@hyzyn/dsh-plugin-kit 0.1.30 → 0.1.31

package/README.en.md

@@ -123,6 +123,7 @@ dsh-plugin-kit is a general-purpose plugin collection for the DeepSeek Harness (
 - **Minimize (state folded into the sidebar entry)**: clicking outside the modal, pressing Esc, or the title-bar “—” collapses the panel while PTY sessions and their output buffers stay alive; the sidebar “Terminal” entry then shows a session-count badge and a status dot, and clicking it brings the panel back. Only the floating bar’s ✕ or the title-bar ✕ really closes it and ends every session.
 - **Supports**: multi-tab sessions (multiple sessions per connection); working directory follows the current session; TERM=xterm-256color injection (TUI apps don’t degrade); automatic reconnect after a drop (session keep-alive + output-buffer replay); SSH agent / key / password auth with `env:VAR` secret references that never touch disk; port-forward tunnels (-L / -R, kept alive by the host); downstream backpressure protection; loopback trust fence; concurrency cap (default 4); settings hot-reload; agent tools (`tty_list` / `tty_capture` / `tty_screen` / `tty_expect` / `tty_send` / `sftp_*` / `tunnel_list`).
 - **Where it is stored**: no config file of its own; configuration lives in the “Settings → Plugins → Terminal Panel” card.
+- **What 0.19.0 fixed**: 48 audited defects — SFTP overwrites now go through a temp part + atomic rename (a failed upload no longer destroys the target), in-flight spawns no longer leave zombie sessions, importing known_hosts no longer raises a false “man-in-the-middle”, plaintext passwords never reach browser storage, force-killing a local PTY no longer crashes the host on Windows, and `tty_capture{last}` / `tty_expect` work again on modern Linux (bash ≥4.4). See `packages/tty/DEFECTS.md` for the list and index.
 - **Note**: resize relies on DSH’s internal terminal-handle shape (known limitation); output is a UTF-8 text stream, so `cat`-ing binary files shows replacement characters. See `packages/tty/README.md` for details.
 
 ![Terminal panel: the sidebar entry opens a multi-tab xterm.js terminal with a compact two-row header (tabs + SSH connection bar)](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-tty.png)

package/README.md

@@ -125,6 +125,7 @@ dsh-plugin-kit 是给 DeepSeek Harness（DSH）Web GUI 用的通用插件集合
 - **最小化（状态并入侧边栏入口）**：点弹窗外空白处、按 Esc 或标题栏「—」把面板收起，PTY 会话与输出缓冲保持存活；侧边栏「终端」入口显示会话数徽标与状态点，点击入口恢复；悬浮条 ✕ / 标题栏 ✕ 才真正关闭并结束全部会话。
 - **支持**：多标签页（单连接多会话）；cwd 跟随当前会话；TERM=xterm-256color 注入（TUI 应用不退化）；断线自动重连（会话保活 + 输出缓冲回放）；SSH agent / 密钥 / 密码认证，`env:VAR` 密钥引用不落盘；端口转发隧道（-L/-R，宿主自持重连）；下行背压保护；loopback 信任围栏；并发上限（默认 4）；配置保存即热生效；agent 工具集（`tty_list` / `tty_capture` / `tty_screen` / `tty_expect` / `tty_send` / `sftp_*` / `tunnel_list`）。
 - **存哪里**：无独立配置文件；配置走「插件配置 → 终端面板」卡片。
+- **0.19.0 修了什么**：48 项审计修复——SFTP 覆盖上传改为临时分片 + 原子 rename（失败不再毁原文件）、断线在途 spawn 不再留僵尸会话、known_hosts 导入不再误报「中间人」、明文口令不再落浏览器存储、Windows 强杀本地 PTY 不再崩宿主、现代 Linux（bash ≥4.4）的 `tty_capture{last}` / `tty_expect` 恢复可用。清单与索引见 `packages/tty/DEFECTS.md`。
 - **注意**：resize 依赖 DSH 内部 terminal handle 结构（已知限制）；输出为 utf8 文本流，`cat` 二进制文件会有替换字符。详细见 `packages/tty/README.md`。
 
 ![终端面板：侧边栏入口打开 xterm.js 多标签终端，紧凑两行头部（标签 + SSH 连接栏）](https://cdn.jsdelivr.net/gh/hyzyn/dsh-plugin-kit@main/docs/dsh-plugin-kit-tty.png)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-plugin-kit",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "type": "module",
   "description": "通用 DSH 插件库（pnpm monorepo）：模板插件、插件开发工具包、一键聚合安装包。根包同时是全家桶 bundle（dsh.bundle.patch），DSH 与插件市场可直接识别安装。",
   "main": "lib/index.js",
@@ -38,16 +38,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@hyzyn/dsh-codegraph": "0.4.1",
-    "@hyzyn/dsh-docker": "0.6.4",
-    "@hyzyn/dsh-env": "0.2.5",
+    "@hyzyn/dsh-codegraph": "0.4.2",
+    "@hyzyn/dsh-docker": "0.7.0",
+    "@hyzyn/dsh-env": "0.2.6",
     "@hyzyn/dsh-kit-settings": "0.1.0",
-    "@hyzyn/dsh-mcp": "0.1.13",
-    "@hyzyn/dsh-profile": "0.1.11",
-    "@hyzyn/dsh-prompt": "0.1.11",
-    "@hyzyn/dsh-rss": "0.3.4",
-    "@hyzyn/dsh-search": "0.3.4",
-    "@hyzyn/dsh-tty": "0.19.0"
+    "@hyzyn/dsh-mcp": "0.1.14",
+    "@hyzyn/dsh-profile": "0.1.12",
+    "@hyzyn/dsh-prompt": "0.1.12",
+    "@hyzyn/dsh-rss": "0.3.5",
+    "@hyzyn/dsh-search": "0.3.5",
+    "@hyzyn/dsh-tty": "0.19.1"
   },
   "scripts": {
     "build": "pnpm -r build",