@khorsheed/dsh-inline-html-render 0.1.14 → 0.1.16

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # 变更记录
 
+## 0.1.16（2026-10-22）
+
+- **技能卡来源归一为包全名**：随包注册的两个作者 skill（`inline-html-card`、`3d-artifact`）的 `provider` 从裸词 `inline-html-render` 改为 `@khorsheed/dsh-inline-html-render`——能力目录的技能卡与其他插件一样显示包全名；行为与 skill 内容不变
+- 适配宿主 0.2.1 线：退役 invariant 伴生并声明 `engines.dsh`（`>=0.1.2-rc.1 <0.3.0-0`）；peer 区间加 `|| ^0.2.1-rc.1`（严格解析路径下 `^0.2.0-rc.1` 不覆盖 0.2.1）；verifiedHost 前移 0.2.1-rc.1
+
+## 0.1.15（2026-09-30）
+
+无功能变更。加宽 `@deepseek-ai/dsh-*` peer 区间以覆盖宿主 0.2.0（0.2.0 的兼容闸会禁用 peer 区间不覆盖宿主版本的已装插件）。
+
 ## 0.1.14（2026-09-27）
 
 - **修复 rc.1 宿主上卡片不再渲染**:rc.1 的 `CodeToolbar` 对 shiki 不认得的 fence 语言一律显示宿主本地化的通用标签(「代码块」),`dsh-card` 信息串完全不进 DOM(无 `.infostring`、无前导文本、无 `language-*` 类)。检测新增内容签名兜底:完整 HTML 文档(doctype/`<html` 开头 + `</html>` 收尾)或含逐字严格 CSP meta 的块即判定为卡片;`.infostring` 与前导文本两臂原样保留(旧宿主与 0.1.5 线不变)。裸 HTML 片段在信息串不可见的宿主上不再识别为卡片(已知损失,上游 `data-lang` 提案见 docs/upstream-proposals)。

package/README.en.md

@@ -6,7 +6,7 @@ English | [中文](README.md)
 
 Without it, an agent that wants you to *see* a result can only paste code for you to imagine, or write an HTML file you have to open in a preview. This plugin swaps the fenced block whose info string is `dsh-card` for a sandboxed iframe — mid-message — that runs the authored HTML: inline between paragraphs and genuinely interactive, not ASCII art or a prose description.
 
-<img src="https://raw.githubusercontent.com/Khorsheed/dsh-web-basic/main/docs/screenshots/inline-html-card-1.png" width="640" alt="a dsh-card block in the agent's reply rendered as a tabbed data-observation card, flowing with the surrounding text">
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/inline-html-card-1.png" width="640" alt="a dsh-card block in the agent's reply rendered as a tabbed data-observation card, flowing with the surrounding text">
 
 ```dsh-card
 <div style="font:14px system-ui;padding:16px;background:#1e1e1e;border-radius:10px;color:#eee">
@@ -57,7 +57,7 @@ The two skills the host half registers, `inline-html-card` and `3d-artifact`, sh
 ## Compatibility
 
 - npm release line (`@deepseek-ai/dsh@0.1.5-rc.1`): ✅ full — this plugin consumes only standard DOM plus the client-runtime `ClientContext`, with no host-service dependency; minHost is 0.1.2-rc.1 — older hosts stay on the previous release line.
-- source line (deepseek-harness master): ✅ (verifiedHost: 0.1.2-rc.1) — the DOM anchors re-checked on master (0.1.7-rc.2) are unchanged: `CodeBlock` still renders the `.md-code-block` wrapper with the info string in its banner (a CSS-module hashed class, caught by the leading-text fallback), `AssistantMarkdown` still sets `data-streaming`, and `ui-sidebar-browser` still registers the `browser` right-Sidebar tab kind.
+- source line (deepseek-harness master): ✅ (verifiedHost: 0.2.1-rc.1) — host-021 wave: full build+test green against the 0.2.1-rc.1 tree, no other surface changes; the DOM anchors re-checked on master (0.1.7-rc.2) are unchanged: `CodeBlock` still renders the `.md-code-block` wrapper with the info string in its banner (a CSS-module hashed class, caught by the leading-text fallback), `AssistantMarkdown` still sets `data-streaming`, and `ui-sidebar-browser` still registers the `browser` right-Sidebar tab kind.
 
 ## Known Limitations
 
@@ -71,7 +71,7 @@ The two skills the host half registers, `inline-html-card` and `3d-artifact`, sh
 <details>
 <summary>Internals (click to expand)</summary>
 
-**Architecture.** The browser half is a pure DOM-layer effect: it owns no slot and registers no Remote, mutating only the DOM the official client already rendered — the same repo-accepted last-resort pattern as message-tools' dom-hider — so it composes as an independent package with no core edits. The host half (`src/index.ts`) does exactly one thing: once the skill registry is ready (awaited via `ctx.inject(['skills'], …)` rather than probed synchronously at apply time), it registers the two bundled content-only skills (a missing/malformed SKILL.md warns, never throws; a composition without the `skills` service stays pending, never fails boot). Identity triangle: the cordis.patch.yml row id `inline-html-render` = the package.json name = `PACKAGE_NAME` in `src/invariant.ts`; the invariant companion holds no runtime invariant and only marks the package alive for the loader.
+**Architecture.** The browser half is a pure DOM-layer effect: it owns no slot and registers no Remote, mutating only the DOM the official client already rendered — the same repo-accepted last-resort pattern as message-tools' dom-hider — so it composes as an independent package with no core edits. The host half (`src/index.ts`) does exactly one thing: once the skill registry is ready (awaited via `ctx.inject(['skills'], …)` rather than probed synchronously at apply time), it registers the two bundled content-only skills (a missing/malformed SKILL.md warns, never throws; a composition without the `skills` service stays pending, never fails boot). Identity triangle: the cordis.patch.yml row id `inline-html-render` = the package.json name = the tsdown `clientBundle` id.
 
 | Module | Responsibility |
 | --- | --- |

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority; after
 # editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/inline-html-render/README.en.md
-packages/inline-html-render/README.en.md: 185f3ea500e662bbc6729419242b6db043b8df4f
-packages/inline-html-render/README.md: e6bd5a6852fe6fea2326559b4d2161365d551fa2
+packages/inline-html-render/README.en.md: e87317bab7778e1be2d5db04c4759610d13eb0ae
+packages/inline-html-render/README.md: 11c14dd73d0fe3085b23259fd64ef2ee57e1b718

package/README.md

@@ -6,7 +6,7 @@
 
 没有它的时候,agent 想让你**看到**一个效果,只能贴段代码让你脑补,或者写个 HTML 文件等你去预览里打开。这个插件把 info string 为 `dsh-card` 的 fenced block 在消息流中间替换成一个沙箱 iframe,直接运行其中的 HTML——内联在段落之间、真正可交互,而不是 ASCII 图或一句描述。
 
-<img src="https://raw.githubusercontent.com/Khorsheed/dsh-web-basic/main/docs/screenshots/inline-html-card-1.png" width="640" alt="agent 回复中间的 dsh-card 代码块被渲染成一张带 tab 的数据观测卡片，与上下文文字自然衔接">
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/inline-html-card-1.png" width="640" alt="agent 回复中间的 dsh-card 代码块被渲染成一张带 tab 的数据观测卡片，与上下文文字自然衔接">
 
 ```dsh-card
 <div style="font:14px system-ui;padding:16px;background:#1e1e1e;border-radius:10px;color:#eee">
@@ -57,7 +57,7 @@ host 半边注册的 `inline-html-card` 与 `3d-artifact` 两个 skill 同属一
 ## Compatibility
 
 - npm 发布线(`@deepseek-ai/dsh@0.1.5-rc.1`):✅ 完整——本插件只消费标准 DOM 与客户端运行时 `ClientContext`,不依赖任何 host 服务;minHost 0.1.2-rc.1,0.1.2 之前的宿主请停留在旧发布线。
-- 源码线(deepseek-harness master):✅(verifiedHost: 0.1.2-rc.1)——所依赖的 DOM 锚点在 master(0.1.7-rc.2)复核无变化:`CodeBlock` 仍渲染 `.md-code-block` 容器且 banner 带 info string(CSS-module 哈希类名,由前导文本回退路径识别),`AssistantMarkdown` 仍置 `data-streaming`,`ui-sidebar-browser` 仍注册 `browser` 右侧栏标签类型。
+- 源码线(deepseek-harness master):✅(verifiedHost: 0.2.1-rc.1)——host-021 波对 0.2.1-rc.1 树全量 build+test 绿,无其它表面变化;所依赖的 DOM 锚点在 master(0.1.7-rc.2)复核无变化:`CodeBlock` 仍渲染 `.md-code-block` 容器且 banner 带 info string(CSS-module 哈希类名,由前导文本回退路径识别),`AssistantMarkdown` 仍置 `data-streaming`,`ui-sidebar-browser` 仍注册 `browser` 右侧栏标签类型。
 
 ## 已知限制
 
@@ -71,7 +71,7 @@ host 半边注册的 `inline-html-card` 与 `3d-artifact` 两个 skill 同属一
 <details>
 <summary>内部结构(点击展开)</summary>
 
-**架构。** 浏览器半部分是纯 DOM 层效果:不拥有 slot、不注册 Remote,只改写官方已渲染的 DOM——与 message-tools 的 dom-hider 同属仓库接受的 last-resort 模式,因此可以作为独立包组合,不改任何核心包。host 半部分(`src/index.ts`)只做一件事:经 `ctx.inject(['skills'], …)` 等 skill 注册表就绪后,注册随包的两个内容型 skill(SKILL.md 缺失/畸形只 warn 不 throw;组合里没有 `skills` 服务时保持 pending,绝不炸 boot)。身份三角:cordis.patch.yml 行 id `inline-html-render` = package.json name = `src/invariant.ts` 的 PACKAGE_NAME;invariant 伴生无运行时不变量,仅向 loader 登记存活。
+**架构。** 浏览器半部分是纯 DOM 层效果:不拥有 slot、不注册 Remote,只改写官方已渲染的 DOM——与 message-tools 的 dom-hider 同属仓库接受的 last-resort 模式,因此可以作为独立包组合,不改任何核心包。host 半部分(`src/index.ts`)只做一件事:经 `ctx.inject(['skills'], …)` 等 skill 注册表就绪后,注册随包的两个内容型 skill(SKILL.md 缺失/畸形只 warn 不 throw;组合里没有 `skills` 服务时保持 pending,绝不炸 boot)。身份三角:cordis.patch.yml 行 id `inline-html-render` = package.json name = tsdown `clientBundle` id。
 
 | 模块 | 职责 |
 | --- | --- |

package/lib/index.js

@@ -49,7 +49,7 @@ function readSkill(ctx, skillName) {
 			description,
 			content,
 			source: "runtime",
-			provider: "inline-html-render"
+			provider: "@khorsheed/dsh-inline-html-render"
 		};
 	} catch (error) {
 		ctx.logger.warn(`inline-html-render: shipped SKILL.md unreadable (${String(error)}) — the ${skillName} skill is not registered`);

package/lib/types/index.js

@@ -48,7 +48,7 @@ function readSkill(ctx, skillName) {
             description,
             content,
             source: 'runtime',
-            provider: 'inline-html-render',
+            provider: '@khorsheed/dsh-inline-html-render',
         };
     }
     catch (error) {

package/package.json

@@ -10,7 +10,7 @@
     "card",
     "sandbox"
   ],
-  "version": "0.1.14",
+  "version": "0.1.16",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -19,10 +19,6 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
-    "./invariant": {
-      "types": "./lib/types/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
     "./client": {
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
@@ -41,13 +37,15 @@
     },
     "compat": {
       "minHost": "0.1.2-rc.1",
-      "verifiedHost": "0.1.2-rc.1"
+      "verifiedHost": "0.2.1-rc.1"
     }
   },
   "license": "MIT",
+  "engines": {
+    "dsh": ">=0.1.2-rc.1 <0.3.0-0"
+  },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.6"
+    "@deepseek-ai/cordis": "^4.0.1"
   },
   "files": [
     "lib",

package/lib/invariant.js

@@ -1,25 +0,0 @@
-//#region lib/types/invariant.js
-/**
-* Package-owned invariant companion for `@khorsheed/dsh-inline-html-render`.
-* @module @khorsheed/dsh-inline-html-render/invariant
-*/
-const PACKAGE_NAME = "@khorsheed/dsh-inline-html-render";
-/** Cordis companion plugin name. */
-const name = "client-inline-html-render-invariant";
-/** Service required before the companion can reserve package ownership. */
-const inject = ["invariants"];
-/**
-* No runtime invariant: the renderer is a pure DOM-layer effect owning its own
-* MutationObserver and a per-document iframe/`<pre>` pair; there is no durable
-* state shared with other packages. Reserved here so the loader knows this
-* package is alive (and so a future invariant can attach without a rename).
-*/
-const install = () => {};
-/**
-* Register this package's invariant companion.
-* @param ctx - Cordis context carrying the invariant service.
-* @returns The installed registration's disposer after setup succeeds.
-*/
-const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//#endregion
-export { apply, inject, name };

package/lib/types/invariant.d.ts

@@ -1,16 +0,0 @@
-/**
- * Package-owned invariant companion for `@khorsheed/dsh-inline-html-render`.
- * @module @khorsheed/dsh-inline-html-render/invariant
- */
-import type { Context } from '@deepseek-ai/cordis';
-/** Cordis companion plugin name. */
-export declare const name = "client-inline-html-render-invariant";
-/** Service required before the companion can reserve package ownership. */
-export declare const inject: string[];
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns The installed registration's disposer after setup succeeds.
- */
-export declare const apply: (ctx: Context) => Promise<() => void>;
-//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -1,23 +0,0 @@
-/**
- * Package-owned invariant companion for `@khorsheed/dsh-inline-html-render`.
- * @module @khorsheed/dsh-inline-html-render/invariant
- */
-const PACKAGE_NAME = '@khorsheed/dsh-inline-html-render';
-/** Cordis companion plugin name. */
-export const name = 'client-inline-html-render-invariant';
-/** Service required before the companion can reserve package ownership. */
-export const inject = ['invariants'];
-/**
- * No runtime invariant: the renderer is a pure DOM-layer effect owning its own
- * MutationObserver and a per-document iframe/`<pre>` pair; there is no durable
- * state shared with other packages. Reserved here so the loader knows this
- * package is alive (and so a future invariant can attach without a rename).
- */
-const install = () => { };
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns The installed registration's disposer after setup succeeds.
- */
-export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-/* jscpd:ignore-end */