@michengai/dsh-automation 1.0.6 → 1.0.8

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 Upcoming changes and recent published versions are listed below. Git tags and GitHub Releases now mirror these entries; historical sections retain links to their original release commits.
 
+## 1.0.8 - 2026-10-24
+
+- Support DeepSeek Harness `0.2.1-rc.3` while retaining all existing supported versions.
+
+## 1.0.7 - 2026-10-23
+
+- **Dedicated Sidebar Activity Bar Entry**: Supports toggling a dedicated scheduled tasks icon on the primary activity bar from the plugin bundle configuration card. Enabled by default on new installs to seamlessly replace the built-in entry, expanding into a full 960px centered workbench for editing long prompts, recurrence rules, and audit logs.
+- **Hide Official Automation Entry Toggle**: Supports toggling whether to hide the host's built-in "Automation tasks" (`ui-schedule`) entry. Enabled by default; automatically resets active panel to default conversation if official panel is open; features persistent client caching against network flicker; restores built-in entry cleanly when disabled or if this plugin is uninstalled.
+- **Online Update Switch & Enterprise Lockdown**: Supports toggling update check status from the plugin card. Supports declaring `updater: false` or `onlineUpdate: false` in Cordis configuration for full lockdown (403 blocked and UI disabled with notice).
+- **Reverse Proxy Subpath Support**: Resolves API endpoints against `document.baseURI` with trailing slash guards, preventing 404 errors when DSH is hosted behind reverse proxies with path prefixes.
+- **Persistent Settings & Security Hardening**: Supports `stateDir` configuration; secures settings HTTP endpoints with host authentication check, CSRF marker validation, and payload size bounds.
+
 ## 1.0.6 - 2026-10-22
 
 - Fix sidebar rebound on collapse after searching: prevent the official workspace tree from mistakenly triggering `expandSidebar` on narrow rail mount due to historical search requests, keeping sidebar collapse stable (Issue #20).

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,18 @@
 
 以下记录待发布变更及近期已发布版本。Git 标签与 GitHub Release 现已和这些条目同步；历史条目继续保留原始发布提交链接。
 
+## 1.0.8 - 2026-10-24
+
+- 支持 DeepSeek Harness `0.2.1-rc.3`，继续兼容此前已支持的宿主版本。
+
+## 1.0.7 - 2026-10-23
+
+- **侧边栏独立入口**：在插件扩展配置卡片中支持自主开启/关闭左侧主活动栏常驻「定时任务」快捷入口，初装默认开启，与屏蔽官方入口协同无缝平替官方活动栏入口，直达 960px 居中大版心主工作台，便于查看长指令、调度配置与运行历史；与会话树次级页签双层互补。
+- **屏蔽官方自动化入口开关**：支持在插件扩展配置卡片中开启/关闭是否隐藏宿主自带的「自动化任务」（`ui-schedule`）入口，默认开启；隐藏时自动将官方 schedules 面板切回默认会话，杜绝主区孤立悬空；带有本地持久化缓存防闪烁；若关闭该项或卸载本插件，官方自带入口将自动完好无损地复现，绝无残留。
+- **在线更新开关与企业合规锁定**：支持在插件卡片中随时切换在线检查更新状态；支持在 Cordis 配置中声明 `updater: false` 或 `onlineUpdate: false` 锁定更新，锁定状态下更新接口强行阻断返回 403，界面自动置灰并提示锁定。
+- **反向代理部署支持**：端点路径自动按页面 `document.baseURI` 解析，彻底解决在带子路径前缀反代（如 `/app/dsh/`）部署下更新与设置端点 404 的问题。
+- **配置持久化与安全性增强**：支持 `stateDir` 配置项；设置 API 补齐宿主认证门禁与跨站防御，读写端点安全可靠。
+
 ## 1.0.6 - 2026-10-22
 
 - 修复搜索后侧栏无法收起（收起后瞬间弹回）的缺陷：阻断官方任务树在窄轨收起状态下因历史搜索请求而误调 `expandSidebar` 导致侧栏秒弹回的问题，保障收起操作稳定执行（Issue #20）。

package/README.md

@@ -73,8 +73,8 @@ For a desktop workbench, download [DSH Codex Desktop](https://github.com/Micheng
 
 ## Prerequisites
 
-- The current source uses DSH `0.2.1-rc.2` for development and real Host compatibility tests, and declares support for `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1`, and `0.2.1-rc.2`. Hosts still on `0.1.x` should stay on plugin `0.1.66`. Back up automation storage and sessions in the Profile before upgrading the Host. `0.2.0` writes V4 sessions, and V4 sessions cannot be read after downgrading.
-- Official DSH peerDependencies are exactly `0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1 || 0.2.1-rc.2`. Intermediate `0.2.1-alpha` releases are no longer supported. `0.1.x` is no longer supported because the current UI uses host primitives that those hosts do not provide. `@deepseek-ai/dsh-agent-presets` and `@deepseek-ai/dsh-agent-preset-registry` are not peers: scheduled tasks use the host `agentPresets` service, and the install gate checks every `@deepseek-ai/dsh-*` peer against the running version. Development dependencies are pinned to `0.2.1-rc.2`. Use one consistent official package version within each Host.
+- The current source uses DSH `0.2.1-rc.2` for development and real Host compatibility tests, and declares support for `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1`, `0.2.1-rc.2`, and `0.2.1-rc.3`. Hosts still on `0.1.x` should stay on plugin `0.1.66`. Back up automation storage and sessions in the Profile before upgrading the Host. `0.2.0` writes V4 sessions, and V4 sessions cannot be read after downgrading.
+- Official DSH peerDependencies are exactly `0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1 || 0.2.1-rc.2 || 0.2.1-rc.3`. Intermediate `0.2.1-alpha` releases are no longer supported. `0.1.x` is no longer supported because the current UI uses host primitives that those hosts do not provide. `@deepseek-ai/dsh-agent-presets` and `@deepseek-ai/dsh-agent-preset-registry` are not peers: scheduled tasks use the host `agentPresets` service, and the install gate checks every `@deepseek-ai/dsh-*` peer against the running version. Development dependencies are pinned to `0.2.1-rc.2`. Use one consistent official package version within each Host.
 - Other versions are outside the declared compatibility range. Installers may warn, and strict peer validation rejects them. Extend and pass the version matrix before adding a new rc.
 - The automation bundle does not override the official Connection entry. Each Host keeps its own startup dependencies, trusted-host expressions, and custom configuration; automation registers its RPC channel in its own plugin scope.
 - A working DeepSeek Harness Web installation with `dsh` available in PowerShell.
@@ -103,6 +103,58 @@ dsh --profile web --dump-config
 ```
 
 Restart DSH Web and hard-refresh the browser. Pin a version with `@0.1.5` instead of `@latest` when needed.
+- **Reverse Proxy Deployment**: Supports running DSH behind a reverse proxy with a path prefix (e.g. `/app/dsh/`). Plugin API and update check endpoints resolve relative to the document base URI (`document.baseURI`) to avoid 404 errors caused by stripped path prefixes.
+
+## Plugin Configuration & Toggles
+
+The plugin follows standard DSH bundle configuration conventions. Options are located at:
+> **Sidebar → Plugins → Click `@michengai/dsh-automation` details** (the host's `plugins.bundle.config` slot).
+
+Three native switches are available:
+
+### 1. Sidebar Entry (`sidebarEntry`)
+- **Default**: Enabled (`true`) / Seamless takeover on new installs
+- **Description**: Displays a dedicated **Scheduled Tasks** icon on the primary activity bar.
+- **Effect**:
+  - **960px Centered View**: When enabled, clicking the sidebar icon opens the full task center inside a **960px centered container** (matching host plugin manager conventions). This eliminates vertical scrolling constraints in narrow settings dialogs, providing ample room for multi-step prompts, schedules, and audit records;
+  - **Clean Unregister**: When toggled off, cleanly unregisters the slot and safely switches away if the panel was active;
+  - **Live Synchronization**: The standard Settings modal and the workspace rail tabs remain fully available and in sync regardless of this toggle.
+
+### 2. Online Updates (`onlineUpdate` / `updater`)
+- **Default**: Enabled (`true`)
+- **Description**: Controls whether the plugin checks for and installs updates from npm.
+- **Effect**:
+  - **Dynamic UI Sync**: Disabling the toggle hides update chips and check buttons from the settings header immediately without requiring a full page reload;
+  - **Endpoint Guard**: When disabled, the update API route returns `HTTP 403` for all check and install requests, preventing unreviewed updates;
+  - **Host / Platform Lock**: For curated plugin indexes (such as VibeDev) or restricted enterprise environments, this can be locked directly via Cordis configuration (bundle patch) without needing UI interaction:
+    ```yaml
+    updater: false # or onlineUpdate: false
+    ```
+    Once configured, the built-in updater is disabled at startup and the UI toggle is disabled with a locked notice;
+  - **Update Mode**: When an update is detected, **Update automatically** runs only when the DSH CLI or Desktop update service is available; otherwise, the dialog provides a profile-specific manual command to copy and run.
+
+### 3. Hide Official Automation Entry (`hideOfficialSchedule`)
+- **Default**: Enabled (`true`, paired with Sidebar Entry)
+- **Description**: Controls whether to hide the host's built-in "Automation tasks" (`ui-schedule`) entry to avoid conflict.
+- **Effect**:
+  - **Clean Sidebar & Seamless Takeover**: Hidden by default on fresh installs while the plugin's own sidebar entry is displayed, avoiding duplicate icons;
+  - **Smart Panel Reset**: When hiding takes effect, if the main view is currently displaying the official schedules panel, it safely resets back to the default conversation view, preventing orphan views;
+  - **Flicker-Free Persistent Caching**: Features client-side local storage caching, eliminating icon flicker even on slow or offline networks;
+  - **Zero Residual Changes**: Toggling off or uninstalling the plugin restores the built-in entry automatically;
+  - **Upgrade Safety**: If an upgrading user had previously disabled `sidebarEntry`, the official entry remains visible by default, avoiding an empty activity bar.
+
+### 4. Storage & Host Configuration (`cordis.patch.yml`)
+The following configuration parameters can be declared under your profile's `cordis.patch.yml`:
+```yaml
+- id: dsh-automation
+  name: '@michengai/dsh-automation'
+  config:
+    stateDir: D:/Data/dsh-automation   # Optional: custom path for settings.json, defaults to active profile directory
+    runTimeoutMinutes: 60              # Optional: task execution timeout in minutes (default: 60, max: 1440)
+    misfireGraceMinutes: 15            # Optional: grace window for missed runs in minutes (default: 15, max: 10080)
+    historyLimit: 200                  # Optional: max audit log entries to retain (default: 200, max: 5000)
+    updater: false                     # Optional: enterprise lockdown for updates (alias: onlineUpdate: false)
+```
 
 ## Updates
 

package/README.zh-CN.md

@@ -73,8 +73,8 @@
 
 ## 前置条件
 
-- 当前源码以 DSH `0.2.1-rc.2` 为开发和真实宿主测试基线，声明支持 `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2`。仍停在 `0.1.x` 的宿主请继续使用插件 `0.1.66`。升级宿主前备份 Profile 中的自动化存储和会话目录。`0.2.0` 写入 V4 会话，V4 会话不支持降级读取。
-- 官方 DSH peerDependencies 精确限定为 `0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1 || 0.2.1-rc.2`。中间的 `0.2.1-alpha` 预发布不再支持。`0.1.x` 不再支持，因为当前界面使用的宿主原语在那些宿主上不存在。`@deepseek-ai/dsh-agent-presets` 和 `@deepseek-ai/dsh-agent-preset-registry` 都不写入 peer：定时任务使用宿主的 `agentPresets` 服务，安装门会拿每一个 `@deepseek-ai/dsh-*` peer 去对当前版本。开发依赖固定为 `0.2.1-rc.2`。同一宿主中的官方包应使用一致版本。
+- 当前源码以 DSH `0.2.1-rc.2` 为开发和真实宿主测试基线，声明支持 `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2`、`0.2.1-rc.3`。仍停在 `0.1.x` 的宿主请继续使用插件 `0.1.66`。升级宿主前备份 Profile 中的自动化存储和会话目录。`0.2.0` 写入 V4 会话，V4 会话不支持降级读取。
+- 官方 DSH peerDependencies 精确限定为 `0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1 || 0.2.1-rc.2 || 0.2.1-rc.3`。中间的 `0.2.1-alpha` 预发布不再支持。`0.1.x` 不再支持，因为当前界面使用的宿主原语在那些宿主上不存在。`@deepseek-ai/dsh-agent-presets` 和 `@deepseek-ai/dsh-agent-preset-registry` 都不写入 peer：定时任务使用宿主的 `agentPresets` 服务，安装门会拿每一个 `@deepseek-ai/dsh-*` peer 去对当前版本。开发依赖固定为 `0.2.1-rc.2`。同一宿主中的官方包应使用一致版本。
 - 其他版本不在声明兼容范围内；安装器可能提示 peer 警告，启用严格 peer 校验时会失败。支持新 rc 前需扩展版本矩阵并通过验证。
 - 自动化 bundle 不覆盖官方 Connection 条目，各版宿主保留自己的启动依赖、可信地址表达式和自定义配置；自动化在自身插件作用域注册 RPC 路由。
 - 已可正常运行 DeepSeek Harness Web，且可在 PowerShell 中使用 `dsh`。
@@ -103,6 +103,58 @@ dsh --profile web --dump-config
 ```
 
 安装后重启 DSH Web，并在浏览器硬刷新。需要钉死某一版时，把 `@latest` 换成 `@0.1.5`。
+- **反向代理部署**：支持将 DSH 部署在带路径前缀的反向代理后面（如 `/app/dsh/`），插件 API 与更新检查端点统一自动按页面基址（`document.baseURI`）相对解析，避免丢失代理路径前缀导致 404。
+
+## 插件配置与可选开关
+
+插件遵循 DSH 官方扩展配置规范，配置项位于：
+> **主界面侧边栏「插件」→ 点击 `@michengai/dsh-automation` 详情页**（对应宿主 `plugins.bundle.config` 槽位）。
+
+此处提供三个原生扁平行开关：
+
+### 1. 侧边栏入口 (`sidebarEntry`)
+- **默认状态**：开启（`true`）/ 新装默认平替接管
+- **功能说明**：在宿主左侧主活动栏常驻 **「定时任务」** 图标入口。
+- **生效效果**：
+  - **960px 居中版心**：开启后，在侧边栏点击即可直达定时任务中心，并在主工作区以 **960px 居中版心**（对齐官方插件管理与市场规范）展开完整大面板，彻底告别在设置弹窗狭窄视口内滚动的局限，便于集中管理长任务指令、定时计划与执行记录；
+  - **安全平滑收退**：关闭后安全注销侧栏槽位；若当前正停留在定时任务面板，会自动安全切回默认视图，防止悬空和白屏；
+  - **双入口数据同步**：无论是否开启侧栏入口，DSH 原有的「设置 → 定时任务」弹窗以及会话侧栏内的「任务与定时」页签均始终保留，两处界面数据与状态 100% 实时同步。
+
+### 2. 在线更新 (`onlineUpdate` / `updater`)
+- **默认状态**：开启（`true`）
+- **功能说明**：控制是否允许在线检查并安装定时任务插件的新版本。
+- **生效效果**：
+  - **界面联动**：关闭开关后，定时任务设置标题旁的「检查更新」按钮与版本提示将即时隐藏，无需刷新页面；开启后自动恢复展示；
+  - **接口安全拦截**：关闭后，服务端的更新路由对任何版本检查和安装请求均返回 `HTTP 403` 禁用状态，彻底杜绝在插件内安装未审核版本；
+  - **宿主/平台级锁定**：面向精选插件索引（如 VibeDev）或企业安全合规环境，支持直接在 Cordis 配置文件（bundle patch）中声明，无需进入界面手动配置：
+    ```yaml
+    updater: false # 或 onlineUpdate: false
+    ```
+    配置生效后，更新器在启动时即被完全禁用，且更新入口默认保持隐藏，前端 Switch 显示为锁定置灰状态；
+  - **更新模式**：发现新版后，只有检测到 DSH CLI 或 Desktop 更新服务时才可使用“自动更新”；其他环境会在弹窗中提供可复制、与当前 Profile 对应的手工更新命令。
+
+### 3. 屏蔽官方自动化入口 (`hideOfficialSchedule`)
+- **默认状态**：开启（`true`，与侧栏入口协同平替）
+- **功能说明**：控制是否隐藏宿主自带的「自动化任务」（`ui-schedule`）活动栏入口，避免与本插件功能冲突。
+- **生效效果**：
+  - **默认清爽与平滑平替**：安装本插件后，宿主自带的自动化任务活动栏按钮默认隐藏，由本插件侧栏入口自动点亮接管，避免界面出现两个相似入口；
+  - **活动区智能复位**：隐藏生效时，若主工作区正处于官方自动化页面，系统自动将其安全切回默认会话，杜绝页面孤立悬空；
+  - **本地持久化防闪烁**：前端支持本地缓存优先读取，弱网或离线环境下首帧绝不出现图标闪烁跳变；
+  - **无损自愈与卸载复原**：关闭开关或通过标准命令卸载本插件后，官方自带的自动化入口将自动完好无损地复现，绝无残留修改；
+  - **老用户升级防死区保护**：若升级前曾手动关闭侧栏入口，新版本将智能继承关闭状态，不隐藏官方入口，杜绝出现活动栏两头皆空的死区。
+
+### 4. 存储与宿主参数配置 (`cordis.patch.yml`)
+支持在 Profile 的 `cordis.patch.yml` 中定制以下参数：
+```yaml
+- id: dsh-automation
+  name: '@michengai/dsh-automation'
+  config:
+    stateDir: D:/Data/dsh-automation   # 可选：自定义设置文件 settings.json 存储路径，默认当前 Profile 目录
+    runTimeoutMinutes: 60              # 可选：单次任务超时时间（分钟），默认 60，上限 1440
+    misfireGraceMinutes: 15            # 可选：错过执行时间的宽限期（分钟），默认 15，上限 10080
+    historyLimit: 200                  # 可选：历史运行记录保留上限，默认 200，上限 5000
+    updater: false                     # 可选：企业级锁定更新（同 onlineUpdate: false）
+```
 
 ## 在线更新