@goodandready/dsh-dsml-artifact-guard 0.2.9 → 0.2.10

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.2.10] - 2026-10-07
+
+### Removed
+- **Dead `settings.register` Fallback**: removed dead legacy registration path in `apply()` and eliminated potential un-unwrapped volatile box leak on host settings delivery (#54, #55, #59).
+- **Dead `settings.plugin.item` Slot**: removed dead slot registration in client bundle, routing exclusively through active `plugins.row.config` and `plugins.item` seats (#59).
+
+### Optimized
+- **Single-Pass Config Unwrapping**: optimized `unwrapConfig` error fallback to evaluate raw plain config in a single pass instead of three recursive walks (#56).
+
 ## [0.2.9] - 2026-10-07
 
 ### Fixed

package/README.md

@@ -119,8 +119,8 @@ The guard retains a minimal 96-byte window until the next chunk or `finish` even
 * **`disabled`**: Bypasses processing entirely.
 
 ### 5. Native Web UI Settings Card
-Registered directly in the DeepSeek Harness `settings.plugin.item` slot (`lib/client.js`):
-* **Reactive Configuration**: Adjust `mode`, `providerId`, and `modelId` on the fly without restarting the harness, powered by reactive `scope.watch`.
+Registered directly in DeepSeek Harness `plugins.row.config` and `plugins.item` slots (`lib/client.js`):
+* **Reactive Configuration**: Adjust `mode`, `providers`, and `modelPattern` on the fly without restarting the harness.
 * **Snapshot State Awareness**: Gracefully handles snapshot loading, ready, and unavailable states.
 * **Protection Bypass Warning**: Displays a prominent `OFF` badge and warning banner when the guard is set to `disabled`.
 

package/lib/client.js

@@ -707,9 +707,8 @@ window.__ModuleLoader__.load({
         }
       }
 
-      // Newest seat first: the Plugins page renders a row's own configuration
-      // page from 'plugins.row.config'. Keep 'settings.plugin.item' below as the
-      // fallback for cores that still render the old card slot.
+      // Plugins page row configuration: the Plugins page renders a row's own configuration
+      // page from 'plugins.row.config'.
       registerSlotWhenReady('plugins.row.config', () =>
         ctx.slots.register(
           {
@@ -742,18 +741,6 @@ window.__ModuleLoader__.load({
         )
       );
 
-      registerSlotWhenReady('settings.plugin.item', () =>
-        ctx.slots.register(
-          {
-            name: 'settings.plugin.item',
-            key: NS,
-            order: 95,
-            locale: NS,
-            inject: () => ({ ctx }),
-          },
-          (props) => React.createElement(PluginCard, { ...props, ctx: (props && props.ctx) || ctx })
-        )
-      );
     };
 
     return module.exports;

package/lib/index.js

@@ -147,25 +147,27 @@ export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact
 export function unwrapConfig(conf) {
   if (!conf) return {};
   // A Volatile reference (any field is now volatile) resolves through .get().
-  const readRef = (val) => {
+  if (typeof conf.get === 'function') {
     try {
-      const inner = typeof val?.get === 'function' ? val.get() : val;
-      return inner && typeof inner === 'object' ? inner : {};
-    } catch {
+      const inner = conf.get();
+      const plain = plainConfig(inner);
+      return plain && typeof plain === 'object' ? plain : {};
+    } catch (err) {
+      /* Getter threw; return safe empty object fallback */
       return {};
     }
-  };
-  if (typeof conf.get === 'function') return readRef(conf);
+  }
   try {
     // Config() returns volatile boxes now, so unwrap them; a plain input stays plain.
     return plainConfig(Config(conf));
-  } catch {
-    return plainConfig(conf) && typeof plainConfig(conf) === 'object' ? plainConfig(conf) : {};
+  } catch (err) {
+    /* Schema validation threw; fallback to single-pass unwrapped raw config */
+    const plain = plainConfig(conf);
+    return plain && typeof plain === 'object' ? plain : {};
   }
 }
 
 export function apply(ctx, initialConfig = {}) {
-  const NS = '@goodandready/dsh-dsml-artifact-guard';
   let activeConfig = unwrapConfig(initialConfig);
 
   let getConfig = () => (typeof initialConfig?.get === 'function' ? unwrapConfig(initialConfig) : activeConfig);
@@ -180,25 +182,7 @@ export function apply(ctx, initialConfig = {}) {
   // DSH 0.1.7 SettingsForms: suppress generic duplicate form, custom card mounts in plugins seat
   if (ctx.settings && typeof ctx.settings.configure === 'function') {
     ctx.effect(() => ctx.settings.configure({ auto: false }), 'dsh-dsml-artifact-guard: settings policy');
-  } else if (typeof ctx.inject === 'function') {
-    // Legacy settings service fallback
-    ctx.inject(['settings'], (sctx) => {
-      if (typeof sctx.settings?.register === 'function') {
-        try {
-          const scope = sctx.settings.register(NS, Config, { base: initialConfig });
-          getConfig = () => Config(scope?.get() ?? initialConfig) ?? {};
-          if (typeof scope?.watch === 'function') {
-            sctx.effect(() => scope.watch(() => {
-              activeConfig = getConfig();
-            }));
-          }
-        } catch (err) {
-          /* Legacy settings service registration unavailable */
-        }
-      }
-    });
   }
-
   // Register one-click updater endpoint
   if (ctx.webServer && typeof ctx.webServer.register === 'function') {
     const mountUpdater = () => registerPluginUpdater(ctx, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-dsml-artifact-guard",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Sanitizes leaked DeepSeek DSML closing tags from model text streams",
   "type": "module",
   "main": "lib/index.js",