@hyzyn/dsh-plugin-kit 0.1.17 → 0.1.18

package/README.en.md

@@ -29,35 +29,27 @@ Repo gates: `pnpm typecheck` / `pnpm build` / `pnpm aggregate`.
 
 ## What It Is
 
-dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (DSH) Web GUI: environment variable / secret management, MCP server configuration, Prompt management, Profile management, RSS / news aggregation, global search, Codegraph integration, a terminal panel, and a Docker container panel (containers and images on the local or an SSH host, read-only by default), plus a one-command scaffolding tool for generating new plugins. Everything mounts into `dsh web` through the official profile mechanism, so no DSH source changes are needed. Install the plugins individually, or install everything at once with the aggregate package.
+dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (DSH) Web GUI: MCP server configuration, Profile management, RSS / news aggregation, global search, Codegraph integration, a terminal panel, a Docker container panel (containers and images on the local or an SSH host, read-only by default), environment variable / secret management, and Prompt management, plus a one-command scaffolding tool for generating new plugins. Everything mounts into `dsh web` through the official profile mechanism, so no DSH source changes are needed. Install the plugins individually, or install everything at once with the aggregate package.
 
-![Example of DSH plugin management cards](docs/dsh-plugin-kit-mcp.png)
+![SFTP dual pane: local left / remote right, inline ⇨/⇦ server-side streaming transfer](docs/dsh-plugin-kit-tty-sftp-dual.png)
+
+![Terminal panel: the sidebar entry opens a multi-tab xterm.js terminal](docs/dsh-plugin-kit-tty.png)
 
 | Capability | Stock dsh web | dsh-plugin-kit family |
 | --- | --- | --- |
-| Environment variables | CLI / manual config | Web GUI card, saves directly into `process.env` |
 | MCP servers | Manual patch / CLI | Visual card + connection test + hot reload after saving |
-| Prompt management | Manual config | Visual editing + versioning / A/B testing / export & sharing |
 | Profile management | CLI | Visual create / copy / rename / delete |
 | RSS aggregation | None | Multiple sources + daily “Today’s Worth Reading” digest |
 | Global search | Session titles/content only | Unified sidebar full-text search over historical sessions |
 | Codegraph integration | None | Code-graph card: index status / symbol search / callers-callees-impact / one-click sync-index |
 | Terminal panel | None | Sidebar “Terminal” entry + xterm.js modal: multi-tab real PTY terminal (vim / htop / dev servers), cwd follows session, hot-reload config |
 | Docker container panel | None | Sidebar “Containers” entry + multi-target (local / SSH) container list with search and state filter, start / stop / remove, details, logs, resource usage and images; **read-only by default**, mutations and exec gated behind explicit switches; `docker_*` agent tools |
+| Environment variables | CLI / manual config | Web GUI card, saves directly into `process.env` |
+| Prompt management | Manual config | Visual editing + versioning / A/B testing / export & sharing |
 | Plugin development | Hand-written boilerplate | `pnpm create-plugin` scaffolding + `@hyzyn/dsh-kit` type helpers |
 
 ## Feature Plugins
 
-### Environment Variables / Secrets Management (@hyzyn/dsh-env)
-
-- **What it does**: add, edit, or delete environment variables and secrets in the Web GUI. After saving, they are immediately written into the current process’s `process.env`, so both the host and subsequently started child processes can read them without restarting.
-- **How to use**: open Settings → Plugins → “Environment Variables / Secrets Management” → add a key-value pair → (check “Secret” for sensitive entries to show them as password fields) → save.
-- **Supports**: plain strings; `js:` prefixed expressions (e.g. `js:process.env.API_KEY`); secret marking.
-- **Where it is stored**: the managed block of `~/.dsh/env.yml` (auto-generated; do not edit by hand).
-- **Note**: key names may only contain letters, digits, and underscores, and must not be duplicated.
-
-![Environment variables / secrets management plugin](docs/dsh-plugin-kit-env.png)
-
 ### MCP Server Configuration (@hyzyn/dsh-mcp)
 
 - **What it does**: add MCP servers to DSH. After saving, they hot-load into `mcp__<server name>__<tool name>` tools within 1–2 seconds, so models can call them directly without restarting.
@@ -68,16 +60,6 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 
 ![MCP server configuration plugin](docs/dsh-plugin-kit-mcp.png)
 
-### Prompt Management (@hyzyn/dsh-prompt)
-
-- **What it does**: visually edit systemPrompt. When enabled, its content is injected as a systemPrompt section and takes effect immediately after saving.
-- **How to use**: open Settings → Plugins → “Prompt Management” → create/edit a Prompt (multiple versions can be saved) → enable.
-- **Supports**: version switching/rollback; A/B testing (choose A/B versions for the same Prompt and randomly match them by weight); export JSON/Markdown, one-click copy & share, import from JSON.
-- **Where it is stored**: the managed block of `~/.dsh/prompts.yml`.
-- **Note**: each Prompt must have at least one version, and a single version’s content must be ≤ 500KB.
-
-![Prompt management plugin](docs/dsh-plugin-kit-promat.png)
-
 ### Profile Management (@hyzyn/dsh-profile)
 
 - **What it does**: visually view all DSH profiles under `~/.dsh/profiles`, with create, copy, rename, and delete operations for maintaining multiple DSH environments.
@@ -90,16 +72,6 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 
 ![Example of starting a headless profile from the command line](docs/dsh-plugin-kit-profile-example-headless1.png)
 
-### Global Search (@hyzyn/dsh-search)
-
-- **What it does**: adds a “Global Search” entry to the Web GUI sidebar. Type a keyword to run full-text search over historical sessions and settings panels.
-- **How to use**: after installing, click or focus the global search box below “New Session” in the sidebar → type a keyword → click a session result to open it and try to locate the matching text; click a settings-panel result to jump straight to the corresponding settings card.
-- **Supports**: full-text session search via DSH’s built-in `sessionQuery`; settings-panel search (official panels always searchable, plugin panels filtered dynamically by what is installed); configurable result limits; keyword highlighting in results.
-- **Where it is stored**: no separate config.
-- **Note**: requires the host `sessionQuery` service; if absent, session search returns an empty list. If the `session-query` full-text index is configured with `openAt: "never"`, session search automatically degrades to per-session scanning; session results are filtered to currently visible/jumpable sessions.
-
-![Global search plugin](docs/dsh-plugin-kit-search.png)
-
 ### RSS / News Aggregation (@hyzyn/dsh-rss)
 
 - **What it does**: subscribe to multiple RSS / Atom sources and automatically compile a daily “Today’s Worth Reading” Markdown digest, injected into systemPrompt for the model to reference.
@@ -118,11 +90,24 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 
 ![Query today’s news: ask the model for “Today’s Worth Reading” and it cites the daily digest](docs/dsh-plugin-kit-rss-query-news.png)
 
+### Global Search (@hyzyn/dsh-search)
+
+- **What it does**: adds a “Global Search” entry to the Web GUI sidebar (⌘/Ctrl+K also opens it) that presents a command-palette window: grouped rows for recent sessions, full-text session hits, Prompts, MCP tools, quick actions, and settings sections.
+- **How to use**: click the sidebar search box or press ⌘/Ctrl+K — the palette **opens with content already in it** (recent sessions + quick actions + settings sections, rendered locally with no request); typing filters local candidates instantly while host full-text hits stream in. ↑/↓ select, ↵ opens, esc closes; ⌥1-9 opens the Nth recent session, and ⌥N / ⌥O / ⌥, trigger New session / Open folder / Open settings. Clicking a session result opens it and tries to locate the matching text; Prompt and MCP tool rows jump to their settings cards; settings sections jump to the corresponding section of the settings dialog.
+- **Supports**: full-text session search via DSH’s built-in `sessionQuery` plus instant title candidates from the client session list; settings sections enumerated live from the client slot registry (`settings.section`, so third-party sections such as “Skins” or “Pets” are listed too, in the same order as the settings navigation); Prompts read from the `~/.dsh/prompts.yml` managed block; MCP tools enumerated by the `mcp__` prefix with their server shown; keyword highlighting; configurable result limits.
+- **Where it is stored**: no separate config.
+- **Note**: requires the host `sessionQuery` service; if absent, session search returns an empty list. If the `session-query` full-text index is configured with `openAt: "never"`, session search automatically degrades to per-session scanning; session results are filtered to currently visible/jumpable sessions. “New session” reuses the GUI’s own `uiWorkspace.startSession()`; “Open folder” is hidden when no directory-picker plugin is installed.
+
+![Global search plugin](docs/dsh-plugin-kit-search.png)
+
+![Global search results (recent sessions / session hits / Prompt / MCP tools / settings)](docs/dsh-plugin-kit-search-query.png)
+
 ### Codegraph Integration (@hyzyn/dsh-codegraph)
 
 - **What it does**: code-graph integration — the “Codegraph” card under Settings → Plugins shows index status, symbol search, callers / callees / impact, and one-click sync / index. On install it automatically injects a CodeGraph usage guideline into systemPrompt so the model prefers `codegraph_explore` / `codegraph explore` over grep / read in indexed projects.
 - **How to use**: open Settings → Plugins → “Codegraph” → view index status, search symbols, click a result to inspect source and call chains / impact, or run Sync / rebuild index manually.
 - **Supports**: index status (version, file / symbol / edge counts, last indexed time, pending changes); symbol search with node / callers / callees / impact details; **the default path follows the active session’s workspace directory** (switches when you switch projects; a manual input temporarily overrides it); one-click incremental sync and full rebuild.
+- **MCP integration (on by default)**: DSH’s MCP client does not declare roots, so `codegraph serve --mcp` can only look upward from its working directory for `.codegraph/` — when the host starts in the home directory, `mcp__codegraph__*` calls fail with “No CodeGraph project is loaded”. This plugin manages the codegraph MCP server row in `~/.dsh/cordis.patch.yml` and aligns its cwd with the default project path (the card’s “Set as default project” switches it in one click and the MCP server hot-restarts on save); a row already configured in the MCP card only gets its cwd filled in, other fields are left untouched. Disable with `mcpIntegration: false`.
 - **Where it is stored**: the index lives in the project’s `.codegraph/` directory (created by `codegraph index`); the plugin has no config file of its own.
 - **Note**: the target project needs a Codegraph index first; unindexed projects return guidance to fall back to regular tools. Indexing / rebuilding are local CLI operations that consume real disk and CPU.
 
@@ -130,12 +115,22 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 
 ### Terminal Panel (@hyzyn/dsh-tty)
 
-- **What it does**: adds a “Terminal” entry to the Web GUI sidebar that opens a large modal with an embedded xterm.js interactive terminal (real PTY via node-pty), with multi-tab support, capable of running arbitrary commands and TUI programs (vim / htop / dev servers).
-- **How to use**: install, then restart `dsh web`; click “Terminal” in the sidebar → the first terminal is created automatically (default `$SHELL`) → use “+” in the tab bar to open more tabs and ✕ to close; new tabs default to the current DSH session’s working directory; Ctrl+F searches inside the terminal, and the toolbar offers clear / copy / paste; closing the panel or pressing Esc ends all sessions.
-- **Supports**: multi-tab sessions (multiple sessions per connection, protocol v2 with sid); working directory follows the current session (sessions client service); TERM=xterm-256color injection (via a `-c` wrapper layer so TUI apps don’t degrade); resize passthrough to node-pty’s native API; a WebSocket frame protocol (spawn/input/resize/kill ↔ ready/data/exit/error); downstream backpressure protection; loopback trust fence; concurrency cap (default 4); settings hot-reload (settings/updated); agent tools (tty_list / tty_capture / tty_send, to inspect and interact with long-running processes in the user's terminal).
+- **What it does**: adds a “Terminal” entry to the Web GUI sidebar that opens a large modal with an embedded xterm.js interactive terminal (real PTY via node-pty) and multi-tab support, capable of running arbitrary commands and TUI programs (vim / htop / dev servers). It also does **direct SSH to remote hosts** (connection book / host-key pinning / automatic reconnect / port-forward tunnels) and **SFTP file transfer** — either the single-pane dialog or the “local left / remote right” dual pane, with upload / download / rename / delete.
+- **How to use**: install, then restart `dsh web`; click “Terminal” in the sidebar → the first terminal is created automatically (default `$SHELL`) → use “+” in the tab bar for a new tab (local terminal / SSH connection book / SSH connection…) and ✕ to close; new tabs default to the current DSH session’s working directory; SSH tabs expose SFTP and tunnel entries in their connection bar; Ctrl+F searches inside the terminal, and the toolbar offers clear / copy / paste.
+- **Two SFTP layouts (configurable)**: `dialog` — a single pane with remote directory browsing, multi-select / drag-and-drop upload (recursive folders), download, rename, delete; `dual` — local pane on the left, remote on the right, where the inline `⇨ / ⇦` buttons stream both paths through the host server (recursive folders, same-name overwrite, bytes never pass through the browser).
+- **Minimize (state folded into the sidebar entry)**: clicking outside the modal, pressing Esc, or the title-bar “—” collapses the panel while PTY sessions and their output buffers stay alive; the sidebar “Terminal” entry then shows a session-count badge and a status dot, and clicking it brings the panel back. Only the floating bar’s ✕ or the title-bar ✕ really closes it and ends every session.
+- **Supports**: multi-tab sessions (multiple sessions per connection); working directory follows the current session; TERM=xterm-256color injection (TUI apps don’t degrade); automatic reconnect after a drop (session keep-alive + output-buffer replay); SSH agent / key / password auth with `env:VAR` secret references that never touch disk; port-forward tunnels (-L / -R, kept alive by the host); downstream backpressure protection; loopback trust fence; concurrency cap (default 4); settings hot-reload; agent tools (`tty_list` / `tty_capture` / `tty_screen` / `tty_expect` / `tty_send` / `sftp_*` / `tunnel_list`).
 - **Where it is stored**: no config file of its own; configuration lives in the “Settings → Plugins → Terminal Panel” card.
 - **Note**: resize relies on DSH’s internal terminal-handle shape (known limitation); output is a UTF-8 text stream, so `cat`-ing binary files shows replacement characters. See `packages/tty/README.md` for details.
 
+![Terminal panel: the sidebar entry opens a multi-tab xterm.js terminal with a compact two-row header (tabs + SSH connection bar)](docs/dsh-plugin-kit-tty.png)
+
+![SFTP dual pane: local left / remote right, inline ⇨/⇦ server-side streaming transfer (sftpStyle=dual)](docs/dsh-plugin-kit-tty-sftp-dual.png)
+
+![SFTP single-pane dialog: remote directory browsing with download / rename / delete](docs/dsh-plugin-kit-tty-sftp-dialog.png)
+
+![Terminal panel settings card: shell / TERM / SFTP style / concurrency cap, saved and applied hot](docs/dsh-plugin-kit-tty-setting.png)
+
 ### Docker Container Panel (@hyzyn/dsh-docker)
 
 - **What it does**: adds a “Containers” entry to the Web GUI sidebar for inspecting containers on the **local machine or an SSH host** — list with state / health / ports / compose project, container details, log tails, resource usage, and images. Once you explicitly enable the switches, it can also start / stop / remove containers and run a one-shot `docker exec`.
@@ -148,6 +143,26 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 - **Where it is stored**: the `docker` settings namespace (`~/.dsh/settings.yaml`).
 - **Note**: there is no interactive TTY (exec is a one-shot command; use the terminal panel for `docker exec -it`), no live log streaming, no image delete / pull / build, and no multi-target aggregate view; `docker rm` is issued without `-f`, so removing a running container fails with a “stop it first” hint. See `packages/docker/README.md` for details.
 
+### Environment Variables / Secrets Management (@hyzyn/dsh-env)
+
+- **What it does**: add, edit, or delete environment variables and secrets in the Web GUI. After saving, they are immediately written into the current process’s `process.env`, so both the host and subsequently started child processes can read them without restarting.
+- **How to use**: open Settings → Plugins → “Environment Variables / Secrets Management” → add a key-value pair → (check “Secret” for sensitive entries; secret values are never sent back to the browser, and saving with an empty field keeps the stored value) → save.
+- **Supports**: plain strings; `js:` prefixed expressions (e.g. `js:process.env.API_KEY`); secret values migrate automatically into the official credentials store `.credentials.yaml` (write-only: the API never sends secrets back, env file keeps only the manifest; existing refs are never overwritten — conflicting entries stay in the env file with a warning).
+- **Where it is stored**: the managed block of `~/.dsh/env.yml` (auto-generated; do not edit by hand).
+- **Note**: key names may only contain letters, digits, and underscores, and must not be duplicated.
+
+![Environment variables / secrets management plugin](docs/dsh-plugin-kit-env.png)
+
+### Prompt Management (@hyzyn/dsh-prompt)
+
+- **What it does**: visually edit systemPrompt. When enabled, its content is injected as a systemPrompt section and takes effect immediately after saving.
+- **How to use**: open Settings → Plugins → “Prompt Management” → create/edit a Prompt (multiple versions can be saved) → enable.
+- **Supports**: version switching/rollback; A/B testing (choose A/B versions for the same Prompt and randomly match them by weight); export JSON/Markdown, one-click copy & share, import from JSON.
+- **Where it is stored**: the managed block of `~/.dsh/prompts.yml`.
+- **Note**: each Prompt must have at least one version, and a single version’s content must be ≤ 500KB.
+
+![Prompt management plugin](docs/dsh-plugin-kit-promat.png)
+
 ## Quick Start
 
 ### System Requirements
@@ -313,6 +328,7 @@ A: There may be root-owned files in the local `~/.npm` cache (a historical npm b
 ## Known Limitations
 
 - The managed block in `~/.dsh/cordis.patch.yml` is only for MCP server configuration; manually adding plugin lines can cause `duplicate loader entry id` at startup.
+- Codegraph’s MCP integration only aligns the working directory of the single `codegraph` server; DSH’s MCP client does not declare roots yet, so switching projects means using the card’s “Set as default project” or passing `projectPath` on the tool call.
 - Profile deletion is recursive and irreversible after the in-panel confirmation. The built-in `web` profile is protected; `headless` can be deleted.
 - RSS needs network access on first startup. An unreachable source does not block other sources, but that source may be missing from the day’s digest.
 - The browser half depends on the official `dsh-web-app` settings panel slots service; non-official Web GUIs may not show the management cards.

package/README.md

@@ -31,7 +31,7 @@
 
 ## 是什么
 
-dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合：环境变量 / 密钥管理、MCP 服务器配置、Prompt 管理、Profile 管理、RSS / 新闻聚合、全局搜索、Codegraph 集成、终端面板（本地 + SSH 终端、SFTP 文件传输）、Docker 容器面板（本机 / SSH 主机上的容器与镜像查看，默认只读），外加一条命令生成新插件的开发脚手架。所有插件都走官方 profile 机制挂载到 `dsh web`，不改 DSH 源码；可以逐个安装，也可以用聚合包一次装齐。
+dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合：MCP 服务器配置、Profile 管理、RSS / 新闻聚合、全局搜索、Codegraph 集成、终端面板（本地 + SSH 终端、SFTP 文件传输）、Docker 容器面板（本机 / SSH 主机上的容器与镜像查看，默认只读）、环境变量 / 密钥管理、Prompt 管理，外加一条命令生成新插件的开发脚手架。所有插件都走官方 profile 机制挂载到 `dsh web`，不改 DSH 源码；可以逐个安装，也可以用聚合包一次装齐。
 
 ![SFTP 双栏：左本机 / 右远程，行内直传](docs/dsh-plugin-kit-tty-sftp-dual.png)
 
@@ -39,29 +39,19 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 
 | 能力 | 原生 dsh web | dsh-plugin-kit 全家桶 |
 | --- | --- | --- |
-| 环境变量管理 | 命令行 / 手改配置 | Web GUI 卡片，保存即写入 `process.env` |
 | MCP 服务器 | 手改 patch / 命令行 | 可视化卡片 + 连接测试 + 保存后热加载 |
-| Prompt 管理 | 手改配置 | 可视化编辑 + 版本管理 / A/B 测试 / 导出分享 |
 | Profile 管理 | 命令行 | 可视化创建 / 复制 / 重命名 / 删除 |
 | RSS 聚合 | 无 | 多源订阅 + 每日「今日值得读」自动摘要 |
 | 全局搜索 | 仅会话标题/内容 | 侧边栏统一全文搜索历史会话、Prompt、MCP 工具与设置面板 |
 | Codegraph 集成 | 无 | 代码图谱卡片：索引状态 / 符号搜索 / 调用链 / 影响面 / 一键 sync-index |
 | 终端面板 | 无 | 侧边栏「终端」入口 + xterm.js 多标签真实 PTY 终端（vim/htop/dev server）；SSH 直连远程主机（连接簿、指纹钉扎、断线重连）；**SFTP 文件传输**（单窗体 / 左本机右远程双栏直传、拖拽上传）；agent 配套 `tty_*` / `sftp_*` 工具 |
 | Docker 容器面板 | 无 | 侧边栏「容器」入口 + 多目标（本机 / SSH）容器列表（搜索 / 状态筛选）、启停删、详情、日志、资源占用与镜像；**默认只读**，变更与 exec 需显式开关；agent 配套 `docker_*` 工具 |
+| 环境变量管理 | 命令行 / 手改配置 | Web GUI 卡片，保存即写入 `process.env` |
+| Prompt 管理 | 手改配置 | 可视化编辑 + 版本管理 / A/B 测试 / 导出分享 |
 | 插件开发 | 手写样板 | `pnpm create-plugin` 脚手架 + `@hyzyn/dsh-kit` 类型助手 |
 
 ## 功能插件
 
-### 环境变量 / 密钥管理（@hyzyn/dsh-env）
-
-- **做什么**：在 Web GUI 里增删改环境变量和密钥，保存后立即写入当前进程的 `process.env`，宿主和之后启动的子进程都能读到，无需重启。
-- **怎么用**：打开 设置 → 插件 →「环境变量 / 密钥管理」→ 添加键值 →（敏感条目勾选「密钥」，以密码框显示）→ 保存。
-- **支持**：普通字符串；`js:` 前缀表达式（如 `js:process.env.API_KEY`）；密钥标记。
-- **存哪里**：`~/.dsh/env.yml` 的托管区块（自动生成，请勿手改）。
-- **注意**：键名只允许字母 / 数字 / 下划线，且不能重复。
-
-![环境变量 / 密钥管理插件](docs/dsh-plugin-kit-env.png)
-
 ### MCP 服务器配置（@hyzyn/dsh-mcp）
 
 - **做什么**：给 DSH 添加 MCP 服务器，保存后 1~2 秒内热加载为 `mcp__<服务器名>__<工具名>` 工具，模型即可直接调用，无需重启。
@@ -72,16 +62,6 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 
 ![MCP 服务器配置插件](docs/dsh-plugin-kit-mcp.png)
 
-### Prompt 管理（@hyzyn/dsh-prompt）
-
-- **做什么**：可视化编辑 systemPrompt，启用后其内容作为 systemPrompt section 注入，保存即生效。
-- **怎么用**：打开 设置 → 插件 →「Prompt 管理」→ 新建 / 编辑 Prompt（可保存多个版本）→ 启用。
-- **支持**：版本切换 / 回滚；A/B 测试（为同一 Prompt 选 A/B 两版并按权重随机命中）；导出 JSON / Markdown、一键复制分享、从 JSON 导入。
-- **存哪里**：`~/.dsh/prompts.yml` 的托管区块。
-- **注意**：每个 Prompt 至少一个版本，单版本内容 ≤ 500KB。
-
-![Prompt 管理插件](docs/dsh-plugin-kit-promat.png)
-
 ### Profile 管理（@hyzyn/dsh-profile）
 
 - **做什么**：可视化查看 `~/.dsh/profiles` 下的全部 DSH profile，支持创建、复制、重命名、删除，方便维护多套 DSH 环境。
@@ -94,16 +74,36 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 
 ![命令行启动 headless profile 示例](docs/dsh-plugin-kit-profile-example-headless1.png)
 
+### RSS / 新闻聚合（@hyzyn/dsh-rss）
+
+- **做什么**：订阅多个 RSS / Atom 源，每天自动汇总成一篇「今日值得读」Markdown，并注入 systemPrompt 供模型直接引用。
+- **怎么用**：安装后可在侧边栏「新建会话」下方点击「今日值得读」直接查看新闻；也可打开 设置 → 插件 →「RSS / 新闻聚合」勾选内置渠道、添加自定义渠道（保存时即时校验地址）、从 [awesome-rsshub-routes](https://jackyst0.github.io/awesome-rsshub-routes/) 订阅源目录搜索并一键添加，维护新闻分类与聚合设置，保存后自动刷新。
+- **内置渠道**：阮一峰、少数派、Solidot、Hacker News、掘金、IT之家、36氪（36氪官方 feed 被反爬拦截，内置为第三方 RSSHub 镜像），勾选即展示、取消勾选即不抓取。
+- **自定义渠道**：填写任意 RSS / Atom 地址，保存时真实抓取校验——官网首页、非 feed、抓不到内容的地址会报错且不保存。
+- **订阅源目录**：内置 awesome-rsshub-routes 精选目录（官方 RSS 与 RSSHub 路由，98 条 / 12 分类），可搜索 / 按分类筛选并一键加入自定义渠道；快照随插件内置，运行时每 12 小时从上游 OPML 静默刷新。
+- **新闻分类**：渠道的分类从「新闻分类」列表里选择；digest（Markdown、systemPrompt、弹窗）按分类分组展示，保存时自动把使用中的分类合并进列表。
+- **支持**：RSS 2.0 / Atom 解析、按来源去重、每源条数限制、每日定时生成、启动补生成、自定义输出目录、内置渠道库。
+- **存哪里**：`~/.dsh/rss-digest/YYYY-MM-DD.md`（可用 `DSH_RSS_DIGEST_DIR` 覆盖）。
+- **注意**：首次安装启动时会联网抓取一次；某个源不可达时会在 digest 的「抓取失败」里列出，不影响其它源。
+
+![RSS / 新闻聚合设置卡片](docs/dsh-plugin-kit-rss-setting.png)
+
+![侧边栏「今日值得读」弹窗：按分类分组，来源带「查看更多」直达官网](docs/dsh-plugin-kit-rss-view.png)
+
+![查询今日新闻：向模型提问「今日值得读」直接引用当天 digest](docs/dsh-plugin-kit-rss-query-news.png)
+
 ### 全局搜索（@hyzyn/dsh-search）
 
-- **做什么**：在 Web GUI 侧边栏加一个「全局搜索」入口，输入关键词即可全文搜索历史会话与设置面板。
-- **怎么用**：安装后在侧边栏「新建会话」下方点击 / 聚焦全局搜索框 → 输入关键词 → 点击会话会打开并尝试定位到匹配文字；点击面板条目会直接跳转到对应设置卡片。
-- **支持**：历史会话全文搜索（走 DSH 自带 sessionQuery 索引）；设置面板搜索（官方面板恒可搜，插件面板按已安装动态过滤）；结果数量可配置；结果关键词高亮。
+- **做什么**：在 Web GUI 侧边栏加一个「全局搜索」入口（⌘/Ctrl+K 同样唤出），打开的是命令面板式搜索窗：分组列出最近会话、历史会话全文命中、Prompt、MCP 工具、快捷操作与设置大类。
+- **怎么用**：点侧边栏搜索框或按 ⌘/Ctrl+K 打开——**打开即出内容**（最近会话 + 快捷操作 + 设置大类，零延迟，不发请求）；输入关键词后本地候选即时过滤、宿主全文命中异步补齐。↑↓ 选择、↵ 打开、esc 关闭；⌥1-9 直接打开第 N 条最近会话，⌥N / ⌥O / ⌥, 触发新会话 / 打开文件夹 / 打开设置。点会话会打开并尝试定位到匹配文字；点 Prompt / MCP 工具跳对应设置卡片；点设置大类跳到设置窗对应分区。
+- **支持**：历史会话全文搜索（走 DSH 自带的 sessionQuery 索引）+ 会话标题即时候选；设置大类实时读客户端 slots 注册表（第三方插件注册的「皮肤」「宠物」「侧边卡片」等同样在列，顺序与设置窗导航一致）；Prompt 读 `~/.dsh/prompts.yml` 托管区块；MCP 工具按 `mcp__` 前缀枚举并标注所属 server；结果关键词高亮；结果数量可配置。
 - **存哪里**：无独立配置。
-- **注意**：需要宿主已安装 `sessionQuery` 服务；缺失时会话搜索返回空列表。若 `session-query` 全文索引配置为 `openAt: "never"`，历史会话会自动降级为逐会话扫描；会话结果会过滤为当前可跳转的可见会话。
+- **注意**：需要宿主已安装 `sessionQuery` 服务；缺失时会话搜索返回空列表。若 `session-query` 全文索引配置为 `openAt: "never"`，历史会话会自动降级为逐会话扫描；会话结果会过滤为当前可跳转的可见会话。「新会话」复用 GUI 自己的 `uiWorkspace.startSession()`；「打开文件夹」在未安装目录选择器插件时不出现。
 
 ![全局搜索插件](docs/dsh-plugin-kit-search.png)
 
+![全局搜索的检索结果（最近会话 / 历史会话 / Prompt / MCP 工具 / 设置分组）](docs/dsh-plugin-kit-search-query.png)
+
 ### Codegraph 集成（@hyzyn/dsh-codegraph）
 
 - **做什么**：代码图谱集成——设置 → 插件 里的「Codegraph」卡片提供索引状态、符号搜索、callers / callees / impact 查看和一键 sync / index；安装后自动向 systemPrompt 注入 CodeGraph 使用指引，模型在已索引项目里优先用 `codegraph_explore` / `codegraph explore` 查询代码而不是 grep / read。
@@ -137,30 +137,33 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 
 - **做什么**：在 Web GUI 侧边栏加一个「容器」入口，查看**本机或 SSH 主机**上的容器列表（状态 / 健康 / 端口 / compose 项目）、容器详情、日志尾部、资源占用与镜像列表；显式打开开关后可启停删容器、执行一次性 `docker exec`。
 - **怎么用**：安装后重启 `dsh web`，侧边栏点击「容器」→ 选择目标（本机 / SSH）→ 容器卡片（镜像 / ID / 端口 / 创建 + 图标操作条）支持搜索与状态筛选 → 点卡片进整栏详情（概览 / 日志 / 统计），或直接点卡片上的图标操作条（左侧「终端 / 日志 / 资源占用」只读可用，右侧「启停 / 重启 / 删除」用竖线分隔、需打开「允许变更操作」）；日志页有 LINES / TIMESTAMPS / AUTO REFRESH 工具条、过滤行与按级别着色。设置 → 插件 →「Docker 容器面板」维护目标与开关，保存即热生效。
-- **上下文入口**：装了 tty ≥ 0.15.0 时，卡片第一个图标是「终端」——点击在**面板底部弹出终端抽屉**（tty 的 `ttyTerminal.mount` 就地嵌入），看着日志直接进容器敲命令，面板不收起；tty 为 0.14.0 时退回「新开终端标签 + 收面板」，更旧或未装则退化为复制命令；SSH 标签的连接栏（SFTP 旁）还会出现「容器」按钮——点击直接用当前会话那台主机打开面板，目标由会话隐式决定（注册即显示；按连接簿名 / host:port 在点击时解析目标，没配目标会提示怎么配）。
+- **终端按钮**：装了 tty ≥ 0.15.0 时，卡片第一个图标是「终端」——点击在**面板底部弹出终端抽屉**（tty 的 `ttyTerminal.mount` 就地嵌入），看着日志直接进容器敲命令，面板不收起；tty 为 0.14.0 时退回「新开终端标签 + 收面板」，更旧或未装则退化为复制命令。
+- **上下文入口**：装了 tty ≥ 0.13.0 时，SSH 标签的连接栏（SFTP 旁）会出现「容器」按钮——点击直接用当前会话那台主机打开面板（插件加载期间一直显示；目标在点击时按连接簿名 / `host:port` 解析，没配目标会提示怎么配）。
 - **目标**：`kind=local` 走宿主所在机器的 docker CLI；`kind=ssh` 可直接**引用 tty 连接簿条目名**（数据级复用，tty 零改动；未装 tty 时用内联 host/username），经 ssh2 exec channel 在远端执行，主机指纹 TOFU 钉扎并以 tty 已有记录作种子。
 - **支持**：容器列表（`all` 含已停止）、`docker inspect` 详情、日志（tail / 时间戳 / since）、`docker stats --no-stream` 快照、镜像列表、一次性 exec（返回退出码与 stdout/stderr）；`dockerBin` 可填 `podman`；输出超限自动截断。
 - **安全模型（重点）**：docker socket ≈ 目标主机 root 权限，因此**默认只读**——`allowMutations` 未开启时启停删被拒（HTTP 403，工具不注册），`allowExec` 未开启时 exec 被拒；容器名 / ID 过白名单校验，命令一律 argv 构造 + 单引号转义；密码 / 口令建议 `env:VAR` 引用且永不回传浏览器。
 - **存哪里**：settings 命名空间 `docker`（`~/.dsh/settings.yaml`）。
 - **注意**：没有交互式 TTY（exec 是一次性命令，交互排障请到终端面板跑 `docker exec -it`），没有实时日志流、没有镜像删除 / 拉取 / 构建、没有多目标聚合视图；`docker rm` 不带 `-f`，运行中容器会报错并提示先停止。详细见 `packages/docker/README.md`。
 
-### RSS / 新闻聚合（@hyzyn/dsh-rss）
+### 环境变量 / 密钥管理（@hyzyn/dsh-env）
 
-- **做什么**：订阅多个 RSS / Atom 源，每天自动汇总成一篇「今日值得读」Markdown，并注入 systemPrompt 供模型直接引用。
-- **怎么用**：安装后可在侧边栏「新建会话」下方点击「今日值得读」直接查看新闻；也可打开 设置 → 插件 →「RSS / 新闻聚合」勾选内置渠道、添加自定义渠道（保存时即时校验地址）、从 [awesome-rsshub-routes](https://jackyst0.github.io/awesome-rsshub-routes/) 订阅源目录搜索并一键添加，维护新闻分类与聚合设置，保存后自动刷新。
-- **内置渠道**：阮一峰、少数派、Solidot、Hacker News、掘金、IT之家、36氪（36氪官方 feed 被反爬拦截，内置为第三方 RSSHub 镜像），勾选即展示、取消勾选即不抓取。
-- **自定义渠道**：填写任意 RSS / Atom 地址，保存时真实抓取校验——官网首页、非 feed、抓不到内容的地址会报错且不保存。
-- **订阅源目录**：内置 awesome-rsshub-routes 精选目录（官方 RSS 与 RSSHub 路由，98 条 / 12 分类），可搜索 / 按分类筛选并一键加入自定义渠道；快照随插件内置，运行时每 12 小时从上游 OPML 静默刷新。
-- **新闻分类**：渠道的分类从「新闻分类」列表里选择；digest（Markdown、systemPrompt、弹窗）按分类分组展示，保存时自动把使用中的分类合并进列表。
-- **支持**：RSS 2.0 / Atom 解析、按来源去重、每源条数限制、每日定时生成、启动补生成、自定义输出目录、内置渠道库。
-- **存哪里**：`~/.dsh/rss-digest/YYYY-MM-DD.md`（可用 `DSH_RSS_DIGEST_DIR` 覆盖）。
-- **注意**：首次安装启动时会联网抓取一次；某个源不可达时会在 digest 的「抓取失败」里列出，不影响其它源。
+- **做什么**：在 Web GUI 里增删改环境变量和密钥，保存后立即写入当前进程的 `process.env`，宿主和之后启动的子进程都能读到，无需重启。
+- **怎么用**：打开 设置 → 插件 →「环境变量 / 密钥管理」→ 添加键值 →（敏感条目勾选「密钥」，值不回传浏览器，留空保存＝保持已存值）→ 保存。
+- **支持**：普通字符串；`js:` 前缀表达式（如 `js:process.env.API_KEY`）；密钥值自动迁入官方凭据存储 `.credentials.yaml`（write-only：接口不回明文，env 文件只留清单；refs 已有同名键不覆盖，留文件并提示）。
+- **存哪里**：`~/.dsh/env.yml` 的托管区块（自动生成，请勿手改）。
+- **注意**：键名只允许字母 / 数字 / 下划线，且不能重复。
 
-![RSS / 新闻聚合设置卡片](docs/dsh-plugin-kit-rss-setting.png)
+![环境变量 / 密钥管理插件](docs/dsh-plugin-kit-env.png)
 
-![侧边栏「今日值得读」弹窗：按分类分组，来源带「查看更多」直达官网](docs/dsh-plugin-kit-rss-view.png)
+### Prompt 管理（@hyzyn/dsh-prompt）
 
-![查询今日新闻：向模型提问「今日值得读」直接引用当天 digest](docs/dsh-plugin-kit-rss-query-news.png)
+- **做什么**：可视化编辑 systemPrompt，启用后其内容作为 systemPrompt section 注入，保存即生效。
+- **怎么用**：打开 设置 → 插件 →「Prompt 管理」→ 新建 / 编辑 Prompt（可保存多个版本）→ 启用。
+- **支持**：版本切换 / 回滚；A/B 测试（为同一 Prompt 选 A/B 两版并按权重随机命中）；导出 JSON / Markdown、一键复制分享、从 JSON 导入。
+- **存哪里**：`~/.dsh/prompts.yml` 的托管区块。
+- **注意**：每个 Prompt 至少一个版本，单版本内容 ≤ 500KB。
+
+![Prompt 管理插件](docs/dsh-plugin-kit-promat.png)
 
 ## 快速开始
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-plugin-kit",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "type": "module",
   "description": "通用 DSH 插件库（pnpm monorepo）：模板插件、插件开发工具包、一键聚合安装包。根包同时是全家桶 bundle（dsh.bundle.patch），DSH 与插件市场可直接识别安装。",
   "main": "lib/index.js",
@@ -34,15 +34,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@hyzyn/dsh-codegraph": "0.1.8",
-    "@hyzyn/dsh-docker": "0.3.1",
-    "@hyzyn/dsh-env": "0.1.6",
-    "@hyzyn/dsh-mcp": "0.1.7",
-    "@hyzyn/dsh-profile": "0.1.6",
-    "@hyzyn/dsh-prompt": "0.1.5",
-    "@hyzyn/dsh-rss": "0.1.9",
-    "@hyzyn/dsh-search": "0.1.6",
-    "@hyzyn/dsh-tty": "0.16.0"
+    "@hyzyn/dsh-codegraph": "0.1.9",
+    "@hyzyn/dsh-docker": "0.3.2",
+    "@hyzyn/dsh-env": "0.2.0",
+    "@hyzyn/dsh-mcp": "0.1.8",
+    "@hyzyn/dsh-profile": "0.1.7",
+    "@hyzyn/dsh-prompt": "0.1.6",
+    "@hyzyn/dsh-rss": "0.2.0",
+    "@hyzyn/dsh-search": "0.2.0",
+    "@hyzyn/dsh-tty": "0.16.1"
   },
   "scripts": {
     "build": "pnpm -r build",