dsh-qr-share
DSH web plugin：侧边栏页脚中的二维码按钮，允许手机扫描并重新发出当前浏览器已认证的启动 URL，复用桌面端刚完成的相同 ?token 交换。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:xiaoguomeiyitian/dsh-qr-share#644f3d678cee0eecd082fdc55fcd35963dcae29b
Qr Share 以 dsh-qr-share 发布，当前版本为 0.3.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
DSH web plugin: a sidebar-footer QR-code button that lets a phone scan and re-issue the current browser's authenticated launch URL, reusing the same
?token=…exchange the desktop just completed.
Placeholder — add a screenshot of the sidebar footer button + dialog to
docs/screenshot.pngand uncomment the line below. Recommended size: 640×400, capturing the bottom of the sidebar and the QR dialog.
BrowserAuth exchanges the token for a cookie (303 → /) and the
phone lands on the same session.The QR URL is composed from window.location.origin so it automatically
matches whatever authority the desktop actually used (LAN IP, public
domain, reverse-proxied sub-path). No environment variable is needed
for the QR to point at the right host — the DSH_PUBLIC_HOST already
in web-external.patch.yml still gates the route via the trust fence.
/_qr/share route is gated by connection.requestRejection —
identical to /api's gate. 403 if Host isn't trusted; 401 if the
browser cookie isn't valid. The token is only returned on 200.dsh web activation) and
becomes useless after the first exchange (the cookie is bound to the
authority and HttpOnly + SameSite=Strict).SameSite=Strict + same-origin fetch mean the route is unreachable
from any cross-site frame.dsh plugin --profile <name> add dsh-qr-share@latest
This adds the bundle declaration to your profile and reuses the
cordis.patch.yml shipped in the package — no manual patch overlay
edits needed.
npm install# in a project that owns a DSH profile directory
npm install dsh-qr-share
# or with pnpm
pnpm add dsh-qr-share
Then add the row from cordis.patch.yml (shipped with the package) to
your profile's patch overlay, and ensure the package is reachable from
the profile's node_modules (pnpm/npm flat layout works; pnpm strict
layout needs a symlink — see manual install below).
Place the package at /app/dsh-qr-share/.
Symlink it into $DSH_HOME/profiles/node_modules/dsh-qr-share (the
entrypoint does this for you; see docker-build/docker-scripts/entrypoint.sh).
Add the row from cordis.patch.yml to your patch overlay:
- insert:
- id: qr-share
name: 'dsh-qr-share'
- insert:
- id: qr-share
name: 'dsh-qr-share'
config:
enabled: true # default true; set false to short-circuit the route to 404
# Recommended: pnpm (matches the project lockfile-less layout)
pnpm install
pnpm build # tsc declarations + tsdown bundles
pnpm typecheck # strict check
pnpm pack # produce dsh-qr-share-<version>.tgz (used by the install commands above)
# Also supported: npm (any Node >= 20, no extra install)
npm install
npm run build # same tsc + tsdown pipeline
npm run typecheck
npm pack
For npm publishing we ship
./npm_publish.sh— a single-file mirror of the core_ts release flow (npm login→npm install→npm run build→npm pack --dry-runreview →npm publish --access public).
Outputs:
lib/index.js — Node host half (the /_qr/share route)lib/invariant.js — runtime guardlib/client.js — official profile channel bundle (id dsh-qr-share)lib/client-registry.js — plugin-registry channel bundle (id dsh-external/dsh-qr-share)lib/types/** — TypeScript declarations>=20>=0.1.0-rc.8 (tested against
0.1.1-rc.2 and 0.1.2-alpha.1)^18 || ^19 (peer, optional — the host half doesn't need React)The host half uses @deepseek-ai/cordis types only (declaration
merging + Context re-export); the runtime cordis instance is supplied
by the DSH core at plugin mount time. This is why the peer dependency
on @deepseek-ai/cordis is intentionally absent — it would be rejected
by the DSH market manifest gate, and is not required at runtime.
For maintainers — see RELEASE-CHECKLIST.md for
the step-by-step npm publish flow.
MIT — see LICENSE.
dsh-better-sidebar — the
slot injection and dual client bundle (official / plugin-registry) pattern
is inspired by its tsdown.config.ts.qrcode — the QR code renderer.dsh.community plugin manifest spec
(0.15) and the verification / discovery surface at
dsh.so.