Restart DSH

Adds a Restart DSH button to DSH Desktop → Settings → General (通用设置). It sits directly below「繁忙时 Enter 键行为」and lets you restart the DSH Desktop application with one click, using DSH's official graceful restart facility.

Features

• Restart DSH Desktop from Settings → General (官方 slot：settings.general.item)
• Uses the official DSH Desktop restart API

(ctx.desktopRuntime.requestRestart() → graceful Cordis teardown + app.relaunch() + app.exit(0)) when a desktop shell is present

• Pure dsh --profile web support (v0.1.7): arms a detached relauncher,

then SIGTERMs its own process so the CLI's built-in handler performs the same graceful Cordis teardown; the relauncher waits for the old pid to die and re-execs the original argv/cwd verbatim, then the browser panel reloads on the new generation — still no shell, no kill/pkill/sudo

• Native confirmation dialog (native Modal + Button primitives) before restarting
• Single-flight protection: while a restart is pending the button shows

「正在重启…」and is disabled

• Light / Dark theme via DSH design tokens (--dsw-alias-*) — no hardcoded colors
• i18n: zh-CN + en
• No telemetry, no network access, no credential access, no filesystem access

Installation

Local install into a DSH web profile (additive, backed-up edits):

1. Add to ~/.dsh/profiles/web/package.json dependencies: ``json "@y2zyyr/dsh-restart-control": "link:/path/to/dsh-restart-control" ` 2. Add @y2zyyr/dsh-restart-control to dsh.profile.bundles. 3. Run pnpm install` in the profile directory. 4. Restart DSH Desktop once so the new bundle's loader row activates.

> Naming rule (DSH Desktop ≥ 2.0.2): the dependency key must be exactly the > plugin's package.json name (@y2zyyr/dsh-restart-control). The desktop > validates that every bundle's resolved manifest name matches its reference name > and otherwise refuses to load the whole profile with > profile package identity is invalid. Do not alias the key to a scoped name.

The plugin's own cordis.patch.yml registers the Loader entry; the host half is loaded by Cordis and the browser half is served as /plugins/@y2zyyr/dsh-restart-control/client.js.

Compatibility

• DSH Desktop (Electron shell) running in compatibility or advanced mode —

provides the desktopRuntime service; the button restarts through the official facade (mode: "desktop").

• Pure dsh web / --profile web (no desktop shell): the button restarts the

server process itself — graceful SIGTERM teardown + detached relauncher re-execing the captured argv/cwd (mode: "web"). Requires a real Node host process (always true for the host half); if spawning the relauncher fails the route returns 500 and keeps the server up.

• DSH core packages at ^0.1.0-rc.6 (compatible with the DeepSeek Harness Desktop runtime 0.1.0-rc.7; v0.1.1 widened the range so the DSH Desktop market verifier accepts the package).

Restart mechanism

The host half registers a browser-trust-fenced route (/dsh-restart-control/api, loopback / same-origin only) and calls the official ctx.desktopRuntime.requestRestart() when a desktop shell is present. The official implementation disposes the whole Cordis plugin tree (flushing settings / session state, 5 s grace), then app.relaunch() + app.exit(0). This is a graceful restart — never a process kill. Without a desktop shell the plugin uses its web path: it spawns a detached relauncher child FIRST, replies 202, then sends itself SIGTERM — the dsh CLI installs process.on("SIGTERM") -> root fiber.dispose(), so the identical graceful teardown runs before exit. The relauncher polls until the old pid is actually gone (bounded backstop, never double-spawns) and re-execs the captured argv/cwd verbatim. GET /status reports { ok, restartable, mode }.

Security

• No shell execution — restart goes through the official desktopRuntime

service; the plugin never spawns kill/pkill/osascript/sudo.

• No network — the only route is a loopback, same-origin-fenced HTTP route.
• No credential / token access — the plugin reads no .env, API keys, or

session content.

• No telemetry — the only runtime side effect is an optional boot marker under

/tmp/dsh-restart-control-test/ used purely for local verification, and it is never shipped as telemetry.

• Minimal permissions — the host only requires webServer (route) and

optionally desktopRuntime; the client only slots/locale.

Development

• pnpm install
• pnpm typecheck (tsc, no emit)
• pnpm test (node --test; real Cordis integration tests)
• pnpm build (scripts/build.mjs → lib/index.js + lib/client.js)