@crazyhappyone/dsh-tui 0.1.0-alpha.3 → 0.1.0-alpha.5

package/README.i18n.yaml

@@ -1,5 +1,5 @@
 # Bilingual-pair consistency record: both languages carry equal authority.
 # This source-only mirror has no DSH pairing runner. Recompute with:
 #   git hash-object README.md README.zh.md
-README.md: 6ba38f56bdd03135d3b64978b0cb48bd011d67a7
-README.zh.md: 9fe961f55b084acfa9938638238ea71ab43c6147
+README.md: 496d812168deb2af7d4a933f961b58c1cfd814cd
+README.zh.md: 8474c7be4cf16c0d5123222bab95b5231f34e185

package/README.md

@@ -7,6 +7,10 @@ kind: "package-group"
 
 English | [中文](README.zh.md)
 
+[![CI](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml)
+[![GitHub release](https://img.shields.io/github/v/release/zhangyang-crazy-one/dsh-tui?include_prereleases)](https://github.com/zhangyang-crazy-one/dsh-tui/releases)
+[![npm next](https://img.shields.io/npm/v/%40crazyhappyone%2Fdsh-tui/next?label=npm%40next)](https://www.npmjs.com/package/@crazyhappyone/dsh-tui)
+
 ## Summary
 
 `@crazyhappyone/dsh-tui` provides the `dsh-tui` command for running and safely updating the DeepSeek Harness terminal interface. The launcher manages a dedicated DSH source checkout, so it never pulls, resets, stashes, or cleans a contributor's development checkout. This public repository also mirrors the `packages/tui/` bundle and renderer sources for review. DSH continues to own agents, sessions, tools, persistence, providers, permissions, and profile assembly.
@@ -40,22 +44,34 @@ After sending `你好`:
 -----
 
 <a id="install-the-launcher"></a>
-## Install the launcher
+## Install the launcher and runtime modes
 
 The unscoped `dsh-tui` package belongs to another maintainer. This project publishes only under the authenticated `crazyhappyone` npm scope.
 
-The launcher requires Git, pnpm, and a DSH-supported Node version. Installing `@deepseek-ai/dsh` separately is neither required nor used: `dsh-tui` always runs the `deepseek-tui` profile from its dedicated source checkout.
+`dsh-tui` supports two runtime modes:
 
-Install the prerelease and complete the first launch:
+### Mode A: Lightweight Mode (Recommended, Zero-Clone)
+Install the official core engine and the TUI launcher globally (dozens of MB):
 
 ```text
+npm install --global @deepseek-ai/dsh
 npm install --global @crazyhappyone/dsh-tui@next
-dsh-tui version
-dsh-tui update
+dsh-tui probe
 dsh-tui
 ```
 
-Package installation creates only the launcher. It does not clone DSH, run `pnpm install`, prompt for Git credentials, or execute a postinstall script. The explicit `dsh-tui update` command creates the source runtime; its default private source requires repository authorization.
+In this mode, the launcher automatically detects the installed `dsh` executable and mounts the bundled prebuilt TUI extension without cloning the 2GB monorepo.
+
+### Mode B: Source Mode (Developer / Debugging)
+To debug or hack on TUI or DSH source directly:
+
+```text
+npm install --global @crazyhappyone/dsh-tui@next
+dsh-tui update
+dsh-tui --source
+```
+
+The explicit `dsh-tui update` command clones the monorepo via Git and runs `pnpm install`. You can use `dsh-tui probe` anytime to inspect the detected engine.
 
 -----
 
@@ -146,30 +162,26 @@ The launcher runtime must remain separate from the development checkout. To test
 <a id="publish-the-npm-package"></a>
 ## Publish the npm package
 
-The operator authenticates through npm's browser flow and verifies the selected account:
+GitHub Actions tests every pull request and push to `main` on Node 22.19 and 24. Publishing starts only when a GitHub Release is published. The workflow rejects a release tag unless it equals `v` followed by the version in `package.json`; prereleases publish to npm's `next` tag and stable releases publish to `latest`.
 
-```text
-npm config delete //registry.npmjs.org/:_authToken
-npm config set registry https://registry.npmjs.org/
-npm login --registry=https://registry.npmjs.org/ --auth-type=web
-npm whoami
-```
-
-`npm whoami` must print `crazyhappyone`. Never place the password, OTP, or npm token in this repository, an issue, command output captured for review, or an AI conversation.
-
-After tests and packed-install verification pass, publish a prerelease only with explicit operator approval:
+Configure npm Trusted Publishing once after `publish.yml` is present on the default branch. npm CLI 11.5.1 or newer can register the GitHub workflow through an authenticated browser session. The command below runs a compatible npm 11 temporarily and does not replace the globally installed npm:
 
 ```text
-npm publish --access public --tag next
+npx --yes npm@11 trust github @crazyhappyone/dsh-tui \
+  --file publish.yml \
+  --repository zhangyang-crazy-one/dsh-tui \
+  --allow-publish
 ```
 
-When npm requires two-factor authentication, the operator supplies the current code locally:
+The equivalent npm website settings are organization or user `zhangyang-crazy-one`, repository `dsh-tui`, workflow filename `publish.yml`, with no environment restriction. The workflow uses GitHub OIDC and stores no npm token, password, or OTP.
+
+For each release, bump `package.json`, merge the change after CI passes, then create a GitHub Release whose tag matches the package version:
 
 ```text
-npm publish --access public --tag next --otp=<six-digit-code>
+gh release create v0.1.0-alpha.4 --prerelease --generate-notes
 ```
 
-Promotion to `latest` is a separate release decision. Local implementation and verification never create or change a registry package automatically.
+The `Publish npm` workflow runs tests and packed-package verification again before publishing. Do not rerun an old release tag: npm versions are immutable. Promotion to stable is a new version and a non-prerelease GitHub Release.
 
 -----
 

package/README.zh.md

@@ -7,6 +7,10 @@ kind: "package-group"
 
 [English](README.md) | 中文
 
+[![CI](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml)
+[![GitHub release](https://img.shields.io/github/v/release/zhangyang-crazy-one/dsh-tui?include_prereleases)](https://github.com/zhangyang-crazy-one/dsh-tui/releases)
+[![npm next](https://img.shields.io/npm/v/%40crazyhappyone%2Fdsh-tui/next?label=npm%40next)](https://www.npmjs.com/package/@crazyhappyone/dsh-tui)
+
 ## 概述
 
 `@crazyhappyone/dsh-tui` 提供 `dsh-tui` 命令，用于运行和安全更新 DeepSeek Harness 终端界面。Launcher 管理专用 DSH 源码 checkout，因此不会 pull、reset、stash 或 clean 贡献者的开发 checkout。本公开仓库还镜像 `packages/tui/` bundle 与 renderer 源码以供审查。Agent、会话、工具、持久化、provider、权限与 profile 组装仍由 DSH 拥有。
@@ -40,22 +44,34 @@ kind: "package-group"
 -----
 
 <a id="install-the-launcher"></a>
-## 安装 launcher
+## 安装 launcher 与运行模式
 
 无 scope 的 `dsh-tui` 包属于另一位 maintainer。本项目只在已认证的 `crazyhappyone` npm scope 下发布。
 
-Launcher 需要 Git、pnpm 与 DSH 支持的 Node 版本。无需单独安装 `@deepseek-ai/dsh`，launcher 也不会使用它：`dsh-tui` 始终从专用源码 checkout 运行 `deepseek-tui` profile。
+`dsh-tui` 支持两种运行模式：
 
-安装 prerelease 并完成首次启动：
+### 模式 A：轻量模式（推荐，零 Clone 秒开）
+只需通过 npm 全局安装官方核心引擎与 TUI launcher（仅数十 MB），即可直接运行：
 
 ```text
+npm install --global @deepseek-ai/dsh
 npm install --global @crazyhappyone/dsh-tui@next
-dsh-tui version
-dsh-tui update
+dsh-tui probe
 dsh-tui
 ```
 
-安装 npm 包只会创建 launcher。它不会 clone DSH、运行 `pnpm install`、请求 Git 凭据或执行 postinstall script。显式执行 `dsh-tui update` 才会创建源码运行时；其默认 private 源码需要仓库授权。
+在此模式下，launcher 会自动探测全局 `dsh`，并挂载预构建的 TUI 扩展，无需克隆 2GB 的 monorepo 仓库。
+
+### 模式 B：源码模式（开发者调试）
+若需对 TUI 或 DSH 底层代码进行修改与调试：
+
+```text
+npm install --global @crazyhappyone/dsh-tui@next
+dsh-tui update
+dsh-tui --source
+```
+
+显式执行 `dsh-tui update` 才会通过 Git 克隆源码并执行 `pnpm install`。可通过 `dsh-tui probe` 查看当前探测到的运行引擎。
 
 -----
 
@@ -146,30 +162,26 @@ Launcher runtime 必须与开发 checkout 分离。要安全测试其他源码
 <a id="publish-the-npm-package"></a>
 ## 发布 npm 包
 
-Operator 通过 npm browser flow 认证，并验证所选账号：
+GitHub Actions 会在每个 pull request 和向 `main` 的 push 上使用 Node 22.19 与 24 运行测试。只有发布 GitHub Release 才会启动 npm 发布。工作流要求 Release tag 等于 `v` 加 `package.json` 中的版本；prerelease 发布到 npm `next` tag，stable release 发布到 `latest`。
 
-```text
-npm config delete //registry.npmjs.org/:_authToken
-npm config set registry https://registry.npmjs.org/
-npm login --registry=https://registry.npmjs.org/ --auth-type=web
-npm whoami
-```
-
-`npm whoami` 必须打印 `crazyhappyone`。绝不要把密码、OTP 或 npm token 放入本仓库、issue、供审查捕获的命令输出或 AI conversation。
-
-测试与 packed-install 验证通过后，仅在 operator 显式批准时发布 prerelease：
+在 `publish.yml` 进入默认分支后，一次性配置 npm Trusted Publishing。npm CLI 11.5.1 或更高版本可以通过已认证的 browser session 注册 GitHub workflow。下面的命令会临时运行兼容的 npm 11，不替换全局安装的 npm：
 
 ```text
-npm publish --access public --tag next
+npx --yes npm@11 trust github @crazyhappyone/dsh-tui \
+  --file publish.yml \
+  --repository zhangyang-crazy-one/dsh-tui \
+  --allow-publish
 ```
 
-npm 要求双因素认证时，operator 在本地提供当前验证码：
+对应的 npm 网站配置为：organization or user 填 `zhangyang-crazy-one`，repository 填 `dsh-tui`，workflow filename 填 `publish.yml`，environment 留空。工作流使用 GitHub OIDC，不保存 npm token、密码或 OTP。
+
+每次发布时，先提升 `package.json` 版本，等待 CI 通过并合并，然后创建 tag 与 package version 一致的 GitHub Release：
 
 ```text
-npm publish --access public --tag next --otp=<six-digit-code>
+gh release create v0.1.0-alpha.4 --prerelease --generate-notes
 ```
 
-提升到 `latest` 是单独的 release 决策。本地实现与验证绝不会自动创建或更改 registry package。
+`Publish npm` workflow 会在发布前再次运行测试与 packed-package 验证。不要重新运行旧的 release tag：npm version 不可覆盖。提升到 stable 必须使用新版本并发布 non-prerelease GitHub Release。
 
 -----
 

package/bin/dsh-tui.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /** Command-line entry for the dsh-tui source-runtime launcher. */
 
-import { lstatSync, mkdirSync, readFileSync } from 'node:fs'
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { constants, homedir } from 'node:os'
 import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
@@ -50,17 +50,21 @@ function signalOutcome(signal) {
 
 const manifest = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'))
 
+const packageRoot = fileURLToPath(new URL('..', import.meta.url))
+
 try {
   const invocation = parseLauncherInvocation(process.argv.slice(2))
-  const settings = resolveLauncherSettings({ env: process.env, homeDirectory: homedir() })
+  const settings = resolveLauncherSettings({ env: process.env, homeDirectory: homedir(), packageRoot })
   process.exitCode = runLauncher({
     invocation,
     settings,
     packageVersion: manifest.version,
+    env: process.env,
     adapters: {
       inspectPath,
       makeDirectory: path => mkdirSync(path, { recursive: true, mode: 0o700 }),
       readText: path => readFileSync(path, 'utf8'),
+      writeText: (path, content) => writeFileSync(path, content, 'utf8'),
       run,
       writeOut: text => process.stdout.write(text),
       writeError: text => process.stderr.write(text),

package/cordis.patch.yml

@@ -0,0 +1,73 @@
+# The deepseek-tui bundle patch: terminal-surface mode directly over dsh-base.
+# It mounts no Host, HTTP server, Web runtime, or browser plugin. An ordinary
+# provider plugin parses --resume/--cwd and the task positional, then the
+# terminal driver creates an Agent through the core registry and prints its
+# durable result. Unlike the web surface, the agent plane stays process-wide:
+# dsh-base keeps tool-bash/tool-fs/tool-todo and friends because the TUI is
+# single-session and composes its agent process-wide.
+
+- id: system-prompt
+  config:
+    persona: >-
+      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+      You are interacting with the user through the deepseek-tui terminal interface.
+
+# The shared module-reload HMR row stays off; the launcher's watch-only
+# fallback still keeps the user patch layers live until the run exits.
+- id: hmr
+  disabled: true
+
+- id: tools
+  config:
+    # Keep the same temporary process-wide Code Mode opt-in as the Web surface.
+    mode: !!js process.env.DSH_TOOLS_MODE
+
+- id: approval
+  config:
+    policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'workspace-write') === 'danger-full-access' ? 'never' : 'ask'"
+
+# Full-text session search stays disabled until the first Ctrl+K search (the
+# base row's `openAt: never`). The TUI has no browser-latency concern, so the
+# node:sqlite import and in-memory handle open lazily on first search.
+- id: session-query-sqlite
+  config:
+    path: ':memory:'
+    openAt: first-search
+
+- insert:
+    - id: tui-startup
+      name: "./dist/startup.js"
+
+    # Reads its task from the ordinary tuiStartup provider.
+    - id: tui-runtime
+      name: "./dist/index.js"
+      inject: [tuiStartup]
+      config:
+        task: !!js ctx.tuiStartup.task
+        resume: !!js ctx.tuiStartup.resume
+        cwd: !!js ctx.tuiStartup.cwd
+        frameStats: !!js ctx.tuiStartup.frameStats
+        # Render policy (overscan + stream pacing + scroll pacing + cache budgets).
+        # Loaded by the runtime Config schema; the values below mirror the
+        # schema defaults so the deployment layer owns the tunables. Override
+        # here to retune without touching the plugin.
+        renderPolicy:
+          transcriptOverscan: 16
+          stream:
+            frameIntervalMs: 16
+            entryDepth: 64
+            exitDepth: 32
+            entryOldestAgeMs: 500
+            exitOldestAgeMs: 250
+            entryDrainBackpressureMs: 100
+            exitDrainBackpressureMs: 50
+            catchUpRowsPerFrame: 16
+          scroll:
+            frameIntervalMs: 16
+            stepPerFrame: 1
+            wheelRows: 3
+            catchUpThreshold: 10
+            maxCatchUpStep: 8
+          cache:
+            maxRows: 4096
+            maxBytes: 4194304