@goodandready/dsh-dsml-artifact-guard 0.2.7 → 0.2.8

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.2.8] - 2026-09-26
+
+### Added
+- **Universal DeepSeek Model Matching**: replaced strict single `providerId`/`modelId` pair with case-insensitive `modelPattern` RegExp (default: `deepseek`), automatically protecting all DeepSeek models regardless of provider gateway or vendor prefix (#48).
+- **Target Providers Filter**: added optional `providers` array filter (empty = all providers) (#48).
+- **Russian Localization**: added native `ru` translations in the Web UI settings card alongside English and Chinese (#48).
+
+### Changed
+- **De-identification**: removed proprietary `opencode-go` default in public package configuration.
+- **Backward Compatibility**: user configs with legacy `providerId` and `modelId` continue to work as an additional exact rule, with a deprecation notice and one-click clear button in the Web UI settings card.
+- **Documentation**: added dedicated section explaining lack of DSML processing in core DSH 0.1.7-rc.2.
+
 ## [0.2.7] - 2026-09-25
 
 ### Fixed

package/README.md

@@ -55,6 +55,14 @@ These leaked closing tags visually pollute the chat bubble, cause Markdown rende
 
 ---
 
+## 💡 Why Not in DSH Core?
+
+As of DeepSeek Harness **0.1.7-rc.2**, the core upstream stream pipeline (`dsh-llm-pi-ai`, `dsh-llm-deepseek*`, etc.) does not perform terminal DSML protocol cleanup — there is zero mention or handling of `｜DSML｜` anywhere in the core engine. When upstream gateways (e.g. `commandcode`, `deepseek-official`, or custom proxies) leak protocol closing tags at the conclusion of an assistant turn, DSH forwards them directly to the frontend.
+
+`dsh-dsml-artifact-guard` serves as the universal runtime guard across all DeepSeek models regardless of provider gateway or routing configuration.
+
+---
+
 ## 🏗️ Architecture
 
 ```mermaid
@@ -141,14 +149,14 @@ Restart your DeepSeek Harness instance.
 
 ## ⚙️ Configuration (`settings.yaml`)
 
-Configure provider and model targets in `settings.yaml` or through the Web UI:
+Configure model matching and provider targets in `settings.yaml` or through the Web UI:
 
 ```yaml
 # settings.yaml
 dsh-dsml-artifact-guard:
   mode: sanitize
-  providerId: "your-provider-id"
-  modelId: "your-model-id"
+  modelPattern: "deepseek"   # Case-insensitive RegExp matching all DeepSeek models
+  providers: []             # Empty = guard all providers; or e.g. ["commandcode", "deepseek-official"]
 ```
 
 ### Configuration Parameters
@@ -156,8 +164,10 @@ dsh-dsml-artifact-guard:
 | Parameter | Type | Default | Description |
 |:---|:---|:---|:---|
 | `mode` | `string` | `"sanitize"` | Operation mode: `"sanitize"` (strip tags), `"audit"` (log only), or `"disabled"` |
-| `providerId` | `string` | `"opencode-go"` | Target provider identifier exhibiting leaked tags |
-| `modelId` | `string` | `"deepseek-v4-flash"` | Target model identifier exhibiting leaked tags |
+| `modelPattern` | `string` | `"deepseek"` | Case-insensitive RegExp matched against model IDs (e.g. `deepseek`, `deepseek-v4.*`, `deepseek/.*`) |
+| `providers` | `string[]` | `[]` | Optional list of provider IDs. When empty, guards all providers |
+| `providerId` | `string` | `undefined` | *(Deprecated)* Legacy exact provider identifier; maintained for backward compatibility |
+| `modelId` | `string` | `undefined` | *(Deprecated)* Legacy exact model identifier; maintained for backward compatibility |
 
 ### HTTP Management Endpoints
 

package/README.ru.md

@@ -55,6 +55,14 @@
 
 ---
 
+## 💡 Почему этого нет в ядре DSH?
+
+По состоянию на DeepSeek Harness **0.1.7-rc.2**, ядро системы (`dsh-llm-pi-ai`, `dsh-llm-deepseek*` и др.) вообще не выполняет очистку завершающих тегов DSML — в ядровом коде нет ни единого упоминания `｜DSML｜`. Когда вышестоящие провайдеры (например, `commandcode`, `deepseek-official` или внешние шлюзы) отдают в потоке закрывающие теги протокола, DSH пропускает их прямо в интерфейс чата.
+
+Плагин `dsh-dsml-artifact-guard` обеспечивает универсальную защиту для всех моделей DeepSeek независимо от конкретного шлюза или маршрутизатора.
+
+---
+
 ## 🏗️ Архитектура работы
 
 ```mermaid

package/README.zh.md

@@ -55,6 +55,14 @@
 
 ---
 
+## 💡 为什么核心层未包含此功能？
+
+截至 DeepSeek Harness **0.1.7-rc.2**，核心上游流管道（`dsh-llm-pi-ai`、`dsh-llm-deepseek*` 等）均未对末端 DSML 协议标签进行任何清洗——核心引擎中完全不存在对 `｜DSML｜` 的处理。当上游网关（例如 `commandcode`、`deepseek-official` 或其他代理）在回复结尾泄漏协议闭合标签时，DSH 会将其直接传输到聊天前端。
+
+`dsh-dsml-artifact-guard` 为所有 DeepSeek 模型提供通用的运行时防护，不受特定服务商网关或路由配置的限制。
+
+---
+
 ## 🏗️ 架构设计
 
 ```mermaid

package/lib/client.js

@@ -41,8 +41,15 @@ window.__ModuleLoader__.load({
       modeSanitize: 'Sanitize (strip leaked closing tags)',
       modeAudit: 'Audit (log warnings only, preserve output)',
       modeDisabled: 'Disabled (bypass all streams)',
-      providerId: 'Target Provider ID',
-      modelId: 'Target Model ID',
+      modelPattern: 'Model Pattern (RegExp)',
+      modelPatternHint: 'Case-insensitive RegExp matched against model IDs (e.g. deepseek, deepseek-v4.*). Default: deepseek.',
+      providers: 'Target Providers (optional)',
+      providersPlaceholder: 'all providers (comma-separated, e.g. commandcode, deepseek-official)',
+      providersHint: 'Comma-separated list of provider IDs. Leave empty to guard all providers.',
+      legacyDetected: 'Legacy providerId / modelId detected: active as an additional rule.',
+      legacyClear: 'Clear legacy fields',
+      providerId: 'Target Provider ID (legacy)',
+      modelId: 'Target Model ID (legacy)',
       disabledNotice: '⚠️ Guard is currently disabled. DSML closing tags will reach the chat interface.',
       statusUnavailable: 'Settings service unavailable.',
       saving: 'Saving…',
@@ -67,8 +74,15 @@ window.__ModuleLoader__.load({
       modeSanitize: 'Sanitize 清洗（自动剥除残留闭合标签）',
       modeAudit: 'Audit 审计（仅在日志记录警告，不修改正文）',
       modeDisabled: 'Disabled 禁用（直通所有数据流）',
-      providerId: '目标服务商标识 (Provider ID)',
-      modelId: '目标模型标识 (Model ID)',
+      modelPattern: '模型正则匹配式 (RegExp)',
+      modelPatternHint: '对模型 ID 进行不区分大小写的正则表达式匹配（默认：deepseek）。支持任意服务商前缀。',
+      providers: '目标服务商（可选）',
+      providersPlaceholder: '所有服务商（以逗号分隔，例如 commandcode, deepseek-official）',
+      providersHint: '以逗号分隔的服务商 ID 列表。留空则保护所有服务商。',
+      legacyDetected: '检测到旧版 providerId / modelId 配置，并作为附加精确规则生效。',
+      legacyClear: '清除旧版配置',
+      providerId: '目标服务商标识 (Provider ID, 旧版)',
+      modelId: '目标模型标识 (Model ID, 旧版)',
       disabledNotice: '⚠️ 守卫当前已禁用，残留的 DSML 闭合标签将直接显示在聊天界面。',
       statusUnavailable: '配置服务不可用。',
       saving: '正在保存…',
@@ -77,10 +91,45 @@ window.__ModuleLoader__.load({
       saveError: '保存失败: {msg}',
     };
 
+    const ru = {
+      title: 'Защита от артефактов DSML',
+      sub: 'Фильтрация утекших замыкающих тегов протокола DSML из потоков моделей DeepSeek',
+      version: 'Версия',
+      updateChecking: 'Проверка обновлений…',
+      updateAvailable: 'Доступно обновление: v{v}',
+      upToDate: 'Установлена последняя версия',
+      updateNow: 'Обновить сейчас',
+      updating: 'Обновление…',
+      updateSuccess: 'Обновлено до v{v}. Перезапустите службу DSH для применения изменений.',
+      updateFailed: 'Ошибка обновления: {msg}',
+      checkUpdateFailed: 'Не удалось проверить обновления',
+      mode: 'Режим работы',
+      modeSanitize: 'Санация (вырезать утекшие замыкающие теги)',
+      modeAudit: 'Аудит (только логировать предупреждения в журнал)',
+      modeDisabled: 'Отключено (пропускать все потоки без изменений)',
+      modelPattern: 'Шаблон модели (RegExp)',
+      modelPatternHint: 'Регулярное выражение без учёта регистра для ID модели (по умолчанию: deepseek).',
+      providers: 'Целевые провайдеры (опционально)',
+      providersPlaceholder: 'все провайдеры (через запятую, напр. commandcode, deepseek-official)',
+      providersHint: 'Список ID провайдеров через запятую. Оставьте пустым для защиты всех провайдеров.',
+      legacyDetected: 'Обнаружены устаревшие параметры providerId / modelId (действуют как дополнительное правило).',
+      legacyClear: 'Очистить устаревшие поля',
+      providerId: 'Целевой провайдер (устаревшее)',
+      modelId: 'Целевая модель (устаревшее)',
+      disabledNotice: '⚠️ Защита отключена. Замыкающие теги DSML будут попадать в интерфейс чата.',
+      statusUnavailable: 'Служба настроек недоступна.',
+      saving: 'Сохранение…',
+      ready: 'Сохранить настройки',
+      saved: 'Настройки сохранены',
+      saveError: 'Ошибка сохранения: {msg}',
+    };
+
     const DEFAULTS = {
       mode: 'sanitize',
-      providerId: 'opencode-go',
-      modelId: 'deepseek-v4-flash',
+      modelPattern: 'deepseek',
+      providers: '',
+      providerId: '',
+      modelId: '',
     };
 
     function PluginCard({ ctx: _ctx, t, bare }) {
@@ -115,8 +164,9 @@ window.__ModuleLoader__.load({
       }
       const scope = scopeRef.current;
 
-      const currentLang = ((typeof _ctx?.locale?.getLocale === 'function' ? _ctx.locale.getLocale() : null) || (typeof navigator !== 'undefined' && navigator.language) || 'en').startsWith('zh') ? 'zh' : 'en';
-      const dict = currentLang === 'zh' ? zh : en;
+      const rawLang = ((typeof _ctx?.locale?.getLocale === 'function' ? _ctx.locale.getLocale() : null) || (typeof navigator !== 'undefined' && navigator.language) || 'en');
+      const currentLang = rawLang.startsWith('ru') ? 'ru' : (rawLang.startsWith('zh') ? 'zh' : 'en');
+      const dict = currentLang === 'ru' ? ru : (currentLang === 'zh' ? zh : en);
       const tt = (k, params) => {
         let str = (typeof t === 'function' ? t(k) : null) || dict[k] || en[k] || k;
         if (params && typeof params === 'object') {
@@ -137,22 +187,19 @@ window.__ModuleLoader__.load({
         const syncSnapshot = (snap) => {
           if (!snap || cancelled) return;
           const view = snap.view || snap.value || snap;
-          if (typeof snap === 'object' && 'status' in snap) {
-            if (snap.status === 'ready' && view) {
-              setDraft({
-                mode: view.mode || DEFAULTS.mode,
-                providerId: view.providerId || DEFAULTS.providerId,
-                modelId: view.modelId || DEFAULTS.modelId,
-              });
-              setStatus('ready');
-            } else {
-              setStatus(snap.status);
-            }
-          } else if (typeof view === 'object') {
+          if (typeof snap === 'object' && 'status' in snap && snap.status !== 'ready') {
+            setStatus(snap.status);
+            return;
+          }
+          if (typeof view === 'object' && view !== null) {
             setDraft({
               mode: view.mode || DEFAULTS.mode,
-              providerId: view.providerId || DEFAULTS.providerId,
-              modelId: view.modelId || DEFAULTS.modelId,
+              modelPattern: view.modelPattern !== undefined ? String(view.modelPattern) : DEFAULTS.modelPattern,
+              providers: Array.isArray(view.providers)
+                ? view.providers.join(', ')
+                : (typeof view.providers === 'string' ? view.providers : ''),
+              providerId: view.providerId ? String(view.providerId) : '',
+              modelId: view.modelId ? String(view.modelId) : '',
             });
             setStatus('ready');
           } else {
@@ -253,9 +300,16 @@ window.__ModuleLoader__.load({
         setMsg('');
         try {
           const failures = [];
-          for (const key of ['mode', 'providerId', 'modelId']) {
+          const entries = [
+            ['mode', draft.mode || 'sanitize'],
+            ['modelPattern', (draft.modelPattern !== undefined && draft.modelPattern !== null) ? String(draft.modelPattern).trim() : 'deepseek'],
+            ['providers', draft.providers ? draft.providers.split(',').map(s => s.trim()).filter(Boolean) : []],
+            ['providerId', draft.providerId ? String(draft.providerId).trim() : ''],
+            ['modelId', draft.modelId ? String(draft.modelId).trim() : ''],
+          ];
+          for (const [key, val] of entries) {
             try {
-              await scope.set(key, draft[key]);
+              await scope.set(key, val);
             } catch (err) {
               failures.push(key + ': ' + (err.message || String(err)));
             }
@@ -452,15 +506,16 @@ window.__ModuleLoader__.load({
               )
             ),
 
-            // Provider ID Field
+            // Model Pattern Field
             React.createElement('div', { style: { display: 'flex', flexDirection: 'column', gap: 6 } },
               React.createElement('label', {
                 style: { fontSize: 13, fontWeight: 500, color: 'var(--dsw-alias-label-primary)' },
-              }, tt('providerId')),
+              }, tt('modelPattern')),
               React.createElement('input', {
                 type: 'text',
-                value: draft.providerId,
-                onChange: (e) => setDraft(d => ({ ...d, providerId: e.target.value })),
+                value: draft.modelPattern,
+                placeholder: 'deepseek',
+                onChange: (e) => setDraft(d => ({ ...d, modelPattern: e.target.value })),
                 style: {
                   height: 34,
                   borderRadius: 6,
@@ -470,18 +525,22 @@ window.__ModuleLoader__.load({
                   padding: '0 10px',
                   fontSize: 13,
                 },
-              })
+              }),
+              React.createElement('span', {
+                style: { fontSize: 11, color: 'var(--dsw-alias-label-tertiary)', lineHeight: '1.4' },
+              }, tt('modelPatternHint'))
             ),
 
-            // Model ID Field
+            // Target Providers Field
             React.createElement('div', { style: { display: 'flex', flexDirection: 'column', gap: 6 } },
               React.createElement('label', {
                 style: { fontSize: 13, fontWeight: 500, color: 'var(--dsw-alias-label-primary)' },
-              }, tt('modelId')),
+              }, tt('providers')),
               React.createElement('input', {
                 type: 'text',
-                value: draft.modelId,
-                onChange: (e) => setDraft(d => ({ ...d, modelId: e.target.value })),
+                value: draft.providers,
+                placeholder: tt('providersPlaceholder'),
+                onChange: (e) => setDraft(d => ({ ...d, providers: e.target.value })),
                 style: {
                   height: 34,
                   borderRadius: 6,
@@ -491,7 +550,49 @@ window.__ModuleLoader__.load({
                   padding: '0 10px',
                   fontSize: 13,
                 },
-              })
+              }),
+              React.createElement('span', {
+                style: { fontSize: 11, color: 'var(--dsw-alias-label-tertiary)', lineHeight: '1.4' },
+              }, tt('providersHint'))
+            ),
+
+            // Legacy Provider/Model notice if detected
+            (draft.providerId || draft.modelId) && React.createElement('div', {
+              style: {
+                display: 'flex',
+                alignItems: 'flex-start',
+                justifyContent: 'space-between',
+                gap: 8,
+                padding: '8px 10px',
+                borderRadius: 6,
+                background: 'color-mix(in srgb, var(--dsw-alias-state-warning-primary) 10%, transparent)',
+                border: '1px solid color-mix(in srgb, var(--dsw-alias-state-warning-primary) 25%, transparent)',
+                fontSize: 12,
+                color: 'var(--dsw-alias-label-secondary)',
+              },
+            },
+              React.createElement('div', { style: { display: 'flex', flexDirection: 'column', gap: 2 } },
+                React.createElement('span', null, tt('legacyDetected')),
+                React.createElement('span', { style: { fontFamily: 'monospace', fontSize: 11 } },
+                  (draft.providerId ? 'provider: ' + draft.providerId : '') +
+                  (draft.providerId && draft.modelId ? ' | ' : '') +
+                  (draft.modelId ? 'model: ' + draft.modelId : '')
+                )
+              ),
+              React.createElement('button', {
+                type: 'button',
+                onClick: () => setDraft(d => ({ ...d, providerId: '', modelId: '' })),
+                style: {
+                  background: 'transparent',
+                  border: 'none',
+                  color: 'var(--dsw-alias-brand-primary, var(--dsw-alias-label-primary))',
+                  fontSize: 11,
+                  cursor: 'pointer',
+                  textDecoration: 'underline',
+                  whiteSpace: 'nowrap',
+                  padding: '2px 4px',
+                },
+              }, tt('legacyClear'))
             ),
 
             // Actions
@@ -574,7 +675,7 @@ window.__ModuleLoader__.load({
       if (typeof ctx.locale?.register === 'function') {
         const registerLocale = () => {
           try {
-            return ctx.locale.register(NS, { en, zh });
+            return ctx.locale.register(NS, { en, zh, ru });
           } catch (err) {
             /* Locale namespace already registered or unavailable */
           }

package/lib/index.js

@@ -11,8 +11,10 @@ export const inject = ['llm', 'settings', 'webServer'];
 
 const rawConfig = Schema.object({
   mode: Schema.string().default('sanitize'),
-  providerId: Schema.string().default('opencode-go'),
-  modelId: Schema.string().default('deepseek-v4-flash'),
+  modelPattern: Schema.string().default('deepseek'),
+  providers: Schema.array(Schema.string()).default([]),
+  providerId: Schema.string(),
+  modelId: Schema.string(),
 });
 
 export const Config = typeof rawConfig.volatile === 'function'
@@ -20,9 +22,37 @@ export const Config = typeof rawConfig.volatile === 'function'
   : rawConfig.extra('volatile', true);
 
 export function matchesScope(o, c) {
-  const provider = o?.providerId ?? o?.provider?.id ?? o?.provider;
-  const model = o?.modelId ?? o?.model?.id ?? o?.model?.name ?? o?.model;
-  return provider == c.providerId && model == c.modelId;
+  if (!c || c.mode === 'disabled') return false;
+  const provider = String(o?.providerId ?? o?.provider?.id ?? o?.provider ?? '').trim();
+  const model = String(o?.modelId ?? o?.model?.id ?? o?.model?.name ?? o?.model ?? '').trim();
+  if (!model && !provider) return false;
+
+  // 1. Backward compatibility: if legacy exact providerId/modelId were specified and match
+  if (c.providerId && c.modelId && provider === c.providerId && model === c.modelId) {
+    return true;
+  }
+
+  // 2. Provider check: if c.providers is non-empty, provider must be included
+  const providersList = Array.isArray(c.providers)
+    ? c.providers.map(p => String(p).trim()).filter(Boolean)
+    : (typeof c.providers === 'string' && c.providers.trim() ? c.providers.split(',').map(p => p.trim()).filter(Boolean) : []);
+
+  if (providersList.length > 0) {
+    if (!providersList.includes(provider)) return false;
+  }
+
+  // 3. Model pattern check (case-insensitive regex)
+  const pattern = (c.modelPattern !== undefined && c.modelPattern !== null && String(c.modelPattern).trim() !== '')
+    ? String(c.modelPattern).trim()
+    : 'deepseek';
+
+  try {
+    const rx = new RegExp(pattern, 'i');
+    return rx.test(model);
+  } catch (err) {
+    /* Fallback to substring matching if regex syntax is invalid */
+    return model.toLowerCase().includes(pattern.toLowerCase());
+  }
 }
 
 export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact } = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-dsml-artifact-guard",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Sanitizes leaked DeepSeek DSML closing tags from model text streams",
   "type": "module",
   "main": "lib/index.js",