@goodandready/dsh-context-lens 0.1.17 → 0.1.19

package/lib/client.js

@@ -6,6 +6,13 @@ window.__ModuleLoader__.load({
     const NS = '@goodandready/dsh-context-lens';
 
         const en = {
+      'update.available': 'Update available: v{latestVersion} (current: v{currentVersion})',
+      'update.btn': 'Update Now',
+      'update.updating': 'Updating…',
+      'update.done': 'Successfully updated to v{version}! Please restart DSH.',
+      'update.failed': 'Update failed: {error}',
+      'update.checking': 'Checking for updates…',
+      'update.up_to_date': 'Up to date',
       title: 'Context Lens & Token Guard',
       sub: 'AST compression, log filtering, token budget',
       mode: 'Compression mode',
@@ -37,6 +44,13 @@ window.__ModuleLoader__.load({
     };
 
     const zh = {
+      'update.available': '发现新版本 v{latestVersion}（当前版本 v{currentVersion}）',
+      'update.btn': '立即更新',
+      'update.updating': '正在更新…',
+      'update.done': '更新成功至 v{version}！请重启 DSH 服务生效。',
+      'update.failed': '更新失败：{error}',
+      'update.checking': '正在检查更新…',
+      'update.up_to_date': '已是最新版本',
       title: 'Context Lens 上下文镜头与 Token 守卫',
       sub: 'AST 代码精简、日志过滤与 Token 预算监控',
       mode: '压缩模式',
@@ -108,12 +122,12 @@ window.__ModuleLoader__.load({
 .cl-badge-ok {
   border-color: var(--dsw-alias-state-success-primary, #10b981);
   color: var(--dsw-alias-state-success-primary, #10b981);
-  background: rgba(16, 185, 129, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent);
 }
 .cl-badge-warn {
   border-color: var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
-  background: rgba(239, 68, 68, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent);
 }
 .cl-stat-grid {
   display: grid;
@@ -211,7 +225,7 @@ window.__ModuleLoader__.load({
 .cl-banner-warn {
   padding: 10px 14px;
   border-radius: 8px;
-  background: rgba(239, 68, 68, 0.1);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);
   border: 1px solid var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
   font-size: 12px;
@@ -244,7 +258,7 @@ window.__ModuleLoader__.load({
 .cl-error-box {
   padding: 12px;
   border-radius: 8px;
-  background: rgba(239, 68, 68, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent);
   border: 1px solid var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
   font-size: 12px;
@@ -253,6 +267,18 @@ window.__ModuleLoader__.load({
       document.head.appendChild(style);
     }
 
+    function makeT(dict, fallback) {
+      return function t(key, vars) {
+        let val = (dict && dict[key]) || (fallback && fallback[key]) || key;
+        if (vars && typeof val === 'string') {
+          for (const k of Object.keys(vars)) {
+            val = val.replace(new RegExp('\\{' + k + '\\}', 'g'), String(vars[k]));
+          }
+        }
+        return val;
+      };
+    }
+
     function createErrorBoundary() {
       if (!React || typeof React.Component !== 'function') {
         return function NoopBoundary(props) { return (props && props.children) || null; };
@@ -293,7 +319,9 @@ window.__ModuleLoader__.load({
           const snap = ctx.locale.getSnapshot();
           if (snap && snap.active && snap.active.startsWith('zh')) return zh;
         }
-      } catch {}
+      } catch (err) {
+        /* intentional fallback: default to english on snapshot error */
+      }
       return en;
     }
 
@@ -534,7 +562,7 @@ window.__ModuleLoader__.load({
         style: {
           position: 'absolute', top: 'calc(100% + 6px)', right: 0, width: 280,
           background: 'var(--dsw-alias-bg-layer-3)', border: '1px solid var(--dsw-alias-border-l2)',
-          borderRadius: 10, boxShadow: '0 8px 24px rgba(0, 0, 0, 0.28)', padding: '12px 14px',
+          borderRadius: 10, boxShadow: 'var(--dsw-alias-modal-shadow, var(--dsw-alias-shadow-large, 0 4px 16px var(--dsw-alias-border-l1)))', padding: '12px 14px',
           zIndex: 1000, fontSize: 12, color: 'var(--dsw-alias-label-primary)', cursor: 'default', textAlign: 'left'
         },
         onClick: (e) => e.stopPropagation()
@@ -587,7 +615,7 @@ window.__ModuleLoader__.load({
       const scopeRef = React.useRef(null);
       if (!scopeRef.current && _ctx) {
         try {
-          const s = (_ctx.get && _ctx.get('lanSettings')) || _ctx.settingsScope;
+          const s = _ctx.settingsScope || (_ctx.get && _ctx.get('settingsScope'));
           if (s && typeof s.bind === 'function') {
             scopeRef.current = s.bind({ namespace: NS });
           }
@@ -627,7 +655,9 @@ window.__ModuleLoader__.load({
             unsub = scope.subscribe(() => {
               if (!cancelled) loadSnap();
             });
-          } catch (_) {}
+          } catch (_err) {
+            console.warn('[dsh-context-lens] scope subscribe failed', _err && _err.message || _err);
+          }
         }
 
         return () => {
@@ -636,6 +666,69 @@ window.__ModuleLoader__.load({
         };
       }, [scope]);
 
+      const [updateState, setUpdateState] = React.useState({
+        checking: false,
+        updating: false,
+        currentVersion: '0.1.18',
+        latestVersion: '',
+        updateAvailable: false,
+        canAutoUpdate: true,
+        notice: '',
+        error: ''
+      });
+
+      const checkUpdate = React.useCallback(async () => {
+        setUpdateState((s) => ({ ...s, checking: true, error: '' }));
+        try {
+          const res = await fetch('/api/dsh-context-lens/update');
+          if (!res.ok) throw new Error('HTTP ' + res.status);
+          const data = await res.json().catch(() => ({}));
+          setUpdateState((s) => ({
+            ...s,
+            checking: false,
+            currentVersion: data.currentVersion || s.currentVersion,
+            latestVersion: data.latestVersion || '',
+            updateAvailable: !!data.updateAvailable,
+            canAutoUpdate: data.canAutoUpdate !== false,
+          }));
+        } catch (_) {
+          setUpdateState((s) => ({ ...s, checking: false }));
+        }
+      }, []);
+
+      React.useEffect(() => {
+        if (expanded) checkUpdate();
+      }, [expanded, checkUpdate]);
+
+      async function handleTriggerUpdate() {
+        if (updateState.updating) return;
+        setUpdateState((s) => ({ ...s, updating: true, error: '', notice: '' }));
+        try {
+          const res = await fetch('/api/dsh-context-lens/update', {
+            method: 'POST',
+            headers: { 'x-dsh-plugin-update': '1', 'x-dsh-context-lens-update': '1' }
+          });
+          const data = await res.json().catch(() => ({}));
+          if (!res.ok || data.ok === false || data.error) {
+            throw new Error(data.error || ('HTTP ' + res.status));
+          }
+          const newVer = data.updatedVersion || updateState.latestVersion || updateState.currentVersion;
+          setUpdateState((s) => ({
+            ...s,
+            updating: false,
+            updateAvailable: false,
+            currentVersion: newVer,
+            notice: tt('update.done', { version: newVer }),
+          }));
+        } catch (e) {
+          setUpdateState((s) => ({
+            ...s,
+            updating: false,
+            error: tt('update.failed', { error: e && e.message || String(e) }),
+          }));
+        }
+      }
+
       React.useEffect(() => {
         if (!expanded) return;
         fetch('/dsh-context-lens/status').then((r) => r.ok ? r.json() : null).then((j) => {
@@ -646,7 +739,8 @@ window.__ModuleLoader__.load({
         }).catch(() => {});
       }, [expanded, draft.autoCollapse]);
 
-      const tt = t || ((k) => (en[k] || k));
+      const L = React.useMemo(() => getActiveLocale(_ctx), [_ctx]);
+      const tt = React.useMemo(() => (t ? t : makeT(L, en)), [t, L]);
 
       let ChevronIcon = null;
       try {
@@ -655,9 +749,29 @@ window.__ModuleLoader__.load({
       } catch (e) { ChevronIcon = null; }
 
       const Chevron = ChevronIcon ? function ChevronNode(p) {
-        return React.createElement(ChevronIcon, { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)', transition: 'transform .16s', transform: p.open ? 'rotate(180deg)' : 'none' } });
+        return React.createElement(ChevronIcon, { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)', transition: 'transform .16s ease', transform: p.open ? 'rotate(180deg)' : 'none' } });
       } : function Fallback(p) {
-        return React.createElement('span', { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)' } }, '▼');
+        return React.createElement('svg', {
+          className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''),
+          viewBox: '0 0 14 14',
+          width: 14,
+          height: 14,
+          style: {
+            marginLeft: 'auto',
+            color: 'var(--dsw-alias-label-tertiary)',
+            transform: p.open ? 'rotate(180deg)' : 'none',
+            transition: 'transform .16s ease',
+            display: 'inline-block',
+            flexShrink: 0
+          }
+        }, React.createElement('path', {
+          d: 'M3.5 5.25L7 8.75L10.5 5.25',
+          fill: 'none',
+          stroke: 'currentColor',
+          strokeWidth: '1.5',
+          strokeLinecap: 'round',
+          strokeLinejoin: 'round'
+        }));
       };
 
       async function onSave() {
@@ -711,6 +825,39 @@ window.__ModuleLoader__.load({
           React.createElement(Chevron, { open: expanded })
         ),
         expanded ? React.createElement('div', { className: 'cl-body', style: { borderTop: '1px solid var(--dsw-alias-border-l2)', paddingTop: 12 } },
+          React.createElement('div', {
+            style: {
+              display: 'flex', alignItems: 'center', justifyContent: 'space-between',
+              padding: '6px 10px', marginBottom: 10, borderRadius: 8,
+              background: 'var(--dsw-alias-bg-layer-2)', border: '1px solid var(--dsw-alias-border-l2)', fontSize: 12
+            }
+          },
+            React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
+              React.createElement('span', { style: { fontWeight: 500, color: 'var(--dsw-alias-label-primary)' } },
+                'v' + (updateState.currentVersion || '0.1.18')
+              ),
+              updateState.checking
+                ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: 11 } }, tt('update.checking'))
+                : updateState.updateAvailable
+                  ? React.createElement('span', { className: 'cl-badge cl-badge-warn' },
+                      tt('update.available', { latestVersion: updateState.latestVersion, currentVersion: updateState.currentVersion })
+                    )
+                  : React.createElement('span', { className: 'cl-badge cl-badge-ok' },
+                      '✓ ' + tt('update.up_to_date')
+                    )
+            ),
+            updateState.updateAvailable
+              ? React.createElement('button', {
+                  type: 'button',
+                  className: 'cl-btn cl-btn-primary',
+                  disabled: updateState.updating,
+                  onClick: handleTriggerUpdate,
+                  style: { padding: '3px 8px', fontSize: 11 }
+                }, updateState.updating ? tt('update.updating') : tt('update.btn'))
+              : null
+          ),
+          updateState.notice ? React.createElement('div', { className: 'cl-banner-ok', style: { marginBottom: 10, padding: '8px 12px', borderRadius: 8, background: 'color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent)', border: '1px solid var(--dsw-alias-state-success-primary, #10b981)', color: 'var(--dsw-alias-state-success-primary, #10b981)', fontSize: 12 } }, '✓ ' + updateState.notice) : null,
+          updateState.error ? React.createElement('div', { className: 'cl-banner-warn', style: { marginBottom: 10 } }, updateState.error) : null,
           budgetWarn ? React.createElement('div', { className: 'cl-banner-warn', style: { marginBottom: 12 } }, '⚠ ' + tt('lowBudget')) : null,
           status === 'loading' ? React.createElement('div', { style: { padding: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Loading…') :
           status === 'unavailable' ? React.createElement('div', { style: { padding: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Settings unavailable — plugin not registered on host yet') :
@@ -815,9 +962,28 @@ window.__ModuleLoader__.load({
       );
     }
 
-    module.exports.inject = ['slots', 'locale'];
+    module.exports.inject = ['slots', 'locale', 'settingsScope'];
     module.exports.apply = function apply(ctx) {
-      try { ctx.locale.register(NS, { en, zh }); } catch (e) { console.warn('[dsh-context-lens] locale register failed', e && e.message || e); }
+      let hasEffect = false;
+      try {
+        hasEffect = typeof ctx.effect === 'function';
+      } catch (_) {
+        hasEffect = false;
+      }
+      if (hasEffect) {
+        ctx.effect(() => {
+          try {
+            const dispose = ctx.locale?.register ? ctx.locale.register(NS, { en, zh }) : undefined;
+            return () => {
+              if (typeof dispose === 'function') dispose();
+            };
+          } catch (e) {
+            console.warn('[dsh-context-lens] locale register failed', e && e.message || e);
+          }
+        }, 'dsh-context-lens: locale');
+      } else {
+        try { ctx.locale.register(NS, { en, zh }); } catch (e) { console.warn('[dsh-context-lens] locale register failed', e && e.message || e); }
+      }
       if (!ctx.slots) return;
       let registered = false;
       const doRegister = () => {
@@ -890,17 +1056,28 @@ window.__ModuleLoader__.load({
                     const ok = ctx.slots.inject("sidebar.right.pane.tab", registerPaneTab);
                     if (!ok) console.warn("[dsh-context-lens] sidebar.right.pane.tab inject returned false");
                   } catch (e) {
-                    try { registerPaneTab(); } catch (e2) {}
+                    console.warn("[dsh-context-lens] sidebar.right.pane.tab inject failed, falling back to direct register", e && e.message || e);
+                    try {
+                      registerPaneTab();
+                    } catch (e2) {
+                      console.warn("[dsh-context-lens] registerPaneTab direct register fallback failed", e2 && e2.message || e2);
+                    }
                   }
                 } else {
-                  try { registerPaneTab(); } catch (e) {}
+                  try {
+                    registerPaneTab();
+                  } catch (err) {
+                    console.warn("[dsh-context-lens] registerPaneTab direct register failed", err && err.message || err);
+                  }
                 }
               }
             } catch (e) {
               console.warn("[dsh-context-lens] native sidebar registration failed", e && e.message || e);
             }
           });
-        } catch (e) {}
+        } catch (err) {
+          console.warn("[dsh-context-lens] native sidebar inject failed", err && err.message || err);
+        }
       }
 
       if (typeof ctx.inject === 'function') {
@@ -925,7 +1102,9 @@ window.__ModuleLoader__.load({
               console.warn('[dsh-context-lens] betterSidebar registerTab failed', e && e.message || e);
             }
           });
-        } catch (e) {}
+        } catch (err) {
+          console.warn('[dsh-context-lens] betterSidebar inject failed', err && err.message || err);
+        }
       }
 
       if (ctx.slots) {
@@ -945,11 +1124,19 @@ window.__ModuleLoader__.load({
           try {
             ctx.slots.inject('conversation.session.header.utilities', headerChipRegister);
           } catch (e) {
-            console.warn('[dsh-context-lens] utilities inject failed', e && e.message || e);
-            try { headerChipRegister(); } catch (e2) {}
+            console.warn('[dsh-context-lens] utilities inject failed, falling back to direct register', e && e.message || e);
+            try {
+              headerChipRegister();
+            } catch (e2) {
+              console.warn('[dsh-context-lens] headerChipRegister fallback failed', e2 && e2.message || e2);
+            }
           }
         } else {
-          try { headerChipRegister(); } catch (e) {}
+          try {
+            headerChipRegister();
+          } catch (err) {
+            console.warn('[dsh-context-lens] headerChipRegister direct register failed', err && err.message || err);
+          }
         }
       }
     };

package/lib/http.js

@@ -0,0 +1,114 @@
+export function writeJson(res, code, body) {
+  try {
+    res.writeHead(code, {
+      'Content-Type': 'application/json; charset=utf-8',
+      'Cache-Control': 'no-store',
+    });
+    res.end(JSON.stringify(body));
+  } catch {
+    /* socket already closed */
+  }
+}
+
+export function readBody(req, maxBytes = 256 * 1024) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on('data', (c) => {
+      size += c.length;
+      if (size > maxBytes) {
+        req.destroy();
+        reject(new Error('body too large'));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', reject);
+  });
+}
+
+export function header(request, name) {
+  const value = request?.headers?.[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+export function isLoopbackAddress(value) {
+  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.');
+}
+
+/** Reject cross-site writes while allowing local, LAN, and reverse-proxy UIs. */
+export function isTrustedRequest(request) {
+  const secFetchSite = header(request, 'sec-fetch-site');
+  if (secFetchSite === 'cross-site') {
+    return false;
+  }
+
+  const host = header(request, 'x-forwarded-host') || header(request, 'host');
+  const origin = header(request, 'origin');
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  const referer = header(request, 'referer');
+  if (referer) {
+    try {
+      const url = new URL(referer);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  // Requests without origin/referer (e.g. curl, loopback tests, or internal calls)
+  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
+    return true;
+  }
+
+  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
+    return true;
+  }
+
+  return false;
+}
+
+export const UPDATE_HEADER = 'x-dsh-plugin-update';
+export const ALT_UPDATE_HEADER = 'x-dsh-context-lens-update';
+
+export function isTrustedUpdateRequest(request) {
+  const updHdr = header(request, UPDATE_HEADER) || header(request, ALT_UPDATE_HEADER);
+  if (updHdr !== '1') return false;
+  if (!isLoopbackAddress(request?.socket?.remoteAddress)) return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopbackAddress(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}