Restart DSH

Adds a Restart DSH button to DSH Desktop → Settings → General (通用设置). It sits
directly below「繁忙时 Enter 键行为」and lets you restart the DSH Desktop application
with one click, using DSH's official graceful restart facility.

Features

• Restart DSH Desktop from Settings → General (官方 slot：settings.general.item)
• Uses the official DSH Desktop restart API
  (ctx.desktopRuntime.requestRestart() → graceful Cordis teardown +
  app.relaunch() + app.exit(0)) when a desktop shell is present
• Pure dsh --profile web support (v0.1.7): arms a detached relauncher,
  then SIGTERMs its own process so the CLI's built-in handler performs the same
  graceful Cordis teardown; the relauncher waits for the old pid to die and
  re-execs the original argv/cwd verbatim, then the browser panel reloads on
  the new generation — still no shell, no kill/pkill/sudo
• Native confirmation dialog (native Modal + Button primitives) before restarting
• Single-flight protection: while a restart is pending the button shows
  「正在重启…」and is disabled
• Light / Dark theme via DSH design tokens (--dsw-alias-*) — no hardcoded colors
• i18n: zh-CN + en
• No telemetry, no network access, no credential access, no filesystem access

Installation

Local install into a DSH web profile (additive, backed-up edits):

1. Add to ~/.dsh/profiles/web/package.json dependencies:

"@y2zyyr/dsh-restart-control": "link:/path/to/dsh-restart-control"

2. Add @y2zyyr/dsh-restart-control to dsh.profile.bundles.
3. Run pnpm install in the profile directory.
4. Restart DSH Desktop once so the new bundle's loader row activates.

> Naming rule (DSH Desktop ≥ 2.0.2): the dependency key must be exactly the
> plugin's package.json name (@y2zyyr/dsh-restart-control). The desktop
> validates that every bundle's resolved manifest name matches its reference name
> and otherwise refuses to load the whole profile with
> profile package identity is invalid. Do not alias the key to a scoped name.

The plugin's own cordis.patch.yml registers the Loader entry; the host half is
loaded by Cordis and the browser half is served as
/plugins/@y2zyyr/dsh-restart-control/client.js.

Compatibility

• DSH Desktop (Electron shell) running in compatibility or advanced mode —
  provides the desktopRuntime service; the button restarts through the
  official facade (mode: "desktop").
• Pure dsh web / --profile web (no desktop shell): the button restarts the
  server process itself — graceful SIGTERM teardown + detached relauncher
  re-execing the captured argv/cwd (mode: "web"). Requires a real Node host
  process (always true for the host half); if spawning the relauncher fails the
  route returns 500 and keeps the server up.
• DSH core packages at ^0.1.0-rc.6 (compatible with the DeepSeek Harness Desktop runtime 0.1.0-rc.7; v0.1.1 widened the range so the DSH Desktop market verifier accepts the package).

Restart mechanism

The host half registers a browser-trust-fenced route (/dsh-restart-control/api,
loopback / same-origin only) and calls the official
ctx.desktopRuntime.requestRestart() when a desktop shell is present. The
official implementation disposes the whole Cordis plugin tree (flushing settings /
session state, 5 s grace), then app.relaunch() + app.exit(0). This is a
graceful restart — never a process kill. Without a desktop shell the plugin
uses its web path: it spawns a detached relauncher child FIRST, replies 202, then
sends itself SIGTERM — the dsh CLI installs
process.on("SIGTERM") -> root fiber.dispose(), so the identical graceful
teardown runs before exit. The relauncher polls until the old pid is actually
gone (bounded backstop, never double-spawns) and re-execs the captured
argv/cwd verbatim. GET /status reports { ok, restartable, mode }.

Security

• No shell execution — restart goes through the official desktopRuntime
  service; the plugin never spawns kill/pkill/osascript/sudo.
• No network — the only route is a loopback, same-origin-fenced HTTP route.
• No credential / token access — the plugin reads no .env, API keys, or
  session content.
• No telemetry — the only runtime side effect is an optional boot marker under
  /tmp/dsh-restart-control-test/ used purely for local verification, and it is
  never shipped as telemetry.
• Minimal permissions — the host only requires webServer (route) and
  optionally desktopRuntime; the client only slots/locale.

Development

• pnpm install
• pnpm typecheck (tsc, no emit)
• pnpm test (node --test; real Cordis integration tests)
• pnpm build (scripts/build.mjs → lib/index.js + lib/client.js)