dsh-zen-remote 2.0.2 → 2.2.0

package/src/client/locales.ts

@@ -253,6 +253,22 @@ export const zh = {
   'settings.client.diagRecentFailures': '最近的远程调用失败',
   'settings.client.diagCompatGroups': '指纹有差异的组：{groups}',
   'settings.client.diagCompatCalls': '最近的不兼容调用',
+  // --- PB-5 插件桥：主服务端同意小节 + 子客户端诊断小节 ---
+  'settings.bridge.title': '插件桥',
+  'settings.bridge.empty': '暂无插件登记插件桥',
+  'settings.bridge.loading': '正在读取插件桥登记…',
+  'settings.bridge.loadFailed': '插件桥列表读取失败（旧版服务端或经网关打开的页面）',
+  'settings.bridge.sessionOnly': '随会话共享转发',
+  'settings.bridge.consentToggle': '允许转发整机数据',
+  'settings.bridge.consentHint': '打开后，已配对的桌面应用端可在远程会话里读取该插件的整机数据。',
+  'settings.bridge.stateBridged': '已桥接',
+  'settings.bridge.stateNotOnServer': '服务端未安装',
+  'settings.bridge.stateVersionMismatch': '版本不同（服务端 {version}）',
+  'settings.bridge.stateDeclarationMismatch': '声明不一致',
+  'settings.bridge.stateConsentOff': '服务端主人未允许整机数据',
+  'settings.bridge.stateOffline': '中继离线',
+  'settings.bridge.stateServerTooOld': '服务端 zen-remote 版本过旧',
+  'settings.bridge.interceptOff': '本机改道未启用：{reason}',
   // --- T34 子客户端远程状态：标题行图标、横幅、关闭远程 ---
   'remoteStatusOnline': '远程会话 · 已连接',
   'remoteStatusOffline': '服务端离线，正在重连',
@@ -269,6 +285,9 @@ export const zh = {
   'remoteStatusOfflineClick': '服务端离线，无法操作',
   'remoteStatusUnshareFail': '关闭远程失败，请稍后再试',
   'remoteStatusUnshareFailCode': '关闭远程失败（{code}），请稍后再试',
+  // --- PB-14: the unbridged better-sidebar note (a CSS variable the
+  // remote-session stylesheet spends as the empty tab's ::before copy) ---
+  'remoteBridgeUnbridgedNote': 'better-sidebar 未在远程会话桥接（服务端未装同版本或未允许），文件与改动请以会话内消息为准',
   // 远程分组标题的后缀（后台 merge-streams 拿不到界面语言，固定用中文）；
   // 这里登记英文对照，供界面侧需要复述同样状态时使用。
   'remoteGroupOffline': '（离线）',
@@ -524,6 +543,22 @@ export const en: Record<MobileNavKey, string> = {
   'settings.client.diagRecentFailures': 'Recent remote call failures',
   'settings.client.diagCompatGroups': 'Groups with fingerprint differences: {groups}',
   'settings.client.diagCompatCalls': 'Recent incompatible calls',
+  // --- PB-5 plugin bridge: host consent section + sub-client diagnostics ---
+  'settings.bridge.title': 'Plugin bridge',
+  'settings.bridge.empty': 'No plugin has registered a bridge yet',
+  'settings.bridge.loading': 'Loading the bridge registrations…',
+  'settings.bridge.loadFailed': 'The bridge listing failed to load (an older server, or the page opened through the gateway)',
+  'settings.bridge.sessionOnly': 'Forwards with shared sessions',
+  'settings.bridge.consentToggle': 'Allow forwarding whole-machine data',
+  'settings.bridge.consentHint': 'When on, paired desktop apps can read this plugin\u2019s whole-machine data in remote sessions.',
+  'settings.bridge.stateBridged': 'Bridged',
+  'settings.bridge.stateNotOnServer': 'Not installed on the server',
+  'settings.bridge.stateVersionMismatch': 'Version differs (server {version})',
+  'settings.bridge.stateDeclarationMismatch': 'Declaration mismatch',
+  'settings.bridge.stateConsentOff': 'Server owner has not allowed whole-machine data',
+  'settings.bridge.stateOffline': 'Relay offline',
+  'settings.bridge.stateServerTooOld': 'Server zen-remote is too old',
+  'settings.bridge.interceptOff': 'Local rerouting not enabled: {reason}',
   // --- T34 remote-status icon, composer banner, unshare ---
   'remoteStatusOnline': 'Remote session · connected',
   'remoteStatusOffline': 'Server offline — reconnecting',
@@ -540,6 +575,7 @@ export const en: Record<MobileNavKey, string> = {
   'remoteStatusOfflineClick': 'The server is offline — nothing to do',
   'remoteStatusUnshareFail': 'Closing the remote failed — try again later',
   'remoteStatusUnshareFailCode': 'Closing the remote failed ({code}) — try again later',
+  'remoteBridgeUnbridgedNote': 'better-sidebar is not bridged for this remote session (the server lacks the same version or has not allowed it) — treat files and changes as session messages only',
   // Remote group title suffixes (the background merger cannot know the UI
   // language and always uses the Chinese forms); the English equivalents
   // live here for UI surfaces that restate the same status.

package/src/client/settings/SettingsSection.tsx

@@ -35,11 +35,12 @@
 import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react'
 import type { ReactNode } from 'react'
 import type { PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
-import { Button, SettingsForm, SettingsValueField } from '@deepseek-ai/dsh-client-ui-primitives'
+import { Button, SettingsForm, SettingsValueField, Switch } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { SettingsFormLabels } from '@deepseek-ai/dsh-client-ui-primitives'
 import {
   ADMIN_ACTION_ROUTE,
   ADMIN_PAIR_ROUTE,
+  ADMIN_PLUGIN_BRIDGE_ROUTE,
   ADMIN_PUSH_TEST_ROUTE,
   ADMIN_STATUS_ROUTE,
   CLIENT_CLAIM_ROUTE,
@@ -55,6 +56,8 @@ import {
   normalizePairingCode,
   shouldFollowServerDeviceName,
 } from '../../client-data/settings-form.ts'
+import { bridgeSectionState, togglePluginConsent } from '../../client-data/plugin-bridge.ts'
+import type { PluginBridgeStatusView } from '../../client-data/plugin-bridge.ts'
 import type {
   AdminStatusBody,
   ClaimRouteBody,
@@ -374,6 +377,40 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
     ? deriveSettingsView(load.body, { now, rowUser: config.rowUser() })
     : undefined
   const clientRole = config.savedRoleIsClient()
+
+  // The plugin bridge's registered-plugin listing (PB-5), host page only:
+  // loaded once per page life and refreshed whenever a save lands (the
+  // consent staged by the toggles below rides that very save). Starts in
+  // the loading state — the section renders the loading copy until the
+  // first answer lands (or the load fails, which is its own state, never
+  // the empty one); a composition without the route stays loading.
+  // PB-9-fix: the listing is a THREE-state read — loading, failed (an old
+  // build, or the page opened through the gateway where the listing is
+  // refused), or an answer that carries zero rows. Only the third means
+  // "nothing registered"; the first two must not masquerade as it.
+  const [bridgeLoad, setBridgeLoad] = useState<{ state: 'loading' | 'error' | 'ready', rows: { plugin: string, version: string, hasServerScope: boolean, consent: boolean }[] }>({ state: 'loading', rows: [] })
+  const loadBridge = useCallback(() => {
+    setBridgeLoad((prev) => ({ state: 'loading', rows: prev.rows }))
+    fetch(ADMIN_PLUGIN_BRIDGE_ROUTE)
+      .then((res) => {
+        if (!res.ok) return Promise.reject(new Error(String(res.status)))
+        return res.json() as Promise<{ value?: { plugins?: unknown } }>
+      })
+      .then((body) => {
+        const plugins = body?.value?.plugins
+        if (!Array.isArray(plugins)) return
+        setBridgeLoad({
+          state: 'ready',
+          rows: plugins.filter((row): row is { plugin: string, version: string, hasServerScope: boolean, consent: boolean } =>
+            row !== null && typeof row === 'object' && typeof (row as { plugin?: unknown }).plugin === 'string'),
+        })
+      })
+      .catch(() => { setBridgeLoad((prev) => ({ state: 'error', rows: prev.rows })) })
+  }, [])
+  useEffect(() => {
+    if (!clientRole) loadBridge()
+  }, [clientRole, loadBridge])
+  const bridgeState = bridgeSectionState(bridgeLoad.state, bridgeLoad.rows)
   const statusPoll = config.statusPoll()
 
   useEffect(() => {
@@ -817,6 +854,9 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
     else setClientLoad({ state: 'loading' })
     const refresh = config.savedRoleIsClient() ? loadClientStatus : loadStatus
     refresh()
+    // The plugin bridge listing re-reads too (PB-5): the consent toggles
+    // stage through the very save that just landed.
+    if (!config.savedRoleIsClient()) loadBridge()
     // Immediate pull + 1.5s covers a hot-only save. A save that reloads the
     // plugin row (T17) restarts the row and the gateway child with it — the
     // reload and the gateway's rebinding of its port both take longer than
@@ -901,6 +941,49 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
               <h3 className="zr-settings-card-title">{t('settings.shareTitle')}</h3>
               {text(form.idleHours, 'idleHours', t('settings.fieldIdleHours'), t('settings.fieldIdleHoursHint'), t('settings.invalidHours'), true)}
               {bool(form.autoShareNewSessions, 'autoShareNewSessions', t('settings.fieldAutoShare'), t('settings.fieldAutoShareHint'))}
+
+              {/* 插件桥 (PB-5): the consent toggles stage the NEXT consent map
+                  over the SAME form — one save button, one revision fence —
+                  reading the CURRENT map off the staged (or displayed) draft
+                  so consecutive toggles compose. */}
+              <h3 className="zr-settings-card-title">{t('settings.bridge.title')}</h3>
+              {bridgeState === 'loading' && <p className="zr-settings-hint">{t('settings.bridge.loading')}</p>}
+              {bridgeState === 'error' && <p className="zr-settings-hint" data-invalid="true">{t('settings.bridge.loadFailed')}</p>}
+              {bridgeState === 'empty' && <p className="zr-settings-hint">{t('settings.bridge.empty')}</p>}
+              {bridgeLoad.rows.map((row) => {
+                let current: Record<string, boolean> = {}
+                try {
+                  const parsed: unknown = JSON.parse(form.pluginBridgeConsent.text)
+                  if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                    current = parsed as Record<string, boolean>
+                  }
+                } catch { /* a malformed draft reads as nothing consented */ }
+                return (
+                  <div className="zr-settings-field" key={row.plugin}>
+                    <div className="zr-settings-head">
+                      <span className="zr-settings-head-title">{row.plugin}</span>
+                      <span className="zr-settings-badge">{row.version}</span>
+                    </div>
+                    {row.hasServerScope ? (
+                      <>
+                        <div className="zr-settings-head">
+                          <label>{t('settings.bridge.consentToggle')}</label>
+                          <Switch
+                            checked={current[row.plugin] === true}
+                            onChange={(checked) => {
+                              config.stage('pluginBridgeConsent', JSON.stringify(togglePluginConsent(current, row.plugin, checked)))
+                            }}
+                            label={t('settings.bridge.consentToggle')}
+                          />
+                        </div>
+                        <p className="zr-settings-hint">{t('settings.bridge.consentHint')}</p>
+                      </>
+                    ) : (
+                      <p className="zr-settings-hint">{t('settings.bridge.sessionOnly')}</p>
+                    )}
+                  </div>
+                )
+              })}
             </>
           )}
         </SettingsForm>
@@ -1073,8 +1156,9 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
               client/status body. The interceptor (T23b) and compat (T42)
               groups render only when the response carried their fields —
               earlier servers answer neither, and the section itself only
-              exists when there is at least one line to show. */}
-          {clientView !== undefined && (clientView.lastError !== '' || clientView.intercept !== undefined || clientView.compat !== undefined) && (
+              exists when there is at least one line to show. PB-5 adds the
+              bridge rows and the rerouting note on the same presence gate. */}
+          {clientView !== undefined && (clientView.lastError !== '' || clientView.intercept !== undefined || clientView.compat !== undefined || (clientView.pluginBridge?.length ?? 0) > 0 || clientView.pluginRouteIntercept !== undefined) && (
             <>
               <h3 className="zr-settings-card-title">{t('settings.client.diagTitle')}</h3>
               {clientView.lastError !== '' && (
@@ -1132,6 +1216,26 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
                   )}
                 </>
               )}
+              {(clientView.pluginBridge?.length ?? 0) > 0 && clientView.pluginBridge !== undefined && (
+                <div className="zr-settings-field">
+                  <div className="zr-settings-head">
+                    <label>{t('settings.bridge.title')}</label>
+                  </div>
+                  {clientView.pluginBridge.map((row: PluginBridgeStatusView) => (
+                    <p key={row.plugin} className="zr-settings-hint">
+                      {row.plugin} · {row.localVersion !== '' ? `v${row.localVersion}` : '—'} ·{' '}
+                      {row.stateKey === 'settings.bridge.stateVersionMismatch'
+                        ? t(row.stateKey, { version: row.serverVersion ?? '?' })
+                        : t(row.stateKey)}
+                    </p>
+                  ))}
+                </div>
+              )}
+              {clientView.pluginRouteIntercept !== undefined && !clientView.pluginRouteIntercept.installed && (
+                <p className="zr-settings-hint" data-invalid="true">
+                  {t('settings.bridge.interceptOff', { reason: clientView.pluginRouteIntercept.reasons.join('; ') || '—' })}
+                </p>
+              )}
             </>
           )}
         </div>

package/src/client/styles/remote-session.css.ts

@@ -32,17 +32,23 @@ html[data-zr-remote-session="1"] [data-open-target] {
   display: none !important;
 }
 
-/* ---------- remote session: hide dsh-better-sidebar's file surfaces (T53) ----------
-   dsh-better-sidebar 0.24.x is the second big "open the machine's files" UI.
-   Every tab it registers (files/editor, git changes, subagent/tasks, side
-   chat, the markdown/html/code file viewers) builds its requests from a
-   {sessionId, cwd} scope and POSTs them to the plugin's own /sidebar/api/*
-   routes on whichever machine answers — in a remote session that is the
-   SUB-CLIENT's machine (client.js call() ~3111, fetchUpload ~3162,
-   encodeHtmlUrl /sidebar/html/ ~3069-3414), so the tree would show same-named
-   LOCAL files as if they were the session's and an edit would WRITE locally.
-   Per the T53 decision the interfaces are hidden, not proxied: the relay
-   carries no /sidebar routes and none are added.
+/* ---------- remote session: hide dsh-better-sidebar's file surfaces (T53, two regimes since PB-14) ----------
+   dsh-better-sidebar 0.25.0 is the second big "open the machine's files" UI
+   AND, since PB-12/13, the first ADAPTER-BRIDGED one: at exactly 0.25.0 its
+   /sidebar/api routes, its two WebSockets and its side chat cross the byte
+   tunnel and read/write the SERVER's data, gated on the whole-machine-data
+   consent. The hiding below therefore applies ONLY while the plugin is NOT
+   bridged — the :not([data-zr-bridge-dsh-better-sidebar="1"]) stamp the
+   remote-status poll writes; see the PB-14 note above): bridged, the panels
+   are remote-aware and stay visible; unbridged (a different version, the
+   server without the adapter's consent), every tab it registers (files/
+   editor, git changes, subagent/tasks, side chat, the markdown/html/code
+   file viewers) builds its requests from a {sessionId, cwd} scope and POSTs
+   them to the plugin's own /sidebar/api/* routes on whichever machine
+   answers — in a remote session that is the SUB-CLIENT's machine (client.js
+   call() ~3111, fetchUpload ~3162, encodeHtmlUrl /sidebar/html/ ~3069-3414),
+   so the tree would show same-named LOCAL files as if they were the
+   session's and an edit would WRITE locally.
 
    Anchors, all the plugin's or the host's own rendered contracts (no hashed
    class names; the one suffix selector, _chipIcon, is unique among the
@@ -51,18 +57,21 @@ html[data-zr-remote-session="1"] [data-open-target] {
    @liustack/modsearch / @wxg-prc-cpg/browser-skill-dsh-plugin (modsearch /
    browser-skill) / dshmarket and every @deepseek-ai sidebar package for it):
 
-   HONEST LIMITS (T53-fix): everything here is display:none ONLY. The plugin's
+   HONEST LIMITS (T53-fix, adjusted PB-14): unbridged, the plugin's
    components stay mounted and keep silently POSTing READ-ONLY /sidebar/api
    requests to the local machine (session.cwd, changes.ops, the tree reads a
    mounted tab refreshes with) — the data never leaves that machine, and no
-   write can happen because every write control is inside the hidden surfaces.
-   Known boundary: a dsh-resource://file/** address opened through
-   sidebarRight.openResource in a remote session (file links in chat,
-   deliverables, @-references, skills) is CLAIMED by the plugin's editor
-   registration (client.js ~21377: patterns ["dsh-resource://file/**"]) before
-   the host preview sees it — the right sidebar expands, the rules below hide
-   the tab's body and chip, and an EMPTY panel remains. Root fix needs
-   zen-remote's own remote file tree; separate discussion.
+   write can happen because every write control is inside the hidden
+   surfaces (the tab body hides its CHILDREN and spends the note copy as a
+   ::before, so an already-open tab reads WHY it is empty instead of
+   sitting blank). Known boundary: a dsh-resource://file/** address opened
+   through sidebarRight.openResource in a remote session (file links in
+   chat, deliverables, @-references, skills) is CLAIMED by the plugin's
+   editor registration (client.js ~21377: patterns ["dsh-resource://file/**"])
+   before the host preview sees it — the right sidebar expands, the rules
+   below hide the tab's body content and chip, and the note fills the panel.
+   Bridged (0.25.0 + consent), none of this applies: the tab reads the
+   server's data through the adapter and stays visible whole.
 
    - [data-dsh-bottom-toggle] — the header-utilities button that expands the
      bottom workbench (client.js BottomDockToggle ~20863; slot registration
@@ -135,31 +144,61 @@ html[data-zr-remote-session="1"] [data-open-target] {
      attribute and this rule hides it too (cosmetic; the page stays reachable
      through its shortcut command path and the plugin's takeover is the
      "files" implementation on every deployment this plugin pairs with
-     better-sidebar anyway). */
-html[data-zr-remote-session="1"] [data-dsh-bottom-toggle] {
+     better-sidebar anyway).
+
+   /* PB-14: every T53 rule below carries
+   :not([data-zr-bridge-dsh-better-sidebar="1"]) — when the adapter
+   (PB-12) bridges the plugin, the panels read the SERVER's data through
+   the byte tunnel and MUST stay visible; the hiding applies only to the
+   unbridged combination, and the empty tab body then carries a note
+   instead of blankness. The stamp is written by
+   effects/remote-session.ts off the remote-status poll's bridgedPlugins
+   list (client-data/remote-status.ts shouldStampBridgeAttribute). */
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-dsh-bottom-toggle] {
   display: none !important;
 }
-html[data-zr-remote-session="1"] [data-dsh-panel-host] {
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-dsh-panel-host] {
   display: none !important;
 }
-html[data-zr-remote-session="1"] {
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) {
   --dsh-sidebar-height: 0px !important;
 }
-html[data-zr-remote-session="1"] [data-dsh-native-tab-host] {
+/* The unbridged tab body: hide the plugin's own content and spend the
+   note copy as a ::before — an already-open tab reads WHY it is empty
+   (0.25.0 keeps tabs mounted, so a stale body would otherwise sit blank).
+   --zr-bridge-note is set on <html> by the stamp effect, in the
+   browser's language; unset (effect not running yet) the content falls
+   through and nothing renders. */
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-dsh-native-tab-host] > * {
+  display: none !important;
+}
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-dsh-native-tab-host]::before {
+  content: var(--zr-bridge-note);
+  display: block;
+  padding: 24px 16px;
+  font-size: 13px;
+  line-height: 1.7;
+  color: var(--dsh-fg-muted, #6b7280);
+  word-break: break-word;
+}
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-dockkit-tab]:has([class$="_chipIcon"]) {
   display: none !important;
 }
-html[data-zr-remote-session="1"] [data-dockkit-tab]:has([class$="_chipIcon"]) {
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-floating-window]:has([data-window-body]) {
   display: none !important;
 }
-html[data-zr-remote-session="1"] [data-floating-window]:has([data-window-body]) {
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-sidebar-right-guide-entry="git"],
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-sidebar-right-guide-entry="subagent"],
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-sidebar-right-guide-entry="sidechat"] {
   display: none !important;
 }
-html[data-zr-remote-session="1"] [data-sidebar-right-guide-entry="git"],
-html[data-zr-remote-session="1"] [data-sidebar-right-guide-entry="subagent"],
-html[data-zr-remote-session="1"] [data-sidebar-right-guide-entry="sidechat"] {
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-sidebar-right-guide-entry="files"]:not([aria-keyshortcuts]) {
   display: none !important;
 }
-html[data-zr-remote-session="1"] [data-sidebar-right-guide-entry="files"]:not([aria-keyshortcuts]) {
+/* 0.25.0's dock fallback — the floating quick-open button the plugin pins
+   for empty workspaces. Same treatment as every other open-the-machine's-
+   files control: hidden while unbridged, untouched when bridged. */
+html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [data-dsh-dock-fallback] {
   display: none !important;
 }
 

package/src/client-data/plugin-bridge.ts

@@ -0,0 +1,150 @@
+/**
+ * The plugin bridge's settings-page pure pieces (PB-5): the status → copy
+ * mapping the 子客户端诊断区 renders, and the consent-toggle arithmetic the
+ * 主服务端插件桥 section stages. Pure by the settings-form discipline — no
+ * fetch, no clock, no context — so scripts/check-plugin-bridge-ui.mjs pins
+ * every copy and every toggle shape.
+ *
+ * Deliberately import-free: this file rides the BROWSER bundle, and the
+ * bridge's own module (src/plugin-bridge.ts) drags node:crypto in. The
+ * status shape is therefore restated structurally here — it mirrors
+ * lib/plugin-bridge.js's `BridgeStatus` verbatim, and a drifted wire is
+ * handled by the tolerant mapping, not by the type system.
+ */
+
+/** One plugin's bridge verdict, exactly the shape `client/status`'s
+ * `pluginBridge` array carries (PB-2). */
+export interface PluginBridgeStatusLike {
+  plugin: string
+  bridged: boolean
+  reason?: string
+  localVersion: string
+  serverVersion?: string
+}
+
+/** One row of the 诊断区's 插件桥 group: the plugin, its LOCAL version, and
+ * the copy key (plus the interpolation value) the locale renders. */
+export interface PluginBridgeStatusView {
+  plugin: string
+  localVersion: string
+  /** The locale key under `settings.bridge.state*`. */
+  stateKey: PluginBridgeStateKey
+  /** The server's version, when the verdict names one (版本不同's copy). */
+  serverVersion: string | undefined
+}
+
+export type PluginBridgeStateKey =
+  | 'settings.bridge.stateBridged'
+  | 'settings.bridge.stateNotOnServer'
+  | 'settings.bridge.stateVersionMismatch'
+  | 'settings.bridge.stateDeclarationMismatch'
+  | 'settings.bridge.stateConsentOff'
+  | 'settings.bridge.stateOffline'
+  | 'settings.bridge.stateServerTooOld'
+
+/** The reason → copy-key table, one entry per BridgeReason plus the
+ * everything-else fallback (an unknown reason from a newer server reads as
+ * 未桥接-generic — the offline copy, honest without inventing a claim). */
+const REASON_KEYS: Readonly<Record<string, PluginBridgeStateKey>> = {
+  'not-on-server': 'settings.bridge.stateNotOnServer',
+  'version-mismatch': 'settings.bridge.stateVersionMismatch',
+  'declaration-mismatch': 'settings.bridge.stateDeclarationMismatch',
+  'consent-off': 'settings.bridge.stateConsentOff',
+  offline: 'settings.bridge.stateOffline',
+  'server-too-old': 'settings.bridge.stateServerTooOld',
+}
+
+/** Tolerant read of one `pluginBridge` wire array into the render rows,
+ * input order kept (the route already sorts by plugin name). A malformed
+ * entry is skipped, never thrown into the settings page. */
+export function derivePluginBridgeStatuses(value: unknown): PluginBridgeStatusView[] {
+  if (!Array.isArray(value)) return []
+  const rows: PluginBridgeStatusView[] = []
+  for (const entry of value) {
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) continue
+    const record = entry as Record<string, unknown>
+    if (typeof record.plugin !== 'string' || record.plugin === '') continue
+    const bridged = record.bridged === true
+    const reason = typeof record.reason === 'string' ? record.reason : undefined
+    rows.push({
+      plugin: record.plugin,
+      localVersion: typeof record.localVersion === 'string' ? record.localVersion : '',
+      stateKey: bridged
+        ? 'settings.bridge.stateBridged'
+        : reason !== undefined && REASON_KEYS[reason] !== undefined
+          ? REASON_KEYS[reason]
+          : 'settings.bridge.stateOffline',
+      serverVersion: typeof record.serverVersion === 'string' ? record.serverVersion : undefined,
+    })
+  }
+  return rows
+}
+
+/**
+ * The three-state resolution for the host settings page's 插件桥 list
+ * (PB-9-fix): a fetch that has not answered is LOADING, a failed or
+ * refused fetch is an ERROR — and only a successful answer with zero rows
+ * means "no plugin has registered a bridge". Collapsing the first two into
+ * the empty copy would tell the user nothing is bridged while the answer is
+ * simply not in yet (or the page was opened through the gateway, where the
+ * listing is refused). Pure so the check pins all four outcomes.
+ */
+export function bridgeSectionState(load: 'loading' | 'error' | 'ready', rows: unknown): 'loading' | 'error' | 'empty' | 'plugins' {
+  if (load === 'loading') return 'loading'
+  if (load === 'error') return 'error'
+  return Array.isArray(rows) && rows.length > 0 ? 'plugins' : 'empty'
+}
+
+/**
+ * One consent-toggle click: the NEXT whole-machine-data consent map, staged
+ * over the row's `pluginBridgeConsent` field. Only `plugin`'s key moves —
+ * every other key (including entries for plugins no longer registered; the
+ * settings page deliberately never prunes what it does not render) is
+ * carried over verbatim, in its existing key order. An illegal current map
+ * (a hand-edited row) reads as the empty map: the toggle then writes exactly
+ * one key, and the junk is left for the row validator to keep refusing.
+ */
+export function togglePluginConsent(current: unknown, plugin: string, allow: boolean): Record<string, boolean> {
+  const next: Record<string, boolean> = {}
+  if (current !== null && typeof current === 'object' && !Array.isArray(current)) {
+    for (const [key, value] of Object.entries(current as Record<string, unknown>)) {
+      if (typeof value === 'boolean') next[key] = value
+    }
+  }
+  next[plugin] = allow
+  return next
+}
+
+/** One row of the host settings page's 插件桥 list, as the admin listing
+ * answers it (PB-5: plugin/version/hasServerScope/consent; PB-11 adds the
+ * adapter mark). */
+export interface AdminBridgeRowView {
+  plugin: string
+  version: string
+  hasServerScope: boolean
+  consent: boolean
+  /** True when zen-remote's own adapter stands in for this plugin (the
+   * row renders「由 zen-remote 适配」); a wiring that predates adapters
+   * never sets it. */
+  adapted: boolean
+}
+
+/**
+ * Tolerant read of one admin listing row into the render shape (PB-11).
+ * A malformed row is `undefined`, never a throw — the settings page skips
+ * it the same way {@link derivePluginBridgeStatuses} skips a bad verdict.
+ * `adapted` defaults to false: an older server's answer simply reads as
+ * "nothing is adapted".
+ */
+export function readAdminBridgeRow(row: unknown): AdminBridgeRowView | undefined {
+  if (row === null || typeof row !== 'object' || Array.isArray(row)) return undefined
+  const record = row as Record<string, unknown>
+  if (typeof record.plugin !== 'string' || record.plugin === '') return undefined
+  return {
+    plugin: record.plugin,
+    version: typeof record.version === 'string' ? record.version : '',
+    hasServerScope: record.hasServerScope === true,
+    consent: record.consent === true,
+    adapted: record.adapted === true,
+  }
+}

package/src/client-data/remote-status.ts

@@ -51,6 +51,11 @@ export interface RemoteStatusView {
   versionMismatch: boolean
   serverName: string
   closed: Readonly<Record<string, RemoteClosedReason>>
+  /** The plugins whose bridge verdict is bridged RIGHT NOW (PB-2; sorted
+   * server-side). A garbage or missing field degrades to the empty list —
+   * nothing is ever considered bridged on a shape the parse does not
+   * trust. */
+  bridgedPlugins: readonly string[]
   /** When this view was parsed off a GET body. */
   asOf: number
 }
@@ -80,10 +85,35 @@ export function parseRemoteStatusBody(body: unknown, now: number): RemoteStatusV
     versionMismatch: record.versionMismatch === true,
     serverName: typeof record.serverName === 'string' ? record.serverName : '',
     closed,
+    bridgedPlugins: Array.isArray(record.bridgedPlugins)
+      ? record.bridgedPlugins.filter((name): name is string => typeof name === 'string' && name !== '')
+      : [],
     asOf: now,
   }
 }
 
+// --- the bridge stamp (PB-14) -----------------------------------------------
+
+/**
+ * Whether ONE plugin's bridge verdict is bridged RIGHT NOW, judged off the
+ * `bridgedPlugins` list the remote-status body carries. Tolerant by the
+ * same discipline as the parse: a garbage list (an older server that never
+ * learned the field, a broken body) reads as "not bridged" — the hiding
+ * rules stay in force unless the server positively says otherwise, never
+ * the reverse. This is the pure core behind the
+ * `html[data-zr-bridge-<plugin>]` stamp the remote-session stylesheet
+ * spends.
+ */
+export function shouldStampBridgeAttribute(bridgedPlugins: unknown, plugin: string): boolean {
+  return Array.isArray(bridgedPlugins) && bridgedPlugins.includes(plugin)
+}
+
+/** The plugin the bridge stamp names. */
+export const BRIDGE_STAMP_PLUGIN = 'dsh-better-sidebar'
+
+/** The html attribute the stamp writes (`data-zr-bridge-dsh-better-sidebar`). */
+export const BRIDGE_STAMP_ATTRIBUTE = `data-zr-bridge-${BRIDGE_STAMP_PLUGIN}`
+
 // --- the icon's states -------------------------------------------------------
 
 /** The locale keys `describeRemoteStatus` needs. */