@hyzyn/dsh-plugin-kit 0.1.19 → 0.1.21

package/README.en.md

@@ -14,7 +14,7 @@
   <img src="https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square" alt="License">
 </p>
 
-Repo gates: `pnpm typecheck` / `pnpm build` / `pnpm aggregate`.
+Repo gates: `pnpm typecheck` / `pnpm build` / `pnpm test` / `pnpm aggregate`.
 
 <p align="center">
   <strong>The plugin family for the DeepSeek Harness (DSH) Web GUI</strong><br>
@@ -39,14 +39,14 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 | --- | --- | --- |
 | MCP servers | Manual patch / CLI | Visual card + connection test + hot reload after saving |
 | Profile management | CLI | Visual create / copy / rename / delete |
-| RSS aggregation | None | Multiple sources + daily “Today’s Worth Reading” digest |
+| RSS aggregation | None | Multiple sources + daily “Today’s Worth Reading” digest + optional AI summaries (follows the host default model, zero config) |
 | Global search | Session titles/content only | Unified sidebar full-text search over historical sessions |
 | Codegraph integration | None | Code-graph card: index status / symbol search / callers-callees-impact / one-click sync-index |
 | Terminal panel | None | Sidebar “Terminal” entry + xterm.js modal: multi-tab real PTY terminal (vim / htop / dev servers), cwd follows session, hot-reload config |
-| Docker container panel | None | Sidebar “Containers” entry + multi-target (local / SSH) container list with search and state filter, start / stop / remove, details, logs, resource usage and images; **read-only by default**, mutations and exec gated behind explicit switches; `docker_*` agent tools |
+| Docker container panel | None | Sidebar “Containers” entry + multi-target (local / SSH) container list with search and state filter, start / stop / remove, details, logs (snapshot + **live follow via SSE**), resource usage (snapshot + **live follow with sparklines**), a **Compose project view with merged logs**, a **read-only multi-target overview**, image list plus details (layers / build history), a **`docker pull` progress stream**, and image remove / dangling prune; **read-only by default**, mutations and exec gated behind explicit switches; `docker_*` agent tools |
 | Environment variables | CLI / manual config | Web GUI card, saves directly into `process.env` |
 | Prompt management | Manual config | Visual editing + versioning / A/B testing / export & sharing |
-| Plugin development | Hand-written boilerplate | `pnpm create-plugin` scaffolding + `@hyzyn/dsh-kit` type helpers |
+| Plugin development | Hand-written boilerplate | `pnpm create-plugin` scaffolding + `@hyzyn/dsh-kit` type helpers and host-side shared utilities (HTTP fence / managed blocks / `!!js` expressions) |
 
 ## Feature Plugins
 
@@ -80,9 +80,10 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 - **Custom channels**: enter any RSS / Atom URL; it is validated with a real fetch on save — homepages, non-feed pages, and empty feeds are rejected with a clear error and not saved.
 - **Source catalog**: ships the awesome-rsshub-routes curated catalog (official RSS and RSSHub routes, 98 feeds / 12 categories), searchable and filterable by category with one-click add to custom channels; bundled snapshot silently refreshes from the upstream OPML every 12 hours at runtime (falling back to the snapshot when offline).
 - **Categories**: a channel’s category is picked from the category list, and the digest (Markdown, systemPrompt, modal) is grouped by category; categories in use are merged into the list automatically on save.
+- **AI summaries (optional)**: once enabled in the card, each digest item gets a one-sentence Chinese summary generated by the host’s configured default model (no API key needed; you can also pair a custom provider / model in the card). Results are cached per item for 30 days so regenerating does not re-bill; a failed item falls back to the truncated original text without blocking the rest. Summaries flow into the Markdown digest, the modal, search, and systemPrompt.
 - **Supports**: RSS 2.0 / Atom parsing, deduplication, per-source item limits, daily scheduled generation, startup catch-up generation, custom output directory, and the built-in channel library.
 - **Where it is stored**: `~/.dsh/rss-digest/YYYY-MM-DD.md` (override with `DSH_RSS_DIGEST_DIR`).
-- **Note**: the first startup will fetch feeds over the network; unreachable sources are listed in the digest’s “fetch failed” section and do not block the remaining sources.
+- **Note**: the first startup will fetch feeds over the network; unreachable sources are listed in the digest’s “fetch failed” section and do not block the remaining sources. With AI summaries enabled, generation time depends on model responses (failed items fall back instead of blocking).
 
 ![RSS / News Aggregation settings card](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-rss-setting.png)
 
@@ -110,6 +111,7 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 - **MCP integration (on by default)**: DSH’s MCP client does not declare roots, so `codegraph serve --mcp` can only look upward from its working directory for `.codegraph/` — when the host starts in the home directory, `mcp__codegraph__*` calls fail with “No CodeGraph project is loaded”. This plugin manages the codegraph MCP server row in `~/.dsh/cordis.patch.yml` and aligns its cwd with the default project path (the card’s “Set as default project” switches it in one click and the MCP server hot-restarts on save); a row already configured in the MCP card only gets its cwd filled in, other fields are left untouched. Disable with `mcpIntegration: false`.
 - **Where it is stored**: the index lives in the project’s `.codegraph/` directory (created by `codegraph index`); the plugin has no config file of its own.
 - **Note**: the target project needs a Codegraph index first; unindexed projects return guidance to fall back to regular tools. Indexing / rebuilding are local CLI operations that consume real disk and CPU.
+- **Compatibility and tuning**: verified end to end on DSH `0.1.5-rc.2` + codegraph CLI `1.5.0` (declares `dsh.engines.dsh: >=0.1.2-rc.1`); the CLI commands and flags used are listed in the package README. For large repositories, raise `indexTimeoutMs` (default 600s; `cliTimeoutMs` covers query commands, default 60s), and enable `indexForce` when the CLI refuses to index a home directory / filesystem root.
 
 ![Codegraph settings card](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-codegraph.png)
 
@@ -133,15 +135,15 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 
 ### Docker Container Panel (@hyzyn/dsh-docker)
 
-- **What it does**: adds a “Containers” entry to the Web GUI sidebar for inspecting containers on the **local machine or an SSH host** — list with state / health / ports / compose project, container details, log tails, resource usage, and images. Once you explicitly enable the switches, it can also start / stop / remove containers and run a one-shot `docker exec`.
+- **What it does**: adds a “Containers” entry to the Web GUI sidebar for inspecting containers on the **local machine or an SSH host** — list with state / health / ports / compose project, a **read-only multi-target overview**, a **Compose project view (project → service → containers, plus project-level merged logs)**, container details, log tails, resource usage (**live follow + mini sparklines**), and images (list plus details: layers / build history). Once you explicitly enable the switches, it can also start / stop / remove containers, pull / remove / prune images, and run a one-shot `docker exec`.
 - **How to use**: install, restart `dsh web`, then click “Containers” in the sidebar → pick a target (local / SSH) → the container list supports search and state filtering → open a card for details / logs / stats, or start / stop / remove (requires “allow mutations”); manage targets and switches under Settings → Plugins → “Docker Container Panel”, saved and applied hot.
 - **Terminal button**: with tty ≥ 0.15.0 installed, the first icon on a card opens an **in-panel terminal drawer** (tty's `ttyTerminal.mount` embeds the terminal in place, so the panel stays open); with tty 0.14.0 it falls back to opening a new terminal tab and closing the panel, and without tty it copies the command `docker exec -it '<container>' sh` (falls back to copying the command when tty's terminal capability is unavailable).
 - **Contextual entry**: with tty ≥ 0.13.0 installed, the SSH tab’s connection bar (next to SFTP) shows a “Containers” button — it opens the panel straight for the host you are connected to (shown whenever the plugin is loaded; the target is resolved at click time by connection-book name or `host:port`, and a missing target shows how to configure it).
 - **Targets**: `kind=local` runs the host machine’s docker CLI; `kind=ssh` can **reference a tty connection-book entry by name** (data-level reuse, tty unchanged; inline host/username when tty is not installed) and runs docker on the remote host over an ssh2 exec channel, with TOFU host-key pinning seeded from tty’s existing records.
-- **Supports**: container list (`all` includes stopped containers), `docker inspect` details, logs (tail / timestamps / since), `docker stats --no-stream` snapshots, image list, and one-shot exec (exit code plus stdout/stderr); `dockerBin` can be set to `podman`; oversized output is truncated.
+- **Supports**: container list (`all` includes stopped containers), `docker inspect` details, logs (tail / timestamps / since), **live log streaming** (a FOLLOW toggle backed by SSE `docker logs --follow`, for both local and SSH targets, with auto-scroll and the same filtering/coloring as the snapshot; switches back to snapshot automatically when the container exits), `docker stats` **snapshots and a live stream** (SSE with a 60-point CPU / memory sparkline; this stream never ends on its own, so the front end closes it), a **Compose project view** (grouped by `composeProject` / `composeService`, with project-level logs merged client-side behind a `[service]` prefix), a **container event activity stream** (SSE `docker events` feeding an "Activity" bar in the list plus a 500 ms debounced list refresh), a **read-only multi-target overview** (one screen for every configured target: count cards plus a table of unhealthy / restarting containers, fetched in parallel with per-target failure tolerance and no cross-target actions), **networks and volumes** (lists plus details: subnets / gateways / attached containers, mountpoints / options / labels; removal and prune require `allowMutations`), plus **ephemeral multi-select merged logs from the container list** (2–8 containers), image list plus **image details** (`docker image inspect` layers / size and `docker history` build steps), a **`docker pull` progress stream** (per-layer, over SSE), image remove / dangling prune (requires `allowMutations`), and one-shot exec (exit code plus stdout/stderr); `dockerBin` can be set to `podman`; oversized output is truncated. All four SSE streams (logs / stats / events / pull) share one `openSseStream` foundation (heartbeat, active-stream registry, disconnect cleanup).
 - **Security model (important)**: the docker socket is equivalent to root on the target host, so the plugin is **read-only by default** — with `allowMutations` off, start / stop / remove are rejected (HTTP 403 and no agent tool registered); with `allowExec` off, exec is rejected. Container names/IDs pass a whitelist check, commands are always built as argv arrays with single-quote escaping, and passwords / passphrases should use `env:VAR` and are never sent back to the browser.
 - **Where it is stored**: the `docker` settings namespace (`~/.dsh/settings.yaml`).
-- **Note**: there is no interactive TTY (exec is a one-shot command; use the terminal panel for `docker exec -it`), no live log streaming, no image delete / pull / build, and no multi-target aggregate view; `docker rm` is issued without `-f`, so removing a running container fails with a “stop it first” hint. See `packages/docker/README.md` for details.
+- **Note**: there is no interactive TTY (exec is a one-shot command; use the terminal panel for `docker exec -it`), streaming exists only in the browser panel (the `docker_logs` / `docker_stats` / `docker_image_pull` agent tools keep snapshot semantics), there is no `docker build` / `save` / `load` / `push`, Compose is a read-only view (no `compose up/down`), and the multi-target overview is a **read-only** summary (there are no cross-target actions; start / stop / remove stay per-target); `docker rm` and `docker image rm` are issued without `-f`, so a running container or a referenced image fails with an explanatory hint. See `packages/docker/README.md` for details.
 
 ### Environment Variables / Secrets Management (@hyzyn/dsh-env)
 
@@ -161,13 +163,14 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 - **Where it is stored**: the managed block of `~/.dsh/prompts.yml`.
 - **Note**: each Prompt must have at least one version, and a single version’s content must be ≤ 500KB.
 
-![Prompt management plugin](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-promat.png)
+![Prompt management plugin](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-prompt.png)
 
 ## Quick Start
 
 ### System Requirements
 
-- DeepSeek Harness installed and `dsh web` starts normally.
+- DeepSeek Harness installed and `dsh web` starts normally. The current verified baseline is DSH `0.1.5-rc.2` (host routes, browser half, systemPrompt injections, and the managed MCP row, end to end).
+- Every installable plugin declares the DSH release line it supports via `dsh.engines.dsh` (this repository uses `>=0.1.2-rc.1` across the board); the plugin market reads it to show compatible / incompatible, and an undeclared package shows as “unknown”. **Only the `>=X.Y.Z[-prerelease]` form is supported**: `^0.1.2`, `~0.1.2` or a two-sided `>=0.1.2-rc.1 <0.2.0` all read as “cannot verify”, and a declared-but-unverifiable requirement fails closed — the update is refused outright, which is worse than declaring nothing. CI enforces this with `node scripts/check-dsh-engines.mjs`.
 - No extra requirements for npm installs; installing from this repository requires Node.js >= 22.19 and pnpm 10.
 
 ### Three-Step Setup
@@ -330,7 +333,7 @@ A: There may be root-owned files in the local `~/.npm` cache (a historical npm b
 - The managed block in `~/.dsh/cordis.patch.yml` is only for MCP server configuration; manually adding plugin lines can cause `duplicate loader entry id` at startup.
 - Codegraph’s MCP integration only aligns the working directory of the single `codegraph` server; DSH’s MCP client does not declare roots yet, so switching projects means using the card’s “Set as default project” or passing `projectPath` on the tool call.
 - Profile deletion is recursive and irreversible after the in-panel confirmation. The built-in `web` profile is protected; `headless` can be deleted.
-- RSS needs network access on first startup. An unreachable source does not block other sources, but that source may be missing from the day’s digest.
+- RSS needs network access on first startup. An unreachable source does not block other sources, but that source may be missing from the day’s digest. AI summaries require a model configured on the host (`agent-default-model`, or a provider/model pair set in the card); when none is configured or a call fails, items fall back to the truncated original text.
 - The browser half depends on the official `dsh-web-app` settings panel slots service; non-official Web GUIs may not show the management cards.
 - The terminal panel (dsh-tty) resize passthrough relies on DSH’s internal terminal-handle shape, and TERM injection needs the `-c` wrapper layer (DSH hard-codes node-pty `name:"dumb"`); see `packages/tty/README.md`.
 - Installing from the repository requires Node.js >= 22.19 and pnpm 10; it is for development/debugging only. npm installs are not affected.
@@ -339,7 +342,7 @@ A: There may be root-owned files in the local `~/.npm` cache (a historical npm b
 
 - Generate new plugins with the scaffolding command: `pnpm create-plugin <name> [id]`, instead of writing boilerplate by hand.
 - Follow Conventional Commits for commit messages (e.g. `fix(mcp): fix connection test timeout`). For user-visible changes, please include screenshots or verification evidence.
-- Run the gates before submitting: `pnpm typecheck && pnpm build && pnpm aggregate`.
+- Run the gates before submitting: `pnpm typecheck && pnpm build && pnpm test && pnpm aggregate`.
 - After adding or removing plugins, run `pnpm aggregate` to regenerate the `packages/all` manifest.
 
 ## License

package/README.md

@@ -16,7 +16,7 @@
   <img src="https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square" alt="License">
 </p>
 
-仓库门禁：`pnpm typecheck` / `pnpm build` / `pnpm aggregate`。
+仓库门禁：`pnpm typecheck` / `pnpm build` / `pnpm test` / `pnpm aggregate`。
 
 <p align="center">
   <strong>DeepSeek Harness（DSH）Web GUI 的插件全家桶</strong><br>
@@ -41,14 +41,14 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 | --- | --- | --- |
 | MCP 服务器 | 手改 patch / 命令行 | 可视化卡片 + 连接测试 + 保存后热加载 |
 | Profile 管理 | 命令行 | 可视化创建 / 复制 / 重命名 / 删除 |
-| RSS 聚合 | 无 | 多源订阅 + 每日「今日值得读」自动摘要 |
+| RSS 聚合 | 无 | 多源订阅 + 每日「今日值得读」+ 可选 AI 摘要（跟随宿主默认模型，零配置） |
 | 全局搜索 | 仅会话标题/内容 | 侧边栏统一全文搜索历史会话、Prompt、MCP 工具与设置面板 |
 | Codegraph 集成 | 无 | 代码图谱卡片：索引状态 / 符号搜索 / 调用链 / 影响面 / 一键 sync-index |
 | 终端面板 | 无 | 侧边栏「终端」入口 + xterm.js 多标签真实 PTY 终端（vim/htop/dev server）；SSH 直连远程主机（连接簿、指纹钉扎、断线重连）；**SFTP 文件传输**（单窗体 / 左本机右远程双栏直传、拖拽上传）；agent 配套 `tty_*` / `sftp_*` 工具 |
-| Docker 容器面板 | 无 | 侧边栏「容器」入口 + 多目标（本机 / SSH）容器列表（搜索 / 状态筛选）、启停删、详情、日志、资源占用与镜像；**默认只读**，变更与 exec 需显式开关；agent 配套 `docker_*` 工具 |
+| Docker 容器面板 | 无 | 侧边栏「容器」入口 + 多目标（本机 / SSH）容器列表（搜索 / 状态筛选）、启停删、详情、日志（快照 + **SSE 实时跟随**）、资源占用（快照 + **实时跟随 + sparkline**）、**多目标总览（只读）**、**Compose 项目视图 + 项目级聚合日志**、镜像列表与详情（层 / 构建历史）、**`docker pull` 进度流**、删除 / dangling 清理；**默认只读**，变更与 exec 需显式开关；agent 配套 `docker_*` 工具 |
 | 环境变量管理 | 命令行 / 手改配置 | Web GUI 卡片，保存即写入 `process.env` |
 | Prompt 管理 | 手改配置 | 可视化编辑 + 版本管理 / A/B 测试 / 导出分享 |
-| 插件开发 | 手写样板 | `pnpm create-plugin` 脚手架 + `@hyzyn/dsh-kit` 类型助手 |
+| 插件开发 | 手写样板 | `pnpm create-plugin` 脚手架 + `@hyzyn/dsh-kit` 类型助手与宿主半体共享工具库（HTTP 围栏 / 托管区块 / !!js 表达式） |
 
 ## 功能插件
 
@@ -82,9 +82,10 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 - **自定义渠道**：填写任意 RSS / Atom 地址，保存时真实抓取校验——官网首页、非 feed、抓不到内容的地址会报错且不保存。
 - **订阅源目录**：内置 awesome-rsshub-routes 精选目录（官方 RSS 与 RSSHub 路由，98 条 / 12 分类），可搜索 / 按分类筛选并一键加入自定义渠道；快照随插件内置，运行时每 12 小时从上游 OPML 静默刷新。
 - **新闻分类**：渠道的分类从「新闻分类」列表里选择；digest（Markdown、systemPrompt、弹窗）按分类分组展示，保存时自动把使用中的分类合并进列表。
+- **AI 摘要（可选）**：卡片里开启后，每天 digest 的条目由宿主已配置的默认模型各生成一句中文摘要（无需填 API key；也可在卡片里成对指定 provider/model 用别的模型）。结果按条目缓存 30 天，重复生成不重复计费；单条失败自动回落原文截断，不影响其它条目。摘要同时进 Markdown、弹窗、搜索与 systemPrompt。
 - **支持**：RSS 2.0 / Atom 解析、按来源去重、每源条数限制、每日定时生成、启动补生成、自定义输出目录、内置渠道库。
 - **存哪里**：`~/.dsh/rss-digest/YYYY-MM-DD.md`（可用 `DSH_RSS_DIGEST_DIR` 覆盖）。
-- **注意**：首次安装启动时会联网抓取一次；某个源不可达时会在 digest 的「抓取失败」里列出，不影响其它源。
+- **注意**：首次安装启动时会联网抓取一次；某个源不可达时会在 digest 的「抓取失败」里列出，不影响其它源。AI 摘要开启时生成耗时取决于模型响应（失败条目回落，不会卡死生成）。
 
 ![RSS / 新闻聚合设置卡片](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-rss-setting.png)
 
@@ -112,6 +113,7 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 - **MCP 托管（默认开）**：DSH 的 MCP 客户端不声明 roots，`codegraph serve --mcp` 只能从工作目录向上找 `.codegraph/`——宿主若从家目录启动，模型调用 `mcp__codegraph__*` 会拿到 "No CodeGraph project is loaded"。本插件自动在 `~/.dsh/cordis.patch.yml` 托管 codegraph MCP 服务器行并把 cwd 对齐默认项目路径（卡片「设为默认项目」一键切换，保存即热重启 MCP 服务器）；已在 MCP 卡片配置过的行只补 cwd 不动其它字段。可用 `mcpIntegration: false` 关闭。
 - **存哪里**：索引在项目 `.codegraph/` 目录（由 `codegraph index` 生成）；默认项目路径持久化在 settings 命名空间 `codegraph`。
 - **注意**：查询目标项目需要先有 Codegraph 索引；未索引项目会返回指引改用常规工具。索引 / 重建为本地 CLI 操作，消耗真实磁盘与 CPU。一台 codegraph MCP 服务器同一时刻只挂载一个默认项目，其它已索引项目可在工具调用里传 `projectPath` 查询。
+- **兼容与调优**：已在 DSH `0.1.5-rc.2` + codegraph CLI `1.5.0` 上实测（声明 `dsh.engines.dsh: >=0.1.2-rc.1`）；CLI 命令与旗标见包内 README。大仓库全量重建可调 `indexTimeoutMs`（默认 600s，查询档 `cliTimeoutMs` 默认 60s），CLI 拒绝索引家目录 / 文件系统根时开 `indexForce`。
 
 ![Codegraph 设置卡片](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-codegraph.png)
 
@@ -135,15 +137,16 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 
 ### Docker 容器面板（@hyzyn/dsh-docker）
 
-- **做什么**：在 Web GUI 侧边栏加一个「容器」入口，查看**本机或 SSH 主机**上的容器列表（状态 / 健康 / 端口 / compose 项目）、容器详情、日志尾部、资源占用与镜像列表；显式打开开关后可启停删容器、执行一次性 `docker exec`。
-- **怎么用**：安装后重启 `dsh web`，侧边栏点击「容器」→ 选择目标（本机 / SSH）→ 容器卡片（镜像 / ID / 端口 / 创建 + 图标操作条）支持搜索与状态筛选 → 点卡片进整栏详情（概览 / 日志 / 统计），或直接点卡片上的图标操作条（左侧「终端 / 日志 / 资源占用」只读可用，右侧「启停 / 重启 / 删除」用竖线分隔、需打开「允许变更操作」）；日志页有 LINES / TIMESTAMPS / AUTO REFRESH 工具条、过滤行与按级别着色。设置 → 插件 →「Docker 容器面板」维护目标与开关，保存即热生效。
+- **做什么**：在 Web GUI 侧边栏加一个「容器」入口，查看**本机或 SSH 主机**上的容器列表（状态 / 健康 / 端口 / compose 项目）、**Compose 项目视图（项目 → 服务 → 容器 + 项目级聚合日志）**、容器详情、日志尾部、资源占用（**实时跟随 + 迷你趋势图**）、**多目标总览**（一屏汇总全部目标的容器计数与异常容器）与镜像（列表 + 详情：层 / 构建历史）；显式打开开关后可启停删容器、拉取 / 删除 / 清理镜像、执行一次性 `docker exec`。
+- **怎么用**：安装后重启 `dsh web`，侧边栏点击「容器」→ 选择目标（本机 / SSH）→ 工具条三段切换「容器 / 镜像 / Compose」：容器卡片（镜像 / ID / 端口 / 创建 + 图标操作条）支持搜索与状态筛选，点卡片进整栏详情（概览 / 日志 / 统计，统计页有 **FOLLOW 实时跟随 + 迷你趋势图**），日志页有 LINES / TIMESTAMPS / AUTO REFRESH / **FOLLOW（实时跟随）** 工具条与过滤行；镜像页每行可看**详情（层 / 构建历史）**、删除，工具条有**拉取镜像（图标，SSE 逐层进度）**与「清理 dangling」；Compose 页按项目分组，点进项目看服务表或**项目级聚合日志**（客户端按 `[service]` 前缀混流）。设置 → 插件 →「Docker 容器面板」维护目标与开关，保存即热生效。
 - **终端按钮**：装了 tty ≥ 0.15.0 时，卡片第一个图标是「终端」——点击在**面板底部弹出终端抽屉**（tty 的 `ttyTerminal.mount` 就地嵌入），看着日志直接进容器敲命令，面板不收起；tty 为 0.14.0 时退回「新开终端标签 + 收面板」，更旧或未装则退化为复制命令。
 - **上下文入口**：装了 tty ≥ 0.13.0 时，SSH 标签的连接栏（SFTP 旁）会出现「容器」按钮——点击直接用当前会话那台主机打开面板（插件加载期间一直显示；目标在点击时按连接簿名 / `host:port` 解析，没配目标会提示怎么配）。
 - **目标**：`kind=local` 走宿主所在机器的 docker CLI；`kind=ssh` 可直接**引用 tty 连接簿条目名**（数据级复用，tty 零改动；未装 tty 时用内联 host/username），经 ssh2 exec channel 在远端执行，主机指纹 TOFU 钉扎并以 tty 已有记录作种子。
-- **支持**：容器列表（`all` 含已停止）、`docker inspect` 详情、日志（tail / 时间戳 / since）、`docker stats --no-stream` 快照、镜像列表、一次性 exec（返回退出码与 stdout/stderr）；`dockerBin` 可填 `podman`；输出超限自动截断。
+- **跨目标与需关注**：总览页一屏汇总全部目标（计数卡 + 跨目标异常表，单目标失败不影响其余）；「需关注」口径覆盖不健康 / 反复重启 / **被 OOM 杀** / 非零退出 / 僵死，agent 侧 `docker_attention` 与 `docker_ps target:'*'` 同样支持跨目标聚合。
+- **支持**：容器列表（`all` 含已停止）、`docker inspect` 详情、日志（tail / 时间戳 / since）、**实时日志流**（FOLLOW 开关走 SSE `docker logs --follow`，本地与 SSH 目标都支持，自动滚动 / 过滤着色与快照共用，容器退出自动切回快照）、`docker stats` **快照 + 实时流**（SSE，60 点 sparkline 看 CPU / 内存趋势；这条流不会自然结束，前端主动断）、**Compose 项目视图**（按 `composeProject` / `composeService` 分组，项目级聚合日志在客户端按 `[service]` 前缀混流）、**容器事件活动流**（SSE `docker events` → 列表头部「活动」条 + 500ms 防抖刷新容器列表）、**网络与卷**（列表 + 详情：子网 / 网关 / 接入容器、挂载点 / 选项 / 标签；删除与 prune 需 `allowMutations`）、**多目标总览**（不选目标一屏看全部主机：计数卡 + 异常容器置顶表；并行取数、单目标失败只影响自己那一格；只读、无跨目标操作）、以及**容器列表多选的临时聚合日志**（勾 2~8 个容器即开混流）、镜像列表 + **镜像详情**（`docker image inspect` 的层 / 大小 + `docker history` 构建历史）、**`docker pull` 进度流**（SSE 逐层）、镜像删除 / dangling 清理（需 `allowMutations`）、一次性 exec（返回退出码与 stdout/stderr）；`dockerBin` 可填 `podman`；输出超限自动截断。四条 SSE 长流（日志 / 统计 / 事件 / 拉取）共用同一份 `openSseStream` 基建（心跳 / 活跃流登记 / 断开清理）。
 - **安全模型（重点）**：docker socket ≈ 目标主机 root 权限，因此**默认只读**——`allowMutations` 未开启时启停删被拒（HTTP 403，工具不注册），`allowExec` 未开启时 exec 被拒；容器名 / ID 过白名单校验，命令一律 argv 构造 + 单引号转义；密码 / 口令建议 `env:VAR` 引用且永不回传浏览器。
 - **存哪里**：settings 命名空间 `docker`（`~/.dsh/settings.yaml`）。
-- **注意**：没有交互式 TTY（exec 是一次性命令，交互排障请到终端面板跑 `docker exec -it`），没有实时日志流、没有镜像删除 / 拉取 / 构建、没有多目标聚合视图；`docker rm` 不带 `-f`，运行中容器会报错并提示先停止。详细见 `packages/docker/README.md`。
+- **注意**：没有交互式 TTY（exec 是一次性命令，交互排障请到终端面板跑 `docker exec -it`），流式能力只在浏览器面板里（agent 的 `docker_logs` / `docker_stats` / `docker_image_pull` 保持快照语义），没有 `docker build` / `save` / `load` / `push`，Compose 是只读视图（不提供 `compose up/down`），多目标总览是**只读**汇总（没有跨目标操作，启停删仍需逐目标）；`docker rm` 与 `docker image rm` 都不带 `-f`，运行中容器 / 被引用的镜像会报错并给出提示。详细见 `packages/docker/README.md`。
 
 ### 环境变量 / 密钥管理（@hyzyn/dsh-env）
 
@@ -163,13 +166,14 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 - **存哪里**：`~/.dsh/prompts.yml` 的托管区块。
 - **注意**：每个 Prompt 至少一个版本，单版本内容 ≤ 500KB。
 
-![Prompt 管理插件](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-promat.png)
+![Prompt 管理插件](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-prompt.png)
 
 ## 快速开始
 
 ### 系统要求
 
-- 已安装 DeepSeek Harness，`dsh web` 可正常启动。
+- 已安装 DeepSeek Harness，`dsh web` 可正常启动。当前实测基线为 DSH `0.1.5-rc.2`（宿主路由、浏览器半体、systemPrompt 注入、MCP 托管行全链路）。
+- 每个可安装插件都在 `dsh.engines.dsh` 声明支持的 DSH 版本线（本仓库统一 `>=0.1.2-rc.1`），插件市场据此显示兼容 / 不兼容；未声明的包显示为「未知」。**只支持 `>=X.Y.Z[-预发布]` 一种形式**：`^0.1.2`、`~0.1.2`、两段式 `>=0.1.2-rc.1 <0.2.0` 都会被判成「无法验证」，而已声明却无法验证是 fail-closed——更新会被直接拦下，比不声明更糟。CI 跑 `node scripts/check-dsh-engines.mjs` 兜底。
 - npm 安装方式无额外要求；从仓库安装需要 Node.js >= 22.19 与 pnpm 10。
 
 ### 三步上手
@@ -331,7 +335,7 @@ A: 本机 `~/.npm` 缓存存在 root-owned 文件（历史 npm bug），执行 `
 - MCP 的 `~/.dsh/cordis.patch.yml` 里托管区块只应放服务器配置；手工追加插件行会导致 `duplicate loader entry id` 启动失败。
 - Codegraph 的 MCP 托管只对齐 codegraph 一个服务器的工作目录；DSH 的 MCP 客户端暂不声明 roots，切换项目需在 Codegraph 卡片「设为默认项目」或调用工具时传 `projectPath`。
 - Profile 删除为递归删除，面板内会二次确认，但一旦执行不可撤销；内置 `web` profile 受保护，`headless` 可删。
-- RSS 首次启动需要联网抓取；某个源不可达不会阻塞其它源，但当天 digest 可能缺少该源内容。
+- RSS 首次启动需要联网抓取；某个源不可达不会阻塞其它源，但当天 digest 可能缺少该源内容。AI 摘要依赖宿主已配置的模型（`agent-default-model` 或卡片里成对指定的 provider/model），未配置或调用失败时条目回落原文截断。
 - 浏览器半体依赖官方 `dsh-web-app` 的设置面板 slots 服务，非官方 Web GUI 可能不显示管理卡片。
 - 终端面板（dsh-tty）的 resize 透传依赖 DSH 内部 terminal handle 结构，TERM 注入需经 `-c` 包装层（DSH 硬编码 node-pty name:"dumb"）；详见 `packages/tty/README.md`。
 - 仓库安装需要 Node.js >= 22.19 与 pnpm 10，仅供开发调试；npm 安装不受影响。
@@ -340,7 +344,7 @@ A: 本机 `~/.npm` 缓存存在 root-owned 文件（历史 npm bug），执行 `
 
 - 新插件用脚手架生成：`pnpm create-plugin <name> [id]`，避免手写样板。
 - 提交信息遵循 Conventional Commits（如 `fix(mcp): 修复连接测试超时`），用户可见变更请附截图或验证证据。
-- 提交前过门禁：`pnpm typecheck && pnpm build && pnpm aggregate`。
+- 提交前过门禁：`pnpm typecheck && pnpm build && pnpm test && pnpm aggregate`。
 - 增删插件后记得跑 `pnpm aggregate` 重新生成 `packages/all` 聚合清单。
 
 ## 许可证

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-plugin-kit",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "description": "通用 DSH 插件库（pnpm monorepo）：模板插件、插件开发工具包、一键聚合安装包。根包同时是全家桶 bundle（dsh.bundle.patch），DSH 与插件市场可直接识别安装。",
   "main": "lib/index.js",
@@ -11,10 +11,14 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "engines": {
+      "dsh": ">=0.1.2-rc.1"
     }
   },
   "devDependencies": {
-    "typescript": "~5.9.3"
+    "typescript": "~5.9.3",
+    "vitest": "^3.2.7"
   },
   "license": "Apache-2.0",
   "repository": {
@@ -34,19 +38,21 @@
     "access": "public"
   },
   "dependencies": {
-    "@hyzyn/dsh-codegraph": "0.1.10",
-    "@hyzyn/dsh-docker": "0.3.3",
-    "@hyzyn/dsh-env": "0.2.1",
-    "@hyzyn/dsh-mcp": "0.1.9",
-    "@hyzyn/dsh-profile": "0.1.7",
-    "@hyzyn/dsh-prompt": "0.1.7",
-    "@hyzyn/dsh-rss": "0.2.0",
-    "@hyzyn/dsh-search": "0.2.0",
-    "@hyzyn/dsh-tty": "0.16.2"
+    "@hyzyn/dsh-codegraph": "0.2.1",
+    "@hyzyn/dsh-docker": "0.5.0",
+    "@hyzyn/dsh-env": "0.2.3",
+    "@hyzyn/dsh-mcp": "0.1.10",
+    "@hyzyn/dsh-profile": "0.1.8",
+    "@hyzyn/dsh-prompt": "0.1.9",
+    "@hyzyn/dsh-rss": "0.3.1",
+    "@hyzyn/dsh-search": "0.3.1",
+    "@hyzyn/dsh-tty": "0.17.1"
   },
   "scripts": {
     "build": "pnpm -r build",
     "typecheck": "pnpm -r typecheck",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "create-plugin": "node scripts/create-plugin.mjs",
     "aggregate": "node scripts/aggregate.mjs"
   }