@nanmicoder/dsh-agent-teams 0.1.14 → 0.1.15-alpha.1

package/lib/index.js

@@ -26,6 +26,7 @@ import { collectArchivedTeamsActivity, collectTeamsActivity } from "./snapshot.j
 import { findTeamByCaptain } from "./state.js";
 import { formatProfilesForPrompt } from "./profiles.js";
 import { qualityPlanningPrompt } from "./quality-gates.js";
+import { authenticatedWebRoutes } from "./web-routes.js";
 /** Web-server service key candidates, newest first. */
 const WEB_SERVER_KEYS = ['webServer', 'httpServer'];
 /** Workspace registry service key candidates, newest first. */
@@ -159,10 +160,11 @@ export function apply(ctx, config) {
     const registerWebSurface = () => {
         if (webRegistered)
             return;
-        const webServer = (ctx.get(WEB_SERVER_KEYS[0]) ?? ctx.get(WEB_SERVER_KEYS[1]));
+        const rawWebServer = (ctx.get(WEB_SERVER_KEYS[0]) ?? ctx.get(WEB_SERVER_KEYS[1]));
         const workspaceRegistry = (ctx.get(WORKSPACE_KEYS[0]) ?? ctx.get(WORKSPACE_KEYS[1]));
-        if (webServer === undefined || workspaceRegistry === undefined)
+        if (rawWebServer === undefined || workspaceRegistry === undefined)
             return;
+        const webServer = authenticatedWebRoutes(rawWebServer, () => ctx.get('connection'));
         webRegistered = true;
         // Activity panel data route: the browser floater polls this for team
         // snapshots (disk truth + live subagent activity). Mirrors the Claude

package/lib/types/client/ActivityPanel.d.ts

@@ -19,7 +19,8 @@
 import type { ModelDirectoryResolver } from '@deepseek-ai/dsh-client-ui-model-selection/client';
 import type { PropsLocale } from '@deepseek-ai/dsh-client-ui-slots';
 import type { SessionId } from '@deepseek-ai/dsh-session/types';
-import type { ObservableSnapshot, SessionListState } from '@deepseek-ai/dsh-client-runtime/client';
+import type { ObservableSnapshot } from '@deepseek-ai/dsh-client-store';
+import type { SessionListState } from '@deepseek-ai/dsh-api-session-controller/client';
 /** The top-right activity floater. Teams follow the current session: live
  * snapshots and historic card summaries are only shown while their captain
  * session is the one currently open. */

package/lib/types/client/agent-teams-card-definition.d.ts

@@ -10,7 +10,7 @@
  * the card survives restarts without writing an out-of-repo event type.
  * @module dsh-agent-teams/client/card
  */
-import type { ConversationNodeDefinition } from '@deepseek-ai/dsh-client-runtime/client';
+import type { ConversationNodeDefinition } from '@deepseek-ai/dsh-client-ui-conversation/client';
 /** Final keyed Chat payload for the team summary card. */
 export interface AgentTeamsCardData {
     readonly teamId: string;
@@ -23,7 +23,7 @@ export interface AgentTeamsCardData {
         readonly role: string;
     }[];
 }
-declare module '@deepseek-ai/dsh-client-ui-conversation/client' {
+declare module '@deepseek-ai/dsh-client-ui-chat/client' {
     interface ChatNodeDataMap {
         /** Lightweight team summary card anchoring the conversation. */
         'agent-teams': AgentTeamsCardData;

package/lib/types/client/index.d.ts

@@ -1,5 +1,5 @@
 /** Browser plugin for the AgentTeams activity floater and conversation card. */
-import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
 import { type AgentTeamsLocaleKey } from './locales.ts';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {

package/lib/types/client/session-navigation.d.ts

@@ -1,5 +1,6 @@
 /** Version-tolerant navigation into durable AgentTeams member transcripts. */
-import type { SessionId, SubagentAddress } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SessionId } from '@deepseek-ai/dsh-session/types';
+import type { SubagentAddress } from '@deepseek-ai/dsh-subagent/client';
 /** Narrow sessions-service face used by the activity panel and team card. */
 export interface AgentTeamsSessionNavigator {
     /** Legacy/ordinary session navigation. */

package/lib/types/web-routes.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { HostConnectionService } from '@deepseek-ai/dsh-client-connection';
+/** Public WebServer route surface used by the plugin. */
+export interface WebRouteHost {
+    register(route: {
+        kind: 'exact' | 'prefix';
+        path: string;
+        handler: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+    }): () => void;
+}
+export type BrowserRequestGate = Pick<HostConnectionService, 'requestRejection'>;
+/** Raw WebServer routes do not inherit Connection's authentication fence. */
+export declare function authenticatedWebRoutes(server: WebRouteHost, connection: () => BrowserRequestGate | undefined): WebRouteHost;

package/lib/web-routes.js

@@ -0,0 +1,26 @@
+/** Raw WebServer routes do not inherit Connection's authentication fence. */
+export function authenticatedWebRoutes(server, connection) {
+    return {
+        register(route) {
+            return server.register({
+                ...route,
+                async handler(req, res) {
+                    const gate = connection();
+                    // Missing/disposing Connection is an assembly failure, never an
+                    // invitation to expose workspace state or accept plan mutations.
+                    const rejection = gate === undefined ? 503 : gate.requestRejection(req);
+                    if (rejection !== undefined) {
+                        res.writeHead(rejection, {
+                            'content-type': 'application/json; charset=utf-8',
+                            'cache-control': 'no-store',
+                        });
+                        res.end(JSON.stringify({ error: rejection === 503 ? 'authentication unavailable'
+                                : rejection === 401 ? 'unauthorized' : 'forbidden' }));
+                        return;
+                    }
+                    await route.handler(req, res);
+                },
+            });
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanmicoder/dsh-agent-teams",
-  "version": "0.1.14",
+  "version": "0.1.15-alpha.1",
   "description": "AgentTeams for DeepSeek Harness: multi-agent team collaboration (captain, members, tasks with dependencies, messaging) driven by natural language, with a tree monitor in the web GUI",
   "type": "module",
   "main": "lib/index.js",
@@ -56,6 +56,7 @@
   },
   "publishConfig": {
     "access": "public",
+    "tag": "alpha",
     "registry": "https://registry.npmjs.org/"
   },
   "dsh": {
@@ -65,10 +66,12 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-runtime",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-layout",
-        "@deepseek-ai/dsh-client-ui-model-selection"
+        "@deepseek-ai/dsh-client-ui-model-selection",
+        "@deepseek-ai/dsh-api-session-controller",
+        "@deepseek-ai/dsh-client-ui-session",
+        "@deepseek-ai/dsh-client-ui-chat"
       ],
       "platform": "web"
     }
@@ -78,26 +81,35 @@
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "sync:skill": "node scripts/sync-skill.mjs",
     "verify:skill": "node scripts/sync-skill.mjs --check",
-    "verify": "node scripts/verify.mjs && node scripts/fallback-tdd.mjs && node scripts/quality-gates-tdd.mjs && node scripts/lifecycle-verify.mjs && node scripts/stress-verify.mjs && pnpm verify:skill",
-    "prepublishOnly": "pnpm build && pnpm verify"
+    "verify": "node scripts/verify.mjs && node scripts/fallback-tdd.mjs && node scripts/quality-gates-tdd.mjs && node scripts/lifecycle-verify.mjs && node scripts/stress-verify.mjs && pnpm verify:web-routes && pnpm verify:release && pnpm verify:skill",
+    "prepublishOnly": "pnpm build && pnpm verify",
+    "verify:web-routes": "node scripts/web-routes-verify.mjs",
+    "verify:release": "node --test scripts/release-metadata.test.mjs"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1-rc.1",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-layout": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-model-selection": "^0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-commands": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-subagent": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "^3.18.1-rc.1",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-chat": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-layout": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-model-selection": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-session": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-commands": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-subagent": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-util-values": "^0.1.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
@@ -107,10 +119,19 @@
     "@deepseek-ai/dsh-agent": {
       "optional": true
     },
+    "@deepseek-ai/dsh-api-session-controller": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-client-locale": {
       "optional": true
     },
-    "@deepseek-ai/dsh-client-runtime": {
+    "@deepseek-ai/dsh-client-store": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-chat": {
       "optional": true
     },
     "@deepseek-ai/dsh-client-ui-conversation": {
@@ -125,6 +146,12 @@
     "@deepseek-ai/dsh-client-ui-primitives": {
       "optional": true
     },
+    "@deepseek-ai/dsh-client-ui-renderer": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-session": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-client-ui-slots": {
       "optional": true
     },
@@ -137,6 +164,9 @@
     "@deepseek-ai/dsh-session": {
       "optional": true
     },
+    "@deepseek-ai/dsh-session-projection": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-subagent": {
       "optional": true
     },
@@ -146,6 +176,9 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     },
+    "@deepseek-ai/dsh-util-values": {
+      "optional": true
+    },
     "@deepseek-ai/schemastery": {
       "optional": true
     },
@@ -154,23 +187,31 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-commands": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-subagent": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-workspace": "0.1.0-rc.8",
-    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-session-controller": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-chat": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-session": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-commands": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-subagent": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-util-values": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-workspace": "0.1.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.2",
     "@types/node": "^24.13.3",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.7",

package/release-notes/v0.1.15-alpha.1.md

@@ -0,0 +1,61 @@
+# AgentTeams v0.1.15-alpha.1
+
+## Compatibility first
+
+**Requires DeepSeek Harness 0.1.2-alpha.2.** This is an opt-in Alpha release,
+published to npm **alpha**. **latest remains 0.1.14** for the previous host line.
+There is no dual-version adapter and the plugin does not upgrade Harness for you.
+
+```sh
+# First verify that the Harness instance you run is 0.1.2-alpha.2.
+dsh --version
+dsh plugin --profile web add @nanmicoder/dsh-agent-teams@0.1.15-alpha.1
+```
+
+Keep a working older host/plugin pair if you cannot update Harness. The previous
+baseline was Harness **0.1.0-rc.8 + plugin 0.1.14**:
+
+```sh
+dsh plugin --profile web add @nanmicoder/dsh-agent-teams@0.1.14
+```
+
+Restart the matching host and refresh the browser. Source users must update and
+rebuild the actual Harness checkout too. See the README for upgrade and rollback
+instructions; neither every older RC nor future Alpha versions are claimed as supported.
+
+## Changes
+
+- Restore the Web client on Alpha.2 using its current conversation, session,
+  store and subagent APIs; remove the retired client-runtime dependency.
+- Pin the development dependency graph to Alpha.2 and validate the packaged plugin.
+- Protect raw state, plan, halt and artwork routes with host authentication and
+  Host/Origin checks; fail closed when the Connection service is unavailable.
+- Keep prereleases away from npm/GitHub latest through explicit channel metadata,
+  publication flags and regression checks.
+
+## Validation
+
+Real DeepSeek API calls in `/tmp`, including a three-member order-settlement
+workflow producing JSON, offline HTML and an independent review. Human UI tests
+covered plan revision/approval/discard, invalid dependencies, member navigation,
+interruption/continuation, refresh recovery, locales/themes and 390px layouts.
+Model output mistakes required human correction and member continuation; this
+does not claim unattended business correctness. See
+[the acceptance record](https://github.com/NanmiCoder/dsh-agent-teams/blob/v0.1.15-alpha.1/docs/alpha2-release-acceptance.md).
+
+Full build/verification and real HTTP authentication regression checks passed
+locally. Real API/UI coverage is macOS arm64 + Alpha.2 + DeepSeek Flash; Docker
+was unavailable. Linux Actions run the build and automated checks before publish.
+
+## 中文说明
+
+本版只对应 **Harness 0.1.2-alpha.2**，通过 **alpha** 渠道发布，
+**latest 保留 0.1.14**。没有安装 Alpha.2、或实际运行的 Harness 源码未更新，
+请保留原先可用的旧插件；原验证基线为宿主 0.1.0-rc.8 + 插件 0.1.14。
+升级插件不会自动升级宿主。更新后必须重启对应宿主并刷新浏览器；
+回退时也要匹配宿主与插件版本，不需要删除凭据或团队数据。
+
+本次修复 Alpha.2 下插件无法加载的问题，并补齐 Web 路由认证。
+已用真实 API 完成订单分析、报表生成和独立复核，并在真实 UI 中验证计划审核、
+修改、取消、成员续跑、刷新、多语言、主题和手机宽度。
+业务产物曾出现模型执行偏差，已通过人工反馈和成员续跑修正，详见验收记录。