@dsh-plus/secret-env 0.1.1 → 0.1.2

package/src/client/client.ts

@@ -1,17 +1,20 @@
 /**
  * 浏览器半入口：
- * - settings.section 官方插槽注册「密钥变量」独立设置页（全局管理）；
- * - conversation.input.right session 作用域插槽注册 composer 钥匙胶囊
- *   （会话级密钥面板；会话 id 由插槽 inject 工厂直接供给）。
+ * - settings.section 官方插槽注册「环境变量」独立设置页
+ *   （全局管理 + 继承变量屏蔽 + 会话变量管理）；
+ * - conversation.input.overlay 注册两个 session 作用域浮层：
+ *   `$` 触发补全菜单与 /var 命令唤起的会话变量面板；
+ * - commandUi 注册 /var 斜杠命令（官方 popupSelect 壳 → 打开总线 → 面板）。
  * 数据均经同源 HTTP 端点（值不上行经任何对话通道）。
  * @module @dsh-plus/secret-env/client
  */
 import type { Context } from '@deepseek-ai/cordis'
 
-import { ComposerSecret } from './composer.tsx'
+import { registerVarCommand } from './command.ts'
 import { en, NS, zh } from './i18n.ts'
 import { SecretMenu, type TokenSpanLike } from './menu.tsx'
-import { SecretsSection } from './section.tsx'
+import { SessionPanelHost } from './panel-host.tsx'
+import { SecretsSection, type SessionsListLike } from './section.tsx'
 import { injectSecretEnvStyle } from './styles.ts'
 
 export const name = 'dsh-plus-secret-env'
@@ -34,14 +37,16 @@ interface SessionScopeLike {
   bail(subject: unknown, event: string, payload: Record<string, unknown>): unknown
 }
 
-interface SessionsLike {
+interface SessionsLike extends SessionsListLike {
   scope(sessionId: string): SessionScopeLike | undefined
+  subagentAddress?(sessionId: string): unknown
 }
 
 interface ClientContext {
   slots: SlotsLike
   locale: LocaleLike
   sessions: SessionsLike
+  inject(keys: readonly string[], callback: (scope: never) => void): unknown
   effect(execute: () => () => void, label?: string): unknown
 }
 
@@ -65,26 +70,14 @@ export function apply(ctx: Context): void {
         id: 'dsh-plus-secret-env',
         order: 16,
         label: () => t('nav'),
-        inject: () => ({ t }),
+        inject: () => ({ t, sessions: c.sessions }),
       },
       SecretsSection,
     ),
   )
 
-  // composer 工具行钥匙胶囊（conversation.input.right：session 作用域 list 槽，
-  // inject 工厂收框架解析的 sessionId）。
-  c.slots.inject('conversation.input.right', () =>
-    c.slots.register(
-      {
-        name: 'conversation.input.right',
-        id: 'dsh-plus-secret-env',
-        order: 40,
-        locale: NS,
-        inject: (sessionId: string) => ({ sessionId }),
-      },
-      ComposerSecret,
-    ),
-  )
+  // `/var` 斜杠命令（commandUi 由 dsh-client-ui-commands 客户端半提供）。
+  registerVarCommand(c, c.sessions, t)
 
   // `$` 触发补全菜单（conversation.input.overlay：composer 卡片内浮层）。
   // 插入走官方会话作用域 bail 通道 slash/input-insert-text（span+draftRev CAS）。
@@ -112,4 +105,18 @@ export function apply(ctx: Context): void {
       SecretMenu,
     ),
   )
+
+  // `/var` 唤起的会话变量面板（同一 overlay 槽，监听打开总线）。
+  c.slots.inject('conversation.input.overlay', () =>
+    c.slots.register(
+      {
+        name: 'conversation.input.overlay',
+        id: 'dse-secret-panel',
+        order: 20,
+        locale: NS,
+        inject: (sessionId: string) => ({ sessionId }),
+      },
+      SessionPanelHost,
+    ),
+  )
 }

package/src/client/command.ts

@@ -0,0 +1,62 @@
+/**
+ * `/var` 斜杠命令（dsh-client-ui-commands 的 commandUi 服务）：
+ * contribution 仅支持官方 popupSelect 壳（kind 唯一），故命令提供单个
+ * 「打开面板」动作，选中后经打开总线唤起本会话的变量面板——
+ * 完全自定义的 React 面板只能在自己占有的 overlay 槽渲染。
+ * 子代理会话不提供本命令（对齐官方 /model 的可用性过滤）。
+ * @module secret-env/client/command
+ */
+import { requestOpenSessionPanel } from './panel-bus.ts'
+
+/** commandUi 服务的结构子集（dsh-client-ui-commands CommandUiContract）。 */
+interface CommandUiLike {
+  register(contribution: {
+    name: string
+    description: string
+    available(session: { sessionId: string }): boolean
+    ui: {
+      kind: 'popupSelect'
+      options(session: { sessionId: string }): Promise<readonly { id: string; label: string }[]>
+      onSelect(option: { id: string }, session: { sessionId: string }): void | Promise<void>
+    }
+  }): () => void
+}
+
+interface CommandScope {
+  commandUi: CommandUiLike
+  effect(execute: () => () => void, label?: string): unknown
+}
+
+interface CommandHostContext {
+  inject(keys: readonly string[], callback: (scope: CommandScope) => void): unknown
+}
+
+interface SessionsAvailabilityLike {
+  subagentAddress?(sessionId: string): unknown
+}
+
+/** 注册 /var 命令（commandUi 服务缺席时 inject 回调不触发，自然跳过）。 */
+export function registerVarCommand(
+  ctx: CommandHostContext,
+  sessions: SessionsAvailabilityLike,
+  t: (key: string) => string,
+): void {
+  ctx.inject(['commandUi'], (scope) => {
+    scope.effect(
+      () =>
+        scope.commandUi.register({
+          name: 'var',
+          description: t('command.description'),
+          available: (session) => sessions.subagentAddress?.(session.sessionId) === undefined,
+          ui: {
+            kind: 'popupSelect',
+            options: () => Promise.resolve([{ id: 'open', label: t('command.openPanel') }]),
+            onSelect: (_option, session) => {
+              requestOpenSessionPanel(session.sessionId)
+            },
+          },
+        }),
+      'secret-env: /var contribution',
+    )
+  })
+}

package/src/client/common.ts

@@ -1,7 +1,9 @@
 /**
- * 浏览器半共享小件：错误码文案映射与复制助手（设置页与会话控件共用）。
+ * 浏览器半共享小件：错误码文案映射、复制助手与变量名输入规则
+ * （设置页与会话控件共用；名称规则与 node 半 names.ts 同源）。
  * @module secret-env/client/common
  */
+import { type NameError, normalizeSuffix, validateSuffix } from '../names.ts'
 import { ApiError } from './api.ts'
 
 /** 端点错误 → 本地化文案（未知码回落 internal）。 */
@@ -12,6 +14,17 @@ export function errorText(t: (key: string) => string, error: unknown): string {
   return text === `error.${code}` ? t('error.internal') : text
 }
 
+/** 名称输入的实时规范化：键入即转大写（去空白交给保存时的 normalizeSuffix）。 */
+export function liveName(raw: string): string {
+  return raw.toUpperCase()
+}
+
+/** 名称输入的实时校验：空串不标错（必填兜底），其余按 names.ts 规则判定。 */
+export function nameErrorOf(raw: string): NameError | null {
+  if (raw.trim() === '') return null
+  return validateSuffix(normalizeSuffix(raw))
+}
+
 /** 复制文本到剪贴板（clipboard API 缺席时退 execCommand）。 */
 export async function copyText(text: string): Promise<boolean> {
   try {

package/src/client/i18n.ts

@@ -7,22 +7,18 @@ import { commonEn, commonZh, mergeDict } from '@dsh-plus/shared/client'
 export const NS = 'dsh-plus-secret-env'
 
 const ownZh = {
-  nav: '密钥变量',
-  title: '密钥变量',
+  nav: '环境变量',
+  title: '环境变量',
   description:
-    '以 $DSH_SECRET_* 变量名向 agent 暴露密钥：值在每次 shell 调用时由宿主注入，不进入对话记录与提示词，不影响上下文缓存。',
+    '以 $DSH_VAR_* 变量名向 agent 暴露值（密钥、链接等）：值在每次 shell 调用时由宿主注入，不进入对话记录与提示词，不影响上下文缓存。',
   // 设置页（全局）
-  globalList: '全局密钥',
-  colName: '变量名（模型可见）',
-  colDescription: '描述',
-  colState: '状态',
-  colActions: '操作',
+  globalList: '全局变量',
   configured: '已配置',
   unconfigured: '未配置',
   readonly: '只读来源',
-  addGlobal: '添加全局密钥',
-  nameLabel: '变量名后缀',
-  nameHint: '大写字母/数字/下划线，如 GITHUB_TOKEN；模型实际使用 $DSH_SECRET_ 前缀拼接后的完整名。',
+  addGlobal: '添加全局变量',
+  nameLabel: '变量名',
+  nameHint: '大写字母/数字/下划线，如 GITHUB_TOKEN；模型实际使用 $DSH_VAR_ 前缀拼接后的完整名。',
   valueLabel: '值',
   valueHint: '写入后不可回读；保存于宿主凭据库，不进入对话。',
   descLabel: '描述（可选）',
@@ -30,26 +26,46 @@ const ownZh = {
   save: '保存',
   saving: '保存中…',
   delete: '删除',
-  deleteConfirm: '确认删除 {name}？该变量将立即对后续命令失效。',
   copy: '复制变量名',
   copied: '已复制',
-  emptyGlobal: '暂无全局密钥。添加后 agent 即可通过变量名引用。',
+  emptyGlobal: '暂无全局变量。添加后 agent 即可通过变量名引用。',
   loadFailed: '加载失败，请稍后重试。',
   retry: '重试',
-  // 会话注入控件
-  sessionSecrets: '会话密钥',
-  sessionEmpty: '本会话暂无有默认值的密钥。',
+  // 继承变量
+  inheritedList: '继承变量（宿主环境）',
+  inheritedNote: '来自宿主进程环境，默认纳入注入',
+  inheritedEmpty: '宿主环境中没有可继承的 DSH_VAR_* 变量。',
+  maskGlobal: '全局屏蔽',
+  unmaskGlobal: '恢复注入',
+  maskedBadge: '已屏蔽',
+  maskedGlobalBadge: '已全局屏蔽',
+  // 设置页会话管理
+  sessionManage: '会话变量',
+  sessionPick: '选择会话',
+  sessionPickEmpty: '暂无会话',
+  // 会话面板
+  sessionSecrets: '会话变量',
+  sessionList: '会话变量',
+  sessionEmpty: '本会话暂无变量。',
   sessionHint: '仅当前会话的 shell 命令可用；会话结束或一次性使用即失效。',
-  addSession: '添加会话密钥',
+  addSession: '添加会话变量',
   onceLabel: '一次性（首次使用后销毁）',
+  globalInSession: '全局变量（可在本会话屏蔽）',
+  inheritedInSession: '继承变量（可在本会话屏蔽）',
+  maskSession: '在本会话屏蔽',
+  unmaskSession: '在本会话恢复',
   close: '关闭',
   refresh: '刷新',
   scopeGlobal: '全局',
   scopeSession: '会话',
   scopeOnce: '一次性',
+  scopeInherited: '继承',
   // `$` 触发补全菜单
-  'menu.title': '密钥变量',
-  'menu.aria': '密钥变量候选',
+  'menu.title': '变量',
+  'menu.aria': '变量候选',
+  // /var 斜杠命令
+  'command.description': '管理本会话的环境变量（密钥、链接等）',
+  'command.openPanel': '打开会话变量面板',
   // 错误码
   'error.invalid-name': '变量名不合法：大写字母开头，仅字母/数字/下划线，≤64 字符。',
   'error.empty-value': '值不能为空。',
@@ -61,22 +77,18 @@ const ownZh = {
 }
 
 const ownEn = {
-  nav: 'Secret Variables',
-  title: 'Secret Variables',
+  nav: 'Env Variables',
+  title: 'Env Variables',
   description:
-    'Expose secrets to the agent as $DSH_SECRET_* variables: values are injected by the host into each shell call, never enter the transcript or prompt, and do not affect context caching.',
-  globalList: 'Global secrets',
-  colName: 'Variable (model-visible)',
-  colDescription: 'Description',
-  colState: 'State',
-  colActions: 'Actions',
+    'Expose values (keys, links, etc.) to the agent as $DSH_VAR_* variables: values are injected by the host into each shell call, never enter the transcript or prompt, and do not affect context caching.',
+  globalList: 'Global variables',
   configured: 'Configured',
   unconfigured: 'Not configured',
   readonly: 'Read-only source',
-  addGlobal: 'Add global secret',
-  nameLabel: 'Name suffix',
+  addGlobal: 'Add global variable',
+  nameLabel: 'Variable name',
   nameHint:
-    'Uppercase letters/digits/underscore, e.g. GITHUB_TOKEN; the model uses the full name with the $DSH_SECRET_ prefix.',
+    'Uppercase letters/digits/underscore, e.g. GITHUB_TOKEN; the model uses the full name with the $DSH_VAR_ prefix.',
   valueLabel: 'Value',
   valueHint: 'Write-only after saving; stored in the host credential store, never in chat.',
   descLabel: 'Description (optional)',
@@ -84,25 +96,42 @@ const ownEn = {
   save: 'Save',
   saving: 'Saving…',
   delete: 'Delete',
-  deleteConfirm: 'Delete {name}? The variable stops working for subsequent commands immediately.',
   copy: 'Copy variable name',
   copied: 'Copied',
-  emptyGlobal: 'No global secrets yet. Once added, the agent can reference them by name.',
+  emptyGlobal: 'No global variables yet. Once added, the agent can reference them by name.',
   loadFailed: 'Failed to load. Try again later.',
   retry: 'Retry',
-  sessionSecrets: 'Session secrets',
-  sessionEmpty: 'No session secrets yet.',
+  inheritedList: 'Inherited variables (host env)',
+  inheritedNote: 'From the host process environment; injected by default',
+  inheritedEmpty: 'No inheritable DSH_VAR_* variables in the host environment.',
+  maskGlobal: 'Mask globally',
+  unmaskGlobal: 'Resume injection',
+  maskedBadge: 'Masked',
+  maskedGlobalBadge: 'Masked globally',
+  sessionManage: 'Session variables',
+  sessionPick: 'Select session',
+  sessionPickEmpty: 'No sessions',
+  sessionSecrets: 'Session variables',
+  sessionList: 'Session variables',
+  sessionEmpty: 'No session variables yet.',
   sessionHint:
     'Available to shell commands of this session only; expires when the session ends or after one use.',
-  addSession: 'Add session secret',
+  addSession: 'Add session variable',
   onceLabel: 'One-time (destroyed after first use)',
+  globalInSession: 'Global variables (can be masked in this session)',
+  inheritedInSession: 'Inherited variables (can be masked in this session)',
+  maskSession: 'Mask in this session',
+  unmaskSession: 'Resume in this session',
   close: 'Close',
   refresh: 'Refresh',
   scopeGlobal: 'global',
   scopeSession: 'session',
   scopeOnce: 'once',
-  'menu.title': 'Secret variables',
-  'menu.aria': 'Secret variable suggestions',
+  scopeInherited: 'inherited',
+  'menu.title': 'Variables',
+  'menu.aria': 'Variable suggestions',
+  'command.description': "Manage this session's env variables (keys, links, etc.)",
+  'command.openPanel': 'Open the session variable panel',
   'error.invalid-name':
     'Invalid name: start with an uppercase letter; letters/digits/underscore only, ≤64 chars.',
   'error.empty-value': 'Value must not be empty.',

package/src/client/menu-core.ts

@@ -14,12 +14,12 @@ export interface SecretHit {
   readonly end: number
 }
 
-/** 菜单候选项（全局与会话密钥的统一视图，纯展示数据）。 */
+/** 菜单候选项（全局/会话/继承密钥的统一视图，纯展示数据）。 */
 export interface SecretCandidate {
   readonly envName: string
   readonly name: string
   readonly description: string
-  readonly scope: 'global' | 'session'
+  readonly scope: 'global' | 'session' | 'inherited'
   readonly once?: boolean
 }
 

package/src/client/menu.tsx

@@ -92,12 +92,23 @@ function toCandidates(list: SecretList): SecretCandidate[] {
       scope: 'session' as const,
       once: entry.once,
     })),
-    ...list.global.map((entry) => ({
-      envName: entry.envName,
-      name: entry.name,
-      description: entry.description,
-      scope: 'global' as const,
-    })),
+    // 已屏蔽的变量不会注入，不出候选（避免误导补全）。
+    ...list.global
+      .filter((entry) => !entry.masked)
+      .map((entry) => ({
+        envName: entry.envName,
+        name: entry.name,
+        description: entry.description,
+        scope: 'global' as const,
+      })),
+    ...list.inherited
+      .filter((entry) => !entry.masked)
+      .map((entry) => ({
+        envName: entry.envName,
+        name: entry.name,
+        description: '',
+        scope: 'inherited' as const,
+      })),
   ]
 }
 
@@ -262,6 +273,7 @@ export function SecretMenu(props: SecretMenuProps): ReactElement | null {
             type="button"
             role="option"
             aria-selected={index === highlight}
+            title={`$${entry.envName}`}
             className={`dse-menuItem${index === highlight ? ' dse-menuItemActive' : ''}`}
             onMouseEnter={() => setHighlight(index)}
             onMouseDown={(event) => {
@@ -269,12 +281,16 @@ export function SecretMenu(props: SecretMenuProps): ReactElement | null {
               pick(entry)
             }}
           >
-            <span className="dse-menuName">${entry.envName}</span>
+            <span className="dse-menuName">{entry.name}</span>
             <span className="dse-menuDesc">{entry.description}</span>
             <span className="dse-menuBadges">
               {entry.once === true ? <span className="dse-badge">{t('scopeOnce')}</span> : null}
               <span className="dse-badge dse-badgeDim">
-                {entry.scope === 'session' ? t('scopeSession') : t('scopeGlobal')}
+                {entry.scope === 'session'
+                  ? t('scopeSession')
+                  : entry.scope === 'inherited'
+                    ? t('scopeInherited')
+                    : t('scopeGlobal')}
               </span>
             </span>
           </button>

package/src/client/panel-bus.ts

@@ -0,0 +1,23 @@
+/**
+ * 会话密钥面板的打开总线（bundle 内模块级 pub/sub）：
+ * 斜杠命令的 onSelect 与 overlay 槽里的面板宿主在同一 bundle，
+ * 经此按 sessionId 定向投递「打开面板」信号，避免跨 cordis 作用域布线。
+ * @module secret-env/client/panel-bus
+ */
+
+type Listener = (sessionId: string) => void
+
+const listeners = new Set<Listener>()
+
+/** 请求打开指定会话的密钥面板（由 /secret 命令的 onSelect 调用）。 */
+export function requestOpenSessionPanel(sessionId: string): void {
+  for (const listener of listeners) listener(sessionId)
+}
+
+/** 订阅打开信号；返回退订器（随组件卸载清理）。 */
+export function onOpenSessionPanel(listener: Listener): () => void {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}

package/src/client/panel-host.tsx

@@ -0,0 +1,63 @@
+/**
+ * 会话变量面板的 overlay 宿主（conversation.input.overlay 官方插槽，
+ * session 作用域）：常驻监听打开总线，/var 命令选中后弹出面板。
+ * 弹层定位于 composer 卡片上方（与 $ 菜单同一浮层语言）；
+ * 点外部或 Esc 关闭。闭合态不渲染面板（数据在打开时现取）。
+ * @module secret-env/client/panel-host
+ */
+import { type ReactElement, useEffect, useRef, useState } from 'react'
+
+import { SessionSecretsPanel } from './panel.tsx'
+import { onOpenSessionPanel } from './panel-bus.ts'
+
+export interface SessionPanelHostProps {
+  /** 插槽 inject 工厂注入的当前会话 id。 */
+  sessionId: string
+  t(key: string): string
+}
+
+export function SessionPanelHost(props: SessionPanelHostProps): ReactElement | null {
+  const { sessionId, t } = props
+  const [open, setOpen] = useState(false)
+  const wrapRef = useRef<HTMLDivElement | null>(null)
+
+  // 打开总线：只响应本会话的定向信号。
+  useEffect(
+    () =>
+      onOpenSessionPanel((target) => {
+        if (target === sessionId) setOpen(true)
+      }),
+    [sessionId],
+  )
+
+  // Esc / 点外部关闭（捕获阶段，先于编辑器吞键）。
+  useEffect(() => {
+    if (!open) return
+    const onKey = (event: KeyboardEvent): void => {
+      if (event.key !== 'Escape') return
+      event.preventDefault()
+      event.stopPropagation()
+      setOpen(false)
+    }
+    const onDown = (event: PointerEvent): void => {
+      if (!(event.target instanceof Node)) return
+      if (wrapRef.current?.contains(event.target) === true) return
+      setOpen(false)
+    }
+    document.addEventListener('keydown', onKey, true)
+    document.addEventListener('pointerdown', onDown, true)
+    return () => {
+      document.removeEventListener('keydown', onKey, true)
+      document.removeEventListener('pointerdown', onDown, true)
+    }
+  }, [open])
+
+  if (!open) return null
+  return (
+    <div className="dse-panelWrap" ref={wrapRef}>
+      <div className="dse-panelCard" role="dialog" aria-label={t('sessionSecrets')}>
+        <SessionSecretsPanel sessionId={sessionId} t={t} onClose={() => setOpen(false)} />
+      </div>
+    </div>
+  )
+}