@hanamesh/dsh-app-host 0.6.22 → 0.6.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/docs/LIBRARY.md CHANGED
@@ -9,7 +9,7 @@
9
9
  ## 目录源
10
10
 
11
11
  - `library.fixture` 只用于受控验收;内容必须符合 `schemas/catalog-provider-page.schema.json`。
12
- - `library.sources` **未配置**时默认为 HanaMesh 目录源 `https://market.hanamesh.com/catalog-source.json?view=hanamesh`(rc.26;显式 `[]` = 不要来源);可有多项,但浏览时必须恰好启用一项。目录 manifest 接受标准端口 HTTPS;本机回环 127.0.0.1、::1、localhost 另接受任意端口 HTTP(Node URL 解析后精确匹配主机名,安全上下文回环例外)。无凭据/fragment,仅允许可选查询 view=hanamesh;endpoint 和重定向必须保持完整同源(协议、主机、端口),不把主机别名互换。新默认仅在初始 revision=0 且来源为空时播种,已保存旧来源、自定义来源和手动清空列表均不自动改写。
12
+ - `library.sources` **未配置**时默认为 HanaMesh 目录源 `https://market.hanamesh.com/catalog-source.json?view=hanamesh`(rc.26;显式 `[]` = 不要来源);可有多项,但浏览时必须恰好启用一项。目录 manifest 接受标准端口 HTTPS;HTTPS 本机回环 127.0.0.1、::1、localhost 及 *.localhost 可使用任意端口;本机回环 127.0.0.1、::1、localhost 另接受任意端口 HTTP(Node URL 解析后精确匹配主机名,安全上下文回环例外)。无凭据/fragment,仅允许可选查询 view=hanamesh;endpoint 和重定向必须保持完整同源(协议、主机、端口),不把主机别名互换。新默认仅在初始 revision=0 且来源为空时播种,已保存旧来源、自定义来源和手动清空列表均不自动改写。
13
13
  - 请求固定 `Accept: application/json` 与 `Accept-Encoding: identity`;最多三次同源跳转,拒绝压缩响应与超过 2 MiB 的响应。
14
14
  - `categories` 含 `hanamesh-app` 且 `package.registry` 为 `npm` 的条目是应用(安装后读 `app.json`、供给 runtime);其它 `package.registry` 为 `npm` 的条目是插件(rc.28 起同样可装卸,只跑 `dsh plugin add/remove`);无 npm 包的条目(repository-only)只展示。
15
15
 
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "package": {
3
3
  "name": "@hanamesh/dsh-app-host",
4
- "version": "0.6.22",
4
+ "version": "0.6.25",
5
5
  "license": "SEE LICENSE IN LICENSE",
6
6
  "source": "git+https://github.com/yzsnstotz/hanamesh-plugin-app-host.git",
7
7
  "purpose": "Application ownership, view leases, Router forwarding, and application library for official DSH"
@@ -20,107 +20,113 @@
20
20
  "distribution": "bundleDependencies; original LICENSE at node_modules/@hanamesh/lib-provision/LICENSE"
21
21
  },
22
22
  "zod": {
23
- "version": "4.5.4",
23
+ "version": "4.4.3",
24
24
  "license": "MIT",
25
- "source": "https://registry.npmjs.org/zod/-/zod-4.5.4.tgz",
25
+ "source": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
26
26
  "purpose": "Runtime snapshot validation",
27
27
  "usedAs": [
28
28
  "dependencies"
29
29
  ],
30
30
  "specs": {
31
- "dependencies": "4.5.4"
31
+ "dependencies": "4.4.3"
32
32
  }
33
33
  },
34
34
  "@deepseek-ai/cordis": {
35
- "version": "4.0.5-alpha.1",
35
+ "version": "4.1.0",
36
36
  "license": "MIT",
37
- "source": "https://registry.npmjs.org/@deepseek-ai/cordis/-/cordis-4.0.5-alpha.1.tgz",
37
+ "source": "https://registry.npmjs.org/@deepseek-ai/cordis/-/cordis-4.1.0.tgz",
38
38
  "purpose": "Official DSH plugin lifecycle and service container",
39
39
  "usedAs": [
40
40
  "peerDependencies",
41
41
  "devDependencies"
42
42
  ],
43
43
  "specs": {
44
- "peerDependencies": ">=4.0.4 <4.1.0-0 || >=4.0.5-alpha.1 <4.1.0-0",
45
- "devDependencies": "4.0.5-alpha.1"
44
+ "peerDependencies": ">=4.0.4 <4.2.0-0 || >=4.0.5-alpha.1 <4.2.0-0",
45
+ "devDependencies": "4.1.0"
46
46
  }
47
47
  },
48
48
  "@deepseek-ai/dsh-storage-domain": {
49
- "version": "0.2.1-alpha.2",
49
+ "version": "0.2.2-rc.1",
50
50
  "license": "MIT",
51
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-domain/-/dsh-storage-domain-0.2.1-alpha.2.tgz",
51
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-domain/-/dsh-storage-domain-0.2.2-rc.1.tgz",
52
52
  "purpose": "Official DSH persistent storage service",
53
53
  "usedAs": [
54
54
  "peerDependencies",
55
55
  "devDependencies"
56
56
  ],
57
57
  "specs": {
58
- "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
59
- "devDependencies": "0.2.1-alpha.2"
58
+ "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
59
+ "devDependencies": "0.2.2-rc.1"
60
60
  }
61
61
  },
62
62
  "@deepseek-ai/schemastery": {
63
- "version": "3.18.5-alpha.1",
63
+ "version": "3.19.0",
64
64
  "license": "MIT",
65
- "source": "https://registry.npmjs.org/@deepseek-ai/schemastery/-/schemastery-3.18.5-alpha.1.tgz",
65
+ "source": "https://registry.npmjs.org/@deepseek-ai/schemastery/-/schemastery-3.19.0.tgz",
66
66
  "purpose": "Official DSH configuration schema service",
67
67
  "usedAs": [
68
68
  "peerDependencies",
69
69
  "devDependencies"
70
70
  ],
71
71
  "specs": {
72
- "peerDependencies": ">=3.18.4 <3.19.0-0 || >=3.18.5-alpha.1 <3.19.0-0",
73
- "devDependencies": "3.18.5-alpha.1"
72
+ "peerDependencies": ">=3.18.4 <3.20.0-0 || >=3.18.5-alpha.1 <3.20.0-0",
73
+ "devDependencies": "3.19.0"
74
74
  }
75
75
  },
76
76
  "@deepseek-ai/dsh-host-webserver": {
77
- "version": "0.2.1-alpha.2",
77
+ "version": "0.2.2-rc.1",
78
78
  "license": "MIT",
79
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-host-webserver/-/dsh-host-webserver-0.2.1-alpha.2.tgz",
79
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-host-webserver/-/dsh-host-webserver-0.2.2-rc.1.tgz",
80
80
  "purpose": "Official DSH authenticated HTTP route host",
81
81
  "usedAs": [
82
82
  "peerDependencies",
83
83
  "devDependencies"
84
84
  ],
85
85
  "specs": {
86
- "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
87
- "devDependencies": "0.2.1-alpha.2"
86
+ "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
87
+ "devDependencies": "0.2.2-rc.1"
88
88
  }
89
89
  },
90
90
  "@deepseek-ai/dsh-client-connection": {
91
- "version": "0.2.1-alpha.2",
91
+ "version": "0.2.2-rc.1",
92
92
  "license": "MIT",
93
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-connection/-/dsh-client-connection-0.2.1-alpha.2.tgz",
93
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-connection/-/dsh-client-connection-0.2.2-rc.1.tgz",
94
94
  "purpose": "Official DSH client connection service",
95
95
  "usedAs": [
96
- "peerDependencies"
96
+ "peerDependencies",
97
+ "devDependencies"
97
98
  ],
98
99
  "specs": {
99
- "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0"
100
+ "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
101
+ "devDependencies": "0.2.2-rc.1"
100
102
  }
101
103
  },
102
104
  "@deepseek-ai/dsh-client-ui-settings": {
103
- "version": "0.2.1-alpha.2",
105
+ "version": "0.2.2-rc.1",
104
106
  "license": "MIT",
105
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-settings/-/dsh-client-ui-settings-0.2.1-alpha.2.tgz",
107
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-settings/-/dsh-client-ui-settings-0.2.2-rc.1.tgz",
106
108
  "purpose": "Official DSH client settings surface",
107
109
  "usedAs": [
108
- "peerDependencies"
110
+ "peerDependencies",
111
+ "devDependencies"
109
112
  ],
110
113
  "specs": {
111
- "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0"
114
+ "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
115
+ "devDependencies": "0.2.2-rc.1"
112
116
  }
113
117
  },
114
118
  "@deepseek-ai/dsh-client-locale": {
115
- "version": "0.2.1-alpha.2",
119
+ "version": "0.2.2-rc.1",
116
120
  "license": "MIT",
117
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-locale/-/dsh-client-locale-0.2.1-alpha.2.tgz",
121
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-locale/-/dsh-client-locale-0.2.2-rc.1.tgz",
118
122
  "purpose": "Official DSH client localization",
119
123
  "usedAs": [
120
- "peerDependencies"
124
+ "peerDependencies",
125
+ "devDependencies"
121
126
  ],
122
127
  "specs": {
123
- "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0"
128
+ "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
129
+ "devDependencies": "0.2.2-rc.1"
124
130
  }
125
131
  },
126
132
  "react": {
@@ -136,87 +142,87 @@
136
142
  }
137
143
  },
138
144
  "@deepseek-ai/dsh-scope": {
139
- "version": "0.2.1-alpha.2",
145
+ "version": "0.2.2-rc.1",
140
146
  "license": "MIT",
141
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-scope/-/dsh-scope-0.2.1-alpha.2.tgz",
147
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-scope/-/dsh-scope-0.2.2-rc.1.tgz",
142
148
  "purpose": "Build and test fixture for official DSH scopes",
143
149
  "usedAs": [
144
150
  "devDependencies"
145
151
  ],
146
152
  "specs": {
147
- "devDependencies": "0.2.1-alpha.2"
153
+ "devDependencies": "0.2.2-rc.1"
148
154
  }
149
155
  },
150
156
  "@deepseek-ai/dsh-session": {
151
- "version": "0.2.1-alpha.2",
157
+ "version": "0.2.2-rc.1",
152
158
  "license": "MIT",
153
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session/-/dsh-session-0.2.1-alpha.2.tgz",
159
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session/-/dsh-session-0.2.2-rc.1.tgz",
154
160
  "purpose": "Build and test fixture for official DSH sessions",
155
161
  "usedAs": [
156
162
  "devDependencies"
157
163
  ],
158
164
  "specs": {
159
- "devDependencies": "0.2.1-alpha.2"
165
+ "devDependencies": "0.2.2-rc.1"
160
166
  }
161
167
  },
162
168
  "@deepseek-ai/dsh-session-persistence": {
163
- "version": "0.2.1-alpha.2",
169
+ "version": "0.2.2-rc.1",
164
170
  "license": "MIT",
165
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence/-/dsh-session-persistence-0.2.1-alpha.2.tgz",
171
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence/-/dsh-session-persistence-0.2.2-rc.1.tgz",
166
172
  "purpose": "Build and test fixture for official DSH session persistence",
167
173
  "usedAs": [
168
174
  "devDependencies"
169
175
  ],
170
176
  "specs": {
171
- "devDependencies": "0.2.1-alpha.2"
177
+ "devDependencies": "0.2.2-rc.1"
172
178
  }
173
179
  },
174
180
  "@deepseek-ai/dsh-session-persistence-jsonl": {
175
- "version": "0.2.1-alpha.2",
181
+ "version": "0.2.2-rc.1",
176
182
  "license": "MIT",
177
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence-jsonl/-/dsh-session-persistence-jsonl-0.2.1-alpha.2.tgz",
183
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence-jsonl/-/dsh-session-persistence-jsonl-0.2.2-rc.1.tgz",
178
184
  "purpose": "Build and test fixture for official DSH JSONL session persistence",
179
185
  "usedAs": [
180
186
  "devDependencies"
181
187
  ],
182
188
  "specs": {
183
- "devDependencies": "0.2.1-alpha.2"
189
+ "devDependencies": "0.2.2-rc.1"
184
190
  }
185
191
  },
186
192
  "@deepseek-ai/dsh-session-projection": {
187
- "version": "0.2.1-alpha.2",
193
+ "version": "0.2.2-rc.1",
188
194
  "license": "MIT",
189
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-projection/-/dsh-session-projection-0.2.1-alpha.2.tgz",
195
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-projection/-/dsh-session-projection-0.2.2-rc.1.tgz",
190
196
  "purpose": "Build and test fixture for official DSH session projections",
191
197
  "usedAs": [
192
198
  "devDependencies"
193
199
  ],
194
200
  "specs": {
195
- "devDependencies": "0.2.1-alpha.2"
201
+ "devDependencies": "0.2.2-rc.1"
196
202
  }
197
203
  },
198
204
  "@deepseek-ai/dsh-storage": {
199
- "version": "0.2.1-alpha.2",
205
+ "version": "0.2.2-rc.1",
200
206
  "license": "MIT",
201
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage/-/dsh-storage-0.2.1-alpha.2.tgz",
207
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage/-/dsh-storage-0.2.2-rc.1.tgz",
202
208
  "purpose": "Build and test fixture for official DSH storage",
203
209
  "usedAs": [
204
210
  "devDependencies"
205
211
  ],
206
212
  "specs": {
207
- "devDependencies": "0.2.1-alpha.2"
213
+ "devDependencies": "0.2.2-rc.1"
208
214
  }
209
215
  },
210
216
  "@deepseek-ai/dsh-storage-json": {
211
- "version": "0.2.1-alpha.2",
217
+ "version": "0.2.2-rc.1",
212
218
  "license": "MIT",
213
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-json/-/dsh-storage-json-0.2.1-alpha.2.tgz",
219
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-json/-/dsh-storage-json-0.2.2-rc.1.tgz",
214
220
  "purpose": "Build and test fixture for official DSH JSON storage",
215
221
  "usedAs": [
216
222
  "devDependencies"
217
223
  ],
218
224
  "specs": {
219
- "devDependencies": "0.2.1-alpha.2"
225
+ "devDependencies": "0.2.2-rc.1"
220
226
  }
221
227
  },
222
228
  "typescript": {
@@ -262,49 +268,181 @@
262
268
  }
263
269
  },
264
270
  "@deepseek-ai/dsh-client-ui-renderer": {
265
- "version": "0.2.1-alpha.2",
271
+ "version": "0.2.2-rc.1",
266
272
  "license": "MIT",
267
- "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-renderer/-/dsh-client-ui-renderer-0.2.1-alpha.2.tgz",
273
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-renderer/-/dsh-client-ui-renderer-0.2.2-rc.1.tgz",
268
274
  "purpose": "Public DSH renderer slots service; official client placement without client changes",
269
275
  "usedAs": [
270
276
  "peerDependencies",
271
277
  "devDependencies"
272
278
  ],
273
279
  "specs": {
274
- "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
275
- "devDependencies": "0.2.1-alpha.2"
280
+ "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
281
+ "devDependencies": "0.2.2-rc.1"
276
282
  }
277
283
  },
278
284
  "@hanamesh/release-platform-gate": {
279
- "version": "0.1.10",
285
+ "version": "0.1.12",
280
286
  "license": "UNKNOWN: private development tool does not declare a license",
281
- "source": "file:vendor/hanamesh-release-platform-gate-0.1.10.tgz",
282
- "purpose": "Development-only shared immutable platform gate0.1.10; R2 PASS docs cce1576, source C7a39e4e and same reviewed archive SHA; never runtime or bundled",
287
+ "source": "file:vendor/hanamesh-release-platform-gate-0.1.12.tgz",
288
+ "purpose": "Development-only R119b PASS platform closure and explicit installer exit qualification gate; never runtime or bundled",
283
289
  "usedAs": [
284
290
  "devDependencies"
285
291
  ],
286
292
  "specs": {
287
- "devDependencies": "file:vendor/hanamesh-release-platform-gate-0.1.10.tgz"
293
+ "devDependencies": "file:vendor/hanamesh-release-platform-gate-0.1.12.tgz"
288
294
  },
289
- "sourceCommit": "7a39e4e332a2cbb5dcbfddec68383fb5cef39eb8",
290
- "archiveSha256": "71545cbb636d3b1a5e7d9fbba728b16e006b8eaf70bc2540038d077df7263a61",
291
- "reviewDocs": "cce157612b1390b845ccca3f0632247de9fb3229"
295
+ "sourceCommit": "95e54102f9380ea2e8e4d8a2e36eacd387c3f7e7",
296
+ "archiveSha256": "caf78747649b1dd37cbe9ba331351c81f94a48dc9e779aee83c75336140068d1",
297
+ "reviewDocs": "a24716374e2d35b8dfaa21131ae654f8b141ba67"
292
298
  },
293
299
  "@hanamesh/core": {
294
- "version": "0.3.30",
300
+ "version": "0.3.33",
295
301
  "license": "MIT",
296
- "source": "https://registry.npmjs.org/@hanamesh/core/-/core-0.3.30.tgz",
302
+ "source": "file:vendor/hanamesh-core-0.3.33.tgz",
297
303
  "purpose": "Development-only public Core suite declaration and provider-owned install command for clean CI; never runtime or bundled",
298
304
  "usedAs": [
299
305
  "devDependencies"
300
306
  ],
301
307
  "specs": {
302
- "devDependencies": "^0.3.30"
308
+ "devDependencies": "file:vendor/hanamesh-core-0.3.33.tgz"
303
309
  },
304
- "sourceCommit": "11335137f909d28cd5724d6d206b770841ddb653",
305
- "archiveSha256": "6dfa824891aa9115052473e1b27cf87811ff47a757addd812f6d6daf9c35c338",
310
+ "sourceCommit": "969a89a1f7e383fca7d6aefa7f27507d3a1605d5",
311
+ "archiveSha256": "088cf6a7b7575fa1d22116d6af8a6b0312fbbb825c50d9bf38f0447ef36c7c78",
306
312
  "licenseNotice": "MIT License\n\nCopyright (c) 2026 HanaMesh\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
307
313
  "licenseSha256": "cd29e05178eecb3207c494901de7d41785a7b31216e94ab37f3e104e93f3f3b1"
314
+ },
315
+ "@deepseek-ai/cordis-plugin-loader": {
316
+ "version": "1.1.0",
317
+ "license": "MIT",
318
+ "source": "https://registry.npmjs.org/@deepseek-ai/cordis-plugin-loader/-/cordis-plugin-loader-1.1.0.tgz",
319
+ "purpose": "Official host lifecycle development prerequisite",
320
+ "usedAs": [
321
+ "devDependencies"
322
+ ],
323
+ "specs": {
324
+ "devDependencies": "1.1.0"
325
+ }
326
+ },
327
+ "@deepseek-ai/cordis-plugin-include": {
328
+ "version": "1.1.0",
329
+ "license": "MIT",
330
+ "source": "https://registry.npmjs.org/@deepseek-ai/cordis-plugin-include/-/cordis-plugin-include-1.1.0.tgz",
331
+ "purpose": "Official host lifecycle development prerequisite",
332
+ "usedAs": [
333
+ "devDependencies"
334
+ ],
335
+ "specs": {
336
+ "devDependencies": "1.1.0"
337
+ }
338
+ },
339
+ "@deepseek-ai/cordis-plugin-group": {
340
+ "version": "1.1.0",
341
+ "license": "MIT",
342
+ "source": "https://registry.npmjs.org/@deepseek-ai/cordis-plugin-group/-/cordis-plugin-group-1.1.0.tgz",
343
+ "purpose": "Official host lifecycle development prerequisite",
344
+ "usedAs": [
345
+ "devDependencies"
346
+ ],
347
+ "specs": {
348
+ "devDependencies": "1.1.0"
349
+ }
350
+ },
351
+ "@deepseek-ai/dsh-app-boot": {
352
+ "version": "0.2.2-rc.1",
353
+ "license": "MIT",
354
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-app-boot/-/dsh-app-boot-0.2.2-rc.1.tgz",
355
+ "purpose": "Declared public host type/build prerequisite",
356
+ "usedAs": [
357
+ "devDependencies"
358
+ ],
359
+ "specs": {
360
+ "devDependencies": "0.2.2-rc.1"
361
+ }
362
+ },
363
+ "@deepseek-ai/dsh-client-ui-primitives": {
364
+ "version": "0.2.2-rc.1",
365
+ "license": "MIT",
366
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-primitives/-/dsh-client-ui-primitives-0.2.2-rc.1.tgz",
367
+ "purpose": "Declared public host type/build prerequisite",
368
+ "usedAs": [
369
+ "devDependencies"
370
+ ],
371
+ "specs": {
372
+ "devDependencies": "0.2.2-rc.1"
373
+ }
374
+ },
375
+ "@deepseek-ai/dsh-client-ui-sidebar": {
376
+ "version": "0.2.2-rc.1",
377
+ "license": "MIT",
378
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-sidebar/-/dsh-client-ui-sidebar-0.2.2-rc.1.tgz",
379
+ "purpose": "Declared public host type/build prerequisite",
380
+ "usedAs": [
381
+ "devDependencies"
382
+ ],
383
+ "specs": {
384
+ "devDependencies": "0.2.2-rc.1"
385
+ }
386
+ },
387
+ "@deepseek-ai/dsh-typert-protocol": {
388
+ "version": "0.2.2-rc.1",
389
+ "license": "MIT",
390
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-typert-protocol/-/dsh-typert-protocol-0.2.2-rc.1.tgz",
391
+ "purpose": "Declared public host type/build prerequisite",
392
+ "usedAs": [
393
+ "devDependencies"
394
+ ],
395
+ "specs": {
396
+ "devDependencies": "0.2.2-rc.1"
397
+ }
398
+ },
399
+ "@deepseek-ai/dsh-util-file-drag": {
400
+ "version": "0.2.2-rc.1",
401
+ "license": "MIT",
402
+ "source": "https://registry.npmjs.org/@deepseek-ai/dsh-util-file-drag/-/dsh-util-file-drag-0.2.2-rc.1.tgz",
403
+ "purpose": "Declared public host type/build prerequisite",
404
+ "usedAs": [
405
+ "devDependencies"
406
+ ],
407
+ "specs": {
408
+ "devDependencies": "0.2.2-rc.1"
409
+ }
410
+ },
411
+ "@shikijs/langs": {
412
+ "version": "4.4.3",
413
+ "license": "MIT",
414
+ "source": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.4.3.tgz",
415
+ "purpose": "Declared public host type/build prerequisite",
416
+ "usedAs": [
417
+ "devDependencies"
418
+ ],
419
+ "specs": {
420
+ "devDependencies": "4.4.3"
421
+ }
422
+ },
423
+ "@types/node": {
424
+ "version": "24.13.4",
425
+ "license": "MIT",
426
+ "source": "https://registry.npmjs.org/@types/node/-/node-24.13.4.tgz",
427
+ "purpose": "Declared public host type/build prerequisite",
428
+ "usedAs": [
429
+ "devDependencies"
430
+ ],
431
+ "specs": {
432
+ "devDependencies": "24.13.4"
433
+ }
434
+ },
435
+ "@types/js-yaml": {
436
+ "version": "4.0.9",
437
+ "license": "MIT",
438
+ "source": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
439
+ "purpose": "Declared public host type/build prerequisite",
440
+ "usedAs": [
441
+ "devDependencies"
442
+ ],
443
+ "specs": {
444
+ "devDependencies": "4.0.9"
445
+ }
308
446
  }
309
447
  },
310
448
  "downloadedRuntimes": {
package/docs/SECURITY.md CHANGED
@@ -1,3 +1,7 @@
1
+ D3(编排11-09授权):仅公开install-target的有效匿名GET/GET预检对名单外HTTP(S) Origin给精确CORS,披露固定ORIGIN_DENIED与本机拒绝监听存在,不披露客户端能力、安装或允许名单。预检204只使浏览器继续读取拒绝;PNA true响应仅在对应请求头为true时出现。其他接口/Host/凭据/iframe边界不变。详见INSTALL_TARGET.md。
2
+
3
+ 0.6.23:安装状态只在原显式同意之后自动发现当前用户的官方 CLI;不读认证/聊天/配置文件、不修改用户配置。登录 shell 仅输出白名单PATH/管理器/XDG路径的封装JSON,未复制完整环境或模型/API token;正常shell stderr不当失败,插件清单仍要求无stderr。监督器保留管理器PATH及原XDG值/缺省,仅临时工作目录和TMP隔离;CLI 仍限版本与插件/市场只读清单,版本下限和既有 JSON 校验双门。Windows npm shim 解析至具名官方 JS,绝不经 cmd 执行。详见 INSTALLATION_STATUS.md。
4
+
1
5
  0.6.7 installation-status is a separately consented read capability: exact existing loopback Host/approved Origin, credentials omitted, strict POST body before any reader. Core is authoritative; CLI executable/profile/target/budgets are static trusted settings, never browser input. Official list output is whitelisted and no raw paths, unrelated inventory or errors leave the host. A live detached IPC anchor owns cancellation and parent-disconnect group cleanup; no cached installed answer. See INSTALLATION_STATUS.md for exact protocol and scope limits.
2
6
 
3
7
  D-230: failed activation releases only resources acquired by that AppHost activation, including partially registered routes and optional-service listeners. Once-only releases also serve normal Cordis unload. All failed-startup releases are attempted in reverse order; APPHOST_CLEANUP_FAILED names the internal resource without raw errors or credentials, and logger failures cannot replace the original activation error. No authentication, origin, lease, application or browser policy is relaxed.
@@ -89,3 +93,14 @@ B17 候选的套件来源选择仅在 AppHost 自有同源已准入设置端点
89
93
  0.6.16:只消费 DSH 公开源事实和公开排序/后继许可规则,不读 .npmrc、凭据、私有服务字段;配置源与受控 CLI 使用同一选择;null项沿用pnpm自有配置,不显式传registry。30秒上限只用于本次安装前查询,超时终止且不重试;配置源的顺序由 DSH 决定。诊断只投影脱敏的类型/消息/code/cause链及已知CLI字段,同时进既有UI和宿主日志;URL用户信息、全部查询值、Authorization/Cookie、token/secret均删除,限4001字符,不传任意details/stack/响应正文。
90
94
 
91
95
  公开registry规则只从已证明的宿主manager安装位置加载,复用原版本守卫;不安装第二份manager、不复制生产规则、不从任意浏览器路径加载模块。tests/fixtures的原始MIT规则与SHA/许可证只作测试,不进发布包。
96
+
97
+
98
+ ## Local snapshot publication on Windows
99
+
100
+ The optional local `AtomicFileStore` flushes the newly written snapshot file, closes it, then renames it within the same directory on every platform. On Linux and macOS it additionally opens and synchronizes the containing directory before acknowledging publication. Node does not provide the directory-open/fsync operation on Windows, so that extra directory flush is not attempted there. Windows still publishes a complete file image and retains real process-kill/crash-cut checks; this does not promise that the renamed directory entry survives power loss or an OS/storage crash. A file-sync failure is never ignored, and a failure after rename remains `COMMIT_UNCERTAIN`. The normal DSH storage-domain bridge keeps its provider's publication contract.
101
+
102
+
103
+ On Windows the optional Coding OAuth Gateway **file** source remains unreachable: Node's POSIX mode bits cannot establish a private Windows ACL, so AppHost rejects that source before reading its contents. `chmod(0600)` is never treated as ACL proof. The authenticated HTTP provider is the supported alternative; no secret is silently imported from an unverified file.
104
+
105
+
106
+ An explicitly configured existing standalone Node on Windows x64 may be used by the controlled CLI supervisor. It is executed only for the fixed Node probe, with an empty PATH, bounded output and a two-second deadline; the response must match the selected OS/architecture, Node 24 version floor and absence of Electron. That external selection does not enable managed downloads/preparation or owned application launch.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@hanamesh/dsh-app-host",
3
- "version": "0.6.22",
3
+ "version": "0.6.25",
4
4
  "description": "HanaMesh application ownership, durable view leases, and application library for official DSH 0.2.x",
5
5
  "type": "module",
6
6
  "license": "SEE LICENSE IN LICENSE",
@@ -86,8 +86,8 @@
86
86
  "check:devkit-supply": "node scripts/check-devkit-consumption.mjs",
87
87
  "check:provision-supply": "node scripts/check-provision-consumption.mjs",
88
88
  "install:safe": "node scripts/safe-git.mjs pnpm install --frozen-lockfile",
89
- "release:check": "hanamesh-release check --lockfile pnpm-lock.yaml",
90
- "release:publish": "hanamesh-release publish --lockfile pnpm-lock.yaml",
89
+ "release:check": "hanamesh-release check --lockfile pnpm-lock.yaml --installation-targets release/installation-targets.json",
90
+ "release:publish": "hanamesh-release publish --lockfile pnpm-lock.yaml --installation-targets release/installation-targets.json",
91
91
  "prepublishOnly": "hanamesh-release source-guard"
92
92
  },
93
93
  "dsh": {
@@ -107,25 +107,25 @@
107
107
  }
108
108
  },
109
109
  "dependencies": {
110
- "zod": "4.5.4",
110
+ "zod": "4.4.3",
111
111
  "@hanamesh/lib-provision": "^0.2.1",
112
112
  "semver": "7.8.5"
113
113
  },
114
114
  "peerDependencies": {
115
- "@deepseek-ai/cordis": ">=4.0.4 <4.1.0-0 || >=4.0.5-alpha.1 <4.1.0-0",
116
- "@deepseek-ai/dsh-storage-domain": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
117
- "@deepseek-ai/schemastery": ">=3.18.4 <3.19.0-0 || >=3.18.5-alpha.1 <3.19.0-0",
118
- "@deepseek-ai/dsh-host-webserver": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
119
- "@deepseek-ai/dsh-client-connection": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
120
- "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
121
- "@deepseek-ai/dsh-client-ui-settings": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
122
- "@deepseek-ai/dsh-client-locale": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
115
+ "@deepseek-ai/cordis": ">=4.0.4 <4.2.0-0 || >=4.0.5-alpha.1 <4.2.0-0",
116
+ "@deepseek-ai/dsh-storage-domain": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
117
+ "@deepseek-ai/schemastery": ">=3.18.4 <3.20.0-0 || >=3.18.5-alpha.1 <3.20.0-0",
118
+ "@deepseek-ai/dsh-host-webserver": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
119
+ "@deepseek-ai/dsh-client-connection": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
120
+ "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
121
+ "@deepseek-ai/dsh-client-ui-settings": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
122
+ "@deepseek-ai/dsh-client-locale": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
123
123
  "react": "^18.3.1"
124
124
  },
125
125
  "hanamesh": {
126
126
  "module": "app-host",
127
127
  "contractVersion": 1,
128
- "dshTarget": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
128
+ "dshTarget": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0",
129
129
  "upstreamFilesModified": 0,
130
130
  "installTarget": {
131
131
  "contract": "hanamesh.install-target",
@@ -137,22 +137,36 @@
137
137
  }
138
138
  },
139
139
  "devDependencies": {
140
- "@hanamesh/core": "^0.3.30",
141
- "@deepseek-ai/cordis": "4.0.5-alpha.1",
142
- "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.2",
143
- "@deepseek-ai/dsh-scope": "0.2.1-alpha.2",
144
- "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
145
- "@deepseek-ai/dsh-session-persistence": "0.2.1-alpha.2",
146
- "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-alpha.2",
147
- "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
148
- "@deepseek-ai/dsh-storage": "0.2.1-alpha.2",
149
- "@deepseek-ai/dsh-storage-domain": "0.2.1-alpha.2",
150
- "@deepseek-ai/dsh-storage-json": "0.2.1-alpha.2",
151
- "@deepseek-ai/schemastery": "3.18.5-alpha.1",
140
+ "@hanamesh/core": "file:vendor/hanamesh-core-0.3.33.tgz",
141
+ "@deepseek-ai/cordis": "4.1.0",
142
+ "@deepseek-ai/dsh-host-webserver": "0.2.2-rc.1",
143
+ "@deepseek-ai/dsh-scope": "0.2.2-rc.1",
144
+ "@deepseek-ai/dsh-session": "0.2.2-rc.1",
145
+ "@deepseek-ai/dsh-session-persistence": "0.2.2-rc.1",
146
+ "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.2-rc.1",
147
+ "@deepseek-ai/dsh-session-projection": "0.2.2-rc.1",
148
+ "@deepseek-ai/dsh-storage": "0.2.2-rc.1",
149
+ "@deepseek-ai/dsh-storage-domain": "0.2.2-rc.1",
150
+ "@deepseek-ai/dsh-storage-json": "0.2.2-rc.1",
151
+ "@deepseek-ai/schemastery": "3.19.0",
152
152
  "typescript": "5.8.3",
153
153
  "@hanamesh/devkit": "^0.2.6",
154
- "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
155
- "@hanamesh/release-platform-gate": "file:vendor/hanamesh-release-platform-gate-0.1.10.tgz"
154
+ "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-rc.1",
155
+ "@hanamesh/release-platform-gate": "file:vendor/hanamesh-release-platform-gate-0.1.12.tgz",
156
+ "@deepseek-ai/cordis-plugin-loader": "1.1.0",
157
+ "@deepseek-ai/cordis-plugin-include": "1.1.0",
158
+ "@deepseek-ai/cordis-plugin-group": "1.1.0",
159
+ "@deepseek-ai/dsh-client-ui-settings": "0.2.2-rc.1",
160
+ "@deepseek-ai/dsh-client-connection": "0.2.2-rc.1",
161
+ "@deepseek-ai/dsh-app-boot": "0.2.2-rc.1",
162
+ "@deepseek-ai/dsh-client-locale": "0.2.2-rc.1",
163
+ "@deepseek-ai/dsh-client-ui-primitives": "0.2.2-rc.1",
164
+ "@deepseek-ai/dsh-client-ui-sidebar": "0.2.2-rc.1",
165
+ "@deepseek-ai/dsh-typert-protocol": "0.2.2-rc.1",
166
+ "@deepseek-ai/dsh-util-file-drag": "0.2.2-rc.1",
167
+ "@shikijs/langs": "4.4.3",
168
+ "@types/node": "24.13.4",
169
+ "@types/js-yaml": "4.0.9"
156
170
  },
157
171
  "packageManager": "pnpm@10.33.0",
158
172
  "bundleDependencies": [