@jayyuen66/dsh-ocr-review 0.1.3 → 0.1.4-rc.1

package/README.md

@@ -20,7 +20,7 @@ English · [中文](README.zh-CN.md)
 - Platforms: macOS and Linux are the targets. Process reaping (the reaper guard around `ocr_review` / `ocr_scan`) depends on a POSIX toolchain - bash traps and job control plus the process-group semantics of `ps` / `pgrep` / `kill`. None of that exists on Windows, so the package runs the bare command there (guarded by `process.platform`): no reaping, but it still works. The cost is that a hard host exit can leave an orphaned OCR process.
 - The provider list and the key status come from the official host channels `ctx.settings.describe()` (the `value.providers` of the `llm-pi-ai` entry) and `ctx.credentials`.
 - When either is missing the card shows the degradation reason while tools and settings keep working.
-- The host must be `>=0.2.0-rc.2`: declared in `peerDependencies` (the host checks it on plugin install from 0.1.7-rc; alpha.1 has no such gate yet) and in `engines.dsh` (same value, read by nothing).
+- The host must be `>= 0.2.1-alpha.1`: declared in `peerDependencies` (the host checks it on plugin install from 0.1.7-rc; alpha.1 has no such gate yet) and in `engines.dsh` (same value, read by nothing).
 
 ## Installation
 
@@ -30,7 +30,10 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
 
 - The packages are on the public npm registry, so installation needs no credentials.
 - The published files are only `host.js`, `client.js`, `cordis.patch.yml` and `scripts` (`prepack` rebuilds both bundles); source repository: see `repository.url` in package.json.
-- Runtime value dependencies are `@jayyuen66/dsh-plugin-shared`, `@deepseek-ai/schemastery` (the host's fork of schemastery — only it implements the 0.1.7 `.volatile()` resolution) and `js-yaml` (the last one used only by `scripts/get-cred.mjs`).
+- No `@deepseek-ai/*` goes in `dependencies`, and that is not a style preference. Consumers of this package are dsh plugins installed into a profile (`nodeLinker: hoisted`, `autoInstallPeers: false`), so any host package listed under `dependencies` is written into that profile as a **real directory**, coexisting with the copy the host process already loaded. `@deepseek-ai/dsh-tools` keys its `TOOL_RUNTIME_SCHEDULER` with a plain `Symbol` (not `Symbol.for`), so symbol identity is per module instance: the host's `dsh-agent-loop` reads a `ToolRuntime` mounted from the duplicate using its own copy's symbol, gets `undefined`, and **every native tool call throws** `Cannot read properties of undefined (reading 'prepare')` — the whole profile loses its tools. This package's build, typecheck and tests all stay green right up to that point, so `test/publish-manifest.test.ts` pins the invariant in the manifest instead.
+- The four host packages this bundle imports as **values** are required (non-optional) `peerDependencies`: `@deepseek-ai/schemastery` (the host's fork of schemastery — only it implements the 0.1.7 `.volatile()` resolution), `@deepseek-ai/dsh-credentials`, `@deepseek-ai/dsh-home-paths` and `@deepseek-ai/dsh-atomic-write`. The host provides them at runtime, and a profile installs no peers, so no duplicate appears. `build-host.mjs` externalizes `dependencies`, `peerDependencies` *and* `optionalDependencies`, so `host.js` keeps the bare specifiers unchanged.
+- Those four are repeated in `devDependencies` — that is what lets this repository's own typecheck, build and tests resolve them. Every other `@deepseek-ai/*` is type-only (erased at build, no specifier left in `host.js`) and stays in `devDependencies` alone.
+- What is left in `dependencies` is genuinely this package's own runtime code: `@jayyuen66/dsh-plugin-shared` and `js-yaml` (the last one used only by `scripts/get-cred.mjs`).
 
 ## pnpm blocks the dependency script on install (ERR_PNPM_IGNORED_BUILDS)
 

package/README.zh-CN.md

@@ -19,7 +19,7 @@
 - 平台：目标平台是 macOS / Linux。进程收割（`ocr_review` / `ocr_scan` 的 reaper 守护）依赖 POSIX 工具链——bash 的 trap 与作业控制，加上 `ps` / `pgrep` / `kill` 的进程组语义。Windows 上这层整体缺席，本包按 `process.platform` 直接放行裸命令（不收割但能跑）；代价是宿主硬退出后 OCR 可能留下孤儿进程。
 - provider 清单与 key 状态走宿主官方通道 `ctx.settings.describe()`（`llm-pi-ai` 那条的 `value.providers`）与 `ctx.credentials`。
 - 两者缺席时卡片显示降级原因，工具与设置照常可用。
-- 宿主版本要求 `>=0.2.0-rc.2`：写在 `peerDependencies`（0.1.7-rc 起宿主装插件时校验它；alpha.1 还没有这道门）与 `engines.dsh`（同值、无人读）。
+- 宿主版本要求 `>= 0.2.1-alpha.1`：写在 `peerDependencies`（0.1.7-rc 起宿主装插件时校验它；alpha.1 还没有这道门）与 `engines.dsh`（同值、无人读）。
 
 ## 安装
 
@@ -56,7 +56,10 @@ allowBuilds:
 **关于这个 postinstall：** 它在正常路径下什么都不做。平台二进制由上游的 `optionalDependencies`（`@alibaba-group/ocr-<os>-<arch>`，各自带 `os` / `cpu` 字段，pnpm 只装匹配当前平台的那个）提供，`install.js` 检测到就打印 `Binary provided by platform package, skipping download.` 后直接返回。实测放行与不放行都能让 `ocr` 正常执行，差别只是要不要在安装期跑那段脚本——它只在平台包装不上时才下载兜底，而在 pnpm 下平台包必然装得上。
 
 如果你更希望完全不执行安装期脚本，可以写 `'@alibaba-group/open-code-review': false`：`ocr` 同样可用（launcher 直接从平台包目录取二进制），但宿主 `readPendingBuilds()` 只认值为 `set this to true or false` 的条目，改成 `false` 后官方审批流程就不再能代为授权，只能手工维护。
-- 运行期值依赖 `@jayyuen66/dsh-plugin-shared`、`@deepseek-ai/schemastery`（宿主 fork 的 schemastery，0.1.7 的 `.volatile()` 解析只在它有实现）与 `js-yaml`（后者只被 `scripts/get-cred.mjs` 用）。
+- `dependencies` 里不放任何 `@deepseek-ai/*`，这不是风格偏好。本包的消费方是 dsh 插件，被装进 profile（`nodeLinker: hoisted`、`autoInstallPeers: false`），只要宿主包出现在 `dependencies`，pnpm 就会把它在那颗 profile 里落成**真实目录**，与宿主进程已经加载的那份并存。而 `@deepseek-ai/dsh-tools` 的 `TOOL_RUNTIME_SCHEDULER` 是普通 `Symbol`（不是 `Symbol.for`），符号身份按模块实例计算——宿主 `dsh-agent-loop` 拿自己那份的 Symbol 去读由副本挂载出来的 `ToolRuntime`，得到 `undefined`，于是**每一次原生工具调用都抛** `Cannot read properties of undefined (reading 'prepare')`，整个 profile 的工具一起失效。本包的构建、类型检查与测试在这之前全部照绿，所以判据只能由 `test/publish-manifest.test.ts` 落在 manifest 面。
+- 产物里以**值**导入的四枚宿主包是非 optional 的 `peerDependencies`：`@deepseek-ai/schemastery`（宿主 fork 的 schemastery，0.1.7 的 `.volatile()` 解析只在它有实现）、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write`。运行期由宿主在场提供，而 profile 不装 peer，所以不产生副本；`build-host.mjs` 对 `dependencies`、`peerDependencies` 与 `optionalDependencies` 三张表一律外部化，`host.js` 里的裸说明符因此一字不变。
+- 这四枚同时另列一份进 `devDependencies`——那才是本包自己的 typecheck、build、test 解析得到它们的方式。其余 `@deepseek-ai/*` 全是 type-only（构建即擦除，`host.js` 里不留说明符），只留在 `devDependencies`。
+- `dependencies` 剩下的确实是本包自己的运行期代码：`@jayyuen66/dsh-plugin-shared` 与 `js-yaml`（后者只被 `scripts/get-cred.mjs` 用）。
 
 ## 在 dsh 里启用
 

package/client.js

@@ -1,16 +1,17 @@
 // GENERATED by buildClient() in build-client.mjs — edit src/client-entry.ts, then run `node build-client.mjs`.
 window.__ModuleLoader__.load({
-  id: '@jayyuen66/dsh-ocr-review',
+  id: "@jayyuen66/dsh-ocr-review",
   factory: (require) => {
-    var module = { exports: {} };
-    var exports = module.exports;
+    'use strict';
+    const module = { exports: {} };
+    let exports = module.exports;
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let react = require("react");
 //#region src/ui-messages.ts
 const UI_MESSAGES = {
 	zh: {
 		cardTitle: "open-code-review 代码审查",
-		cardDescription: "ocr 工具配置：选择 provider/model 应用到 OCR（key 走 api_key_cmd 动态读取，不落明文）+ 审查参数设置",
+		cardDescription: "ocr 工具配置：选择 provider/model 应用到 OCR（应用后 key 由 api_key_cmd 动态读取，不再写入明文）+ 审查参数设置",
 		statusReadOnly: "当前作用域只读",
 		statusDirty: "有未保存的修改，点「保存」生效",
 		statusClean: "无未保存的修改",
@@ -18,6 +19,7 @@ const UI_MESSAGES = {
 		saving: "保存中…",
 		revert: "撤销",
 		saveFailed: "保存失败：",
+		saveRefused: "未写入（宿主拒收或跳过）：{fields}",
 		loadProvidersFailed: "加载 providers 失败：{error}（端点未就绪？重启 dsh 后重试）",
 		loadingProviders: "加载 providers…",
 		noKeySuffix: "（未配置 key）",
@@ -68,7 +70,7 @@ const UI_MESSAGES = {
 	},
 	en: {
 		cardTitle: "open-code-review code review",
-		cardDescription: "ocr tool setup: pick a provider/model and apply it to OCR (keys are read dynamically via api_key_cmd, never stored in plain text) + review parameters",
+		cardDescription: "ocr tool setup: pick a provider/model and apply it to OCR (once applied, keys are read dynamically via api_key_cmd and no longer written in plain text) + review parameters",
 		statusReadOnly: "This scope is read-only",
 		statusDirty: "Unsaved changes — press Save to apply",
 		statusClean: "No unsaved changes",
@@ -76,6 +78,7 @@ const UI_MESSAGES = {
 		saving: "Saving…",
 		revert: "Revert",
 		saveFailed: "save failed: ",
+		saveRefused: "not written (host refused or skipped): {fields}",
 		loadProvidersFailed: "failed to load providers: {error} (endpoint not ready? restart dsh and retry)",
 		loadingProviders: "loading providers…",
 		noKeySuffix: " (no key configured)",
@@ -126,14 +129,12 @@ const UI_MESSAGES = {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@jayyuen66+dsh-plugin-shared@0.1.0_@deepseek-ai+cordis@4.0.4_eslint-plugin-sonarjs@4.2._a5b0027b68963132c312048d042510c0/node_modules/@jayyuen66/dsh-plugin-shared/dist/record.js
-/** 对象类型守卫：非 `null` 的 `object` 且非数组（`Record` 索引签名投影的基础）。 */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+//#region node_modules/.pnpm/@jayyuen66+dsh-plugin-shared@0.1.3_@deepseek-ai+cordis@4.0.5-alpha.1_@deepseek-ai+dsh-c_6c028874c2202469b2088f67c885abe7/node_modules/@jayyuen66/dsh-plugin-shared/dist/record.js
+function e(e) {
+	return typeof e == `object` && !!e && !Array.isArray(e);
 }
-/** 从 `unknown` 投影单个字段；非 `Record` → `undefined`。 */
-function fieldOf(value, key) {
-	return isRecord(value) ? value[key] : void 0;
+function t(t, n) {
+	return e(t) ? t[n] : void 0;
 }
 //#endregion
 //#region src/client-entry.ts
@@ -176,43 +177,43 @@ function errorSummary(error) {
 }
 function modelOf(raw) {
 	return {
-		id: strOf(fieldOf(raw, "id")),
-		name: strOf(fieldOf(raw, "name"))
+		id: strOf(t(raw, "id")),
+		name: strOf(t(raw, "name"))
 	};
 }
 function providerOf(raw) {
-	const modelsArr = fieldOf(raw, "models");
+	const modelsArr = t(raw, "models");
 	const models = Array.isArray(modelsArr) ? modelsArr.map((item) => modelOf(item)) : [];
-	const apiKeyEnvRaw = fieldOf(raw, "apiKeyEnv");
+	const apiKeyEnvRaw = t(raw, "apiKeyEnv");
 	return {
-		name: strOf(fieldOf(raw, "name")),
-		displayName: strOf(fieldOf(raw, "displayName")),
+		name: strOf(t(raw, "name")),
+		displayName: strOf(t(raw, "displayName")),
 		apiKeyEnv: typeof apiKeyEnvRaw === "string" ? apiKeyEnvRaw : null,
-		baseURL: strOf(fieldOf(raw, "baseURL")),
+		baseURL: strOf(t(raw, "baseURL")),
 		models,
-		hasKey: fieldOf(raw, "hasKey") === true
+		hasKey: t(raw, "hasKey") === true
 	};
 }
 function providersPayloadOf(json) {
-	const providersArr = fieldOf(json, "providers");
+	const providersArr = t(json, "providers");
 	const providers = Array.isArray(providersArr) ? providersArr.map((item) => providerOf(item)) : [];
-	const currentRaw = fieldOf(json, "current");
+	const currentRaw = t(json, "current");
 	const current = {
-		provider: strOf(fieldOf(currentRaw, "provider")),
-		model: strOf(fieldOf(currentRaw, "model")),
-		keyIsDynamic: fieldOf(currentRaw, "keyIsDynamic") === true,
-		url: strOf(fieldOf(currentRaw, "url"))
+		provider: strOf(t(currentRaw, "provider")),
+		model: strOf(t(currentRaw, "model")),
+		keyIsDynamic: t(currentRaw, "keyIsDynamic") === true,
+		url: strOf(t(currentRaw, "url"))
 	};
-	const sourceRaw = fieldOf(json, "source");
+	const sourceRaw = t(json, "source");
 	return {
 		providers,
 		current,
-		getCredReady: fieldOf(json, "getCredReady") === true,
+		getCredReady: t(json, "getCredReady") === true,
 		source: {
-			status: strOf(fieldOf(sourceRaw, "status")),
-			message: strOf(fieldOf(sourceRaw, "message"))
+			status: strOf(t(sourceRaw, "status")),
+			message: strOf(t(sourceRaw, "message"))
 		},
-		csrf: strOf(fieldOf(json, "csrf"))
+		csrf: strOf(t(json, "csrf"))
 	};
 }
 /** 三行表单控件（数字/文本/下拉）共用的类名 = CARD_CSS 里 `.ocr-select{…}` 那条规则。
@@ -361,7 +362,7 @@ function OcrPluginCard(props) {
 		}
 	}, headRow, chevron);
 	const body = open ? (0, react.createElement)("div", { className: "ocr-card-body" }, children) : null;
-	return (0, react.createElement)("li", { className: `ocr-card${open ? " ocr-card-open" : ""}` }, header, body);
+	return (0, react.createElement)("div", { className: `ocr-card${open ? " ocr-card-open" : ""}` }, header, body);
 }
 /** 整数数字输入行（保存条模式：合法输入上报草稿，不直写）。 */
 function NumberRow(props) {
@@ -698,7 +699,7 @@ async function refreshProviders(sinks) {
 	try {
 		const res = await fetch(PROVIDERS_URL, { headers: { accept: "application/json" } });
 		if (!res.ok) {
-			const detail = strOf(fieldOf(await res.json().catch(() => ({})), "error"));
+			const detail = strOf(t(await res.json().catch(() => ({})), "error"));
 			throw new Error(detail === "" ? `HTTP ${res.status}` : detail);
 		}
 		const payload = providersPayloadOf(await res.json());
@@ -729,11 +730,11 @@ async function postWithCsrf(url, body, deps) {
 }
 /** POST select：把选中的 provider/model 写进 OCR 配置，回执里按 autoVerify 决定是否带 llm test。 */
 async function runApplySelection(deps) {
-	const { t, effectiveProvider, effectiveModel } = deps;
+	const { t: t$1, effectiveProvider, effectiveModel } = deps;
 	if (!effectiveProvider || !effectiveModel) {
 		deps.setActionMsg({
 			ok: false,
-			text: t("pickProviderModel")
+			text: t$1("pickProviderModel")
 		});
 		return;
 	}
@@ -744,14 +745,14 @@ async function runApplySelection(deps) {
 			provider: effectiveProvider,
 			model: effectiveModel
 		}))).json();
-		if (fieldOf(selJson, "ok") === true) {
+		if (t(selJson, "ok") === true) {
 			let testText;
-			const llmTestRaw = fieldOf(selJson, "llmTest");
-			if (isRecord(llmTestRaw)) {
-				const testOutput = strOf(fieldOf(llmTestRaw, "output")).slice(0, 400);
-				testText = fieldOf(llmTestRaw, "ok") === true ? t("llmTestPassed") : `${t("llmTestFailed")}${testOutput}`;
-			} else testText = t("notVerified");
-			const appliedText = t("applied", {
+			const llmTestRaw = t(selJson, "llmTest");
+			if (e(llmTestRaw)) {
+				const testOutput = strOf(t(llmTestRaw, "output")).slice(0, 400);
+				testText = t(llmTestRaw, "ok") === true ? t$1("llmTestPassed") : `${t$1("llmTestFailed")}${testOutput}`;
+			} else testText = t$1("notVerified");
+			const appliedText = t$1("applied", {
 				provider: effectiveProvider,
 				model: effectiveModel,
 				test: testText
@@ -762,14 +763,14 @@ async function runApplySelection(deps) {
 			});
 			deps.refresh();
 		} else {
-			const failure = strOf(fieldOf(selJson, "error"));
+			const failure = strOf(t(selJson, "error"));
 			deps.setActionMsg({
 				ok: false,
-				text: failure === "" ? t("applyFailed") : failure
+				text: failure === "" ? t$1("applyFailed") : failure
 			});
 		}
 	} catch (error) {
-		const failedText = `${t("requestFailed")}${errorSummary(error)}`;
+		const failedText = `${t$1("requestFailed")}${errorSummary(error)}`;
 		deps.setActionMsg({
 			ok: false,
 			text: failedText
@@ -780,24 +781,24 @@ async function runApplySelection(deps) {
 }
 /** POST migrate：明文 api_key 一键迁到 api_key_cmd，回执把迁移/跳过两个名单拼成一行。 */
 async function runMigrateKeys(deps) {
-	const { t } = deps;
+	const { t: t$2 } = deps;
 	deps.setBusy(true);
 	deps.setActionMsg(null);
 	try {
 		const json = await (await deps.post(MIGRATE_URL)).json();
-		const migratedVal = fieldOf(json, "migrated");
-		const skippedVal = fieldOf(json, "skippedUnknown");
+		const migratedVal = t(json, "migrated");
+		const skippedVal = t(json, "skippedUnknown");
 		const migrated = Array.isArray(migratedVal) ? migratedVal.filter((item) => typeof item === "string") : [];
 		const skipped = Array.isArray(skippedVal) ? skippedVal.filter((item) => typeof item === "string") : [];
-		const ok = fieldOf(json, "ok") === true;
-		const head = ok ? (migrated.length > 0 ? t("migratedPrefix") + migrated.join(", ") : t("noPlainKey")) + (skipped.length > 0 ? t("skippedPrefix") + skipped.join(", ") : "") : t("migrateFailed");
+		const ok = t(json, "ok") === true;
+		const head = ok ? (migrated.length > 0 ? t$2("migratedPrefix") + migrated.join(", ") : t$2("noPlainKey")) + (skipped.length > 0 ? t$2("skippedPrefix") + skipped.join(", ") : "") : t$2("migrateFailed");
 		deps.setActionMsg({
 			ok,
 			text: head
 		});
 		deps.refresh();
 	} catch (error) {
-		const failedText = `${t("requestFailed")}${errorSummary(error)}`;
+		const failedText = `${t$2("requestFailed")}${errorSummary(error)}`;
 		deps.setActionMsg({
 			ok: false,
 			text: failedText
@@ -808,19 +809,19 @@ async function runMigrateKeys(deps) {
 }
 /** POST test：手动触发 ocr llm test，输出原样回显在动作条上。 */
 async function runTestConnection(deps) {
-	const { t } = deps;
+	const { t: t$3 } = deps;
 	deps.setBusy(true);
 	deps.setActionMsg(null);
 	try {
 		const json = await (await deps.post(TEST_URL)).json();
-		const ok = fieldOf(json, "ok") === true;
-		const testOutput = strOf(fieldOf(json, "output"));
+		const ok = t(json, "ok") === true;
+		const testOutput = strOf(t(json, "output"));
 		deps.setActionMsg({
 			ok,
-			text: (ok ? t("llmTestPassed") : t("llmTestFailed")) + testOutput
+			text: (ok ? t$3("llmTestPassed") : t$3("llmTestFailed")) + testOutput
 		});
 	} catch (error) {
-		const failedText = `${t("requestFailed")}${errorSummary(error)}`;
+		const failedText = `${t$3("requestFailed")}${errorSummary(error)}`;
 		deps.setActionMsg({
 			ok: false,
 			text: failedText
@@ -829,7 +830,10 @@ async function runTestConnection(deps) {
 		deps.setBusy(false);
 	}
 }
-/** 只写差异字段：touched 值为 undefined → 写 null（= 清回 schema 默认）。 */
+/** 只写差异字段：touched 值为 undefined → 写 null（= 清回 schema 默认）。
+*  受理位必须回来：`set` 回 `false` 表示宿主拒收或跳过了这次写入（值没落盘），
+*  这时不能清 touched、也不能报成功——否则用户看到「已保存」而配置原封未动。
+*  传输失败仍以 rejection 表达。 */
 async function saveSettingsDraft(deps) {
 	const { t, value, touched } = deps;
 	const keys = diffTouched(touched, value);
@@ -838,11 +842,16 @@ async function saveSettingsDraft(deps) {
 	deps.setSaveError(null);
 	const ops = keys.map(async (field) => {
 		const draft = touched[field];
-		await deps.set(field, draft === void 0 ? null : draft);
+		return deps.set(field, draft === void 0 ? null : draft);
 	});
 	try {
-		await Promise.all(ops);
+		const settled = await Promise.all(ops);
 		deps.setSettingsBusy(false);
+		const refused = keys.filter((_field, index) => settled[index] !== true);
+		if (refused.length > 0) {
+			deps.setSaveError(t("saveRefused", { fields: refused.join(", ") }));
+			return;
+		}
 		deps.setTouched({});
 	} catch (error) {
 		deps.setSettingsBusy(false);
@@ -1014,13 +1023,7 @@ function apply(ctx) {
 			inject: () => ({
 				t,
 				hooks: { card: store },
-				set: async (field, value) => {
-					try {
-						await scope.set(field, value);
-					} catch (error) {
-						console.error(`[ocr-review-card] set ${field} failed:`, error);
-					}
-				}
+				set: (field, value) => scope.set(field, value)
 			})
 		}, OcrCard);
 	});

package/cordis.patch.yml

@@ -1,4 +1,4 @@
-# ocr-review（2026-09-14）：open-code-review 工作区审查插件（bundle）。
+# ocr-review：open-code-review 工作区审查插件（bundle）。
 # 双面包机制：本包含 Host 半（host.ts：5 个工具 ocr_review/ocr_scan/
 # ocr_delegate_preview/ocr_delegate_rule/ocr_session + settings namespace「ocr-review」+
 # webServer 配置端点）与 Client 半（src/client-entry.ts → client.js：设置卡片，