@hyzyn/dsh-tty 0.27.0 → 0.27.1

package/README.en.md

@@ -872,6 +872,22 @@ ctx.inject(['ttyTerminal'], (c) => {
 - The service name `ttyTerminal` is likewise not declared on the `Context` type surface; inject it as an
   optional dependency; when tty is not installed or is older than 0.14.0 it never fires (dsh-docker degrades
   to “copy command”).
+- **`ttyTerminal` / WS `spawn` is a command surface with no static capability gate** (added 2026-10-07;
+  consumers must not describe it the other way round): this service and the `{t:'spawn'}` frame both accept an
+  arbitrary `command` and are **not governed by any `DSH_*_ALLOW_*`** (this plugin’s own static gate covers only
+  ProxyCommand, the “a config field drives a local command” tier). That is deliberate — the terminal panel *is*
+  the product, and **its permission ceiling rests on the user acting directly**: a human clicks “+” to open a
+  tab and types commands inside it. **Note carefully that the tier gate does not reach here**: the tier gate
+  above hangs on the `tools/pre-execute` waterfall and filters by the `tty_` / `sftp_` / `tunnel_` **prefixes**
+  (`TTY_TIER_PREFIXES`) — i.e. it gates **agent tool calls only**. A browser `spawn` frame or a
+  `ttyTerminal.open` call is a **WS / client-service** path and **never passes through it**. So do not treat it
+  as this command surface’s gate: it does not block a single byte of it (only the `tty_open` agent path is
+  governed).
+  **The cost**: no consumer should advertise “the plugin’s own exec switch” as the boundary that keeps you out of
+  a container — once tty is installed, an in-page script can use `ttyTerminal.open` or a WS `spawn` frame to get
+  an arbitrary command surface strictly stronger than a one-shot exec. See
+  [architecture.md § 7](../../docs/architecture.md#7-一条请求经过什么) for the threat-model boundary; docker states
+  the same boundary in its own README under “Known limitations”.
 
 ### Embedded in-place terminal (`ttyTerminal.mount`, 0.15.0)
 

package/README.md

@@ -791,6 +791,19 @@ ctx.inject(['ttyTerminal'], (c) => {
   只受工具参数的字符串约束。两条通道的入参规则不同，别把这里当 `tty_open` 的限制。
 - 服务名 `ttyTerminal` 同样未声明在 `Context` 类型面上，按可选依赖注入；tty 未安装
   或版本 < 0.14.0 时不会触发（dsh-docker 会退化为「复制命令」）。
+- **`ttyTerminal` / WS `spawn` 是「没有静态能力闸」的命令面**（2026-10-07 补，消费方文案别写反）：
+  本服务与 `{t:'spawn'}` 帧都直接接受任意 `command`，**不受任何 `DSH_*_ALLOW_*` 管辖**（本插件的
+  那个静态闸只覆盖 ProxyCommand 这一档「配置字段驱动本机命令」）。这是刻意的——终端面板本身就是
+  产品，**它的权限上界由用户的直接操作承担**：人点「+」开标签、人在里面敲命令。
+  **务必看清 tier gate 管不到这里**：上面的 tier gate 挂在 `tools/pre-execute` 瀑布上、只按
+  `tty_` / `sftp_` / `tunnel_` **前缀**过滤（`TTY_TIER_PREFIXES`），也就是只闸 **agent 工具调用**；
+  浏览器发来的 `spawn` 帧与 `ttyTerminal.open` 是 **WS / 客户端服务**通道，**完全不经过它**。
+  所以别把它当这条命令面的闸门——它一个字节都不拦（`tty_open` 那条 agent 路径才受它管）。
+  **代价**：任何消费方都不该把「配上 tty 之后本插件自己的 exec 开关」宣传成「进不了容器」的
+  边界——装上 tty 后，页内脚本经 `ttyTerminal.open` 或 WS `spawn` 就能拿到比一次性 exec 更强的
+  任意命令面。威胁模型边界见
+  [architecture.md § 7](../../docs/architecture.md#7-一条请求经过什么)；docker 侧的同一句边界写在
+  它的 README「已知限制」。
 
 ### 就地嵌入终端（`ttyTerminal.mount`，0.15.0）
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-tty",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "DSH Web GUI 的终端面板插件：侧边栏「终端」提供 xterm.js + PTY 全交互终端与 ssh2 原生 SSH 远程连接（连接簿、主机指纹 TOFU、跳板机），支持 tmux 会话持久化、SFTP 文件传输、端口转发与服务器状态条，并向其他插件开放 ttyTerminal / ttyPanel / ttyConnbar 扩展点；Windows 宿主同样可用。",
   "keywords": [
     "dsh",
@@ -52,8 +52,8 @@
     "ws": "^8.18.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2 || ^0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2 || ^0.2.1-alpha.1"
+    "@deepseek-ai/dsh": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2 || ^0.2.0-rc.1 || ^0.2.0-rc.2 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",