@gehennawu/dsh-service 1.5.1 → 1.6.0

package/README.en.md

@@ -9,7 +9,7 @@
   <em>DeepSeek Harness (DSH) Web 服务控制与运维插件。</em>
 </p>
 
-[![Version](https://img.shields.io/badge/version-1.5.1-3b82f6.svg?style=flat-square)](package.json)
+[![Version](https://img.shields.io/badge/version-1.6.0-3b82f6.svg?style=flat-square)](package.json)
 [![License: MIT](https://img.shields.io/badge/License-MIT-10b981.svg?style=flat-square)](LICENSE)
 [![DSH Compatibility](https://img.shields.io/badge/DSH-%E2%89%A50.1.1--rc.2%20%C2%B7%20compatible%20with%200.1.5--rc.1-6366f1.svg?style=flat-square)](https://github.com/deepseek-ai/deepseek-harness)
 [![Cordis](https://img.shields.io/badge/Cordis-v4.x-f59e0b.svg?style=flat-square)](https://cordis.moe/)
@@ -42,7 +42,7 @@ A service-control and operations plugin for DSH Web: safe restart, version manag
 - [🚀 Features](#-features)
   - [Version and updates](#version-and-updates) · [Safe restart](#safe-restart) · [Health diagnostics](#health-diagnostics) · [Model statistics](#model-statistics)
   - [Quota lookup](#quota-lookup) · [Backup management](#backup-management) · [Skills management](#skills-management) · [Subagent model](#subagent-model)
-  - [Task notifications](#task-notifications) · [Session manager](#session-manager) · [Mobile adaptation](#mobile-adaptation) · [External liveness probe](#external-liveness-probe)
+  - [Task notifications](#task-notifications) · [Session manager](#session-manager) · [Mobile adaptation](#mobile-adaptation) · [Right-Sidebar file editing](#right-sidebar-file-editing) · [External liveness probe](#external-liveness-probe)
 - [🏗️ Architecture](#-architecture)
 - [⚡ Installation](#-installation) · [🔄 Automatic restart](#-automatic-restart) · [🖥️ Platform support](#-platform-support)
 - [🔒 Security design](#-security-design) · [❓ FAQ](#-faq) · [🤝 Contributing](#-contributing) · [📄 License](#-license)
@@ -51,14 +51,14 @@ A service-control and operations plugin for DSH Web: safe restart, version manag
 
 The Settings "Service Control" panel has a six-page navigation: **Overview · Model stats · Quota lookup · Health · Maintenance · Configuration**; "Maintenance" aggregates five subpages — Sessions · Skills · Subagents · Backups · Restart — and "Configuration" aggregates Features · Task notifications. Restart, Quota lookup, and Sessions can each enable a **quick entry in the settings left navigation** (off by default; the Skills and Subagents sidebar entries were removed).
 
-Under **Plugins → Plugin configuration**, ten host-level switches: **Health diagnostics, Model statistics, Quota lookup, Backup maintenance, Task notifications, Skill manager, Subagent model, Session manager, Mobile adaptation, `/healthz` liveness endpoint** (all on by default except Mobile adaptation). All are live settings: disabling hides the UI, stops polling/subscriptions, and makes the host reject that capability; Overview and Restart stay available.
+Under **Plugins → Plugin configuration**, eleven host-level switches: **Health diagnostics, Model statistics, Quota lookup, Backup maintenance, Task notifications, Skill manager, Subagent model, Session manager, Mobile adaptation, Right-Sidebar file editing, `/healthz` liveness endpoint** (all on by default except Mobile adaptation). All are live settings: disabling hides the UI, stops polling/subscriptions, and makes the host reject that capability; Overview and Restart stay available.
 
 ![Plugin configuration](./screenshots/plugin-config_en.png)
 
 ### Overview (six sections)
 
 - Status summary (error → warning → info → normal aggregation with a status dot) → actionable items (only when present) → version and runtime → metrics grid → fixed core actions (health check / quota lookup / create backup, gated by feature switches) → recent errors (rendered only when non-empty, collapsed by default)
-- Aggregation rules: any health/diagnostics/backup/statistics/quota/restart failure is error; permission issues and non-advisory diagnostic warnings are warning; available updates, manual-start runtime, and no backups yet are info (high quota-window usage only shows as a progress bar on the quota page and no longer surfaces as an overview reminder)
+- Aggregation rules: any health/diagnostics/backup/statistics/quota/restart failure is error; permission issues and non-advisory diagnostic warnings are warning; available updates and no backups yet are info (high quota-window usage only shows as a progress bar on the quota page, and a likely manual terminal launch — a standing environment fact — appears only in the health checks and in the restart/upgrade confirmations; neither surfaces as an overview reminder)
 
 ### Maintenance and Configuration pages
 
@@ -74,6 +74,7 @@ Under **Plugins → Plugin configuration**, ten host-level switches: **Health di
 - Shows the current DSH and plugin versions, linking to GitHub Releases
 - Automatically checks npm **stable + preview** (latest / next dist-tags); when a new version exists, an inline expandable compares them, each with npmjs and npmmirror links
 - One-click upgrade with automatic restart; when no process manager is detected, it confirms the consequences first, keeps running, and shows manual-restart instructions
+- Between the upgrade landing and the process restart (common in a manual-launch environment) the version row reads "Installed X — restart to take effect" and the upgrade button is withdrawn; reopening the panel or refreshing the page keeps that state until the process is restarted
 
 ### Safe restart
 
@@ -128,6 +129,7 @@ Under **Plugins → Plugin configuration**, ten host-level switches: **Health di
 - Credentials go into the DSH credential store (`$DSH_HOME/.credentials.yaml`, hot-effective): an API key, the CPA management key, the Xiaomi console cookie, or the StepFun Step Plan console token (Oasis-Token; the `Oasis-Webid` is derived from the token automatically — no manual entry)
 - Anti-rate-limit pacing: 60 s result cache, exponential backoff (30 s doubling, capped at 15 min); auto-query can be set to manual-only / 1 / 2 / 5 / 10 minutes
 - CLIProxyAPI: when an account's live query fails, its last cached snapshot windows are shown with a "cached" badge; snapshot windows whose reset time has already passed (the window they described has ended) are dropped, avoiding the illusion of quota stuck on yesterday
+- Failures state their real reason: cards and the ring show "error copy (HTTP status · failing endpoint · failing account · upstream message) · next automatic retry" — a wrong key, an unpaid balance, rate limiting, and a moved endpoint each read differently instead of one generic notice; an upstream 401/403 is classified as "credential rejected by upstream" and the card keeps its credential form available
 - API keys are resolved only inside the host process; the browser receives normalized window data only; unadapted providers are never requested
 
 ### Backup management
@@ -199,6 +201,18 @@ Under **Plugins → Plugin configuration**, ten host-level switches: **Health di
 - Entry: the “Sessions” subpage under “Maintenance” (on by default); the optional settings-sidebar entry is off by default
 - Delete records live at `$DSH_HOME/dsh-service-sessions-deleted.json` (atomic write, `0600`, title/time only — no content, not recoverable)
 
+### Right-Sidebar file editing
+
+- The official right-Sidebar preview header gains an **“Edit” button in its top-right corner** (next to the renderer name): one click enters editing — a monospaced editor with a dirty marker, `Ctrl/Cmd + S` saving, “Reload”, “Undo save”, and a one-click “Preview” back to the official renderer
+- Two equivalent extra routes: the original **renderer dropdown**, and **right-click the tab → ⋯ menu → “Edit”** (the latter uses an official menu seat with no DOM injection at all, as the fallback if the header button ever stops working); while the editor tier is active the header button retracts itself
+- **The official renderers keep their default status**: suffixes they own (`.md`, `.js`, …) still open as Markdown / code previews; only suffixes with no official renderer — the ones that used to fall back to plain text, such as `.txt`, `.log`, `.conf` — default to the editor. When the official preview is absent (older DSH), the whole block stays silent
+- **Writes go through the session's own file service and sandbox policy**: the browser only sends a `dsh-resource://file/session/<session>/<path>` resource address, and the host resolves the session and workspace root itself — free-form paths are refused. Saving carries the version read earlier, so **a file changed by an Agent or another window is never overwritten silently**; you choose “Reload (discard edits)” or “Overwrite with mine”. Read-only sandbox sessions stay preview-only
+- **Keep typing while saving**: a save response acknowledges only the submitted text; any newer typing stays in the editor as unsaved changes. The status distinguishes saving, unsaved changes, and saved. You can keep editing after a conflict, and overwrite uses the latest draft shown in the editor
+- **Protect drafts before leaving**: the editor's own “Preview” and “Reload” buttons show an inline confirmation when changes are unsaved, with a cancel action to keep editing. “Undo save” also requires confirmation and retains its version guard rather than silently overwriting newer disk changes
+- One 2 MiB cap per file (larger files are read-only); editing is unavailable when the session is inactive or the sandbox policy service is missing (the official preview remains available)
+- Not in this first version: syntax highlighting, multi-cursor, find/replace (the plugin half has no bundler to borrow an editor component), and no unsaved-changes prompt when a tab closes
+- The switch lives under Plugins → Plugin configuration → Interaction (on by default, live)
+
 ### External liveness probe
 
 - `GET` / `HEAD /healthz` returns an empty 200; other methods return 405
@@ -310,7 +324,7 @@ Requirements: Node.js `>=22`, and a DSH Web installation capable of loading both
 
 | Area | Boundary |
 | --- | --- |
-| Input | The browser cannot supply URLs, package names, commands, or file paths |
+| Input | The browser cannot supply URLs, package names, commands, or file paths. **One exception**: right-Sidebar file editing accepts only a `dsh-resource://file/session/<session>/<path>` resource address (decoded per segment; every other shape is refused); the session and workspace root are always resolved host-side, and writes are fenced by the session's sandbox policy |
 | Network | Update checks only access fixed npm registry endpoints |
 | RPC | Loopback-only; data never leaves the machine |
 | Data | The usage index stores no messages, prompts, tool arguments, or credentials; API keys are used inside the host process only |
@@ -338,7 +352,7 @@ Use the inline form on the card: an API key for regular adaptations, the managem
 </details>
 
 <details>
-<summary><strong>Xiaomi shows "console cookie expired"?</strong></summary>
+<summary><strong>Xiaomi shows "credential rejected by upstream"?</strong></summary>
 
 The web session expired. Log back in at platform.xiaomimimo.com, copy the `Cookie:` header from any `/api/v1/tokenPlan/` request, and paste it again via "Set console cookie".
 </details>
@@ -350,7 +364,7 @@ Step Plan has no API-key query endpoint — it needs a web session token. Log in
 </details>
 
 <details>
-<summary><strong>StepFun Step Plan card shows "console session expired"?</strong></summary>
+<summary><strong>StepFun Step Plan card shows "credential rejected by upstream"?</strong></summary>
 
 The token expired (the official `oasis-token is embezzled` error means the token and web_id no longer match). Log back in at platform.stepfun.com, copy the full new `Oasis-Token` from Cookies and paste it again; if the copied value carries an `Oasis-Token=` or `Cookie: ` prefix it is stripped automatically.
 </details>

package/README.md

@@ -9,7 +9,7 @@
   <em>A service-control &amp; operations plugin for DeepSeek Harness (DSH) Web.</em>
 </p>
 
-[![Version](https://img.shields.io/badge/version-1.5.1-3b82f6.svg?style=flat-square)](package.json)
+[![Version](https://img.shields.io/badge/version-1.6.0-3b82f6.svg?style=flat-square)](package.json)
 [![License: MIT](https://img.shields.io/badge/License-MIT-10b981.svg?style=flat-square)](LICENSE)
 [![DSH Compatibility](https://img.shields.io/badge/DSH-%E2%89%A50.1.1--rc.2%20%C2%B7%20%E5%B7%B2%E9%80%82%E9%85%8D%200.1.5--rc.1-6366f1.svg?style=flat-square)](https://github.com/deepseek-ai/deepseek-harness)
 [![Cordis](https://img.shields.io/badge/Cordis-v4.x-f59e0b.svg?style=flat-square)](https://cordis.moe/)
@@ -42,7 +42,7 @@ DSH Web 服务控制与运维插件：安全重启、版本管理与一键升级
 - [🚀 功能](#-功能)
   - [版本与更新](#版本与更新) · [安全重启](#安全重启) · [健康诊断](#健康诊断) · [模型统计](#模型统计)
   - [额度查询](#额度查询) · [备份管理](#备份管理) · [技能管理](#技能管理) · [子代理模型](#子代理模型)
-  - [任务通知](#任务通知) · [会话管理](#会话管理) · [移动端适配](#移动端适配) · [外部探活](#外部探活)
+  - [任务通知](#任务通知) · [会话管理](#会话管理) · [移动端适配](#移动端适配) · [右栏文件编辑](#右栏文件编辑) · [外部探活](#外部探活)
 - [🏗️ 架构](#-架构)
 - [⚡ 安装](#-安装) · [🔄 自动重启配置](#-自动重启配置) · [🖥️ 平台支持](#-平台支持)
 - [🔒 安全设计](#-安全设计) · [❓ 常见问题 FAQ](#-常见问题-faq) · [🤝 参与贡献](#-参与贡献) · [📄 许可证](#-许可证)
@@ -51,14 +51,14 @@ DSH Web 服务控制与运维插件：安全重启、版本管理与一键升级
 
 设置页「服务控制」面板六页导航：**概览 · 模型统计 · 额度查询 · 健康诊断 · 维护 · 配置**；其中「维护」聚合 会话管理 · 技能 · 子代理 · 备份维护 · 重启 五个子页，「配置」聚合 功能开关 · 任务通知 两个子页。重启、额度查询、会话管理可另行开启**设置页左列快捷入口**（默认关闭；技能与子代理的左列入口已撤销）。
 
-「插件 → 插件配置」提供十个宿主级开关：**健康诊断、模型统计、额度查询、备份维护、任务通知、技能管理、子代理模型、会话管理、移动端适配、`/healthz` 探活**（除移动端适配外默认开启）。全部热生效：关闭即隐藏界面、停止轮询并让宿主拒绝对应能力；概览与重启固定保留。
+「插件 → 插件配置」提供十一个宿主级开关：**健康诊断、模型统计、额度查询、备份维护、任务通知、技能管理、子代理模型、会话管理、移动端适配、右栏文件编辑、`/healthz` 探活**（除移动端适配外默认开启）。全部热生效：关闭即隐藏界面、停止轮询并让宿主拒绝对应能力；概览与重启固定保留。
 
 ![插件配置](./screenshots/plugin-config.png)
 
 ### 概览（六段式）
 
 - 状态摘要（error → warning → info → normal 聚合，带状态点）→ 可行动项（仅在存在时）→ 版本与运行环境 → 指标格 → 固定核心操作（健康检查 / 额度查询 / 创建备份，随功能开关门控）→ 近期报错（仅非空时渲染，默认折叠）
-- 状态聚合规则：健康/诊断/备份/统计/额度/重启任一失败即 error；权限异常、非咨询性诊断警告为 warning；可更新、手动启动环境、尚无备份为 info（额度窗口高占用只在额度查询页内以进度条呈现，不再进概览提醒）
+- 状态聚合规则：健康/诊断/备份/统计/额度/重启任一失败即 error；权限异常、非咨询性诊断警告为 warning；可更新、尚无备份为 info（额度窗口高占用只在额度查询页内以进度条呈现；疑似终端手动启动属常驻环境事实，也只在健康诊断检查项与重启/升级确认中呈现——两者都不再进概览提醒）
 
 ### 维护与配置聚合页
 
@@ -74,6 +74,7 @@ DSH Web 服务控制与运维插件：安全重启、版本管理与一键升级
 - 显示当前 DSH 与插件版本，链接 GitHub Releases
 - 自动检查 npm **正式版 + 预览版**（latest / next 双 tag）；有新版本时行内展开对比，版本号附 npmjs 与 npmmirror 双链接
 - 一键升级，完成后自动重启；未检测到进程管理器时先确认后果，保持运行并提示手动重启
+- 升级落地但进程尚未重启期间（手动启动环境尤为常见），版本行改示「已安装 X，重启后生效」并收起升级按钮，重开面板或刷新页面状态依旧；重启进程后恢复常态
 
 ### 安全重启
 
@@ -130,6 +131,7 @@ DSH Web 服务控制与运维插件：安全重启、版本管理与一键升级
 - 凭据写入 DSH 凭据库（`$DSH_HOME/.credentials.yaml`，热生效）：普通适配填 API key，CLIProxyAPI 填管理密钥，小米填控制台 Cookie，StepFun Step Plan 填控制台令牌（Oasis-Token，`Oasis-Webid` 由令牌自动派生无需手填）
 - 防风控：结果缓存 60 秒、失败指数退避（30 秒 ×2、封顶 15 分钟）；自动查询可调为仅手动 / 1 / 2 / 5 / 10 分钟
 - CLIProxyAPI 某账号实时查询失败时，回退显示其上次缓存的快照窗口并标注「缓存」徽标；重置时间已过的快照窗口（快照描述的窗口已结束）直接丢弃，避免「额度停在昨天」的错觉
+- 失败原因如实呈现：卡片与圆环显示「错误文案（HTTP 状态 · 失败端点 · 失败账号 · 上游原话）· 下次自动重试时刻」——错 key、欠费、限流、路径变更各有各的上游原话与状态码，不再只有一个笼统提示；上游 401/403 判为「凭据被上游拒绝」，卡片同时保留凭据填写入口
 - API key 只在宿主进程内解析，浏览器仅收到归一化窗口数据；未适配的供应商绝不发起请求
 
 ### 备份管理
@@ -201,6 +203,18 @@ DSH Web 服务控制与运维插件：安全重启、版本管理与一键升级
 - 自动补 `viewport-fit=cover` 避让刘海、禁双击缩放、输入框 ≥16px 防 iOS 聚焦放大
 - `?dshsvc-mobile-debug=1` 显示浮动诊断条（仅调试）
 
+### 右栏文件编辑
+
+- 官方右侧栏的文件预览头部**右上角多一个「编辑」按钮**（紧邻渲染器名），点一下就进编辑模式：等宽编辑器，带脏标记、`Ctrl/Cmd + S` 保存、「重新加载」「撤销保存」，以及一键「预览」返回官方渲染器
+- 另外两条等价入口：原来的**渲染器下拉**里选「编辑」，以及**右键标签 → ⋯ 菜单 →「编辑」**（后者走官方菜单座、不做任何 DOM 注入，是头部按钮失效时的兜底路径）；处于编辑档位时头部按钮自动收起，不会重复
+- **不改变官方渲染器的默认地位**：`.md`、`.js` 等官方有专属渲染器的后缀默认仍是官方预览（Markdown / 代码…）；只有官方没有专属渲染器、本来落到「纯文本」的后缀（如 `.txt`、`.log`、`.conf`）才默认进编辑器。官方预览未挂载（旧版 DSH）时整块静默不出现
+- **写盘走会话自己的文件服务与沙箱策略**：浏览器只送 `dsh-resource://file/session/<会话>/<路径>` 资源地址，会话与工作区根由宿主解析，不接受自由路径；保存携带读取时的版本号，**磁盘已被 Agent 或其他窗口改过就拒绝覆盖**，由你选「重新加载（丢弃修改）」或「用我的内容覆盖」；只读沙箱会话只能预览
+- **保存不中断输入**：保存期间仍可继续编辑，响应只确认本次提交的内容，后续输入保留为「未保存」；状态区分「保存中 / 未保存 / 已保存」。冲突出现后仍可修改，覆盖保存使用编辑器里的最新草稿
+- **离开前保护草稿**：通过编辑器自己的「预览」「重新加载」按钮离开或重读时，若有未保存内容先显示内联确认，可取消继续编辑；「撤销保存」也先确认，且保留版本守卫，不静默覆盖磁盘上的新改动
+- 单文件上限 2 MiB（超过只读）；会话未激活或沙箱策略服务不可用时不可编辑（仍可使用官方预览）
+- 首版**不做**：语法高亮、多光标、查找替换（插件半没有打包器，借不到编辑器组件），关闭标签不弹未保存确认
+- 开关在 插件 → 插件配置 → 交互（默认开，热生效）
+
 ### 外部探活
 
 - `GET` / `HEAD /healthz` 返回空 200，其他方法返回 405
@@ -312,7 +326,7 @@ pm2 start "dsh web --host 127.0.0.1" --name dsh-web
 
 | 领域 | 边界 |
 | --- | --- |
-| 输入 | 浏览器不能传入 URL、包名、命令或文件路径 |
+| 输入 | 浏览器不能传入 URL、包名、命令或文件路径。**唯一例外**：右栏文件编辑只接受 `dsh-resource://file/session/<会话>/<路径>` 资源地址（逐段解码、拒绝其他形态），会话与工作区根一律宿主侧解析，写盘再经会话沙箱策略围栏 |
 | 网络 | 更新检查只访问固定 npm registry 地址 |
 | RPC | 仅接受 loopback 调用，数据不出本机 |
 | 数据 | 用量索引不保存消息、Prompt、工具参数或凭据；API key 只在宿主进程内使用 |
@@ -340,7 +354,7 @@ pm2 start "dsh web --host 127.0.0.1" --name dsh-web
 </details>
 
 <details>
-<summary><strong>小米卡片显示「控制台 Cookie 已失效」？</strong></summary>
+<summary><strong>小米卡片显示「凭据被上游拒绝」？</strong></summary>
 
 网页登录态过期了。重新登录 platform.xiaomimimo.com，从任意 `/api/v1/tokenPlan/` 请求复制 `Cookie:` 头，点卡片「填写控制台 Cookie」重新粘贴。
 </details>
@@ -352,7 +366,7 @@ Step Plan 订阅没有 API-key 形态的查询接口，需要网页登录态令
 </details>
 
 <details>
-<summary><strong>StepFun Step Plan 卡片显示「控制台登录态已失效」？</strong></summary>
+<summary><strong>StepFun Step Plan 卡片显示「凭据被上游拒绝」？</strong></summary>
 
 令牌过期了（官方常见报错 `oasis-token is embezzled` 即令牌与 web_id 不匹配）。重新登录 platform.stepfun.com 后从 Cookies 复制新的 `Oasis-Token` 完整值再粘贴；从控制台复制时若自带 `Oasis-Token=` 或 `Cookie: ` 前缀会被自动剥离，不影响。
 </details>