@fa-software/semi2-dsh 0.0.13-preview.20260921160207 → 0.0.13

package/lib/types/web/routes.d.ts

@@ -1,13 +1,11 @@
 import type { Context } from '@deepseek-ai/cordis';
-import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WebServer } from '@deepseek-ai/dsh-host-webserver';
 import { type RequestFence } from './fence.js';
-/** 注册路由所需的最小 webServer 面（dsh-host-webserver 的 `register`）。 */
-export interface WebServerRouteSink {
-    register(route: {
-        kind: 'exact';
-        path: string;
-        handler: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
-    }): () => void;
+/** 注册路由所需的 webServer 面（dsh-host-webserver 的 `register`）。 */
+export type WebServerRouteSink = Pick<WebServer, 'register'>;
+export interface RouteOptions {
+    /** 请求体上限（字节）；缺省见入口 Config。 */
+    bodyLimitBytes?: number | undefined;
 }
 /**
  * 本模块消费的配置面（登录 / 登出 / 健康）：由入口按运行实例直接传入。
@@ -30,4 +28,4 @@ export interface RouteRuntime {
  * 注册三条路由：依赖全部由调用方传入（webServer 来自 `inject(['webServer'])` 作用域、fence 来自
  * `connection`）。模块内不做「依赖缺席就静默不装」的判断；注册一律走 ctx.effect 保证可回收。
  */
-export declare function installRoutes(ctx: Context, webServer: WebServerRouteSink, runtime: RouteRuntime, fence: RequestFence): void;
+export declare function installRoutes(ctx: Context, webServer: WebServerRouteSink, runtime: RouteRuntime, fence: RequestFence, options?: RouteOptions): void;

package/lib/types/web/welcome-ack.d.ts

@@ -1,7 +1,8 @@
 import type { Context } from '@deepseek-ai/cordis';
 /**
  * dsh-client-ui-settings-models 中 bundle 私有常量的镜像（比 notice 文案高一层）：升级 pinned dsh channel
- * （DSH_VERSION）时须核对该串仍等于客户端 bundle 里的值，回归测试钉住它；陈旧值只退化为原生行为。
+ * 时由 `test/dsh/unit/dsh-contract.test.mjs` 核对该串仍等于客户端 bundle 里的字面量；
+ * 陈旧值只退化为原生行为。
  */
 export declare const WELCOME_NOTICE_VERSION = "2026-08-13.1";
 /** 产品级 GUI onboarding 事实的 durable settings 命名空间。 */

package/lib/web/fence.js

@@ -1,10 +1,10 @@
-/** 校验不过就地应答，返回是否已拒绝（非 undefined 即拒）。 */
+/** 校验不过就地应答（状态码照官方拒绝码：401 未鉴权 / 403 栅栏拒绝），返回是否已拒绝。 */
 export function rejected(req, res, fence) {
     const rejection = fence.requestRejection(req);
-    if (rejection === undefined || rejection === null)
+    if (rejection === undefined)
         return false;
     if (!res.headersSent)
-        res.statusCode = 403;
+        res.statusCode = rejection;
     res.end();
     return true;
 }

package/lib/web/index.js

@@ -2,7 +2,8 @@ import { installRoutes } from './routes.js';
 import { installWelcomeAck } from './welcome-ack.js';
 /** 登录路由健康判定的等待上限：校验面缺席时按「登录路由缺失」暴露，而不是静默。 */
 const FENCE_TIMEOUT_MS = 5_000;
-export function installWebSurface(ctx, runtime, registerHealth) {
+export function installWebSurface(ctx, runtime, registerHealth, options = {}) {
+    const fenceTimeoutMs = options.fenceTimeoutMs ?? FENCE_TIMEOUT_MS;
     let surface = 'absent';
     registerHealth({
         key: 'healthWeb',
@@ -27,7 +28,7 @@ export function installWebSurface(ctx, runtime, registerHealth) {
                     // 无 logger 的宿主忽略。
                 }
             }
-        }, FENCE_TIMEOUT_MS);
+        }, fenceTimeoutMs);
         workstationCtx.effect(() => () => {
             clearTimeout(timer);
         });
@@ -35,7 +36,7 @@ export function installWebSurface(ctx, runtime, registerHealth) {
         // 校验面缺席就不装路由，由健康字段把这种情形暴露出来，而不是让路由静默失效。
         workstationCtx.inject(['connection'], (connCtx) => {
             surface = 'ready';
-            installRoutes(connCtx, webServer, runtime, connCtx.get('connection'));
+            installRoutes(connCtx, webServer, runtime, connCtx.get('connection'), { bodyLimitBytes: options.bodyLimitBytes });
         });
         installWelcomeAck(workstationCtx);
     });

package/lib/web/routes.js

@@ -2,7 +2,6 @@ import { rejected } from './fence.js';
 const LOGIN_PATH = '/semi2/login';
 const LOGOUT_PATH = '/semi2/logout';
 const HEALTH_PATH = '/semi2/health';
-const MAX_BODY = 8 * 1024;
 function send(res, status, body) {
     const payload = JSON.stringify(body);
     res.writeHead(status, {
@@ -12,13 +11,13 @@ function send(res, status, body) {
     });
     res.end(payload);
 }
-async function readJson(req) {
+async function readJson(req, maxBody) {
     const chunks = [];
     let size = 0;
     for await (const chunk of req) {
         const buffer = chunk instanceof Uint8Array ? chunk : Buffer.from(chunk);
         size += buffer.byteLength;
-        if (size > MAX_BODY)
+        if (size > maxBody)
             throw new Error('BODY_TOO_LARGE');
         chunks.push(buffer);
     }
@@ -31,7 +30,8 @@ function text(value) {
  * 注册三条路由：依赖全部由调用方传入（webServer 来自 `inject(['webServer'])` 作用域、fence 来自
  * `connection`）。模块内不做「依赖缺席就静默不装」的判断；注册一律走 ctx.effect 保证可回收。
  */
-export function installRoutes(ctx, webServer, runtime, fence) {
+export function installRoutes(ctx, webServer, runtime, fence, options = {}) {
+    const maxBody = options.bodyLimitBytes ?? 8 * 1024;
     ctx.effect(() => webServer.register({
         kind: 'exact',
         path: LOGIN_PATH,
@@ -43,7 +43,7 @@ export function installRoutes(ctx, webServer, runtime, fence) {
                 return;
             }
             try {
-                const raw = await readJson(req);
+                const raw = await readJson(req, maxBody);
                 const body = raw !== null && typeof raw === 'object'
                     ? raw
                     : {};

package/lib/web/welcome-ack.js

@@ -1,6 +1,7 @@
 /**
  * dsh-client-ui-settings-models 中 bundle 私有常量的镜像（比 notice 文案高一层）：升级 pinned dsh channel
- * （DSH_VERSION）时须核对该串仍等于客户端 bundle 里的值，回归测试钉住它；陈旧值只退化为原生行为。
+ * 时由 `test/dsh/unit/dsh-contract.test.mjs` 核对该串仍等于客户端 bundle 里的字面量；
+ * 陈旧值只退化为原生行为。
  */
 export const WELCOME_NOTICE_VERSION = '2026-08-13.1';
 /** 产品级 GUI onboarding 事实的 durable settings 命名空间。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fa-software/semi2-dsh",
-  "version": "0.0.13-preview.20260921160207",
+  "version": "0.0.13",
   "type": "module",
   "description": "Semi2 单插件：semi2-hub 配置引导 + 公共 Web 能力，并挂载 CodeGraph 官方 MCP 服务。",
   "main": "lib/index.js",
@@ -37,34 +37,50 @@
       ]
     }
   },
-  "dependencies": {
-    "ws": "^8.21.3"
-  },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-agent-default-model": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.6-alpha.2",
     "@deepseek-ai/dsh-credentials": "^0.1.6-alpha.2",
     "@deepseek-ai/dsh-host-webserver": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.1.6-alpha.2",
     "@deepseek-ai/dsh-skill": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.6-alpha.2",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-agent-default-model": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-workspace-controller": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-credentials": {
       "optional": true
     },
     "@deepseek-ai/dsh-host-webserver": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-settings": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-skill": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-util-values": "^0.1.6-alpha.2",
     "@graphql-codegen/cli": "7.4.0",
     "@graphql-codegen/typescript": "6.1.0",
     "@graphql-codegen/typescript-operations": "6.1.6",
     "@types/node": "^24.0.0",
     "@types/react": "^19.0.0",
-    "@types/ws": "^8.18.1",
     "graphql": "^16.11.0",
     "react": "^19.2.0",
     "tsdown": "^0.22.2",