Restart DSH

Adds a Restart DSH button to DSH Desktop → Settings → General (通用设置). It sits
directly below「繁忙时 Enter 键行为」and lets you restart the DSH Desktop application
with one click, using DSH's official graceful restart facility.

Features

• Restart DSH Desktop from Settings → General (官方 slot：settings.general.item)
• Uses the official DSH Desktop restart API
  (ctx.desktopRuntime.requestRestart() → graceful Cordis teardown +
  app.relaunch() + app.exit(0)) when a desktop shell is present
• Pure dsh --profile web support (v0.1.7): arms a detached relauncher,
  then SIGTERMs its own process so the CLI's built-in handler performs the same
  graceful Cordis teardown; the relauncher waits for the old pid to die and
  re-execs the original argv/cwd verbatim, then the browser panel reloads on
  the new generation — still no shell, no kill/pkill/sudo
• Native confirmation dialog (native Modal + Button primitives) before restarting
• Single-flight protection: while a restart is pending the button shows
  「正在重启…」and is disabled
• Light / Dark theme via DSH design tokens (--dsw-alias-*) — no hardcoded colors
• i18n: zh-CN + en
• No telemetry, no network access, no credential access, no filesystem access

Installation

Local install into a DSH web profile (additive, backed-up edits):

1. Add to ~/.dsh/profiles/web/package.json dependencies:

   "@y2zyyr/dsh-restart-control": "link:/path/to/dsh-restart-control"

2. Add @y2zyyr/dsh-restart-control to dsh.profile.bundles.
3. Run pnpm install in the profile directory.
4. Restart DSH Desktop once so the new bundle's loader row activates.

Naming rule (DSH Desktop ≥ 2.0.2): the dependency key must be exactly the
plugin's package.json name (@y2zyyr/dsh-restart-control). The desktop
validates that every bundle's resolved manifest name matches its reference name
and otherwise refuses to load the whole profile with
profile package identity is invalid. Do not alias the key to a scoped name.

The plugin's own cordis.patch.yml registers the Loader entry; the host half is
loaded by Cordis and the browser half is served as
/plugins/@y2zyyr/dsh-restart-control/client.js.

Compatibility

• DSH Desktop (Electron shell) running in compatibility or advanced mode —
  provides the desktopRuntime service; the button restarts through the
  official facade (mode: "desktop").
• Pure dsh web / --profile web (no desktop shell): the button restarts the
  server process itself — graceful SIGTERM teardown + detached relauncher
  re-execing the captured argv/cwd (mode: "web"). Requires a real Node host
  process (always true for the host half); if spawning the relauncher fails the
  route returns 500 and keeps the server up.
• DSH core packages at ^0.1.0-rc.6 (compatible with the DeepSeek Harness Desktop runtime 0.1.0-rc.7; v0.1.1 widened the range so the DSH Desktop market verifier accepts the package).

Restart mechanism

The host half registers a browser-trust-fenced route (/dsh-restart-control/api,
loopback / same-origin only) and calls the official
ctx.desktopRuntime.requestRestart() when a desktop shell is present. The
official implementation disposes the whole Cordis plugin tree (flushing settings /
session state, 5 s grace), then app.relaunch() + app.exit(0). This is a
graceful restart — never a process kill. Without a desktop shell the plugin
uses its web path: it spawns a detached relauncher child FIRST, replies 202, then
sends itself SIGTERM — the dsh CLI installs
process.on("SIGTERM") -> root fiber.dispose(), so the identical graceful
teardown runs before exit. The relauncher polls until the old pid is actually
gone (bounded backstop, never double-spawns) and re-execs the captured
argv/cwd verbatim. GET /status reports { ok, restartable, mode }.

Security

• No shell execution — restart goes through the official desktopRuntime
  service; the plugin never spawns kill/pkill/osascript/sudo.
• No network — the only route is a loopback, same-origin-fenced HTTP route.
• No credential / token access — the plugin reads no .env, API keys, or
  session content.
• No telemetry — the only runtime side effect is an optional boot marker under
  /tmp/dsh-restart-control-test/ used purely for local verification, and it is
  never shipped as telemetry.
• Minimal permissions — the host only requires webServer (route) and
  optionally desktopRuntime; the client only slots/locale.

Development

• pnpm install
• pnpm typecheck (tsc, no emit)
• pnpm test (node --test; real Cordis integration tests)
• pnpm build (scripts/build.mjs → lib/index.js + lib/client.js)