@gehennawu/dsh-service 1.9.6 → 1.9.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.en.md +4 -4
- package/README.md +4 -4
- package/client.js +1 -1
- package/index.js +55 -7
- package/package.json +2 -2
- package/plugin-compat.js +78 -9
package/README.en.md
CHANGED
|
@@ -9,9 +9,9 @@
|
|
|
9
9
|
<em>DeepSeek Harness (DSH) Web 服务控制与运维插件。</em>
|
|
10
10
|
</p>
|
|
11
11
|
|
|
12
|
-
[](package.json)
|
|
13
13
|
[](LICENSE)
|
|
14
|
-
[](https://github.com/deepseek-ai/deepseek-harness)
|
|
15
15
|
[](https://cordis.moe/)
|
|
16
16
|
[](https://github.com/gehennawu/dsh-service)
|
|
17
17
|
[](https://github.com/gehennawu/dsh-service/issues)
|
|
@@ -97,7 +97,7 @@ Under **Plugins → Plugin configuration**, twelve host-level switches: **Health
|
|
|
97
97
|
- **Usage index**: reports how many sessions are indexed, when the index was last updated, and how many sessions failed to index (a failed fold silently undercounts usage). Failed sessions are partial-success, so they are a warning rather than a failure and also surface as an overview attention item; an index that has never been built (the Model statistics page has not been opened yet) is informational; the whole check is omitted while the Model usage feature is off (the host only skips refreshing the index in that state, so reporting would be stale and misleading)
|
|
98
98
|
- **Notification permission**: the diagnostics page appends a browser-side check after the host checks — a blocked or not-yet-granted system-notification permission both mean "notifications will not fire", with a pointer to restore it; an unsupported browser is informational. The row stays inside the diagnostics page: it never enters overview attention items or lights the ⚠ (using notifications is a user choice), and it is not rendered at all while Task notifications is off
|
|
99
99
|
- **Plugin health checks**: checks for anomalies only (the official plugin page already provides the full inventory and toggles, so no duplicate list here) — a failed plugin or one waiting on dependencies marks the check as error/warning, while fresh pending/loading fibers receive a short startup grace period; disposed or unknown states are explicit informational rows and do not become warnings. Affected plugins are listed below the check list with clipped, redacted failure text and missing deps; failed plugins can be reloaded behind a two-step confirmation (only entries the host confirmed as failed); manually disabled plugins (built-in or custom) never count as an anomaly
|
|
100
|
-
- **Plugin compatibility**: every enabled plugin is scanned against the interfaces DSH alpha versions have removed or changed (client suppliers, the SQLite persistence backend, chat/status-line style hashes, deprecated attributes) — a hit flags the plugin as "possibly incompatible" with the concrete reason (e.g. "Declares the removed client supplier @deepseek-ai/dsh-client-runtime"). Tiered verdict: only a real `require`/`import` reference is flagged "possibly incompatible"; a supplier that appears only in the manifest (unused in code) falls back to a gray "stale declaration" note — the official loader silently skips missing suppliers, so it is harmless and merely signals the author to clean up; retired slots (e.g. settings.plugin.item)
|
|
100
|
+
- **Plugin compatibility**: every enabled plugin is scanned against the interfaces DSH alpha versions have removed or changed (client suppliers, the SQLite persistence backend, chat/status-line style hashes, deprecated attributes, legacy settings surfaces) — a hit flags the plugin as "possibly incompatible" with the concrete reason (e.g. "Declares the removed client supplier @deepseek-ai/dsh-client-runtime"). Tiered verdict: only a real `require`/`import` reference is flagged "possibly incompatible"; a supplier that appears only in the manifest (unused in code) falls back to a gray "stale declaration" note — the official loader silently skips missing suppliers, so it is harmless and merely signals the author to clean up; retired slots (e.g. settings.plugin.item) and references to removed client services (e.g. settingsScope — callback-shaped references merely degrade silently while only a declarative inject hangs activation; the text scan cannot tell shapes apart and reports the milder tier) are downgraded to a blue "references a retired interface" notice that does not disrupt plugin execution or raise a yellow warning. Before upgrading to alpha or right after doing so, you can see whether third-party plugins kept up; fully local scan with cached results, zero network
|
|
101
101
|
- File-permission deep scan and repair (two-step confirmation) behind a collapsed "Permissions & repair" section
|
|
102
102
|
- Suspected manual launch → yellow "no restart assurance" caution; no backups is informational only and never lights the ⚠
|
|
103
103
|
|
|
@@ -353,7 +353,7 @@ pm2 start "dsh web --host 127.0.0.1" --name dsh-web
|
|
|
353
353
|
|
|
354
354
|
Requirements: Node.js `>=22`, and a DSH Web installation capable of loading both Host and Client plugin halves. Update checks require access to `registry.npmjs.org`; network failures do not affect other features.
|
|
355
355
|
|
|
356
|
-
**DSH compatibility statement**: adapted to DSH `0.1.7-alpha.
|
|
356
|
+
**DSH compatibility statement**: adapted to DSH `0.1.7-alpha.2` — session format V4 (V3 logs are migrated by the official layer into a `session.v4.jsonl.zstd` generation file on first read, with the old `session.v3.jsonl.zstd` retained per the format catalog's policy; the detail view automatically archives system events), the `SettingsForms` configuration surface (plugin config now lives in the Profile's `cordis.patch.yml` with hot updates over `loader/volatile-update`, while the legacy `settings.register` remains authoritative on 0.1.5/0.1.6 so the two never cross-contaminate on a shared host), and all existing V3 adaptation (the `system/message` history, the handle-based sessionPersistence, the official right sidebar, the object-shaped turn-process), plus dual-hash compatibility for mobile bottom-row triggers, subagent turn-tail list-slot adaptive compatibility, `plugins.bundle.config` slot injection, and session-detail open fallback through `uiWorkspace`. Older DSH releases (`>=0.1.1-rc.2`) remain supported. This release extends the declared range through `0.1.7-alpha.2`; static structure review found no new code adaptation requirements, but CSS hash stems and several real-host UI behaviors remain unverified—see this release's notes. The settings surface and the persistence/layout seams all run in dual shapes detected from runtime capabilities, and adaptation items that target newer structures are naturally inert on older hosts (cosmetic only, no functional loss). Note: sessions written after upgrading cannot be read by older DSH releases — **backups do not restore across a version downgrade**. The plugin marketplace judges compatibility from the `engines.dsh` range in `package.json`, which is the single declaration of the supported range.
|
|
357
357
|
|
|
358
358
|
## 🔒 Security design
|
|
359
359
|
|
package/README.md
CHANGED
|
@@ -9,9 +9,9 @@
|
|
|
9
9
|
<em>A service-control & operations plugin for DeepSeek Harness (DSH) Web.</em>
|
|
10
10
|
</p>
|
|
11
11
|
|
|
12
|
-
[](package.json)
|
|
13
13
|
[](LICENSE)
|
|
14
|
-
[](https://github.com/deepseek-ai/deepseek-harness)
|
|
15
15
|
[](https://cordis.moe/)
|
|
16
16
|
[](https://github.com/gehennawu/dsh-service)
|
|
17
17
|
[](https://github.com/gehennawu/dsh-service/issues)
|
|
@@ -97,7 +97,7 @@ DSH Web 服务控制与运维插件：安全重启、版本管理与一键升级
|
|
|
97
97
|
- **使用统计索引**：报出已索引会话数、索引更新时间与未能索引的会话数（单会话折读失败会让用量静默少算）。失败会话按「部分成功」处理，记警告而非故障，并作为可行动项进概览；尚未建立索引（还没打开过模型统计页）记信息级；「模型统计」开关关闭时整项不检查（宿主在该状态下本就不刷新索引，报了只会是陈旧误导）
|
|
98
98
|
- **通知权限**：诊断页在宿主检查项之后追加一行浏览器侧检查——系统通知被拒绝或尚未授权都意味着「通知不会响」，并给出恢复入口；浏览器不支持时记信息级。该行只留在诊断页内，不进概览可行动项、不点亮标签 ⚠（是否用通知是用户选择），「任务通知」开关关闭时整行不渲染
|
|
99
99
|
- **插件健康检查**：只检查异常（官方插件页已有完整清单与开关，这里不做重复清单）——插件失败或依赖未就绪时检查项报错/警告，刚启动的 pending/loading 有短暂宽限；已释放或未知状态显式标为信息级，不误报为警告。检查清单下方列出异常插件（名称、已脱敏且限长的错误、缺失依赖）；失败插件可**两段式确认后重新加载**（只作用于宿主已确认失败的条目）；手动停用的插件（无论内置还是自定义）一律不算异常
|
|
100
|
-
- **插件兼容性**：对照 DSH alpha 版本已移除/变更的接口（客户端供应商、SQLite
|
|
100
|
+
- **插件兼容性**：对照 DSH alpha 版本已移除/变更的接口（客户端供应商、SQLite 持久化后端、聊天/统计条样式哈希、弃用属性、设置面旧接口）扫描每个启用插件——命中即提示「可能不兼容」并给出具体原因（如「声明了已移除的客户端供应商 @deepseek-ai/dsh-client-runtime」）。分级判定：**代码真实 require/import 才报「可能不兼容」**；仅在 manifest 声明、代码未引用的供应商降为灰色「仅声明残留」（官方加载器对缺失供应商静默跳过，实际无害，提示作者清理即可）；退役槽位（如 settings.plugin.item）、已移除客户端服务的引用（如 settingsScope——回调形态只静默退化、声明式 inject 才挂起激活，文本扫描分不清形态按轻档上报）等降为蓝色「引用已退役接口」提示，不影响插件运行亦不触发黄色警告。升级 alpha 前或刚升级后看一眼就知道第三方插件有没有跟上；纯本地扫描、结果缓存、零网络
|
|
101
101
|
- 文件权限深检与修复（两段式确认）收敛在**默认折叠**的「权限与修复」区（有异常时按钮显示计数）
|
|
102
102
|
- 疑似手动启动 → 黄色警示「重启无保障」；无备份属信息级提示，不点亮 ⚠
|
|
103
103
|
|
|
@@ -355,7 +355,7 @@ pm2 start "dsh web --host 127.0.0.1" --name dsh-web
|
|
|
355
355
|
|
|
356
356
|
运行要求：Node.js `>=22`，DSH Web 能加载 Host 与 Client 两半插件。更新检查需访问 `registry.npmjs.org`；网络失败不影响其他功能。
|
|
357
357
|
|
|
358
|
-
**DSH 适配口径**：已适配 DSH `0.1.7-alpha.
|
|
358
|
+
**DSH 适配口径**：已适配 DSH `0.1.7-alpha.2`——会话格式 V4（V3 日志首读时由官方迁移为 `session.v4.jsonl.zstd` 代际文件，旧 `session.v3.jsonl.zstd` 按格式目录策略保留；详情视图自动归档系统事件）、`SettingsForms` 配置面（插件配置改由 Profile 的 `cordis.patch.yml` 承载，热更新走 `loader/volatile-update`；旧的 `settings.register` 在 0.1.5/0.1.6 上仍是权威来源，装在同一宿主上两者互不串台）、会话格式 V3 既有适配全部保留（`system/message` 入史、sessionPersistence handle 化、官方右栏、turn-process 对象化）、移动端底行触发钮双哈希兼容、子代理回合尾模型行 list 槽位自适应兼容、`plugins.bundle.config` 槽位注入、会话详情打开接入 `uiWorkspace` 降级链路。旧版 DSH（`>=0.1.1-rc.2`）保持兼容。支持区间在本版扩展到 `0.1.7-alpha.2`；alpha.2 上的静态结构审查未发现新的代码适配需求，但 CSS 哈希词干与若干真机 UI 行为尚未实测，详见本版发布说明。设置面、persistence/布局 seam 均按运行时能力探测走双形态，旧宿主上针对新结构的适配项天然不生效（纯展示，无功能损失）。注意：升级后写入的会话日志无法被旧版 DSH 读取，**备份不可跨版本降级恢复**。插件市场按 `package.json` 的 `engines.dsh` 区间判定兼容性（该字段是唯一的支持口径声明）。
|
|
359
359
|
|
|
360
360
|
## 🔒 安全设计
|
|
361
361
|
|