "Stop the current DeepSeek Harness service? {n} active sessions will disconnect (saved sessions are unaffected).",
+					stopped: "Service stopped.\n\nTo restart: run npx @deepseek-ai/dsh web in a terminal. This page reloads automatically once the service is back."
+				}
+			}), "stop-service: dictionaries");
+			const t = ctx.locale.bind(NS);
+			ctx.effect(() => ctx.slots.inject("settings.section", () => ctx.slots.register({
+				name: "settings.section",
+				id: "stop-service",
+				order: 50,
+				label: () => t("tab"),
+				locale: NS,
+				inject: () => ({ t })
+			}, StopServiceTab)), "stop-service: settings section");
+		}
+
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});
+
+//# sourceMappingURL=client.js.map

package/lib/index.js

@@ -0,0 +1,249 @@
+// SPDX-License-Identifier: MIT
+//
+// The loopback request fence below (isIPv4Loopback / isLoopbackAddress /
+// isLoopbackHostname / isLoopbackRequest) is adapted from
+// zhu1090093659/dsh-web (dsh-client-ui-skill-explorer):
+//   Copyright (c) 2026, zhu1090093659 — BSD-3-Clause (full text in LICENSE)
+// Modifications and all other code: Copyright (c) 2026 KhaosGx — MIT.
+
+/**
+ * Host side of dsh-stop-service.
+ *
+ * Registers loopback-only routes on the DSH web host:
+ *   GET  /api/dsh-stop-service/health  — liveness probe
+ *   GET  /api/dsh-stop-service/info    — service/process/profile info
+ *   POST /api/dsh-stop-service/stop    — acknowledge, then SIGTERM this process
+ *
+ * SIGTERM is the same signal `kill <pid>` sends from a terminal, which the
+ * host already handles cleanly (session flush + socket release), so the
+ * browser gets its HTTP response before shutdown begins.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const name = "stop-service";
+const inject = ["webServer", "sessions"];
+
+const ROUTES = {
+  health: "/api/dsh-stop-service/health",
+  info: "/api/dsh-stop-service/info",
+  stop: "/api/dsh-stop-service/stop",
+};
+
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+function isIPv4Loopback(v4) {
+  const parts = v4.split(".");
+  return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+function isLoopbackAddress(address) {
+  if (address === void 0) return false;
+  const normalized = address.toLowerCase();
+  if (normalized === "::1") return true;
+  if (normalized.startsWith("::ffff:")) return isIPv4Loopback(normalized.slice(7));
+  return isIPv4Loopback(normalized);
+}
+
+/** Whether a normalized URL hostname names the loopback authority. */
+function isLoopbackHostname(hostname) {
+  if (hostname === "localhost" || hostname === "[::1]") return true;
+  return isIPv4Loopback(hostname);
+}
+
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ * @param {import("node:http").IncomingMessage} request
+ * @returns {boolean}
+ */
+function isLoopbackRequest(request) {
+  if (!isLoopbackAddress(request.socket.remoteAddress)) return false;
+  const host = request.headers.host;
+  if (typeof host !== "string") return false;
+  let hostUrl;
+  try {
+    hostUrl = new URL("http://" + host);
+  } catch {
+    return false;
+  }
+  if (!isLoopbackHostname(hostUrl.hostname)) return false;
+  if (request.headers["sec-fetch-site"] === "cross-site") return false;
+  const origin = request.headers.origin;
+  if (origin === void 0) return true;
+  try {
+    return new URL(origin).host === hostUrl.host;
+  } catch {
+    return false;
+  }
+}
+
+/** Write a JSON response and end it. */
+function writeJson(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store",
+  });
+  res.end(payload);
+}
+
+/** Guard helper: fence + method check. */
+function guard(req, res, method) {
+  if (!isLoopbackRequest(req)) {
+    writeJson(res, 403, { error: "forbidden: loopback-only" });
+    return false;
+  }
+  if (req.method !== method) {
+    writeJson(res, 405, { error: `method not allowed: ${req.method}` });
+    return false;
+  }
+  return true;
+}
+
+/** Resolved dsh home directory (config > env > default ~/.dsh). */
+function dshHomeOf(config) {
+  return config?.dshHome ?? process.env.DSH_HOME ?? homedir() + sep + ".dsh";
+}
+
+/**
+ * CPU usage percent (single-core basis) since the previous /info request,
+ * from process.cpuUsage deltas; null on the first call. Sampled naturally
+ * by the panel's polling cadence.
+ * @returns {number | null}
+ */
+let lastCpuSample = null;
+function cpuPercentSinceLast() {
+  const usage = process.cpuUsage();
+  const now = process.hrtime.bigint();
+  let percent = null;
+  if (lastCpuSample !== null) {
+    const cpuMs = (usage.user - lastCpuSample.user + usage.system - lastCpuSample.system) / 1000;
+    const wallMs = Number(now - lastCpuSample.time) / 1e6;
+    if (wallMs > 0) percent = Math.round((100 * cpuMs) / wallMs * 10) / 10;
+  }
+  lastCpuSample = { user: usage.user, system: usage.system, time: now };
+  return percent;
+}
+
+/**
+ * This plugin's own version, from the package manifest next to lib/.
+ * @returns {string | null}
+ */
+function pluginVersion() {
+  try {
+    const libDir = dirname(fileURLToPath(import.meta.url));
+    const manifest = JSON.parse(readFileSync(join(dirname(libDir), "package.json"), "utf8"));
+    return manifest.name === "dsh-stop-service" ? manifest.version : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Host version serving this profile, from the profile tree's pinned
+ * @deepseek-ai/dsh package manifest.
+ * @returns {string | null}
+ */
+function hostVersion(config) {
+  try {
+    const manifestPath = join(dshHomeOf(config), "profiles", "node_modules", "@deepseek-ai", "dsh", "package.json");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    return manifest.name === "@deepseek-ai/dsh" ? manifest.version : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Profile composition info: bundles list and plugin dependencies from the
+ * web profile's package.json. Read-only; degrades to null.
+ */
+function profileInfo(config) {
+  try {
+    const manifest = JSON.parse(readFileSync(join(dshHomeOf(config), "profiles", "web", "package.json"), "utf8"));
+    return {
+      name: "web",
+      bundles: manifest?.dsh?.profile?.bundles ?? [],
+      plugins: Object.keys(manifest?.dependencies ?? {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Build the route list for ctx.webServer.register.
+ * @param {any} ctx - host plugin context carrying webServer/sessions.
+ * @param {{dshHome?: string}} [config]
+ * @returns {Array<{path: string, handler: (req: any, res: any) => Promise<void>}>}
+ */
+function makeRoutes(ctx, config) {
+  /** Active session count; null when the registry is unavailable. */
+  const sessionCount = () => {
+    try {
+      return typeof ctx.sessions?.list === "function" ? ctx.sessions.list().length : null;
+    } catch {
+      return null;
+    }
+  };
+  return [
+    {
+      path: ROUTES.health,
+      handler: async (req, res) => {
+        if (!guard(req, res, "GET")) return;
+        writeJson(res, 200, { ok: true, plugin: name, pid: process.pid });
+      },
+    },
+    {
+      path: ROUTES.info,
+      handler: async (req, res) => {
+        if (!guard(req, res, "GET")) return;
+        writeJson(res, 200, {
+          ok: true,
+          pid: process.pid,
+          node: process.version,
+          startedAt: new Date(Date.now() - process.uptime() * 1000).toISOString(),
+          uptimeMs: Math.round(process.uptime() * 1000),
+          memoryRssMb: Math.round((process.memoryUsage().rss / 1048576) * 10) / 10,
+          cpuPercent: cpuPercentSinceLast(),
+          platform: `${process.platform} ${process.arch}`,
+          sessionCount: sessionCount(),
+          hostVersion: hostVersion(config),
+          pluginVersion: pluginVersion(),
+          profile: profileInfo(config),
+        });
+      },
+    },
+    {
+      path: ROUTES.stop,
+      handler: async (req, res) => {
+        if (!guard(req, res, "POST")) return;
+        writeJson(res, 200, { ok: true, stopping: true, pid: process.pid });
+        // Let the response flush, then shut down exactly like a terminal kill.
+        setTimeout(() => process.kill(process.pid, "SIGTERM"), 300);
+      },
+    },
+  ];
+}
+
+/**
+ * Mount the stop-service routes.
+ * @param {any} ctx - host plugin context carrying webServer.
+ * @param {{enabled?: boolean, dshHome?: string}} [config] - resolved plugin config.
+ */
+function apply(ctx, config) {
+  if (config?.enabled === false) return;
+  const routes = makeRoutes(ctx, config);
+  ctx.effect(() => {
+    const disposers = routes.map((route) => ctx.webServer.register(route));
+    return () => {
+      for (const dispose of disposers) dispose();
+    };
+  }, "stop-service: routes");
+}
+
+export { ROUTES, apply, inject, name };

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "dsh-stop-service",
+  "version": "0.3.0",
+  "type": "module",
+  "main": "lib/index.js",
+  "description": "A stop-service button for DeepSeek Harness Web: one confirmed click gracefully terminates the running dsh host (SIGTERM) — no orphaned background processes",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KhaosGx/dsh-stop-service.git"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin"
+  ],
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "engines": {
+      "dsh": ">=0.1.2-rc.1"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-theme"
+      ],
+      "platform": "web"
+    }
+  }
+}