dsh-vscode-bridge-he 0.0.0-stage → 1.0.4

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# DSH VSCode Bridge
+
+Adds a bridge between VS Code and the current DSH conversation.
+
+- VS Code right-click on a selection → `DSH: 发送选中代码到 DSH 对话`
+- VS Code right-click on a file in the Explorer → `DSH: 发送文件路径到 DSH 对话`
+- DSH receives an `@absolute/path` reference (plus `(line N)` / `(lines A-B)` for a selection) and inserts it at the current composer caret. It does **not** auto-send the message.
+
+## Architecture
+
+```text
+VS Code extension
+  └─ HTTP POST /dsh-vscode/attach (Bearer token)
+       └─ DSH Host plugin (this package)
+            └─ SSE /dsh-vscode/events
+                 └─ DSH browser plugin
+                      └─ conversation.input.left → InputActions.insertText()
+```
+
+The Host half writes its endpoint and token to `~/.dsh/vscode-bridge.json` (override with `DSH_VSCODE_BRIDGE_FILE`). The VS Code extension reads that file automatically, so no manual token copying is needed. The token file is regenerated when the DSH process/plugin starts.
+
+When no DSH conversation is open, attachments are queued in memory and flushed to the next browser session that connects.
+
+## DSH-side install
+
+This directory is a local DSH bundle. Install it with:
+
+```text
+plugin_manager install_bundle target=C:\...\dsh-vscode-bridge
+```
+
+After installation, refresh the DSH page once (the client plugin and its injected bridge config are added to the page boot). The bundle is enabled in the profile and survives restarts.
+
+## Endpoints
+
+| Method | Path | Auth | Purpose |
+| --- | --- | --- | --- |
+| POST | `/dsh-vscode/attach` | Bearer token | Queue/deliver one reference |
+| GET | `/dsh-vscode/events` | `token` + `channel` query | SSE stream for the browser half |
+| GET | `/dsh-vscode/config` | same-origin page (or Desktop's authenticated forwarded request) | Supplies the browser half with the current token/channel |
+| GET | `/dsh-vscode/health` | none | Connection/queue status for the VS Code status command |
+
+The DSH Desktop renderer runs at `dsh-app://app/` and forwards non-asset
+requests to the Host with its authentication cookie, so the browser half uses
+relative `/dsh-vscode/*` URLs and works both in the Desktop window and in a
+normal browser tab.
+
+## Notes
+
+- Paths are sent as absolute paths so DSH does not depend on its workspace matching the VS Code workspace.
+- The prompt section `vscode-references` teaches the model that `(lines A-B)` means an inclusive 1-based range to read.
+- The browser half renders nothing; it only subscribes and inserts.
+- The bridge is loopback-only by design.

package/client.js

@@ -0,0 +1,180 @@
+window.__ModuleLoader__.load({
+  id: '@local/dsh-vscode-bridge',
+  factory(require) {
+    const React = require('react');
+
+    const RETRY_MS = 500;
+    const MAX_SEEN = 200;
+
+    /**
+     * Invisible composer participant: it owns the SSE subscription for the
+     * current session and inserts incoming VSCode references at the live caret
+     * through the composer's InputActions. Returning null keeps the DSH UI
+     * unchanged.
+     *
+     * This is registered under `conversation.input.left` rather than
+     * `conversation.composer.dock`: the dock is rendered only when the
+     * composer variant is active, so a brand-new session (hero variant) would
+     * not subscribe until its first message and the Host could only queue the
+     * reference. The left tool slot renders in both variants and receives the
+     * same `sessionId`, `inputActions`, and `useInput` props.
+     */
+    function VSCodeBridgeSlot(props) {
+      const sessionId = props.sessionId;
+      const inputActions = props.inputActions;
+      // The dock slot guarantees useInput; subscribing to the draft lets the
+      // insertion add a separator only when the current draft needs one.
+      const draft = props.useInput((snapshot) => snapshot.draft);
+
+      const queueRef = React.useRef([]);
+      const seenRef = React.useRef(new Set());
+      const timerRef = React.useRef(null);
+      const mountedRef = React.useRef(true);
+      const flushRef = React.useRef(() => {});
+
+      flushRef.current = () => {
+        if (!mountedRef.current) return;
+        if (timerRef.current !== null) {
+          clearTimeout(timerRef.current);
+          timerRef.current = null;
+        }
+        if (inputActions === undefined || inputActions === null
+          || typeof inputActions.captureInsertion !== 'function'
+          || typeof inputActions.insertText !== 'function') {
+          return;
+        }
+        while (queueRef.current.length > 0) {
+          const text = queueRef.current[0];
+          let inserted = false;
+          try {
+            const span = inputActions.captureInsertion();
+            const separator = typeof draft === 'string' && draft !== '' && !/\s$/u.test(draft) ? ' ' : '';
+            inserted = inputActions.insertText(`${separator}${text} `, span) === true;
+          } catch (error) {
+            console.warn('[dsh-vscode-bridge] failed to insert reference', error);
+          }
+          if (!inserted) break;
+          queueRef.current.shift();
+        }
+        if (queueRef.current.length > 0 && timerRef.current === null) {
+          timerRef.current = setTimeout(() => {
+            timerRef.current = null;
+            flushRef.current();
+          }, RETRY_MS);
+        }
+      };
+
+      React.useEffect(() => {
+        mountedRef.current = true;
+        flushRef.current();
+        return () => {
+          mountedRef.current = false;
+          if (timerRef.current !== null) {
+            clearTimeout(timerRef.current);
+            timerRef.current = null;
+          }
+        };
+      }, [inputActions]);
+
+      React.useEffect(() => {
+        if (sessionId === undefined || sessionId === null || sessionId === '') return undefined;
+        let closed = false;
+        let source;
+        let onAttachment;
+        let onHello;
+
+        const connect = async () => {
+          let bridge = typeof window === 'undefined' ? undefined : window.__DSH_VSCODE_BRIDGE__;
+          if (bridge === undefined || bridge === null || !bridge.token || !bridge.channel) {
+            try {
+              const response = await fetch('/dsh-vscode/config', {
+                cache: 'no-store',
+                credentials: 'same-origin',
+                headers: { accept: 'application/json' },
+              });
+              if (!response.ok) throw new Error(`HTTP ${response.status}`);
+              bridge = await response.json();
+              if (typeof window !== 'undefined' && bridge !== null && bridge.token && bridge.channel) {
+                window.__DSH_VSCODE_BRIDGE__ = bridge;
+              }
+            } catch (error) {
+              console.warn('[dsh-vscode-bridge] cannot load bridge config; reload DSH after installing the plugin', error);
+              return;
+            }
+          }
+          if (closed || bridge === undefined || bridge === null || !bridge.token || !bridge.channel) return;
+
+          let url;
+          try {
+            url = new URL('/dsh-vscode/events', window.location.origin);
+          } catch (error) {
+            console.warn('[dsh-vscode-bridge] cannot build bridge URL', error);
+            return;
+          }
+          url.searchParams.set('sessionId', sessionId);
+          url.searchParams.set('channel', bridge.channel);
+          url.searchParams.set('token', bridge.token);
+
+          source = new EventSource(url.toString());
+          onAttachment = (event) => {
+            try {
+              const item = JSON.parse(event.data);
+              if (item === null || typeof item !== 'object' || typeof item.text !== 'string') return;
+              const id = String(item.id ?? '');
+              if (id !== '') {
+                if (seenRef.current.has(id)) return;
+                seenRef.current.add(id);
+                if (seenRef.current.size > MAX_SEEN) {
+                  const oldest = seenRef.current.values().next().value;
+                  if (oldest !== undefined) seenRef.current.delete(oldest);
+                }
+              }
+              queueRef.current.push(item.text);
+              flushRef.current();
+            } catch (error) {
+              console.warn('[dsh-vscode-bridge] invalid attachment event', error);
+            }
+          };
+          onHello = (event) => {
+            try {
+              const hello = JSON.parse(event.data);
+              console.info('[dsh-vscode-bridge] connected', hello);
+            } catch {
+              // A malformed hello is not worth surfacing.
+            }
+          };
+
+          source.addEventListener('attachment', onAttachment);
+          source.addEventListener('hello', onHello);
+          source.addEventListener('error', () => {
+            // EventSource retries automatically; keep the queue intact.
+          });
+        };
+
+        void connect();
+
+        return () => {
+          closed = true;
+          if (source !== undefined) {
+            if (onAttachment !== undefined) source.removeEventListener('attachment', onAttachment);
+            if (onHello !== undefined) source.removeEventListener('hello', onHello);
+            source.close();
+          }
+        };
+      }, [sessionId]);
+
+      return null;
+    }
+
+    return {
+      inject: ['slots'],
+      apply(ctx) {
+        ctx.slots.inject('conversation.input.left', () => ctx.slots.register({
+          name: 'conversation.input.left',
+          id: 'vscode-bridge',
+          order: 90,
+        }, VSCodeBridgeSlot));
+      },
+    };
+  },
+});

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# Loader patch contributed by this bundle.
+# `name` must be the exact npm package name so Node module resolution finds it.
+- insert:
+    - id: dsh-vscode-bridge
+      name: dsh-vscode-bridge-he

package/icon.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="VSCode bridge">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#1b6ef3"/>
+      <stop offset="1" stop-color="#0a3fa8"/>
+    </linearGradient>
+  </defs>
+  <rect x="3" y="3" width="58" height="58" rx="15" fill="url(#bg)"/>
+  <path d="M22 20 12 32l10 12" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M42 20l10 12-10 12" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M36 15 28 49" fill="none" stroke="#9fd0ff" stroke-width="4" stroke-linecap="round"/>
+</svg>

package/index.js

@@ -0,0 +1,561 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+/**
+ * DSH VSCode Bridge (Host half).
+ *
+ * The VSCode extension POSTs a selection/file reference to /dsh-vscode/attach.
+ * The browser half of this plugin keeps an SSE stream open and inserts the
+ * reference text into the current composer through InputActions.
+ */
+
+export const inject = ['webServer'];
+
+const ROUTE_PREFIX = '/dsh-vscode';
+const MAX_BODY_BYTES = 64 * 1024;
+const MAX_QUEUE = 100;
+const MAX_HISTORY = 50;
+const HEARTBEAT_MS = 20_000;
+const PUBLISH_RETRY_MS = 100;
+const PUBLISH_MAX_ATTEMPTS = 100;
+
+const EDITOR_REFERENCES_PROMPT = [
+  '## VSCode references',
+  'A message may contain a reference added from VSCode, written as `@<absolute path>` or',
+  '`@"<absolute path>"` and optionally followed by `(line N)` or `(lines A-B)`. The path is',
+  'absolute on the host. When a line marker is present, read that inclusive range from the',
+  'file (use the read tool with offset/limit) before answering; do not claim to have',
+  'inspected the file otherwise.',
+].join('\n');
+
+function bridgeFilePath() {
+  return process.env.DSH_VSCODE_BRIDGE_FILE || join(homedir(), '.dsh', 'vscode-bridge.json');
+}
+
+function tokenMatches(expected, candidate) {
+  if (typeof candidate !== 'string' || candidate.length === 0) return false;
+  const left = Buffer.from(expected, 'utf8');
+  const right = Buffer.from(candidate, 'utf8');
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+function bearerToken(req) {
+  const header = req.headers.authorization;
+  if (typeof header !== 'string') return '';
+  const match = /^Bearer\s+(.+)$/iu.exec(header);
+  return match?.[1]?.trim() ?? '';
+}
+
+function readJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let size = 0;
+    const chunks = [];
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    req.on('data', (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        fail(new Error('body_too_large'));
+        try {
+          req.destroy();
+        } catch {
+          // The peer may already be gone.
+        }
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => {
+      if (settled) return;
+      settled = true;
+      try {
+        const text = Buffer.concat(chunks).toString('utf8');
+        resolve(text === '' ? {} : JSON.parse(text));
+      } catch {
+        reject(new Error('invalid_json'));
+      }
+    });
+    req.on('error', fail);
+    req.on('aborted', () => fail(new Error('aborted')));
+  });
+}
+
+function sendJson(res, status, body) {
+  if (res.destroyed || res.writableEnded) return;
+  const text = JSON.stringify(body);
+  try {
+    res.writeHead(status, {
+      'content-type': 'application/json; charset=utf-8',
+      'content-length': Buffer.byteLength(text),
+      'cache-control': 'no-store',
+    });
+    res.end(text);
+  } catch {
+    // The request was aborted; there is no response to write.
+  }
+}
+
+function toLine(value) {
+  const number = typeof value === 'string' && value.trim() !== '' ? Number(value) : value;
+  if (!Number.isInteger(number) || number < 1 || number > 10_000_000) return undefined;
+  return number;
+}
+
+function cleanSessionId(value) {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (trimmed === '' || trimmed.length > 200) return undefined;
+  if (/[\u0000-\u001f\u007f]/u.test(trimmed)) return undefined;
+  return trimmed;
+}
+
+function quotePath(path) {
+  if (typeof path !== 'string' || path.length === 0 || path.length > 4096) {
+    throw new Error('invalid_path');
+  }
+  if (/[\u0000-\u001f\u007f"]/u.test(path)) {
+    throw new Error('unsupported_path_characters');
+  }
+  return /\s/u.test(path) ? `@"${path}"` : `@${path}`;
+}
+
+function formatAttachmentText(item) {
+  let path = item.absolutePath;
+  if (item.kind === 'directory') {
+    path = `${path.replace(/[\\/]+$/u, '')}/`;
+  }
+  const reference = quotePath(path);
+  if (item.kind === 'selection' && item.startLine !== undefined) {
+    const suffix = item.startLine === item.endLine
+      ? `line ${item.startLine}`
+      : `lines ${item.startLine}-${item.endLine}`;
+    return `${reference} (${suffix})`;
+  }
+  return reference;
+}
+
+function normalizeAttachment(body) {
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+    throw new Error('body_must_be_object');
+  }
+  const absolutePath = body.absolutePath;
+  if (typeof absolutePath !== 'string' || absolutePath.trim() === '' || absolutePath.length > 4096) {
+    throw new Error('invalid_absolute_path');
+  }
+  if (/[\u0000-\u001f\u007f"]/u.test(absolutePath)) {
+    throw new Error('unsupported_path_characters');
+  }
+
+  const kind = body.kind === 'directory'
+    ? 'directory'
+    : body.kind === 'selection' ? 'selection' : 'file';
+
+  let startLine;
+  let endLine;
+  if (kind === 'selection') {
+    startLine = toLine(body.startLine);
+    endLine = toLine(body.endLine ?? body.startLine);
+    if (startLine === undefined) throw new Error('invalid_start_line');
+    if (endLine === undefined || endLine < startLine) throw new Error('invalid_end_line');
+  }
+
+  const item = {
+    absolutePath,
+    kind,
+    ...(startLine === undefined ? {} : { startLine, endLine }),
+  };
+  if (typeof body.relativePath === 'string' && body.relativePath.length <= 4096) {
+    item.relativePath = body.relativePath;
+  }
+  if (typeof body.workspaceRoot === 'string' && body.workspaceRoot.length <= 4096) {
+    item.workspaceRoot = body.workspaceRoot;
+  }
+  if (typeof body.languageId === 'string' && body.languageId.length <= 80) {
+    item.languageId = body.languageId;
+  }
+  if (typeof body.vscodeVersion === 'string' && body.vscodeVersion.length <= 40) {
+    item.vscodeVersion = body.vscodeVersion;
+  }
+  return item;
+}
+
+function injectBridgeConfig(html, token, channel) {
+  const value = JSON.stringify({ token, channel }).replaceAll('<', '\\u003c');
+  const script = `<script>globalThis.__DSH_VSCODE_BRIDGE__=${value};</script>`;
+  if (/<head(?:\s[^>]*)?>/iu.test(html)) {
+    return html.replace(/<head(?:\s[^>]*)?>/iu, (open) => `${open}${script}`);
+  }
+  return `${script}${html}`;
+}
+
+export function apply(ctx) {
+  const token = randomBytes(24).toString('hex');
+  const channel = randomBytes(12).toString('hex');
+  const clients = new Map();
+  const queue = [];
+  const history = [];
+  const bridgeFile = bridgeFilePath();
+
+  let sequence = 0;
+  let lastClientId;
+  let lastSessionId;
+  let published = false;
+  let publishing = false;
+  let publishAttempts = 0;
+  let publishTimer;
+  let disposed = false;
+  let configFetches = 0;
+
+  const info = (...args) => {
+    try {
+      ctx.logger?.info?.('[dsh-vscode-bridge]', ...args);
+    } catch {
+      // Logging must never break the bridge.
+    }
+  };
+  const warn = (...args) => {
+    try {
+      ctx.logger?.warn?.('[dsh-vscode-bridge]', ...args);
+    } catch {
+      // Logging must never break the bridge.
+    }
+  };
+  const origin = () => {
+    try {
+      return ctx.webServer.getOrigin();
+    } catch {
+      return undefined;
+    }
+  };
+
+  const removeClient = (id) => {
+    const client = clients.get(id);
+    if (client === undefined) return;
+    clearInterval(client.heartbeat);
+    clients.delete(id);
+    try {
+      client.res.end();
+    } catch {
+      // The socket is already closed.
+    }
+    if (lastClientId === id) {
+      const remaining = [...clients.values()];
+      const last = remaining[remaining.length - 1];
+      lastClientId = last?.id;
+      lastSessionId = last?.sessionId;
+    }
+  };
+
+  const pushHistory = (item) => {
+    history.push(item);
+    while (history.length > MAX_HISTORY) history.shift();
+  };
+
+  const enqueue = (item) => {
+    queue.push(item);
+    while (queue.length > MAX_QUEUE) queue.shift();
+  };
+
+  const writeEvent = (client, item) => {
+    if (client.res.destroyed || client.res.writableEnded) return false;
+    try {
+      client.res.write(`id: ${String(item.seq)}\nevent: attachment\ndata: ${JSON.stringify(item)}\n\n`);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+
+  const flushQueue = (client) => {
+    if (queue.length === 0) return;
+    const pending = queue.splice(0, queue.length);
+    for (let index = 0; index < pending.length; index += 1) {
+      const item = pending[index];
+      if (!writeEvent(client, item)) {
+        queue.unshift(...pending.slice(index));
+        return;
+      }
+      pushHistory(item);
+    }
+  };
+
+  const deliver = (item) => {
+    const candidates = [...clients.values()];
+    if (candidates.length === 0) {
+      enqueue(item);
+      return { delivered: false, queued: true };
+    }
+    const preferred = (lastClientId === undefined ? undefined : clients.get(lastClientId))
+      ?? candidates[candidates.length - 1];
+    if (preferred === undefined || !writeEvent(preferred, item)) {
+      if (preferred !== undefined) removeClient(preferred.id);
+      enqueue(item);
+      return { delivered: false, queued: true };
+    }
+    pushHistory(item);
+    return { delivered: true, queued: false };
+  };
+
+  const removeBridgeFile = async () => {
+    try {
+      const text = await readFile(bridgeFile, 'utf8');
+      const current = JSON.parse(text);
+      if (current?.token === token) await rm(bridgeFile, { force: true });
+    } catch {
+      // The file may be absent, unreadable, or owned by another instance.
+    }
+  };
+
+  const publishBridgeFile = async () => {
+    if (published || publishing || disposed) return;
+    const url = origin();
+    if (url === undefined) {
+      if (publishTimer === undefined && publishAttempts < PUBLISH_MAX_ATTEMPTS) {
+        publishAttempts += 1;
+        publishTimer = setTimeout(() => {
+          publishTimer = undefined;
+          void publishBridgeFile();
+        }, PUBLISH_RETRY_MS);
+      } else if (publishAttempts >= PUBLISH_MAX_ATTEMPTS) {
+        warn('web server origin is still unavailable; token file was not written');
+      }
+      return;
+    }
+    publishing = true;
+    try {
+      await mkdir(dirname(bridgeFile), { recursive: true });
+      const payload = {
+        version: 1,
+        url,
+        token,
+        channel,
+        profile: process.env.DSH_PROFILE ?? null,
+        pid: process.pid,
+        updatedAt: new Date().toISOString(),
+      };
+      await writeFile(bridgeFile, `${JSON.stringify(payload, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+      });
+      published = true;
+      info(`ready at ${url} (config: ${bridgeFile})`);
+    } catch (error) {
+      warn(`cannot write ${bridgeFile}: ${error instanceof Error ? error.message : String(error)}`);
+    } finally {
+      publishing = false;
+    }
+  };
+
+  const handleAttach = async (req, res) => {
+    if (req.method !== 'POST') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    if (!tokenMatches(token, bearerToken(req))) {
+      sendJson(res, 401, { ok: false, error: 'unauthorized' });
+      return;
+    }
+    let body;
+    try {
+      body = await readJsonBody(req);
+    } catch (error) {
+      sendJson(res, 400, { ok: false, error: error instanceof Error ? error.message : 'invalid_body' });
+      return;
+    }
+    let attachment;
+    try {
+      attachment = normalizeAttachment(body);
+    } catch (error) {
+      sendJson(res, 400, { ok: false, error: error instanceof Error ? error.message : 'invalid_attachment' });
+      return;
+    }
+
+    sequence += 1;
+    const item = {
+      id: String(sequence),
+      seq: sequence,
+      receivedAt: new Date().toISOString(),
+      source: 'vscode',
+      ...attachment,
+    };
+    item.text = formatAttachmentText(item);
+    const outcome = deliver(item);
+    void publishBridgeFile();
+    info(`attachment ${item.id}: ${item.kind} ${item.absolutePath}${item.startLine === undefined ? '' : ` lines ${item.startLine}-${item.endLine}`} delivered=${String(outcome.delivered)}`);
+    sendJson(res, 200, {
+      ok: true,
+      id: item.id,
+      delivered: outcome.delivered,
+      queued: outcome.queued,
+      clients: clients.size,
+    });
+  };
+
+  const handleEvents = (req, res) => {
+    if (req.method !== 'GET') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    let url;
+    try {
+      url = new URL(req.url ?? '/', 'http://localhost');
+    } catch {
+      sendJson(res, 400, { ok: false, error: 'invalid_url' });
+      return;
+    }
+    if (url.searchParams.get('channel') !== channel
+      || !tokenMatches(token, url.searchParams.get('token') ?? '')) {
+      sendJson(res, 403, { ok: false, error: 'forbidden' });
+      return;
+    }
+    const sessionId = cleanSessionId(url.searchParams.get('sessionId'));
+
+    res.writeHead(200, {
+      'content-type': 'text/event-stream; charset=utf-8',
+      'cache-control': 'no-cache, no-transform',
+      connection: 'keep-alive',
+      'x-accel-buffering': 'no',
+    });
+    res.write('retry: 2000\n\n');
+
+    const client = {
+      id: randomBytes(8).toString('hex'),
+      res,
+      sessionId,
+      connectedAt: Date.now(),
+      heartbeat: undefined,
+    };
+    client.heartbeat = setInterval(() => {
+      if (res.destroyed || res.writableEnded) {
+        removeClient(client.id);
+        return;
+      }
+      try {
+        res.write(': ping\n\n');
+      } catch {
+        removeClient(client.id);
+      }
+    }, HEARTBEAT_MS);
+    client.heartbeat.unref?.();
+
+    clients.set(client.id, client);
+    lastClientId = client.id;
+    lastSessionId = sessionId;
+    info(`SSE client ${client.id} connected for session ${sessionId ?? '(unknown)'}`);
+
+    try {
+      res.write(`event: hello\ndata: ${JSON.stringify({
+        connected: true,
+        sessionId: sessionId ?? null,
+        queued: queue.length,
+      })}\n\n`);
+    } catch {
+      removeClient(client.id);
+      return;
+    }
+
+    const lastEventId = Number(req.headers['last-event-id'] ?? '0');
+    if (Number.isFinite(lastEventId) && lastEventId > 0) {
+      for (const item of history) {
+        if (item.seq > lastEventId) writeEvent(client, item);
+      }
+    }
+    flushQueue(client);
+
+    const cleanup = () => {
+      removeClient(client.id);
+    };
+    req.on('close', cleanup);
+    req.on('aborted', cleanup);
+    res.on('close', cleanup);
+    res.on('error', cleanup);
+  };
+
+  const handleConfig = (req, res) => {
+    if (req.method !== 'GET') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    const expected = origin();
+    const originHeader = req.headers.origin;
+    const referer = req.headers.referer;
+    const site = req.headers['sec-fetch-site'];
+    const sameOrigin = expected !== undefined
+      && (originHeader === expected
+        || (typeof referer === 'string' && (referer === expected || referer.startsWith(`${expected}/`)))
+        || site === 'same-origin');
+    // The Desktop renderer uses the dsh-app:// scheme. Its protocol handler
+    // forwards every non-asset request to this server with the Host-issued
+    // authentication cookie, but strips Origin and Sec-Fetch-Site.
+    const desktopForwarded = typeof req.headers.cookie === 'string'
+      && req.headers.cookie !== ''
+      && (typeof referer === 'string' ? referer.startsWith('dsh-app://app/') : true);
+    if (!sameOrigin && !desktopForwarded) {
+      sendJson(res, 403, { ok: false, error: 'forbidden' });
+      return;
+    }
+    configFetches += 1;
+    sendJson(res, 200, { ok: true, version: 1, token, channel });
+  };
+
+  const handleHealth = (req, res) => {
+    if (req.method !== 'GET') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    void publishBridgeFile();
+    sendJson(res, 200, {
+      ok: true,
+      version: 1,
+      clients: clients.size,
+      queued: queue.length,
+      sessionId: lastSessionId ?? null,
+      configFetches,
+    });
+  };
+
+  ctx.effect(() => {
+    const disposers = [
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/attach`, handler: handleAttach }),
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/events`, handler: handleEvents }),
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/config`, handler: handleConfig }),
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/health`, handler: handleHealth }),
+      ctx.webServer.tapIndex((html) => injectBridgeConfig(html, token, channel)),
+    ];
+    return () => {
+      disposed = true;
+      if (publishTimer !== undefined) clearTimeout(publishTimer);
+      for (const disposer of disposers) {
+        try {
+          disposer();
+        } catch {
+          // Disposal is best-effort.
+        }
+      }
+      for (const id of [...clients.keys()]) removeClient(id);
+      queue.length = 0;
+      history.length = 0;
+      void removeBridgeFile();
+    };
+  }, 'dsh-vscode-bridge routes');
+
+  ctx.inject(['systemPrompt'], (child) => {
+    child.effect(
+      () => child.systemPrompt.section({
+        name: 'vscode-references',
+        order: 810,
+        text: EDITOR_REFERENCES_PROMPT,
+      }),
+      'dsh-vscode-bridge prompt',
+    );
+  });
+
+  void publishBridgeFile();
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "VSCode Bridge",
+    "description": "Send the selected code range or a file's absolute path from VSCode into the current DSH conversation."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "VSCode 桥接",
+    "description": "在 VSCode 中右键，将选中的代码范围或文件绝对路径发送到当前 DSH 对话。"
+  }
+}

package/package.json

@@ -1,6 +1,59 @@
-{
+{
   "name": "dsh-vscode-bridge-he",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.4",
+  "type": "module",
+  "description": "Send a VS Code selection or file path into the open DSH conversation as an @path reference, without sending the message.",
+  "license": "MulanPSL-2.0",
+  "author": "HeYitao",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek",
+    "deepseek-harness",
+    "vscode",
+    "editor",
+    "context"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/heyitaowml-ctrl/dsh-vscode-bridge.git",
+    "directory": "dsh-vscode-bridge"
+  },
+  "homepage": "https://github.com/heyitaowml-ctrl/dsh-vscode-bridge#readme",
+  "bugs": {
+    "url": "https://github.com/heyitaowml-ctrl/dsh-vscode-bridge/issues"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "assets/icon-180.png",
+    "README.md"
+  ],
+  "engines": {
+    "dsh": ">=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ]
+    }
+  }
+}