@cofy-x/dsh-console 0.1.0-alpha.0 → 0.1.0-alpha.10

package/README.md

@@ -1,27 +1,30 @@
 # DSH Console
 
-`dsh-console` is a TypeScript and React/Ink terminal frontend for
-[DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness).
+`dsh-console` is a TypeScript and React/Ink terminal frontend for [DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness).
 
-> DSH Console is currently a public alpha. Commands and UI details may change
-> before the first stable release.
+> DSH Console is currently a public alpha. Commands and UI details may change before the first stable release.
 
 ## Install
 
-DSH Console requires Node.js 24 or newer and a working DSH provider
-configuration.
+DSH Console requires Node.js 24 or newer and a working DSH provider configuration. This release is verified from the npm-default DeepSeek Harness `0.1.1-rc.2` through the current source release `0.1.2-alpha.4`; install DSH normally without pinning the command to a version.
 
 ```sh
-npm install --global @deepseek-ai/dsh @cofy-x/dsh-console@alpha
+npm install --global @deepseek-ai/dsh @cofy-x/dsh-console
 dsh-console --prompt "hello"
 ```
 
-Alpha releases use the `alpha` npm dist-tag and do not update `latest`.
+Public Alpha releases retain prerelease versions while the current published Console remains available through npm's default install path.
 
 ## Use
 
-The launcher initializes or locates the `dsh-console` DSH profile and starts an
-interactive terminal session. Useful commands include:
+The launcher initializes its owned `dsh-console` DSH profile, aligns the profile package with the launcher version, and starts an interactive terminal session. It can continue persisted work before the TUI starts:
+
+```sh
+dsh-console --continue
+dsh-console --resume dsh-console-01234567-89ab-cdef-0123-456789abcdef --prompt "continue this work"
+```
+
+Startup continuation is scoped to persisted top-level Console Sessions in the current directory. Useful interactive commands include:
 
 ```text
 /model       Select the active DSH model
@@ -34,8 +37,6 @@ interactive terminal session. Useful commands include:
 /settings    Edit Console settings
 ```
 
-DSH owns provider credentials, model routing, session logs, and attachments.
-DSH Console does not maintain a separate authentication or session database.
+DSH owns provider credentials, model routing, session logs, and attachments. DSH Console does not maintain a separate authentication or session database.
 
-See the [GitHub repository](https://github.com/cofy-x/dsh-console) for source
-development, architecture, alpha boundaries, and license attribution details.
+See the [GitHub repository](https://github.com/cofy-x/dsh-console) for source development, architecture, alpha boundaries, and license attribution details.

package/bin/dsh-console.js

@@ -6,14 +6,17 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import crossSpawn from 'cross-spawn';
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-const manifest = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+const manifest = JSON.parse(
+  readFileSync(join(packageRoot, 'package.json'), 'utf8'),
+);
+const packageName = '@cofy-x/dsh-console';
 const profile = 'dsh-console';
 const RESTART_EXIT_CODE = 199;
 const forwardedArgs = process.argv.slice(2);
@@ -29,32 +32,74 @@ if (forwardedArgs[0] === '--version' || forwardedArgs[0] === '-V') {
 }
 
 const dshHome = process.env.DSH_HOME || join(homedir(), '.dsh');
+const profileRoot = join(dshHome, 'profiles', profile);
+const profileManifest = join(profileRoot, 'package.json');
 const installedManifest = join(
-  dshHome,
-  'profiles',
-  profile,
+  profileRoot,
   'node_modules',
   '@cofy-x',
   'dsh-console',
   'package.json',
 );
 
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return undefined;
+  }
+}
+
+function profileNeedsInstall({ explicitPackageSpec, localCheckout }) {
+  if (explicitPackageSpec) return true;
+
+  const installed = readJson(installedManifest);
+  if (installed?.name !== packageName || installed.version !== manifest.version)
+    return true;
+
+  if (localCheckout) {
+    try {
+      return (
+        realpathSync(dirname(installedManifest)) !== realpathSync(packageRoot)
+      );
+    } catch {
+      return true;
+    }
+  }
+
+  const configured = readJson(profileManifest)?.dependencies?.[packageName];
+  return configured !== manifest.version;
+}
+
 function run(command, args) {
-  const result = spawnSync(command, args, { stdio: 'inherit', env: process.env });
+  const result = crossSpawn.sync(command, args, {
+    stdio: 'inherit',
+    env: process.env,
+  });
   if (result.error) {
-    process.stderr.write(`dsh-console: unable to run ${command}: ${result.error.message}\n`);
+    process.stderr.write(
+      `dsh-console: unable to run ${command}: ${result.error.message}\n`,
+    );
     process.exit(1);
   }
   if (result.signal) process.kill(process.pid, result.signal);
   return result.status ?? 1;
 }
 
-if (!existsSync(installedManifest)) {
-  const localCheckout = existsSync(join(packageRoot, 'src'));
-  const packageSpec =
-    process.env.DSH_CONSOLE_PACKAGE_SPEC ||
-    (localCheckout ? packageRoot : `@cofy-x/dsh-console@${manifest.version}`);
-  const status = run('dsh', ['plugin', '--profile', profile, 'add', packageSpec]);
+const localCheckout = existsSync(join(packageRoot, 'src'));
+const explicitPackageSpec = process.env.DSH_CONSOLE_PACKAGE_SPEC;
+const packageSpec =
+  explicitPackageSpec ||
+  (localCheckout ? packageRoot : `${packageName}@${manifest.version}`);
+
+if (profileNeedsInstall({ explicitPackageSpec, localCheckout })) {
+  const status = run('dsh', [
+    'plugin',
+    '--profile',
+    profile,
+    'add',
+    packageSpec,
+  ]);
   if (status !== 0) process.exit(status);
 }
 

package/cordis.patch.yml

@@ -12,3 +12,6 @@
       config:
         prompt: !!js ctx.dshConsoleStartup.prompt
         debug: !!js ctx.dshConsoleStartup.debug
+        pokemon: !!js ctx.dshConsoleStartup.pokemon
+        continueSession: !!js ctx.dshConsoleStartup.continueSession
+        resumeSessionId: !!js ctx.dshConsoleStartup.resumeSessionId

package/dist/{chunk-YNJGTXFJ.js → chunk-4L2DX7CL.js}

@@ -1585,24 +1585,52 @@ var NEVER_ALLOWED_NAME_PATTERNS = [
 var NEVER_ALLOWED_VALUE_PATTERNS = [
   /-----BEGIN (RSA|OPENSSH|EC|PGP) PRIVATE KEY-----/i,
   /-----BEGIN CERTIFICATE-----/i,
-  // Credentials in URL
-  /(https?|ftp|smtp):\/\/[^:]+:[^@]+@/i,
   // GitHub tokens (classic, fine-grained, OAuth, etc.)
   /(ghp|gho|ghu|ghs|ghr|github_pat)_[a-zA-Z0-9_]{36,}/i,
   // Google API keys
   /AIzaSy[a-zA-Z0-9_\\-]{33}/i,
   // Amazon AWS Access Key ID
   /AKIA[A-Z0-9]{16}/i,
-  // Generic OAuth/JWT tokens
-  /eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/i,
   // Stripe API keys
   /(s|r)k_(live|test)_[0-9a-zA-Z]{24}/i,
   // Slack tokens (bot, user, etc.)
   /xox[abpr]-[a-zA-Z0-9-]+/i
 ];
+var CREDENTIAL_URL_PROTOCOLS = /* @__PURE__ */ new Set([
+  "http:",
+  "https:",
+  "ftp:",
+  "smtp:"
+]);
+function containsUrlCredentials(value) {
+  try {
+    const url = new URL(value);
+    return CREDENTIAL_URL_PROTOCOLS.has(url.protocol) && (url.username.length > 0 || url.password.length > 0);
+  } catch {
+    return false;
+  }
+}
+function isBase64UrlSegment(value) {
+  if (value.length === 0) {
+    return false;
+  }
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    const isDigit = code >= 48 && code <= 57;
+    const isUppercase = code >= 65 && code <= 90;
+    const isLowercase = code >= 97 && code <= 122;
+    if (!isDigit && !isUppercase && !isLowercase && character !== "_" && character !== "-") {
+      return false;
+    }
+  }
+  return true;
+}
+function looksLikeJwt(value) {
+  const segments = value.split(".");
+  return segments.length === 3 && segments[0].startsWith("eyJ") && segments.every(isBase64UrlSegment);
+}
 function shouldRedactEnvironmentVariable(key, value, allowedSet, blockedSet, isStrictSanitization = false) {
   key = key.toUpperCase();
-  value = value?.toUpperCase();
   if (allowedSet?.has(key)) {
     return false;
   }
@@ -1624,6 +1652,9 @@ function shouldRedactEnvironmentVariable(key, value, allowedSet, blockedSet, isS
     }
   }
   if (value) {
+    if (containsUrlCredentials(value) || looksLikeJwt(value)) {
+      return true;
+    }
     for (const pattern of NEVER_ALLOWED_VALUE_PATTERNS) {
       if (pattern.test(value)) {
         return true;
@@ -2463,6 +2494,16 @@ function sanitizeForDisplay(str, maxLength) {
   }
   return sanitized;
 }
+function sanitizeMultilineForDisplay(str, maxLength) {
+  if (!str) {
+    return "";
+  }
+  let sanitized = stripUnsafeCharacters(str).replace(/\r\n?/g, "\n");
+  if (maxLength && sanitized.length > maxLength) {
+    sanitized = sanitized.substring(0, maxLength - 3) + "...";
+  }
+  return sanitized;
+}
 var stringWidthCache = new LRUCache(
   LRU_BUFFER_PERF_CACHE_LIMIT
 );
@@ -5814,6 +5855,7 @@ export {
   cpSlice,
   stripUnsafeCharacters,
   sanitizeForDisplay,
+  sanitizeMultilineForDisplay,
   getCachedStringWidth,
   escapeAnsiCtrlCodes,
   theme,