@dsh-plus/secret-env 0.1.16 → 0.1.17

package/lib/client.js

@@ -983,7 +983,7 @@ ${extra}
 						timer.current = setTimeout(() => setCopied(false), 1500);
 					});
 				},
-				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutline16, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutline16, { size: 14 })
+				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutlineRegular, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutlineRegular, { size: 14 })
 			});
 		}
 		/** 会话内屏蔽开关（眼睛语义：可见=注入，划掉=本会话屏蔽）。 */
@@ -1031,7 +1031,7 @@ ${extra}
 						onClick: () => {
 							unsetSession(props.sessionId, entry.name).then(() => props.onChanged()).catch((error) => props.onError(errorText(t, error)));
 						},
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconTrashOutline16, { size: 14 })
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconTrashOutlineRegular, { size: 14 })
 					})]
 				})]
 			});
@@ -1146,7 +1146,7 @@ ${extra}
 								title: t("refresh"),
 								"aria-label": t("refresh"),
 								onClick: load,
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconRefreshOutline16, { size: 14 })
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconRefreshOutlineRegular, { size: 14 })
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								type: "button",
@@ -1154,7 +1154,7 @@ ${extra}
 								title: t("close"),
 								"aria-label": t("close"),
 								onClick: props.onClose,
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCloseOutline16, { size: 14 })
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCloseOutlineMedium, { size: 14 })
 							})
 						]
 					}) : null,
@@ -1377,7 +1377,7 @@ ${extra}
 						timer.current = setTimeout(() => setCopied(false), 1500);
 					});
 				},
-				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutline16, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutline16, { size: 14 })
+				children: copied ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCheckOutlineRegular, { size: 14 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutlineRegular, { size: 14 })
 			});
 		}
 		/** 全局变量行：完整变量名（复制）+ 描述 + 状态徽标 + 两步删除。 */
@@ -1432,7 +1432,7 @@ ${extra}
 							title: t("delete"),
 							"aria-label": t("delete"),
 							onClick: () => setConfirming(true),
-							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconTrashOutline16, { size: 14 })
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconTrashOutlineRegular, { size: 14 })
 						})
 					]
 				})]

package/lib/index.d.ts

@@ -1,5 +1,6 @@
 import z from "@deepseek-ai/schemastery";
 import { Context, Service } from "@deepseek-ai/cordis";
+import { UnwrapVolatile } from "@dsh-plus/shared";
 //#region src/config.d.ts
 /** 一条全局密钥的元数据（值不在此处）。 */
 interface SecretMeta {
@@ -13,14 +14,17 @@ interface SecretMetaInput {
   description?: string;
   createdAt?: string;
 }
-declare const Config: z<Schemastery.ObjectS<{
-  secrets: z<SecretMetaInput[], SecretMeta[]>;
-  masked: z<string[], string[]>;
-}>, Schemastery.ObjectT<{
-  secrets: z<SecretMetaInput[], SecretMeta[]>;
-  masked: z<string[], string[]>;
-}>>;
-type SecretEnvConfig = Schemastery.TypeT<typeof Config>;
+declare const Config: z<Schemastery.ObjectS<NoInfer<{
+  secrets: z<NoInfer<SecretMetaInput[]>, NoInfer<SecretMeta[]>, "volatile-defined">;
+  masked: z<NoInfer<string[]>, NoInfer<string[]>, "volatile-defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+  secrets: z<NoInfer<SecretMetaInput[]>, NoInfer<SecretMeta[]>, "volatile-defined">;
+  masked: z<NoInfer<string[]>, NoInfer<string[]>, "volatile-defined">;
+}>>, "plain">;
+/** 活动字段形态（0.1.7 loader 解析产物：volatile 字段为活动引用）。 */
+type SecretEnvConfigFields = Schemastery.TypeT<typeof Config>;
+/** 平面配置形态（消费面的读取形态，由活动引用解包得到）。 */
+type SecretEnvConfig = UnwrapVolatile<SecretEnvConfigFields>;
 //#endregion
 //#region src/inventory.d.ts
 /** 列表端点的全局条目（describe 视图，绝无值）。 */
@@ -66,17 +70,17 @@ declare class SecretEnvService extends Service {
   private readonly sessionMasks;
   /** contributor 登记簿（受管/继承两条线，一键一主）。 */
   private readonly book;
-  /** 行级 config（settings 缺席时的索引来源）。 */
+  /** 行级 config 解包基线（settings 缺席时的索引来源）。 */
   private readonly base;
-  /** installSection 给的实时 getter（scope.get 的活视图，读即最新，无时序竞态）。 */
+  /** 活动引用现取 getter（loader 原位提交，读即最新；行级 config 缺席时为 undefined）。 */
   private readIndex;
   /** 上次调和时的索引快照（onChange 差量用）。 */
   private lastMeta;
   private settingsRef;
   /** 启动镜像建立完成（测试与需要确定性的调用方可等待）。 */
   readonly ready: Promise<void>;
-  constructor(ctx: Context, config: SecretEnvConfig | undefined);
-  /** 当前生效索引（settings 活视图优先，缺席回落行级 config）。 */
+  constructor(ctx: Context, config: SecretEnvConfig | SecretEnvConfigFields | undefined);
+  /** 当前生效索引（活动引用现取优先，行级 config 缺席回落空索引）。 */
   private currentMeta;
   /** 当前全局屏蔽名单（与索引同源，活读取）。 */
   private currentMasked;

package/lib/index.js

@@ -1,6 +1,7 @@
 import z from "@deepseek-ai/schemastery";
 import { Service } from "@deepseek-ai/cordis";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { unwrapVolatile } from "@dsh-plus/shared";
 //#region src/ns.ts
 /**
 * settings 命名空间字面量（纯常量，零依赖，浏览器半可安全引入）。
@@ -23,8 +24,8 @@ const SecretMetaSchema = z.object({
 	createdAt: z.string().description("创建时间 ISO").default("")
 });
 const Config = z.object({
-	secrets: z.array(SecretMetaSchema).description("全局密钥元数据索引（值存凭据库）").default([]),
-	masked: z.array(z.string()).description("全局屏蔽的变量名后缀（继承变量等；注入时跳过）").default([])
+	secrets: z.array(SecretMetaSchema).description("全局密钥元数据索引（值存凭据库）").default([]).volatile(),
+	masked: z.array(z.string()).description("全局屏蔽的变量名后缀（继承变量等；注入时跳过）").default([]).volatile()
 });
 //#endregion
 //#region src/errors.ts
@@ -320,9 +321,9 @@ var SecretEnvService = class extends Service {
 	sessionMasks = /* @__PURE__ */ new Map();
 	/** contributor 登记簿（受管/继承两条线，一键一主）。 */
 	book;
-	/** 行级 config（settings 缺席时的索引来源）。 */
+	/** 行级 config 解包基线（settings 缺席时的索引来源）。 */
 	base;
-	/** installSection 给的实时 getter（scope.get 的活视图，读即最新，无时序竞态）。 */
+	/** 活动引用现取 getter（loader 原位提交，读即最新；行级 config 缺席时为 undefined）。 */
 	readIndex;
 	/** 上次调和时的索引快照（onChange 差量用）。 */
 	lastMeta = [];
@@ -331,10 +332,11 @@ var SecretEnvService = class extends Service {
 	ready;
 	constructor(ctx, config) {
 		super(ctx, "secretEnv");
-		this.base = config ?? {
+		this.base = config !== void 0 ? unwrapVolatile(config) : {
 			secrets: [],
 			masked: []
 		};
+		this.readIndex = config !== void 0 ? () => unwrapVolatile(config) : void 0;
 		this.book = new ContributorBook({
 			shellEnv: ctx.shellEnv,
 			describeManaged: (suffix) => {
@@ -351,18 +353,10 @@ var SecretEnvService = class extends Service {
 			}
 		});
 		ctx.inject(["settings"], (settingsCtx) => {
-			const settings = settingsCtx.settings;
-			settings.installSection(ctx, SETTINGS_NS, Config, this.base, {
-				setSource: (source) => {
-					this.readIndex = source;
-				},
-				onChange: () => {
-					this.reconcile();
-				}
-			});
-			this.settingsRef = settings;
+			this.settingsRef = settingsCtx.settings;
 			this.reconcile();
 		});
+		ctx.events.on("loader/volatile-update", () => void this.reconcile());
 		ctx.root.on("session/disposed", (session) => {
 			this.sessionMasks.delete(session.id);
 			this.dropBucket(session.id);
@@ -377,7 +371,7 @@ var SecretEnvService = class extends Service {
 		for (const suffix of this.inheritedSuffixes()) this.book.syncInherited(suffix);
 		this.ready = this.reconcile();
 	}
-	/** 当前生效索引（settings 活视图优先，缺席回落行级 config）。 */
+	/** 当前生效索引（活动引用现取优先，行级 config 缺席回落空索引）。 */
 	currentMeta() {
 		return asMeta(this.readIndex !== void 0 ? this.readIndex() : this.base);
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-plus/secret-env",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "dsh-plus service+ui plugin: 密钥环境变量——以 $DSH_VAR_* 变量名向 agent 暴露密钥（全局持久/会话级/一次性），执行期经 dsh-shell-env 原生注入，值不进消息流，不影响缓存率",
   "type": "module",
   "main": "lib/index.js",
@@ -19,27 +19,27 @@
     "src"
   ],
   "dependencies": {
-    "@dsh-plus/shared": "0.1.21"
+    "@dsh-plus/shared": "0.1.22"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-credentials": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-settings": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-shell-env": "^0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.2"
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.1.7-alpha.2",
+    "@deepseek-ai/dsh-shell-env": "^0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-client-ui-commands": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-credentials": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-settings": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-shell-env": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "3.18.2",
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-client-ui-commands": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-credentials": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-shell-env": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "3.18.4",
     "@types/node": "26.4.0",
     "@types/react": "~18.3.31",
     "react": "^18.2.0"

package/src/client/panel.tsx

@@ -7,13 +7,13 @@
  */
 
 import {
-  IconCheckOutline16,
-  IconCloseOutline16,
-  IconCopyOutline16,
+  IconCheckOutlineRegular,
+  IconCloseOutlineMedium,
+  IconCopyOutlineRegular,
   IconEye,
   IconEyeOff,
-  IconRefreshOutline16,
-  IconTrashOutline16,
+  IconRefreshOutlineRegular,
+  IconTrashOutlineRegular,
 } from '@dsh-plus/shared/client'
 import { type ReactElement, useEffect, useRef, useState } from 'react'
 
@@ -72,7 +72,7 @@ function CopyButton(props: { t: Translate; text: string }): ReactElement {
         })
       }}
     >
-      {copied ? <IconCheckOutline16 size={14} /> : <IconCopyOutline16 size={14} />}
+      {copied ? <IconCheckOutlineRegular size={14} /> : <IconCopyOutlineRegular size={14} />}
     </button>
   )
 }
@@ -124,7 +124,7 @@ function SessionRow(props: {
               .catch((error: unknown) => props.onError(errorText(t, error)))
           }}
         >
-          <IconTrashOutline16 size={14} />
+          <IconTrashOutlineRegular size={14} />
         </button>
       </div>
     </div>
@@ -253,7 +253,7 @@ export function SessionSecretsPanel(props: SessionSecretsPanelProps): ReactEleme
             aria-label={t('refresh')}
             onClick={load}
           >
-            <IconRefreshOutline16 size={14} />
+            <IconRefreshOutlineRegular size={14} />
           </button>
           <button
             type="button"
@@ -262,7 +262,7 @@ export function SessionSecretsPanel(props: SessionSecretsPanelProps): ReactEleme
             aria-label={t('close')}
             onClick={props.onClose}
           >
-            <IconCloseOutline16 size={14} />
+            <IconCloseOutlineMedium size={14} />
           </button>
         </div>
       ) : null}

package/src/client/section.tsx

@@ -8,11 +8,11 @@
  */
 
 import {
-  IconCheckOutline16,
-  IconCopyOutline16,
+  IconCheckOutlineRegular,
+  IconCopyOutlineRegular,
   IconEye,
   IconEyeOff,
-  IconTrashOutline16,
+  IconTrashOutlineRegular,
 } from '@dsh-plus/shared/client'
 import { type ReactElement, useEffect, useRef, useState, useSyncExternalStore } from 'react'
 
@@ -78,7 +78,7 @@ function CopyButton(props: { t: Translate; text: string }): ReactElement {
         })
       }}
     >
-      {copied ? <IconCheckOutline16 size={14} /> : <IconCopyOutline16 size={14} />}
+      {copied ? <IconCheckOutlineRegular size={14} /> : <IconCopyOutlineRegular size={14} />}
     </button>
   )
 }
@@ -138,7 +138,7 @@ function GlobalRow(props: {
             aria-label={t('delete')}
             onClick={() => setConfirming(true)}
           >
-            <IconTrashOutline16 size={14} />
+            <IconTrashOutlineRegular size={14} />
           </button>
         )}
       </div>

package/src/config.ts

@@ -6,6 +6,7 @@
  * @module secret-env/config
  */
 import z from '@deepseek-ai/schemastery'
+import type { UnwrapVolatile } from '@dsh-plus/shared'
 
 import { SETTINGS_NS as NS_LITERAL } from './ns.ts'
 
@@ -35,12 +36,22 @@ const SecretMetaSchema: z<SecretMetaInput, SecretMeta> = z.object({
   createdAt: z.string().description('创建时间 ISO').default(''),
 })
 
+// 0.1.7：全字段 `.volatile()`——条目进入 settings describe 视图（卡片可读写），
+// loader 原位提交活动引用，索引读取现取即热。
 export const Config = z.object({
-  secrets: z.array(SecretMetaSchema).description('全局密钥元数据索引（值存凭据库）').default([]),
+  secrets: z
+    .array(SecretMetaSchema)
+    .description('全局密钥元数据索引（值存凭据库）')
+    .default([])
+    .volatile(),
   masked: z
     .array(z.string())
     .description('全局屏蔽的变量名后缀（继承变量等；注入时跳过）')
-    .default([]),
+    .default([])
+    .volatile(),
 })
 
-export type SecretEnvConfig = Schemastery.TypeT<typeof Config>
+/** 活动字段形态（0.1.7 loader 解析产物：volatile 字段为活动引用）。 */
+export type SecretEnvConfigFields = Schemastery.TypeT<typeof Config>
+/** 平面配置形态（消费面的读取形态，由活动引用解包得到）。 */
+export type SecretEnvConfig = UnwrapVolatile<SecretEnvConfigFields>

package/src/service.ts

@@ -20,9 +20,10 @@ import type {} from '@deepseek-ai/dsh-session'
 import type {} from '@deepseek-ai/dsh-settings'
 import type {} from '@deepseek-ai/dsh-shell-env'
 import type { ToolExecution } from '@deepseek-ai/dsh-tools'
+import { unwrapVolatile } from '@dsh-plus/shared'
 
 import { registerSecretEnvApi } from './api.ts'
-import { Config, type SecretEnvConfig, type SecretMeta } from './config.ts'
+import type { SecretEnvConfig, SecretEnvConfigFields, SecretMeta } from './config.ts'
 import { ContributorBook } from './contributors.ts'
 import { SecretEnvError } from './errors.ts'
 import {
@@ -38,16 +39,9 @@ import {
 import { envNameOf, suffixOf } from './names.ts'
 import { SETTINGS_NS } from './ns.ts'
 
+/** settings 服务窄面（0.1.7 只需 update 写入用户层；describe 读由 loader 并入 config）。 */
 interface SettingsLike {
-  get(ns: string): unknown
   update(ns: string, patch: Record<string, unknown>): Promise<void>
-  installSection(
-    ownerCtx: Context,
-    ns: string,
-    schema: unknown,
-    base: unknown,
-    hooks: { setSource(source: () => unknown): void; onChange(): void },
-  ): void
 }
 
 export class SecretEnvService extends Service {
@@ -63,19 +57,22 @@ export class SecretEnvService extends Service {
   private readonly sessionMasks = new Map<string, Set<string>>()
   /** contributor 登记簿（受管/继承两条线，一键一主）。 */
   private readonly book: ContributorBook
-  /** 行级 config（settings 缺席时的索引来源）。 */
+  /** 行级 config 解包基线（settings 缺席时的索引来源）。 */
   private readonly base: SecretEnvConfig
-  /** installSection 给的实时 getter（scope.get 的活视图，读即最新，无时序竞态）。 */
-  private readIndex: (() => unknown) | undefined
+  /** 活动引用现取 getter（loader 原位提交，读即最新；行级 config 缺席时为 undefined）。 */
+  private readIndex: (() => SecretEnvConfig) | undefined
   /** 上次调和时的索引快照（onChange 差量用）。 */
   private lastMeta: SecretMeta[] = []
   private settingsRef: SettingsLike | undefined
   /** 启动镜像建立完成（测试与需要确定性的调用方可等待）。 */
   readonly ready: Promise<void>
 
-  constructor(ctx: Context, config: SecretEnvConfig | undefined) {
+  constructor(ctx: Context, config: SecretEnvConfig | SecretEnvConfigFields | undefined) {
     super(ctx, 'secretEnv')
-    this.base = config ?? { secrets: [], masked: [] }
+    // 0.1.7 替代 installSection/setSource：活动引用原位提交——索引读取经
+    // readIndex 现取平面快照，用户层写入走 loader 落盘 + 原位提交热生效。
+    this.base = config !== undefined ? unwrapVolatile(config) : { secrets: [], masked: [] }
+    this.readIndex = config !== undefined ? () => unwrapVolatile(config) : undefined
     this.book = new ContributorBook({
       shellEnv: ctx.shellEnv,
       describeManaged: (suffix) => {
@@ -95,22 +92,14 @@ export class SecretEnvService extends Service {
         return process.env[envNameOf(suffix)]
       },
     })
-    // 官方 installSection 范式（同 usage-panel）：setSource 收到的是
-    // () => scope.get() 活视图——索引读取永远走 currentMeta() 现取，
-    // onChange 仅触发差量调和，因此用户层加载早晚都不会被写覆盖。
+    // settings 在时捕获写入引用并立即差量调和（用户层索引并入镜像，
+    // 用户层加载早晚都不会被写覆盖）；volatile 提交事件驱动重调和
+    // （替代原 installSection onChange）。
     ctx.inject(['settings'], (settingsCtx) => {
-      const settings = settingsCtx.settings as unknown as SettingsLike
-      settings.installSection(ctx, SETTINGS_NS, Config, this.base, {
-        setSource: (source) => {
-          this.readIndex = source
-        },
-        onChange: () => {
-          void this.reconcile()
-        },
-      })
-      this.settingsRef = settings
+      this.settingsRef = settingsCtx.settings as unknown as SettingsLike
       void this.reconcile()
     })
+    ctx.events.on('loader/volatile-update', () => void this.reconcile())
     ctx.root.on('session/disposed', (session: { id: string }) => {
       this.sessionMasks.delete(session.id)
       this.dropBucket(session.id)
@@ -130,7 +119,7 @@ export class SecretEnvService extends Service {
     this.ready = this.reconcile()
   }
 
-  /** 当前生效索引（settings 活视图优先，缺席回落行级 config）。 */
+  /** 当前生效索引（活动引用现取优先，行级 config 缺席回落空索引）。 */
   private currentMeta(): SecretMeta[] {
     return asMeta(this.readIndex !== undefined ? this.readIndex() : this.base)
   }