@lmzhen/dsh-evolution-skill-history 0.17.0 → 0.18.0

package/README.md

@@ -15,6 +15,8 @@ Two registrations, one id (`skill-history`), because that is the sidebar's contr
 
 The label is a **thunk**: the sidebar re-reads it on every projection, so a language switch follows without re-registering the row. The body receives plain callbacks through its inject face — no service handle, no subscription, and the component never sees the context.
 
+The icon draws at the edge the sidebar asks for. The seat hands every occupant `{ size, active }` and the panel row owns the glyph slot, its inset and the gap to the label — the platform's own occupants hand that same `size` straight to their primitive — so `PanelIcon` renders its 16-unit glyph at exactly that `size`. A glyph box of our own moves this label out of the column the other panel rows share; ours did, by 10px, until 0.17.1.
+
 ## The host routes
 
 | Method | Path | Use case |
@@ -24,13 +26,13 @@ The label is a **thunk**: the sidebar re-reads it on every projection, so a lang
 | POST | `/api/dsh-evolution/skill-history/undo` | `curator.undo(name, v?)` — the only write |
 | GET | `/api/dsh-evolution/skill-history/versions/diff?name=&v=` | one body version against its recorded predecessor, as line counts plus the windowed changed region |
 | GET | `/api/dsh-evolution/skill-history/versions/body?name=&v=` | one version's whole text, for the panel's preview; bounded by `MAX_BODY_CHARS` and flagged `truncated` |
-| GET | `/api/dsh-evolution/skill-history/health` | liveness probe for the client |
+| GET | `/api/dsh-evolution/skill-history/health` | answers `{ surface: 'skill-history' }` — a host-side liveness/identity probe. The browser half declares only the five routes it uses and never calls this one (it is what the client's route-parity spec means by "fewer routes than the host publishes") |
 
 Every route sits behind the platform's own /api fence, kept local because the canonical implementation is not part of that package's published surface: the **socket** must be loopback (authoritative; `X-Forwarded-For` is never trusted), the **Host** header must name a loopback authority, an explicit `sec-fetch-site: cross-site` marker is refused, and an attached **Origin** must be exactly this authority.
 
 Transport refusals stay transport refusals (`403` fence, `405` method, `400` missing name / malformed or oversized body). A **business** refusal is a `200` with `{ ok: false, code, message }`, and that message is the curator's own sentence — the same one `/evolution skill undo` prints, so the two faces cannot drift.
 
-The row is **inert without a web server** (`ctx.get('webServer')`, not a declared inject): a headless profile keeps the slash commands as its entry point, and no fiber waits forever on a service that will never arrive. The curator is resolved **per request**, so a profile that mounts the routes before it answers the family's `E-302` sentence instead of throwing.
+The row declares **no service** and **waits** for the web server: `inject` is empty and `apply` mounts the routes inside `ctx.inject(['webServer'], scope => scope.effect(…))`, so a headless profile keeps the slash commands as its entry point and never runs the callback at all — inert, and no row left pending on a service that will never arrive. Reading the service at apply time instead (`ctx.get('webServer')`) is a TIMING fact, not a verdict: 0.11.1 shipped that way and left the routes permanently unregistered while the panel rendered and every call answered HTTP 404. The curator is resolved **per request**, so a profile that mounts the routes before it answers the family's `E-302` sentence instead of throwing.
 
 ## What the panel shows
 
@@ -71,5 +73,6 @@ This package adds **no model-visible content**: no prompt section, no tool schem
 - **No quality and no last-use in the list.** Both are real and both are wanted, but they live in the curator's health view and the usage store; joining them into this listing would make the route a second home for facts it does not own. The row shows what the listing already holds (description, managed/protected markers, version count).
 - **A support version can be read but not restored.** Its bytes and (from 0.14.0) its file name are recorded, and the preview shows them, but `undo` still refuses a support version by name: restoring one means deciding deletion semantics, path validation and what happens to a `scripts/` file, which is a design of its own.
 
+- **The six routes are loopback-only by design.** The fence is the family's shared loopback check, authoritative on the socket (`X-Forwarded-For` is never trusted), so a LAN-facing host that answers the platform's `/api` normally returns **403** here for any non-loopback client; reach the host over loopback (a local browser, or an SSH tunnel). Following the platform's `trustedHosts` instead is an open decision (v46 `决策 3`; the mechanism lives in `evolution-core`'s `http-routes.ts`).
 - **Support-file bytes are history only.** They share the index with the body, so they are listed and labelled, but `undo` refuses them by name — the bytes stay in the blob store for a hand copy.
 - **No occupancy row.** `.history` growth is documented in the evolution-core README; showing the size in the panel would promise a cleanup path the family has not designed (a whole-library reference count belongs to the curator).

package/lib/client.js

@@ -78,6 +78,7 @@ window.__ModuleLoader__.load({
 			"group.support.note": "附带文件的字节与正文共用一份索引；回退不恢复它们。",
 			"empty.skills": "还没有技能留下过内容版本。",
 			"empty.versions": "这个技能还没有记录版本。",
+			"empty.versions.failed": "版本读取失败——这个技能有没有版本，现在判断不了；点「刷新」重试。",
 			"empty.pick": "从左栏选一个技能，看它记录过的版本。",
 			loading: "读取中…",
 			refresh: "刷新",
@@ -152,6 +153,7 @@ window.__ModuleLoader__.load({
 			"group.support.note": "Support-file bytes share this index with the body; restoring the body does not bring them back.",
 			"empty.skills": "No skill has recorded a content version yet.",
 			"empty.versions": "This skill has no recorded versions.",
+			"empty.versions.failed": "The version read FAILED - whether this skill has versions is unknown right now; use Refresh to retry.",
 			"empty.pick": "Pick a skill on the left to see the versions it recorded.",
 			loading: "Loading…",
 			refresh: "Refresh",
@@ -215,6 +217,15 @@ window.__ModuleLoader__.load({
 			"error.hint": "The panel could not reach the host routes — usually a plugin/host version mismatch; restart dsh web and retry."
 		};
 		/**
+		* One message without the locale seat (the fallback path, and what a spec reads).
+		* @param language - which dictionary to read.
+		* @param key - the message key.
+		* @returns the copy, or the key itself when neither dictionary carries it.
+		*/
+		function message(language, key) {
+			return (language === "en" ? en : zh)[key] ?? key;
+		}
+		/**
 		* Fill one TEMPLATE’s `{n}` slots. The seat resolves the key, this fills it, so the panel needs
 		* only the seat plus this rule and never learns which language it is rendering.
 		* @param template - the copy, with `{slot}` placeholders.
@@ -853,6 +864,7 @@ window.__ModuleLoader__.load({
 			const [skillsLoaded, setSkillsLoaded] = (0, react.useState)(false);
 			const [selected, setSelected] = (0, react.useState)(void 0);
 			const [payload, setPayload] = (0, react.useState)(void 0);
+			const [versionsFailed, setVersionsFailed] = (0, react.useState)(void 0);
 			const [noteText, setNoteText] = (0, react.useState)(void 0);
 			const [noteError, setNoteError] = (0, react.useState)(false);
 			const [pending, setPending] = (0, react.useState)(void 0);
@@ -869,6 +881,8 @@ window.__ModuleLoader__.load({
 				setNoteError(false);
 				setNoteText(message);
 			};
+			/** The sentence one failed read carries, in ONE place: every reader below reports the same way. */
+			const failedMessage = (error) => face.t("error") + ": " + (error instanceof Error ? error.message : String(error));
 			/** Read the skills again, keeping the sentence: a re-read is not an answer to anything. */
 			const reloadSkills = () => {
 				face.loadSkills().then(setSkills).catch(failed).finally(() => {
@@ -886,6 +900,7 @@ window.__ModuleLoader__.load({
 				readTicket.current = ticket;
 				setSelected(name);
 				setPayload(void 0);
+				setVersionsFailed(void 0);
 				setPending(void 0);
 				setExpanded(void 0);
 				setDiffs(/* @__PURE__ */ new Map());
@@ -893,7 +908,9 @@ window.__ModuleLoader__.load({
 				face.loadVersions(name).then((next) => {
 					if (readTicket.current === ticket) setPayload(next);
 				}).catch((error) => {
-					if (readTicket.current === ticket) onFailure(error);
+					if (readTicket.current !== ticket) return;
+					setVersionsFailed(failedMessage(error));
+					onFailure(error);
 				});
 			};
 			/** Open a skill from the list: another skill's sentence described another skill, so it goes away. */
@@ -944,7 +961,6 @@ window.__ModuleLoader__.load({
 				const name = selected;
 				const ticket = readTicket.current + 1;
 				readTicket.current = ticket;
-				const failedMessage = (error) => face.t("error") + ": " + (error instanceof Error ? error.message : String(error));
 				if (kind === "diff") {
 					setDiffs((current) => new Map(current).set(v, { kind: "loading" }));
 					face.loadDiff(name, v).then((diff) => {
@@ -1036,7 +1052,7 @@ window.__ModuleLoader__.load({
 			})))), (0, react.createElement)("div", { className: "evo-hist-main" }, panelHead(face, refresh), notice(noteText, noteError), selected === void 0 ? [emptyState(face.t(skills.length === 0 ? skillsLoaded ? "empty.skills" : "loading" : "empty.pick")), (0, react.createElement)("p", {
 				key: "hint",
 				className: "evo-hist-hint"
-			}, face.t("hint"))] : loaded ? null : emptyState(face.t("loading")), loaded ? (0, react.createElement)("div", null, group(face.t("group.content"), payload.content, void 0), group(face.t("group.support"), payload.support, face.t("group.support.note")), payload.content.length === 0 && payload.support.length === 0 ? (0, react.createElement)("p", { className: "evo-hist-hint" }, face.t("empty.versions")) : null) : null));
+			}, face.t("hint"))] : loaded ? null : emptyState(versionsFailed === void 0 ? face.t("loading") : `${face.t("empty.versions.failed")} — ${versionsFailed}`), loaded ? (0, react.createElement)("div", null, group(face.t("group.content"), payload.content, void 0), group(face.t("group.support"), payload.support, face.t("group.support.note")), payload.content.length === 0 && payload.support.length === 0 ? (0, react.createElement)("p", { className: "evo-hist-hint" }, face.t("empty.versions")) : null) : null));
 		}
 		/**
 		* The lazy-read cache without one key.
@@ -1073,44 +1089,30 @@ window.__ModuleLoader__.load({
 		/** Row order inside the global panel list (beside the platform's own rows). */
 		const PANEL_ORDER = 35;
 		/**
-		* The row's icon: a platform-style line glyph, whose SIZE comes from the sidebar's contract and whose
-		* glyph BOX is the one the neighbouring rows draw at.
+		* The row's icon: a platform-style line glyph, drawn at the edge the sidebar asks for.
 		*
-		* Size: the platform hands every `sidebar.panellist` occupant `{ size, active }` (`SidebarRoot.tsx`
-		* `renderSlot('sidebar.panellist', { size: wide ? 16 : 18, active }, …)`), so the glyph takes its size
-		* from that prop; a glyph that sizes itself from CSS (`width: 100%`) resolves against an unsized flex
-		* box and fills the whole column.
+		* The sidebar hands every `sidebar.panellist` occupant `{ size, active }` — its panel row renders
+		* `renderSlot('sidebar.panellist', { size: wide ? 16 : 18, active }, { only: id })` and owns the glyph
+		* slot, its inset and the gap to the label (`ui-sidebar/src/client/SidebarRoot.tsx`) — so the glyph
+		* takes BOTH its edge and its box from that prop, exactly as the platform's own occupants do: their
+		* `PluginsPanelIcon` and `TaskManagerIcon` hand `size` straight to their primitive.
 		*
-		* Box: the three rows above (task board / SSH / skill centre) are NOT slot occupants — they inject
-		* plain DOM into the sidebar with their own CSS (`.entry{padding:0 10px;gap:8px}` plus a 24px icon box
-		* holding an 18px glyph, `shared/client/sidebar-entry-core.ts`), so their glyph ink starts 13px into
-		* the column and their label 42px. Inside the platform panel row (8px padding, 8px gap) those two
-		* lines are reached by a 26px box: `8 + (26 - 16) / 2 = 13` and `8 + 26 + 8 = 42`.
-		* Matching the neighbours is a CHOICE (the platform's own rows below — the workspace folders — sit at
-		* 8px and 32px); it keeps the four plugin rows reading as one column. The label carries the accessible
-		* name, so the glyph stays decoration.
+		* A box of our own, sized to some other row's pixels, moves this label out of the column: measured in
+		* the desktop's global panel list (2026-10-09, 0.2.0) a 26px box put the label at 56px while the
+		* platform's own rows in that list sat at 46px. The label carries the accessible name, so the glyph
+		* stays decoration.
 		*/
-		/** The glyph box in px: the neighbours' 24px icon box, placed to land on their two content lines. */
-		const GLYPH_BOX = 26;
 		/** The glyph's own coordinate system: every path below is drawn inside 16 units. */
 		const GLYPH_UNITS = 16;
-		/**
-		* Trim a computed viewBox number: three decimals stay readable and are far below one pixel.
-		* @param value - the raw number.
-		* @returns the value rounded to three decimals.
-		*/
-		function round3(value) {
-			return Math.round(value * 1e3) / 1e3;
-		}
+		/** The edge to draw at when the sidebar hands no size: its collapsed column asks for 18. */
+		const DEFAULT_GLYPH_SIZE = 18;
 		function PanelIcon(props = {}) {
-			const size = typeof props.size === "number" && props.size > 0 ? props.size : 18;
-			const units = round3(GLYPH_UNITS * GLYPH_BOX / size);
-			const inset = round3((units - GLYPH_UNITS) / 2);
+			const size = typeof props.size === "number" && props.size > 0 ? props.size : DEFAULT_GLYPH_SIZE;
 			return (0, react.createElement)("svg", {
 				"aria-hidden": "true",
-				width: String(GLYPH_BOX),
-				height: String(GLYPH_BOX),
-				viewBox: String(-inset) + " " + String(-inset) + " " + String(units) + " " + String(units),
+				width: String(size),
+				height: String(size),
+				viewBox: "0 0 " + String(GLYPH_UNITS) + " " + String(GLYPH_UNITS),
 				fill: "none",
 				stroke: "currentColor",
 				strokeWidth: "1.5",
@@ -1129,13 +1131,22 @@ window.__ModuleLoader__.load({
 		function apply(ctx) {
 			const seam = ctx;
 			const api = createSkillHistoryApi();
+			let registered = false;
 			ctx.effect(() => {
-				return seam.locale.register(NS, {
-					zh,
-					en
-				});
+				try {
+					const dispose = seam.locale.register(NS, {
+						zh,
+						en
+					});
+					registered = true;
+					return dispose;
+				} catch (error) {
+					ctx.logger.warn(`evolution-skill-history: the locale seat refused the "${NS}" dictionary registration (${error instanceof Error ? error.message : String(error)}) — the panel label falls back to the bundle's own copy and the remaining registrations continue`);
+					return () => {};
+				}
 			}, "evolution-skill-history: locale");
-			const t = seam.locale.bind(NS);
+			const seatTranslator = registered ? seam.locale.bind(NS) : null;
+			const t = (key) => seatTranslator === null ? message("zh", key) : seatTranslator(key);
 			ctx.effect(() => {
 				if (document.querySelector("style[data-plugin-css=\"@lmzhen/dsh-evolution-skill-history/panel.css\"]") === null) {
 					const tag = document.createElement("style");

package/lib/index.js

@@ -23,7 +23,7 @@ const SKILL_HISTORY_ROUTES = {
 */
 const MAX_BODY_CHARS = 2e4;
 /**
-* Build the four routes over the curator seam.
+* Build the six routes over the curator seam.
 * @param services - the host services the handlers read.
 * @returns the route list for ctx.webServer.register.
 */

package/lib/types/routes.d.ts

@@ -35,7 +35,7 @@ export interface RouteServices {
     readonly getCurator: () => CuratorFace | undefined;
 }
 /**
- * Build the four routes over the curator seam.
+ * Build the six routes over the curator seam.
  * @param services - the host services the handlers read.
  * @returns the route list for ctx.webServer.register.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-skill-history",
   "description": "Web surface for skill content history: loopback host routes plus the sidebar panel (community build)",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "publishConfig": {
     "access": "public"
   },
@@ -30,23 +30,23 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@lmzhen/dsh-evolution-core": "^0.17.0"
+    "@lmzhen/dsh-evolution-core": "^0.18.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
     "react": "^18.2.0",
-    "@lmzhen/dsh-evolution-curator": "^0.17.0"
+    "@lmzhen/dsh-evolution-curator": "^0.18.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
     "@types/react": "~18.3.1",
     "react": "^18.2.0",
-    "@lmzhen/dsh-evolution-core": "^0.17.0",
-    "@lmzhen/dsh-evolution-curator": "^0.17.0",
-    "@lmzhen/dsh-evolution-io": "^0.17.0",
-    "@lmzhen/dsh-evolution-io-node": "^0.17.0"
+    "@lmzhen/dsh-evolution-core": "^0.18.0",
+    "@lmzhen/dsh-evolution-curator": "^0.18.0",
+    "@lmzhen/dsh-evolution-io": "^0.18.0",
+    "@lmzhen/dsh-evolution-io-node": "^0.18.0"
   },
   "dsh": {
     "client": {