@gatherthread/dsh-host 0.1.0-beta.1 → 0.1.0-beta.2

package/README.md

@@ -7,38 +7,40 @@ installation, GatherThread does not load in DSH or alter the GatherThread
 server, Web app, Codex bridge, or Claude adapter.
 
 The normal path is the published `@deepseek-ai/dsh` CLI, not a DSH source
-checkout. The verified distribution is `@deepseek-ai/dsh@0.1.2-rc.1` with the
-`web` profile and its public `sessionPersistence.list` recovery surface. The
-earlier source-only PoC remains fixed to `dsh-v0.1.3-alpha.1`, commit
-`d347e703908d0406b7a7ef80e3a0e594d86b2215`, and is only an advanced diagnostic
+checkout. The verified distribution is `@deepseek-ai/dsh@0.1.7-rc.2` with the
+`web` profile and its public `sessionPersistence` recovery surface. The
+source-only path remains fixed to `dsh-v0.1.7-rc.2`, commit
+`477b4f420553e8a52c2fbccc464d7561b239c443`, and is only an advanced diagnostic
 fallback. All version-sensitive Host calls remain inside `src/dsh-compat.ts`.
 The package does not install a DSH runtime dependency.
 
 ## Plugin-first connection
 
-After `@gatherthread/dsh-host` is published, the ordinary three-step path is:
+Use **Connect DeepSeek Harness → Download packages for this server** in GatherThread to download its source-matched DSH plugin TGZ. Replace the example path below with the downloaded file's full path:
 
 ```text
-npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add @gatherthread/dsh-host@0.1.0-beta.1
-npx @deepseek-ai/dsh@0.1.2-rc.1 web
+npx @deepseek-ai/dsh@0.1.7-rc.2 plugin --profile web add "/absolute/path/to/LOCAL_DSH_PLUGIN.tgz"
+npx @deepseek-ai/dsh@0.1.7-rc.2 web
 # In DSH: Settings -> GatherThread / 共序 -> Sign in and pair
 ```
 
+On Windows, use a quoted path such as `C:/Users/you/Downloads/your-plugin.tgz`. The registry's `@gatherthread/dsh-host@0.1.0-beta.1` is an older build and does not include the current message-deletion safeguards. If server downloads are unavailable, [build the matching source checkout](../../docs/DSH_CONNECT.md#source-checkout-fallback); do not substitute the old npm build.
+
 Check the active CLI with `npx @deepseek-ai/dsh --version`. The normal start
-command already pins `0.1.2-rc.1`. DSH 0.1.2 does not
+command already pins `0.1.7-rc.2`. The pinned DSH does not
 expose the root CLI version as a stable Host service, so the package does not
 inspect npx cache paths or claim runtime-version introspection. The install
 command pins the exact verified CLI, while every required Host/Client service is
 validated structurally and fails closed before a request can be claimed.
 
-`dsh plugin --profile web add` is DSH 0.1.2's official package installation
+`dsh plugin --profile web add` is the pinned DSH release's official package installation
 mechanism. It initializes a missing `web` profile on first use, invokes pnpm,
-and appends only packages declaring `dsh.bundle`. DSH 0.1.2 has no verified
+and appends only packages declaring `dsh.bundle`. The pinned DSH has no verified
 public plugin marketplace, marketplace index, or registration workflow. This
 repository change prepares the package but does not publish it or modify a real
 DSH profile.
 
-Inside DSH, choose the future GatherThread public service or enter one custom
+Inside DSH, choose the GatherThread public service or enter one custom
 server origin. The same field covers an HTTPS LAN host, self-hosted deployment,
 or Tailscale address; plain HTTP is accepted only on loopback. The plugin opens
 an outbound HTTPS connection. A five-minute, single-use short code is confirmed
@@ -52,7 +54,7 @@ Before removal, use **Disconnect** inside the DSH panel to clear the local
 grant, then run:
 
 ```text
-npx @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web remove @gatherthread/dsh-host
+npx @deepseek-ai/dsh@0.1.7-rc.2 plugin --profile web remove @gatherthread/dsh-host
 ```
 
 The official command removes only this package dependency and profile layer;
@@ -62,7 +64,7 @@ advanced/offline diagnostics, not the normal user path.
 
 ## GitHub code synchronization
 
-Beta 1 includes direct GitHub controls and requires matching server, Web app and native plugin releases. The project owner first connects an existing repository and base branch in Web. Install Git 2.38+ and GitHub CLI on the device, then open **Settings → GatherThread / 共序 → 项目代码 · GitHub（推荐）**. Click **连接 GitHub · 打开浏览器** to start local browser sign-in if needed, then authorize that exact project/repository configuration. `gh auth login --hostname github.com --git-protocol https --web` remains a local fallback. This consent is separate from GT Cloud and conversation sync; a new GitHub binding automatically uploads settled changes while idle and can be switched off. Configuration changes, including pause/resume, require renewed local authorization.
+Beta 2 includes direct GitHub controls and requires matching server, Web app and native plugin releases. The project owner first connects an existing repository and base branch in Web. Install Git 2.38+ and GitHub CLI on the device, then open **Settings → GatherThread / 共序 → 项目代码 · GitHub（推荐）**. Click **连接 GitHub · 打开浏览器** to start local browser sign-in if needed, then authorize that exact project/repository configuration. `gh auth login --hostname github.com --git-protocol https --web` remains a local fallback. This consent is separate from GT Cloud and conversation sync; a new GitHub binding automatically uploads settled changes while idle and can be switched off. Configuration changes, including pause/resume, require renewed local authorization.
 
 The Web app may request code operations only on your selected online runtime and cannot grant this local consent. Code and GitHub credentials travel directly to GitHub. GitHub permissions remain independent of GT membership; removing a GT member or project does not revoke GitHub access or delete GitHub data. See [Project code collaboration](../../docs/CODE_SYNC.md) for setup, recovery, limits and GitHub workflow-trigger risks.
 
@@ -70,10 +72,13 @@ GitHub 接入仍为**未发布源码预览**，需使用匹配的服务端、网
 
 ## Security and recovery
 
-Only allowlisted public text/tool fields leave DSH. Reasoning blocks, raw model
-streams, request headers, replay state, tool-private metadata, and credentials
-are structurally unreachable from the upload mapper. Tool values are redacted
-and bounded. The connector holds one active request, persists a private atomic
+Only allowlisted public text/tool fields leave DSH. An exact GatherThread-claimed
+prompt can additionally stream native-exposed thinking and real plans. The live
+listener verifies owned Agent, Session and execution; the npm fallback requires
+DSH's genuine Agent-loop marker rather than a model-name match. Raw request
+bodies, headers, replay state, tool-private metadata and unrelated native streams
+stay outside the mapper. Tool arguments are parsed and redacted before upload;
+incomplete JSON emits only a preparation marker. The connector holds one active request, persists a private atomic
 cursor/outbox, reuses DSH's official Session resume/repair path, and releases its
 listeners, timer, HTTP abort signal, Agent handle, and write ownership on unload.
 
@@ -114,9 +119,10 @@ cancels its queued permit before it can claim a request. Existing single-Session
 valid when `bindingMode` is omitted; both modes resolve the real current actor
 before applying Solo permissions.
 
-During an active prompt, newly durable DSH Host events queue a rate-limited,
-generic progress marker; event bursts coalesce. The marker carries no event text,
-reasoning, headers, or private stream data, but renews the exact claim attempt. Progress, completion,
+During an active claimed prompt, selected native-visible answer, thinking, tool
+and plan updates coalesce into bounded redacted snapshots. Generic activity
+markers carry no native content and remain separate from presence. Accepted
+progress renews the exact claim attempt. Progress, completion,
 and request-linked tool outbox entries are rebound to the renewed attempt after a
 crash recovery, while stale attempts remain fenced by the server.
 

package/bundle/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "name": "@gatherthread/dsh-host",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "license": "Apache-2.0",
   "defaultEnabled": false,
   "hostEntry": "@gatherthread/dsh-host",
@@ -15,15 +15,15 @@
     "primary": {
       "distribution": "npm",
       "package": "@deepseek-ai/dsh",
-      "version": "0.1.2-rc.1",
+      "version": "0.1.7-rc.2",
       "profile": "web",
       "persistenceProbe": "list"
     },
     "sourceFallback": {
       "distribution": "source",
-      "tag": "dsh-v0.1.3-alpha.1",
-      "version": "0.1.3-alpha.1",
-      "commit": "d347e703908d0406b7a7ef80e3a0e594d86b2215",
+      "tag": "dsh-v0.1.7-rc.2",
+      "version": "0.1.7-rc.2",
+      "commit": "477b4f420553e8a52c2fbccc464d7561b239c443",
       "verifiedProfiles": ["headless", "web"],
       "persistenceProbe": "stat"
     }

package/client/client.js

@@ -35,6 +35,21 @@ function GatherThreadStatusPanel({ connection, sessions }) {
   const [provider, setProvider] = React.useState("");
   const [model, setModel] = React.useState("");
   const visibleSessionSignature = React.useRef("");
+  /** Recovery observed from both status polls and action responses. */
+  const lastRecoverableError = React.useRef(undefined);
+
+  const observeRouteRecovery = (next, configureResponse = false) => {
+    const recovery = next?.recoverableError;
+    // A failed configure is a new revoked choice even if the error code has not
+    // changed. Steady polls must leave an operator's new selection alone.
+    if (recovery === "route_unavailable"
+      && (configureResponse || lastRecoverableError.current !== "route_unavailable")) {
+      setCatalog(undefined);
+      setProvider("");
+      setModel("");
+    }
+    lastRecoverableError.current = recovery;
+  };
 
   React.useEffect(() => {
     let disposed = false;
@@ -60,6 +75,7 @@ function GatherThreadStatusPanel({ connection, sessions }) {
           }
           setSnapshot(result.snapshot);
           setNativeState(result.nativeState);
+          observeRouteRecovery(result.nativeState);
           setUnavailable(false);
           timer = setTimeout(refresh, POLL_INTERVAL_MS);
         }
@@ -95,10 +111,12 @@ function GatherThreadStatusPanel({ connection, sessions }) {
       const next = endpoint === "catalog/get" ? parseCatalog(value) : parseNativeState(value);
       if (endpoint === "catalog/get") {
         setCatalog(next);
-        const firstProvider = next.providers[0];
-        setProvider((current) => current || firstProvider?.id || "");
-        setModel((current) => current || firstProvider?.models[0]?.id || "");
+        const selectedProvider = next.providers.find((entry) => entry.id === provider) ?? next.providers[0];
+        setProvider(selectedProvider?.id ?? "");
+        setModel((current) => selectedProvider?.models.some((entry) => entry.id === current)
+          ? current : selectedProvider?.models[0]?.id ?? "");
       } else {
+        observeRouteRecovery(next, endpoint === "connection/configure");
         setNativeState(next);
         setSnapshot(next.runtime);
         if (endpoint === "connection/configure") await sessions.refresh();
@@ -184,6 +202,7 @@ function GatherThreadStatusPanel({ connection, sessions }) {
       setDeviceName,
       setProvider,
       setModel,
+      setCatalog,
       runAction,
     }),
   nativeState === undefined || unavailable ? null : renderCodeSyncControls(nativeState, busy, runAction, true),
@@ -435,8 +454,9 @@ function renderNativeControls(input) {
     );
   } else if (state.route === undefined) {
     const providers = input.catalog?.providers ?? [];
-    const selectedProvider = providers.find((entry) => entry.id === input.provider) ?? providers[0];
+    const selectedProvider = providers.find((entry) => entry.id === input.provider);
     const models = selectedProvider?.models ?? [];
+    const validSelection = models.some((entry) => entry.id === input.model);
     controls.push(
       connectionSummary(state),
       // Reaching this branch means authorization is already "paired": the
@@ -445,7 +465,12 @@ function renderNativeControls(input) {
       // is registered, so a bare stopped connection is indistinguishable from a
       // fresh install. State the remaining step explicitly.
       React.createElement("p", { key: "select-model-notice", style: styles.notice },
-        "配对完成后，尚未选择 DSH Provider 与 Model。完成选择并点击下方按钮后，本机 DSH 运行时才会注册到 GatherThread；在此之前，GatherThread 网页无法发现这台 DSH。"),
+        // A dropped route is not the same situation as a fresh pairing, and saying
+        // so is the whole point of not repointing the model silently: the reader has
+        // to know their previous choice no longer exists before picking another.
+        state.recoverableError === "route_unavailable"
+          ? "DSH 当前已不再提供此前为该连接选择的模型，因此该连接已停止并取消注册。请重新选择 Provider 与 Model；在此之前的旧模型不会被自动替换。"
+          : "配对完成后，尚未选择 DSH Provider 与 Model。完成选择并点击下方按钮后，本机 DSH 运行时才会注册到 GatherThread；在此之前，GatherThread 网页无法发现这台 DSH。"),
       input.catalog === undefined
         ? React.createElement("button", {
           key: "load-catalog",
@@ -459,6 +484,7 @@ function renderNativeControls(input) {
           style: styles.form,
           onSubmit: (event) => {
             event.preventDefault();
+            if (input.busy || !validSelection) return;
             void input.runAction("connection/configure", {
               provider: input.provider,
               model: input.model,
@@ -487,7 +513,7 @@ function renderNativeControls(input) {
         )),
         React.createElement("button", {
           type: "submit",
-          disabled: input.busy || !input.provider || !input.model,
+          disabled: input.busy || !validSelection,
           style: styles.primaryButton,
         }, input.busy ? "正在连接…" : "连接全部可访问项目")),
       disconnectButton(input),
@@ -540,11 +566,12 @@ function selectControl(entries, value, setValue, keyOf, labelOf) {
   return React.createElement("select", {
     required: true,
     value,
-    style: styles.input,
+    style: styles.select,
     onChange: (event) => setValue(event.target.value),
   }, ...entries.map((entry) => React.createElement("option", {
     key: keyOf(entry),
     value: keyOf(entry),
+    style: styles.option,
   }, labelOf(entry))));
 }
 
@@ -563,7 +590,7 @@ function parseNativeState(value) {
   if (!AUTHORIZATION_STATES.has(value.authorization)) throw new Error("invalid native authorization state");
   exactObject(value.compatibility, ["package", "version", "profile"]);
   if (value.compatibility.package !== "@deepseek-ai/dsh"
-    || value.compatibility.version !== "0.1.2-rc.1"
+    || value.compatibility.version !== "0.1.7-rc.2"
     || value.compatibility.profile !== "web") throw new Error("incompatible native DSH Host");
   const runtime = parseSnapshot(value.runtime);
   const optionalUrl = (url) => {
@@ -697,7 +724,8 @@ function parseNativeState(value) {
   }
   if (value.recoverableError !== undefined
     && value.recoverableError !== "pairing_failed"
-    && value.recoverableError !== "connection_failed") throw new Error("invalid native recovery state");
+    && value.recoverableError !== "connection_failed"
+    && value.recoverableError !== "route_unavailable") throw new Error("invalid native recovery state");
   return {
     schemaVersion: 2,
     integration: "gatherthread",
@@ -845,6 +873,14 @@ const styles = {
   field: { display: "grid", gap: 6 },
   fieldLabel: { fontSize: 12, fontWeight: 600, opacity: 0.76 },
   input: { width: "100%", minHeight: 36, boxSizing: "border-box", padding: "7px 10px", borderRadius: 9, border: "1px solid rgba(127,127,127,.28)", background: "transparent", color: "inherit", font: "inherit" },
+  // A dropdown owns a popup it cannot inherit: the list surface is painted from the
+  // control's own background and each row from its option, while the text keeps
+  // following the panel. Sharing `input` therefore drew the model names in the
+  // panel's foreground on the UA's own surface — white on white under a dark harness
+  // theme. Both the control and the rows name the system field pair instead, which
+  // the UA resolves against the used color scheme, so neither can match the other.
+  select: { width: "100%", minHeight: 36, boxSizing: "border-box", padding: "7px 10px", borderRadius: 9, border: "1px solid rgba(127,127,127,.28)", background: "Field", color: "FieldText", font: "inherit" },
+  option: { background: "Field", color: "FieldText" },
   primaryButton: { minHeight: 36, padding: "8px 12px", borderRadius: 9, border: "1px solid Highlight", background: "Highlight", color: "HighlightText", WebkitTextFillColor: "HighlightText", font: "inherit", fontWeight: 600, cursor: "pointer" },
   secondaryButton: { minHeight: 36, padding: "8px 12px", borderRadius: 9, border: "1px solid rgba(127,127,127,.3)", background: "transparent", color: "inherit", font: "inherit", cursor: "pointer" },
   linkButton: { display: "inline-flex", alignItems: "center", justifyContent: "center", minHeight: 36, padding: "0 12px", borderRadius: 9, border: "1px solid rgba(127,127,127,.3)", color: "inherit", textDecoration: "none", fontWeight: 600 },