dsh-vscode-bridge-he 0.0.0-stage → 1.0.5

package/README.md

@@ -1,3 +1,100 @@
-# Temporary Holding Version
+# DSH VSCode Bridge
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Send a VS Code selection or a file path into the conversation you already have open in
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH) — as an `@path`
+reference, inserted at the composer caret. It does **not** send the message for you.
+
+> **This package is only the DSH half.** It needs the companion VS Code extension to do
+> anything; installing this alone gives you an idle bridge. Both halves are in the
+> [repository](https://github.com/heyitaowml-ctrl/dsh-vscode-bridge):
+> `dsh-vscode-bridge/` (this package) and `vscode-dsh-bridge/` (the extension).
+
+## Install
+
+**1 · DSH half** — one command, then refresh the DSH page once:
+
+```sh
+dsh plugin --profile <profile> add dsh-vscode-bridge-he
+```
+
+**2 · VS Code half** — pick one:
+
+- **Extensions view:** open VS Code → Extensions → `…` → **Install from VSIX…** → choose
+  [`dist/dsh-vscode-bridge.vsix`](https://github.com/heyitaowml-ctrl/dsh-vscode-bridge/raw/master/dist/dsh-vscode-bridge.vsix)
+- **Terminal:**
+  ```sh
+  code --install-extension dsh-vscode-bridge.vsix
+  ```
+
+Reload the VS Code window afterwards (`Ctrl+Shift+P` → **Developer: Reload Window**); the
+commands appear under **DSH** in the editor and Explorer context menus.
+
+The extension discovers the Host by itself: DSH writes its endpoint and token to
+`~/.dsh/vscode-bridge.json` (override with `DSH_VSCODE_BRIDGE_FILE`) on every start, so
+there is no token to copy by hand.
+
+### Finding out whether the extension is connected
+
+The composer shows a small `⚠ VS Code 未连接` pill until the extension has sent its first
+reference. It disappears on first use and stays hidden afterwards; the `×` dismisses it for
+the current page.
+
+Zero references is the only signal the Host has, so the pill cannot tell "extension not
+installed" apart from "installed but never used" — it deliberately says *not connected*
+rather than *not installed*. If you have just installed the extension and the pill stays,
+reload the VS Code window.
+
+## Usage
+
+- Select lines, right-click in the editor → **DSH: 发送选中代码到 DSH 对话**
+- Right-click a file or folder in the Explorer → **DSH: 发送文件路径到 DSH 对话**
+- Switch back to DSH: the reference is already at the caret, and nothing has been sent.
+
+```text
+@C:\project\src\main.ts (lines 12-28)
+@C:\project\src\main.ts
+@"C:\project\my folder\main.ts" (line 7)
+```
+
+Line markers are inclusive and 1-based; the prompt section `vscode-references` tells the
+model to read that range rather than guess.
+
+## Architecture
+
+```text
+VS Code extension
+  └─ HTTP POST /dsh-vscode/attach (Bearer token)
+       └─ DSH Host plugin (this package)
+            └─ SSE /dsh-vscode/events
+                 └─ DSH browser plugin
+                      └─ conversation.input.left → InputActions.insertText()
+```
+
+When no DSH conversation is open, attachments are queued in memory and flushed to the next
+browser session that connects.
+
+## Endpoints
+
+| Method | Path | Auth | Purpose |
+| --- | --- | --- | --- |
+| POST | `/dsh-vscode/attach` | Bearer token | Queue or deliver one reference |
+| GET | `/dsh-vscode/events` | `token` + `channel` query | SSE stream consumed by the browser half |
+| GET | `/dsh-vscode/config` | same-origin page | Supplies the browser half with the current token/channel |
+| GET | `/dsh-vscode/health` | none | Connection, queue and `attachments` count for the status command |
+
+`/health` and the SSE `hello` frame both report `attachments` (how many references the
+extension has ever sent to this Host instance) and `lastAttachAt`. That pair drives the
+composer hint above.
+
+## Notes
+
+- Paths are sent absolute, so DSH does not have to share a workspace with VS Code.
+- The browser half renders nothing except the connection hint.
+- **The bridge is loopback-only by design.** The Host binds locally, every request carries a
+  per-process bearer token, and the token file is regenerated on each start.
+- This package is unrelated to [`dsh-vscode-bridge`](https://www.npmjs.com/package/dsh-vscode-bridge)
+  on npm, which is a different plugin by a different author.
+
+## License
+
+MulanPSL-2.0

package/client.js

@@ -0,0 +1,254 @@
+window.__ModuleLoader__.load({
+  id: 'dsh-vscode-bridge-he',
+  factory(require) {
+    const React = require('react');
+
+    const RETRY_MS = 500;
+    const MAX_SEEN = 200;
+    // Where the install hint points. Kept in sync with the README's Install section.
+    const INSTALL_DOC_URL = 'https://github.com/heyitaowml-ctrl/dsh-vscode-bridge#install';
+
+    /**
+     * Invisible composer participant: it owns the SSE subscription for the
+     * current session and inserts incoming VSCode references at the live caret
+     * through the composer's InputActions. Returning null keeps the DSH UI
+     * unchanged.
+     *
+     * This is registered under `conversation.input.left` rather than
+     * `conversation.composer.dock`: the dock is rendered only when the
+     * composer variant is active, so a brand-new session (hero variant) would
+     * not subscribe until its first message and the Host could only queue the
+     * reference. The left tool slot renders in both variants and receives the
+     * same `sessionId`, `inputActions`, and `useInput` props.
+     */
+    function VSCodeBridgeSlot(props) {
+      const sessionId = props.sessionId;
+      const inputActions = props.inputActions;
+      // The dock slot guarantees useInput; subscribing to the draft lets the
+      // insertion add a separator only when the current draft needs one.
+      const draft = props.useInput((snapshot) => snapshot.draft);
+
+      // How many references the VS Code extension has ever sent to this Host
+      // instance. `null` means the SSE handshake has not answered yet.
+      // Zero is the only honest signal we have: it cannot tell "extension not
+      // installed" apart from "installed but never used", so the hint says
+      // 未连接 (not connected) rather than 未安装 (not installed).
+      const [attachments, setAttachments] = React.useState(null);
+      const [dismissed, setDismissed] = React.useState(false);
+
+      const queueRef = React.useRef([]);
+      const seenRef = React.useRef(new Set());
+      const timerRef = React.useRef(null);
+      const mountedRef = React.useRef(true);
+      const flushRef = React.useRef(() => {});
+
+      flushRef.current = () => {
+        if (!mountedRef.current) return;
+        if (timerRef.current !== null) {
+          clearTimeout(timerRef.current);
+          timerRef.current = null;
+        }
+        if (inputActions === undefined || inputActions === null
+          || typeof inputActions.captureInsertion !== 'function'
+          || typeof inputActions.insertText !== 'function') {
+          return;
+        }
+        while (queueRef.current.length > 0) {
+          const text = queueRef.current[0];
+          let inserted = false;
+          try {
+            const span = inputActions.captureInsertion();
+            const separator = typeof draft === 'string' && draft !== '' && !/\s$/u.test(draft) ? ' ' : '';
+            inserted = inputActions.insertText(`${separator}${text} `, span) === true;
+          } catch (error) {
+            console.warn('[dsh-vscode-bridge] failed to insert reference', error);
+          }
+          if (!inserted) break;
+          queueRef.current.shift();
+        }
+        if (queueRef.current.length > 0 && timerRef.current === null) {
+          timerRef.current = setTimeout(() => {
+            timerRef.current = null;
+            flushRef.current();
+          }, RETRY_MS);
+        }
+      };
+
+      React.useEffect(() => {
+        mountedRef.current = true;
+        flushRef.current();
+        return () => {
+          mountedRef.current = false;
+          if (timerRef.current !== null) {
+            clearTimeout(timerRef.current);
+            timerRef.current = null;
+          }
+        };
+      }, [inputActions]);
+
+      React.useEffect(() => {
+        if (sessionId === undefined || sessionId === null || sessionId === '') return undefined;
+        let closed = false;
+        let source;
+        let onAttachment;
+        let onHello;
+
+        const connect = async () => {
+          let bridge = typeof window === 'undefined' ? undefined : window.__DSH_VSCODE_BRIDGE__;
+          if (bridge === undefined || bridge === null || !bridge.token || !bridge.channel) {
+            try {
+              const response = await fetch('/dsh-vscode/config', {
+                cache: 'no-store',
+                credentials: 'same-origin',
+                headers: { accept: 'application/json' },
+              });
+              if (!response.ok) throw new Error(`HTTP ${response.status}`);
+              bridge = await response.json();
+              if (typeof window !== 'undefined' && bridge !== null && bridge.token && bridge.channel) {
+                window.__DSH_VSCODE_BRIDGE__ = bridge;
+              }
+            } catch (error) {
+              console.warn('[dsh-vscode-bridge] cannot load bridge config; reload DSH after installing the plugin', error);
+              return;
+            }
+          }
+          if (closed || bridge === undefined || bridge === null || !bridge.token || !bridge.channel) return;
+
+          let url;
+          try {
+            url = new URL('/dsh-vscode/events', window.location.origin);
+          } catch (error) {
+            console.warn('[dsh-vscode-bridge] cannot build bridge URL', error);
+            return;
+          }
+          url.searchParams.set('sessionId', sessionId);
+          url.searchParams.set('channel', bridge.channel);
+          url.searchParams.set('token', bridge.token);
+
+          source = new EventSource(url.toString());
+          onAttachment = (event) => {
+            try {
+              const item = JSON.parse(event.data);
+              if (item === null || typeof item !== 'object' || typeof item.text !== 'string') return;
+              const id = String(item.id ?? '');
+              if (id !== '') {
+                if (seenRef.current.has(id)) return;
+                seenRef.current.add(id);
+                if (seenRef.current.size > MAX_SEEN) {
+                  const oldest = seenRef.current.values().next().value;
+                  if (oldest !== undefined) seenRef.current.delete(oldest);
+                }
+              }
+              queueRef.current.push(item.text);
+              setAttachments((current) => (current === null ? 1 : current + 1));
+              flushRef.current();
+            } catch (error) {
+              console.warn('[dsh-vscode-bridge] invalid attachment event', error);
+            }
+          };
+          onHello = (event) => {
+            try {
+              const hello = JSON.parse(event.data);
+              console.info('[dsh-vscode-bridge] connected', hello);
+              const reported = Number(hello?.attachments ?? 0);
+              setAttachments((current) => {
+                const known = Number.isFinite(reported) && reported > 0 ? reported : 0;
+                if (current === null) return known;
+                return Math.max(current, known);
+              });
+            } catch {
+              // A malformed hello is not worth surfacing.
+            }
+          };
+
+          source.addEventListener('attachment', onAttachment);
+          source.addEventListener('hello', onHello);
+          source.addEventListener('error', () => {
+            // EventSource retries automatically; keep the queue intact.
+          });
+        };
+
+        void connect();
+
+        return () => {
+          closed = true;
+          if (source !== undefined) {
+            if (onAttachment !== undefined) source.removeEventListener('attachment', onAttachment);
+            if (onHello !== undefined) source.removeEventListener('hello', onHello);
+            source.close();
+          }
+        };
+      }, [sessionId]);
+
+      if (dismissed || attachments === null || attachments > 0) return null;
+
+      // Small, theme-neutral pill: it inherits the surrounding text colour and
+      // only lowers its own opacity, so it stays readable in light and dark.
+      return React.createElement(
+        'span',
+        {
+          style: {
+            display: 'inline-flex',
+            alignItems: 'center',
+            gap: 2,
+            height: 22,
+            padding: '0 2px 0 8px',
+            marginRight: 4,
+            fontSize: 11,
+            lineHeight: '22px',
+            borderRadius: 999,
+            border: '1px solid currentColor',
+            opacity: 0.6,
+            whiteSpace: 'nowrap',
+          },
+        },
+        React.createElement(
+          'a',
+          {
+            href: INSTALL_DOC_URL,
+            target: '_blank',
+            rel: 'noreferrer noopener',
+            title: '还没收到过 VS Code 扩展发来的引用。没装过就点这里看安装步骤；装过的话，请在 VS Code 里执行 Developer: Reload Window。',
+            style: { color: 'inherit', textDecoration: 'none', cursor: 'pointer' },
+            onClick: (event) => event.stopPropagation(),
+          },
+          '⚠ VS Code 未连接',
+        ),
+        React.createElement(
+          'button',
+          {
+            type: 'button',
+            title: '不再提示',
+            'aria-label': 'dismiss the VS Code extension hint',
+            onClick: (event) => {
+              event.preventDefault();
+              event.stopPropagation();
+              setDismissed(true);
+            },
+            style: {
+              border: 'none',
+              background: 'transparent',
+              color: 'inherit',
+              cursor: 'pointer',
+              fontSize: 13,
+              lineHeight: '18px',
+              padding: '0 4px',
+            },
+          },
+          '×',
+        ),
+      );
+    }
+
+    return {
+      inject: ['slots'],
+      apply(ctx) {
+        ctx.slots.inject('conversation.input.left', () => ctx.slots.register({
+          name: 'conversation.input.left',
+          id: 'vscode-bridge',
+          order: 90,
+        }, VSCodeBridgeSlot));
+      },
+    };
+  },
+});

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# Loader patch contributed by this bundle.
+# `name` must be the exact npm package name so Node module resolution finds it.
+- insert:
+    - id: dsh-vscode-bridge
+      name: dsh-vscode-bridge-he

package/icon.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="VSCode bridge">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#1b6ef3"/>
+      <stop offset="1" stop-color="#0a3fa8"/>
+    </linearGradient>
+  </defs>
+  <rect x="3" y="3" width="58" height="58" rx="15" fill="url(#bg)"/>
+  <path d="M22 20 12 32l10 12" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M42 20l10 12-10 12" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M36 15 28 49" fill="none" stroke="#9fd0ff" stroke-width="4" stroke-linecap="round"/>
+</svg>

package/index.js

@@ -0,0 +1,567 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+/**
+ * DSH VSCode Bridge (Host half).
+ *
+ * The VSCode extension POSTs a selection/file reference to /dsh-vscode/attach.
+ * The browser half of this plugin keeps an SSE stream open and inserts the
+ * reference text into the current composer through InputActions.
+ */
+
+export const inject = ['webServer'];
+
+const ROUTE_PREFIX = '/dsh-vscode';
+const MAX_BODY_BYTES = 64 * 1024;
+const MAX_QUEUE = 100;
+const MAX_HISTORY = 50;
+const HEARTBEAT_MS = 20_000;
+const PUBLISH_RETRY_MS = 100;
+const PUBLISH_MAX_ATTEMPTS = 100;
+
+const EDITOR_REFERENCES_PROMPT = [
+  '## VSCode references',
+  'A message may contain a reference added from VSCode, written as `@<absolute path>` or',
+  '`@"<absolute path>"` and optionally followed by `(line N)` or `(lines A-B)`. The path is',
+  'absolute on the host. When a line marker is present, read that inclusive range from the',
+  'file (use the read tool with offset/limit) before answering; do not claim to have',
+  'inspected the file otherwise.',
+].join('\n');
+
+function bridgeFilePath() {
+  return process.env.DSH_VSCODE_BRIDGE_FILE || join(homedir(), '.dsh', 'vscode-bridge.json');
+}
+
+function tokenMatches(expected, candidate) {
+  if (typeof candidate !== 'string' || candidate.length === 0) return false;
+  const left = Buffer.from(expected, 'utf8');
+  const right = Buffer.from(candidate, 'utf8');
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+function bearerToken(req) {
+  const header = req.headers.authorization;
+  if (typeof header !== 'string') return '';
+  const match = /^Bearer\s+(.+)$/iu.exec(header);
+  return match?.[1]?.trim() ?? '';
+}
+
+function readJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let size = 0;
+    const chunks = [];
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    req.on('data', (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        fail(new Error('body_too_large'));
+        try {
+          req.destroy();
+        } catch {
+          // The peer may already be gone.
+        }
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => {
+      if (settled) return;
+      settled = true;
+      try {
+        const text = Buffer.concat(chunks).toString('utf8');
+        resolve(text === '' ? {} : JSON.parse(text));
+      } catch {
+        reject(new Error('invalid_json'));
+      }
+    });
+    req.on('error', fail);
+    req.on('aborted', () => fail(new Error('aborted')));
+  });
+}
+
+function sendJson(res, status, body) {
+  if (res.destroyed || res.writableEnded) return;
+  const text = JSON.stringify(body);
+  try {
+    res.writeHead(status, {
+      'content-type': 'application/json; charset=utf-8',
+      'content-length': Buffer.byteLength(text),
+      'cache-control': 'no-store',
+    });
+    res.end(text);
+  } catch {
+    // The request was aborted; there is no response to write.
+  }
+}
+
+function toLine(value) {
+  const number = typeof value === 'string' && value.trim() !== '' ? Number(value) : value;
+  if (!Number.isInteger(number) || number < 1 || number > 10_000_000) return undefined;
+  return number;
+}
+
+function cleanSessionId(value) {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (trimmed === '' || trimmed.length > 200) return undefined;
+  if (/[\u0000-\u001f\u007f]/u.test(trimmed)) return undefined;
+  return trimmed;
+}
+
+function quotePath(path) {
+  if (typeof path !== 'string' || path.length === 0 || path.length > 4096) {
+    throw new Error('invalid_path');
+  }
+  if (/[\u0000-\u001f\u007f"]/u.test(path)) {
+    throw new Error('unsupported_path_characters');
+  }
+  return /\s/u.test(path) ? `@"${path}"` : `@${path}`;
+}
+
+function formatAttachmentText(item) {
+  let path = item.absolutePath;
+  if (item.kind === 'directory') {
+    path = `${path.replace(/[\\/]+$/u, '')}/`;
+  }
+  const reference = quotePath(path);
+  if (item.kind === 'selection' && item.startLine !== undefined) {
+    const suffix = item.startLine === item.endLine
+      ? `line ${item.startLine}`
+      : `lines ${item.startLine}-${item.endLine}`;
+    return `${reference} (${suffix})`;
+  }
+  return reference;
+}
+
+function normalizeAttachment(body) {
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+    throw new Error('body_must_be_object');
+  }
+  const absolutePath = body.absolutePath;
+  if (typeof absolutePath !== 'string' || absolutePath.trim() === '' || absolutePath.length > 4096) {
+    throw new Error('invalid_absolute_path');
+  }
+  if (/[\u0000-\u001f\u007f"]/u.test(absolutePath)) {
+    throw new Error('unsupported_path_characters');
+  }
+
+  const kind = body.kind === 'directory'
+    ? 'directory'
+    : body.kind === 'selection' ? 'selection' : 'file';
+
+  let startLine;
+  let endLine;
+  if (kind === 'selection') {
+    startLine = toLine(body.startLine);
+    endLine = toLine(body.endLine ?? body.startLine);
+    if (startLine === undefined) throw new Error('invalid_start_line');
+    if (endLine === undefined || endLine < startLine) throw new Error('invalid_end_line');
+  }
+
+  const item = {
+    absolutePath,
+    kind,
+    ...(startLine === undefined ? {} : { startLine, endLine }),
+  };
+  if (typeof body.relativePath === 'string' && body.relativePath.length <= 4096) {
+    item.relativePath = body.relativePath;
+  }
+  if (typeof body.workspaceRoot === 'string' && body.workspaceRoot.length <= 4096) {
+    item.workspaceRoot = body.workspaceRoot;
+  }
+  if (typeof body.languageId === 'string' && body.languageId.length <= 80) {
+    item.languageId = body.languageId;
+  }
+  if (typeof body.vscodeVersion === 'string' && body.vscodeVersion.length <= 40) {
+    item.vscodeVersion = body.vscodeVersion;
+  }
+  return item;
+}
+
+function injectBridgeConfig(html, token, channel) {
+  const value = JSON.stringify({ token, channel }).replaceAll('<', '\\u003c');
+  const script = `<script>globalThis.__DSH_VSCODE_BRIDGE__=${value};</script>`;
+  if (/<head(?:\s[^>]*)?>/iu.test(html)) {
+    return html.replace(/<head(?:\s[^>]*)?>/iu, (open) => `${open}${script}`);
+  }
+  return `${script}${html}`;
+}
+
+export function apply(ctx) {
+  const token = randomBytes(24).toString('hex');
+  const channel = randomBytes(12).toString('hex');
+  const clients = new Map();
+  const queue = [];
+  const history = [];
+  const bridgeFile = bridgeFilePath();
+
+  let sequence = 0;
+  let lastClientId;
+  let lastSessionId;
+  let lastAttachAt;
+  let published = false;
+  let publishing = false;
+  let publishAttempts = 0;
+  let publishTimer;
+  let disposed = false;
+  let configFetches = 0;
+
+  const info = (...args) => {
+    try {
+      ctx.logger?.info?.('[dsh-vscode-bridge]', ...args);
+    } catch {
+      // Logging must never break the bridge.
+    }
+  };
+  const warn = (...args) => {
+    try {
+      ctx.logger?.warn?.('[dsh-vscode-bridge]', ...args);
+    } catch {
+      // Logging must never break the bridge.
+    }
+  };
+  const origin = () => {
+    try {
+      return ctx.webServer.getOrigin();
+    } catch {
+      return undefined;
+    }
+  };
+
+  const removeClient = (id) => {
+    const client = clients.get(id);
+    if (client === undefined) return;
+    clearInterval(client.heartbeat);
+    clients.delete(id);
+    try {
+      client.res.end();
+    } catch {
+      // The socket is already closed.
+    }
+    if (lastClientId === id) {
+      const remaining = [...clients.values()];
+      const last = remaining[remaining.length - 1];
+      lastClientId = last?.id;
+      lastSessionId = last?.sessionId;
+    }
+  };
+
+  const pushHistory = (item) => {
+    history.push(item);
+    while (history.length > MAX_HISTORY) history.shift();
+  };
+
+  const enqueue = (item) => {
+    queue.push(item);
+    while (queue.length > MAX_QUEUE) queue.shift();
+  };
+
+  const writeEvent = (client, item) => {
+    if (client.res.destroyed || client.res.writableEnded) return false;
+    try {
+      client.res.write(`id: ${String(item.seq)}\nevent: attachment\ndata: ${JSON.stringify(item)}\n\n`);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+
+  const flushQueue = (client) => {
+    if (queue.length === 0) return;
+    const pending = queue.splice(0, queue.length);
+    for (let index = 0; index < pending.length; index += 1) {
+      const item = pending[index];
+      if (!writeEvent(client, item)) {
+        queue.unshift(...pending.slice(index));
+        return;
+      }
+      pushHistory(item);
+    }
+  };
+
+  const deliver = (item) => {
+    const candidates = [...clients.values()];
+    if (candidates.length === 0) {
+      enqueue(item);
+      return { delivered: false, queued: true };
+    }
+    const preferred = (lastClientId === undefined ? undefined : clients.get(lastClientId))
+      ?? candidates[candidates.length - 1];
+    if (preferred === undefined || !writeEvent(preferred, item)) {
+      if (preferred !== undefined) removeClient(preferred.id);
+      enqueue(item);
+      return { delivered: false, queued: true };
+    }
+    pushHistory(item);
+    return { delivered: true, queued: false };
+  };
+
+  const removeBridgeFile = async () => {
+    try {
+      const text = await readFile(bridgeFile, 'utf8');
+      const current = JSON.parse(text);
+      if (current?.token === token) await rm(bridgeFile, { force: true });
+    } catch {
+      // The file may be absent, unreadable, or owned by another instance.
+    }
+  };
+
+  const publishBridgeFile = async () => {
+    if (published || publishing || disposed) return;
+    const url = origin();
+    if (url === undefined) {
+      if (publishTimer === undefined && publishAttempts < PUBLISH_MAX_ATTEMPTS) {
+        publishAttempts += 1;
+        publishTimer = setTimeout(() => {
+          publishTimer = undefined;
+          void publishBridgeFile();
+        }, PUBLISH_RETRY_MS);
+      } else if (publishAttempts >= PUBLISH_MAX_ATTEMPTS) {
+        warn('web server origin is still unavailable; token file was not written');
+      }
+      return;
+    }
+    publishing = true;
+    try {
+      await mkdir(dirname(bridgeFile), { recursive: true });
+      const payload = {
+        version: 1,
+        url,
+        token,
+        channel,
+        profile: process.env.DSH_PROFILE ?? null,
+        pid: process.pid,
+        updatedAt: new Date().toISOString(),
+      };
+      await writeFile(bridgeFile, `${JSON.stringify(payload, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+      });
+      published = true;
+      info(`ready at ${url} (config: ${bridgeFile})`);
+    } catch (error) {
+      warn(`cannot write ${bridgeFile}: ${error instanceof Error ? error.message : String(error)}`);
+    } finally {
+      publishing = false;
+    }
+  };
+
+  const handleAttach = async (req, res) => {
+    if (req.method !== 'POST') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    if (!tokenMatches(token, bearerToken(req))) {
+      sendJson(res, 401, { ok: false, error: 'unauthorized' });
+      return;
+    }
+    let body;
+    try {
+      body = await readJsonBody(req);
+    } catch (error) {
+      sendJson(res, 400, { ok: false, error: error instanceof Error ? error.message : 'invalid_body' });
+      return;
+    }
+    let attachment;
+    try {
+      attachment = normalizeAttachment(body);
+    } catch (error) {
+      sendJson(res, 400, { ok: false, error: error instanceof Error ? error.message : 'invalid_attachment' });
+      return;
+    }
+
+    sequence += 1;
+    const item = {
+      id: String(sequence),
+      seq: sequence,
+      receivedAt: new Date().toISOString(),
+      source: 'vscode',
+      ...attachment,
+    };
+    item.text = formatAttachmentText(item);
+    lastAttachAt = item.receivedAt;
+    const outcome = deliver(item);
+    void publishBridgeFile();
+    info(`attachment ${item.id}: ${item.kind} ${item.absolutePath}${item.startLine === undefined ? '' : ` lines ${item.startLine}-${item.endLine}`} delivered=${String(outcome.delivered)}`);
+    sendJson(res, 200, {
+      ok: true,
+      id: item.id,
+      delivered: outcome.delivered,
+      queued: outcome.queued,
+      clients: clients.size,
+    });
+  };
+
+  const handleEvents = (req, res) => {
+    if (req.method !== 'GET') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    let url;
+    try {
+      url = new URL(req.url ?? '/', 'http://localhost');
+    } catch {
+      sendJson(res, 400, { ok: false, error: 'invalid_url' });
+      return;
+    }
+    if (url.searchParams.get('channel') !== channel
+      || !tokenMatches(token, url.searchParams.get('token') ?? '')) {
+      sendJson(res, 403, { ok: false, error: 'forbidden' });
+      return;
+    }
+    const sessionId = cleanSessionId(url.searchParams.get('sessionId'));
+
+    res.writeHead(200, {
+      'content-type': 'text/event-stream; charset=utf-8',
+      'cache-control': 'no-cache, no-transform',
+      connection: 'keep-alive',
+      'x-accel-buffering': 'no',
+    });
+    res.write('retry: 2000\n\n');
+
+    const client = {
+      id: randomBytes(8).toString('hex'),
+      res,
+      sessionId,
+      connectedAt: Date.now(),
+      heartbeat: undefined,
+    };
+    client.heartbeat = setInterval(() => {
+      if (res.destroyed || res.writableEnded) {
+        removeClient(client.id);
+        return;
+      }
+      try {
+        res.write(': ping\n\n');
+      } catch {
+        removeClient(client.id);
+      }
+    }, HEARTBEAT_MS);
+    client.heartbeat.unref?.();
+
+    clients.set(client.id, client);
+    lastClientId = client.id;
+    lastSessionId = sessionId;
+    info(`SSE client ${client.id} connected for session ${sessionId ?? '(unknown)'}`);
+
+    try {
+      res.write(`event: hello\ndata: ${JSON.stringify({
+        connected: true,
+        sessionId: sessionId ?? null,
+        queued: queue.length,
+        attachments: sequence,
+        lastAttachAt: lastAttachAt ?? null,
+      })}\n\n`);
+    } catch {
+      removeClient(client.id);
+      return;
+    }
+
+    const lastEventId = Number(req.headers['last-event-id'] ?? '0');
+    if (Number.isFinite(lastEventId) && lastEventId > 0) {
+      for (const item of history) {
+        if (item.seq > lastEventId) writeEvent(client, item);
+      }
+    }
+    flushQueue(client);
+
+    const cleanup = () => {
+      removeClient(client.id);
+    };
+    req.on('close', cleanup);
+    req.on('aborted', cleanup);
+    res.on('close', cleanup);
+    res.on('error', cleanup);
+  };
+
+  const handleConfig = (req, res) => {
+    if (req.method !== 'GET') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    const expected = origin();
+    const originHeader = req.headers.origin;
+    const referer = req.headers.referer;
+    const site = req.headers['sec-fetch-site'];
+    const sameOrigin = expected !== undefined
+      && (originHeader === expected
+        || (typeof referer === 'string' && (referer === expected || referer.startsWith(`${expected}/`)))
+        || site === 'same-origin');
+    // The Desktop renderer uses the dsh-app:// scheme. Its protocol handler
+    // forwards every non-asset request to this server with the Host-issued
+    // authentication cookie, but strips Origin and Sec-Fetch-Site.
+    const desktopForwarded = typeof req.headers.cookie === 'string'
+      && req.headers.cookie !== ''
+      && (typeof referer === 'string' ? referer.startsWith('dsh-app://app/') : true);
+    if (!sameOrigin && !desktopForwarded) {
+      sendJson(res, 403, { ok: false, error: 'forbidden' });
+      return;
+    }
+    configFetches += 1;
+    sendJson(res, 200, { ok: true, version: 1, token, channel });
+  };
+
+  const handleHealth = (req, res) => {
+    if (req.method !== 'GET') {
+      sendJson(res, 405, { ok: false, error: 'method_not_allowed' });
+      return;
+    }
+    void publishBridgeFile();
+    sendJson(res, 200, {
+      ok: true,
+      version: 1,
+      clients: clients.size,
+      queued: queue.length,
+      sessionId: lastSessionId ?? null,
+      configFetches,
+      attachments: sequence,
+      lastAttachAt: lastAttachAt ?? null,
+    });
+  };
+
+  ctx.effect(() => {
+    const disposers = [
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/attach`, handler: handleAttach }),
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/events`, handler: handleEvents }),
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/config`, handler: handleConfig }),
+      ctx.webServer.register({ kind: 'exact', path: `${ROUTE_PREFIX}/health`, handler: handleHealth }),
+      ctx.webServer.tapIndex((html) => injectBridgeConfig(html, token, channel)),
+    ];
+    return () => {
+      disposed = true;
+      if (publishTimer !== undefined) clearTimeout(publishTimer);
+      for (const disposer of disposers) {
+        try {
+          disposer();
+        } catch {
+          // Disposal is best-effort.
+        }
+      }
+      for (const id of [...clients.keys()]) removeClient(id);
+      queue.length = 0;
+      history.length = 0;
+      void removeBridgeFile();
+    };
+  }, 'dsh-vscode-bridge routes');
+
+  ctx.inject(['systemPrompt'], (child) => {
+    child.effect(
+      () => child.systemPrompt.section({
+        name: 'vscode-references',
+        order: 810,
+        text: EDITOR_REFERENCES_PROMPT,
+      }),
+      'dsh-vscode-bridge prompt',
+    );
+  });
+
+  void publishBridgeFile();
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "VSCode Bridge",
+    "description": "Send the selected code range or a file's absolute path from VSCode into the current DSH conversation."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "VSCode 桥接",
+    "description": "在 VSCode 中右键，将选中的代码范围或文件绝对路径发送到当前 DSH 对话。"
+  }
+}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "dsh-vscode-bridge-he",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.5",
+  "type": "module",
+  "description": "Send a VS Code selection or file path into the open DSH conversation as an @path reference, without sending the message.",
+  "license": "MulanPSL-2.0",
+  "author": "HeYitao",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek",
+    "deepseek-harness",
+    "vscode",
+    "editor",
+    "context"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/heyitaowml-ctrl/dsh-vscode-bridge.git",
+    "directory": "dsh-vscode-bridge"
+  },
+  "homepage": "https://github.com/heyitaowml-ctrl/dsh-vscode-bridge#readme",
+  "bugs": {
+    "url": "https://github.com/heyitaowml-ctrl/dsh-vscode-bridge/issues"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "assets/icon-180.png",
+    "README.md"
+  ],
+  "engines": {
+    "dsh": ">=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ]
+    }
+  }
+}