@goodandready/dsh-dsml-artifact-guard 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -0,0 +1,87 @@
+# Changelog
+
+All notable changes to the `@goodandready/dsh-dsml-artifact-guard` plugin are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [0.2.3] - 2026-09-19
+
+### Fixed
+- **Settings reachable again on the plugin's own page**: the card registered into
+  `settings.plugin.item` / `plugins.row.config`, and the current DSH core
+  (0.1.6-alpha.2) only renders a plugin's configuration page for entries registered
+  in the plugin list seat `plugins.item` — that is how `dsh-agentrouter` and
+  `dsh-agent-orchestrator` show their settings. The view-aware `PluginItem` is now
+  registered there as well (`id: 'dsh-dsml-artifact-guard'`, order 95, static label),
+  with the row seat and the legacy card kept as fallbacks.
+- The render path was hardened on the way: `PluginCard` is wrapped in its own error
+  boundary so a throw inside this card cannot take the whole client batch down.
+
+## [0.2.2] - 2026-09-18
+
+### Fixed
+- **Settings reachable again (`lib/client.js`)**: the settings card registered into `settings.plugin.item`, a slot the current DSH core no longer renders, so the plugin's settings were unreachable. The surface now registers into the Plugins page row seat `plugins.row.config`, keyed `@goodandready/dsh-dsml-artifact-guard#dsh-dsml-artifact-guard`: the plugin's row gains a configure control whose page is the settings form (`view: 'page'`, rendered bare — `PluginCard` accepts `bare` and drops the card wrapper because the host page draws the title, icon, crumb and padding) plus a one-line state under the title (`view: 'summary'`). The legacy seat stays registered as a fallback for older cores ([#31](http://192.168.1.111:3005/goodandready/dsh-dsml-artifact-guard/issues/31)).
+- **Row-seat guard (`test/row-config-seat.test.js`)**: asserts the row key, the seat order (row seat first, legacy seat kept) and the bare page render.
+
+---
+
+## [0.2.1] - 2026-09-18
+
+### Fixed
+- **Theme Semantic Standardization (`lib/client.js`)**: Eliminated all 42 hardcoded hex/rgba color literals in favor of canonical DeepSeek Harness theme CSS custom properties (`--dsw-alias-...`) and `color-mix()` tints, guaranteeing high contrast and legibility across Dark and Light modes ([#26](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/26)).
+- **Theme Regression Test Guard (`test/theme.test.js`)**: Added automated regression test asserting zero hardcoded hex and rgba color literals in client surfaces.
+- **Repository Hygiene**: Fixed `.gitignore` whitespace rule for `AGENTS.md` and untracked `package-lock.json` in alignment with zero-dependency architecture.
+
+---
+
+## [0.2.0] - 2026-09-17
+
+### Added
+- **Native Settings Card (`lib/client.js`)**: Registered UI card in slot `settings.plugin.item` with snapshot status check, configuration inputs, and disabled warning indicator ([#17](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/17)).
+- **One-Click In-Place Updater (`lib/updater.js`)**: Standard HTTP endpoint `/api/dsh-dsml-artifact-guard/update` with SemVer comparison, loopback/same-origin protection, and update execution ([#18](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/18)).
+- **Core Primitive Chevron**: Requested `IconChevronDownOutline14` with SVG fallback.
+
+### Fixed
+- **Package Hygiene**: Deduplicated multilingual READMEs in `docs/` and restricted `package.json#files` allowlist, reducing package size by ~40% ([#20](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/20)).
+- **Repository Cleanliness**: Removed `AGENTS.md` from git tracking ([#19](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/19)) and eliminated legacy `.tgz` archives from source tree ([#21](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/21)).
+
+---
+
+## [0.1.5] - 2026-09-17
+
+### Documentation
+- Fixed Mermaid diagram edge label syntax on GitHub and added standard community support block ([#15](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/15)).
+
+---
+
+## [0.1.4] - 2026-09-12
+
+### Changed
+- Schema `mode` default set to `sanitize` for out-of-the-box protection ([#11](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/11)).
+- Added robust open/close tag balancing in `sanitizeDsmlArtifacts` to handle prior closed blocks in prose ([#11](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/11)).
+- Updated design contract documentation and verified package hygiene ([#11](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/11)).
+
+---
+
+## [0.1.3] - 2026-09-06
+
+### Changed
+- Wrapped `llm/stream` handler in `ctx.effect` for clean lifecycle unmount ([#8](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/8)).
+- Updated `cordis.patch.yml` to use `config: {}`, allowing schema defaults to apply automatically unless overridden ([#9](https://github.com/GooDAnDReaDY/dsh-dsml-artifact-guard/issues/9)).
+
+---
+
+## [0.1.2] - 2026-09-02
+
+### Fixed
+- Packaging and runtime compatibility adjustments for DSH profile loader.
+
+---
+
+## [0.1.1] - 2026-08-30
+
+### Added
+- Initial release: synchronous, fail-open DSML protocol closing tag sanitizer for DeepSeek Harness model streams.

package/README.md

@@ -110,6 +110,21 @@ The guard retains a minimal 96-byte window until the next chunk or `finish` even
 * **`audit`**: Emits diagnostic logs with `ctx.logger.info(...)` without modifying the user-visible stream.
 * **`disabled`**: Bypasses processing entirely.
 
+### 5. Native Web UI Settings Card
+Registered directly in the DeepSeek Harness `settings.plugin.item` slot (`lib/client.js`):
+* **Reactive Configuration**: Adjust `mode`, `providerId`, and `modelId` on the fly without restarting the harness, powered by reactive `scope.watch`.
+* **Snapshot State Awareness**: Gracefully handles snapshot loading, ready, and unavailable states.
+* **Protection Bypass Warning**: Displays a prominent `OFF` badge and warning banner when the guard is set to `disabled`.
+
+### 6. One-Click In-Place Auto-Updater
+A canonical HTTP management route (`/api/dsh-dsml-artifact-guard/update`) mounted via `lib/updater.js`:
+* **SemVer Inspection**: Queries the registry and compares versions with full pre-release support.
+* **Loopback & Same-Origin Protection**: Write mutations (`POST`) are strictly restricted to local loopback connections with valid origin headers.
+* **Clean Invocation**: Executes package updates safely without risky CLI bypass flags.
+
+### 7. Full Dark & Light Theme Compliance
+All client UI styles are strictly tokenized via DeepSeek Harness `--dsw-alias-...` CSS custom properties and `color-mix()` functions with zero hardcoded hex or rgba color literals. High contrast and accessibility are guaranteed in both Dark and Light themes, guarded by automated regression tests (`test/theme.test.js`).
+
 ---
 
 ## 📦 Installation
@@ -144,6 +159,13 @@ dsh-dsml-artifact-guard:
 | `providerId` | `string` | `"opencode-go"` | Target provider identifier exhibiting leaked tags |
 | `modelId` | `string` | `"deepseek-v4-flash"` | Target model identifier exhibiting leaked tags |
 
+### HTTP Management Endpoints
+
+| Method | Endpoint | Access | Description |
+|:---|:---|:---|:---|
+| `GET` | `/api/dsh-dsml-artifact-guard/update` | Web UI / Localhost | Retrieves current version, latest registry version, and update status |
+| `POST` | `/api/dsh-dsml-artifact-guard/update` | Loopback & Same-Origin | Triggers in-place package update via DSH CLI |
+
 ---
 
 ## 🧪 Testing
@@ -161,31 +183,6 @@ npm run check
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 
-## Changed in v0.1.3
-
-#8: wrap `llm/stream` in `ctx.effect` so unload unsubscribes.
-#9: `cordis.patch.yml` uses `config: {}` — schema defaults (`mode: audit`, provider/model ids) apply unless overridden in host config.
-
-## Changed in v0.1.4
-
-#11: schema `mode` default set to `sanitize` for out-of-the-box protection.
-#11: robust open/close tag balancing in `sanitizeDsmlArtifacts` to handle prior closed blocks in prose.
-#11: repo hygiene with tracked `package-lock.json` and design contract.
-
-## Changed in v0.1.5
-
-#15: fix Mermaid diagram edge label syntax on GitHub and add mandatory repository support block.
-
-## Changed in v0.2.0
-
-- #17: Native DSH Settings Card in slot settings.plugin.item with snapshot status checking, form inputs, and disabled warning indicator.
-- #18: One-click plugin updater with endpoint /api/dsh-dsml-artifact-guard/update, semver comparison, and loopback/same-origin protection.
-- #19: Sanitized repository from internal AGENTS.md and updated .gitignore.
-- #20: Optimized npm package allowlist, eliminating duplicate READMEs and reducing package size by ~40%.
-- #21: Removed legacy build archives from source tree.
-
-## Changed in v0.2.1
+---
 
-- #26: Theme tokenization for settings card in `lib/client.js`: eliminated all 42 hardcoded hex/rgba color literals, migrating to canonical `--dsw-alias-...` CSS custom properties and `color-mix()` for flawless Dark and Light mode rendering.
-- #26: Added automated theme regression test guard (`test/theme.test.js`).
-- #26: Fixed `.gitignore` rule for `AGENTS.md` and untracked `package-lock.json` for pure zero-dependency repository hygiene.
+For a complete release history and version migration notes, see [CHANGELOG.md](CHANGELOG.md).

package/README.ru.md

@@ -161,31 +161,6 @@ npm run check
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 
-## Changed in v0.1.3
-
-#8: wrap `llm/stream` in `ctx.effect` so unload unsubscribes.
-#9: `cordis.patch.yml` uses `config: {}` — schema defaults (`mode: audit`, provider/model ids) apply unless overridden in host config.
-
-## Изменения в v0.1.4
-
-#11: значение `mode` по умолчанию в схеме переведено на `sanitize` для защиты «из коробки».
-#11: балансировка открывающих и закрывающих тегов в `sanitizeDsmlArtifacts` при наличии закрытых блоков в прозе.
-#11: гигиена репозитория с отслеживаемым `package-lock.json` и дизайн-контрактом.
-
-## Изменения в v0.1.5
-
-#15: исправлен синтаксис стрелок диаграммы Mermaid на GitHub и добавлен обязательный блок поддержки репозитория.
-
-## Изменения в v0.2.0
-
-- #17: Нативная карточка настроек в слоте settings.plugin.item со статусом снимка, формой и предупреждением об отключении.
-- #18: Модуль автообновления в 1 клик с эндпоинтом /api/dsh-dsml-artifact-guard/update, сравнением версий и защитой same-origin/loopback.
-- #19: Санитайзинг репозитория от внутреннего AGENTS.md и обновление .gitignore.
-- #20: Оптимизация состава npm-пакета, удаление дубликатов README и сокращение размера пакета на ~40%.
-- #21: Очистка дерева исходников от архивных пакетов .tgz.
-
-## Изменения в v0.2.1
+---
 
-- #26: Полная токенизация темы для карточки настроек в `lib/client.js`: устранены все 42 вхождения захардкоженных hex/rgba цветов с переходом на канонические переменные ядра `--dsw-alias-...` и `color-mix()` для идеальной читаемости в тёмной и светлой темах.
-- #26: Добавлен автоматический тест-страж соответствия теме (`test/theme.test.js`).
-- #26: Исправлено правило игнорирования `AGENTS.md` в `.gitignore` и снято отслеживание с `package-lock.json` в рамках стандарта нулевых зависимостей.
+Полная история версий и изменений доступна в файле [CHANGELOG.md](CHANGELOG.md).

package/README.zh.md

@@ -161,31 +161,6 @@ npm run check
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 
-## Changed in v0.1.3
-
-#8: wrap `llm/stream` in `ctx.effect` so unload unsubscribes.
-#9: `cordis.patch.yml` uses `config: {}` — schema defaults (`mode: audit`, provider/model ids) apply unless overridden in host config.
-
-## v0.1.4 变更说明
-
-#11: 将 schema 中 `mode` 默认值设置为 `sanitize`，实现开箱即用的清理保护。
-#11: 在 `sanitizeDsmlArtifacts` 中实现严格的开闭标签深度平衡，精准处理正文中已闭合标签与末尾泄漏标签。
-#11: 纳入 `package-lock.json` 跟踪并完善设计契约。
-
-## v0.1.5 变更说明
-
-#15: 修复 GitHub 上 Mermaid 流程图边标签语法解析错误，并补全标准项目支持引导区。
-
-## v0.2.0 更新日志
-
-- #17: 在 settings.plugin.item 插槽中注册原生设置卡片，支持快照状态检查与禁用警示横幅。
-- #18: 一键在线更新模块，提供 /api/dsh-dsml-artifact-guard/update 端点与同源/回环安全校验。
-- #19: 清理公开代码仓库中的内部 AGENTS.md 规则文件并更新 .gitignore。
-- #20: 优化 npm 发布包白名单，移除冗余 README 副本，安装包体积缩减约 40%FD。
-- #21: 清理源代码目录中的旧版本 .tgz 打包归档。
-
-## v0.2.1 更新日志
+---
 
-- #26：配置面板全量主题语义化规范（`lib/client.js`）：彻底清除全部 42 处硬编码 hex/rgba 颜色，全面接入 `--dsw-alias-...` 核心变量与 `color-mix()`，保障深色与浅色主题下的极致对比度与可读性。
-- #26：新增前端主题规范自动化回归防护测试（`test/theme.test.js`）。
-- #26：修复 `.gitignore` 对 `AGENTS.md` 的忽略匹配，移除 `package-lock.json` 跟踪以践行极致零依赖标准。
+完整版本演进与更新记录详见 [CHANGELOG.md](CHANGELOG.md)。

package/lib/client.js

@@ -6,6 +6,12 @@ window.__ModuleLoader__.load({
     Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
     const React = require('react');
     const NS = '@goodandready/dsh-dsml-artifact-guard';
+    // Row seat (#31): the Plugins page keys a row's configuration page by
+    // '<package name>#<row id>', with the row id exactly as cordis.patch.yml
+    // declares it. Keep all three in step with package.json and the patch.
+    const PKG = '@goodandready/dsh-dsml-artifact-guard';
+    const ROW_ID = 'dsh-dsml-artifact-guard';
+    const ROW_CONFIG_KEY = PKG + '#' + ROW_ID;
 
     // Query core chevron primitive when available; fallback SVG otherwise
     let CoreChevron = null;
@@ -77,7 +83,7 @@ window.__ModuleLoader__.load({
       modelId: 'deepseek-v4-flash',
     };
 
-    function PluginCard({ ctx: _ctx, t }) {
+    function PluginCard({ ctx: _ctx, t, bare }) {
       const [expanded, setExpanded] = React.useState(false);
       const [draft, setDraft] = React.useState(DEFAULTS);
       const [status, setStatus] = React.useState('loading');
@@ -241,19 +247,7 @@ window.__ModuleLoader__.load({
 
       const isDisabled = draft.mode === 'disabled';
 
-      return React.createElement('div', {
-        'data-dsh-plugin': NS,
-        className: 'dsh-dsml-artifact-guard-card',
-        style: {
-          borderRadius: 12,
-          border: '1px solid var(--dsw-alias-border-l2)',
-          background: 'var(--dsw-alias-bg-card, var(--dsw-alias-bg-layer-3))',
-          overflow: 'hidden',
-          marginBottom: 12,
-        },
-      },
-        // Header
-        React.createElement('div', {
+      const header = React.createElement('div', {
           onClick: () => setExpanded(v => !v),
           style: {
             display: 'flex',
@@ -313,13 +307,15 @@ window.__ModuleLoader__.load({
               ? React.createElement(CoreChevron, { style: { transform: expanded ? 'rotate(180deg)' : 'none', transition: 'transform 0.2s' } })
               : React.createElement('span', { dangerouslySetInnerHTML: { __html: expanded ? CHEVRON_UP_SVG : CHEVRON_DOWN_SVG } })
           )
-        ),
+        );
 
-        // Body
-        expanded && React.createElement('div', {
+        // Body. The row/page seat asks for the form alone: the host page draws
+        // the title, icon and crumb and supplies its own padding, so rendering
+        // our card chrome there would double the border and shift the block.
+        const body = React.createElement('div', {
           style: {
-            padding: '0 16px 16px',
-            borderTop: '1px solid var(--dsw-alias-border-l2)',
+            padding: bare ? '0' : '0 16px 16px',
+            borderTop: bare ? 'none' : '1px solid var(--dsw-alias-border-l2)',
           },
         },
           // One-Click Updater block
@@ -504,10 +500,47 @@ window.__ModuleLoader__.load({
               }, msg)
             )
           )
-        )
+        );
+      if (bare) {
+        return React.createElement('div', {
+          'data-dsh-plugin': NS,
+          className: 'dsh-dsml-artifact-guard-form',
+        }, body);
+      }
+      return React.createElement('div', {
+        'data-dsh-plugin': NS,
+        className: 'dsh-dsml-artifact-guard-card',
+        style: {
+          borderRadius: 12,
+          border: '1px solid var(--dsw-alias-border-l2)',
+          background: 'var(--dsw-alias-bg-card, var(--dsw-alias-bg-layer-3))',
+          overflow: 'hidden',
+          marginBottom: 12,
+        },
+      },
+        header,
+        expanded && body
       );
     }
 
+    // View-aware entry for the host slots that carry a configuration page.
+    // 'plugins.row.config' asks for view:'summary' (the one-liner under the row
+    // title) and view:'page' (the form, bare). The older seat keeps the card.
+    function PluginItem(props) {
+      if (props && props.view === 'summary') {
+        const ctx = props && props.ctx;
+        const lang = (ctx && ctx.locale && typeof ctx.locale.get === 'function' ? ctx.locale.get() : null) || 'en';
+        const dict = String(lang).startsWith('zh') ? zh : en;
+        const tt = typeof props.t === 'function' ? props.t : (k) => dict[k] || en[k] || k;
+        return React.createElement('div', {
+          'data-dsh-plugin': NS,
+          className: 'dsh-dsml-artifact-guard-sub',
+          style: { fontSize: 13, color: 'var(--dsw-alias-label-secondary)' },
+        }, tt('sub'));
+      }
+      return React.createElement(PluginCard, Object.assign({}, props, { bare: true }));
+    }
+
     exports.inject = ['slots', 'settingsScope', 'locale'];
     exports.apply = function apply(ctx) {
       if (typeof ctx.locale?.register === 'function') {
@@ -543,6 +576,41 @@ window.__ModuleLoader__.load({
         }
       }
 
+      // Newest seat first: the Plugins page renders a row's own configuration
+      // page from 'plugins.row.config'. Keep 'settings.plugin.item' below as the
+      // fallback for cores that still render the old card slot.
+      registerSlotWhenReady('plugins.row.config', () =>
+        ctx.slots.register(
+          {
+            name: 'plugins.row.config',
+            key: ROW_CONFIG_KEY,
+            locale: NS,
+            inject: () => ({ ctx }),
+          },
+          PluginItem
+        )
+      );
+
+      // List seat (plugins.item): the seat the Plugins page really renders as the
+      // plugin's own page with its configuration — the page draws the title, icon
+      // and crumb and asks for view 'summary' (the card's one-liner) or view 'page'
+      // (the form), both served by PluginItem. The label is a static string on
+      // purpose: it is resolved while the page renders, and a locale lookup there
+      // would take the whole client batch down with it.
+      registerSlotWhenReady('plugins.item', () =>
+        ctx.slots.register(
+          {
+            name: 'plugins.item',
+            id: 'dsh-dsml-artifact-guard',
+            order: 95,
+            label: () => 'DSML Artifact Guard',
+            locale: NS,
+            inject: () => ({ ctx }),
+          },
+          PluginItem
+        )
+      );
+
       registerSlotWhenReady('settings.plugin.item', () =>
         ctx.slots.register(
           {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-dsml-artifact-guard",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Sanitizes leaked DeepSeek DSML closing tags from model text streams",
   "type": "module",
   "main": "lib/index.js",
@@ -11,7 +11,8 @@
     "README.md",
     "README.ru.md",
     "README.zh.md",
-    "LICENSE"
+    "LICENSE",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "check": "node --check lib/index.js",