@senguoyun/dsh-arkme 0.1.16 → 0.1.23

package/README.md

@@ -1,10 +1,19 @@
 # Arkme DSH Plugin
 
+[![npm 版本](https://img.shields.io/npm/v/%40senguoyun/dsh-arkme?label=npm%20%E7%89%88%E6%9C%AC)](https://www.npmjs.com/package/@senguoyun/dsh-arkme)
+[![发布记录](https://img.shields.io/badge/%E5%8F%91%E5%B8%83%E8%AE%B0%E5%BD%95-GitHub-blue)](https://github.com/arkme-senx/arkme-dsh-plugin/releases)
+
 Arkme 的 DeepSeek Harness 集成插件，为 DSH 提供账号、记录、聊天、Bot、社区、通话和市集能力。
 
 - npm：[`@senguoyun/dsh-arkme`](https://www.npmjs.com/package/@senguoyun/dsh-arkme)
 - 源码：[`arkme-senx/arkme-dsh-plugin`](https://github.com/arkme-senx/arkme-dsh-plugin)
 
+## 版本与发布
+
+- 项目首页顶部的 **npm 版本** 徽章显示当前可通过 npm 安装的正式版本。
+- 功能分支只提交功能代码；版本号、更新说明和 GitHub Release 由合并后的发版流程统一处理。
+- 发版负责人通过 GitHub Actions 的“准备插件发版”创建发版 PR；合并后自动发布 npm、创建同版本 Git Tag 和 GitHub Release。详见[插件自动发版](docs/plugin-release.md)。
+
 ## 功能
 
 - 内置搜索页支持快记搜索、搜索历史、纯图片库和已生成 AI 视频快速入口；图片库采用桌面端多列视图并排除普通视频。

package/assets/desktop_call/arkme-video-linear.svg

@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M12.53 20.4201H6.21C3.05 20.4201 2 18.3201 2 16.2101V7.79008C2 4.63008 3.05 3.58008 6.21 3.58008H12.53C15.69 3.58008 16.74 4.63008 16.74 7.79008V16.2101C16.74 19.3701 15.68 20.4201 12.53 20.4201Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M19.52 17.0999L16.74 15.1499V8.83989L19.52 6.88989C20.88 5.93989 22 6.51989 22 8.18989V15.8099C22 17.4799 20.88 18.0599 19.52 17.0999Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M11.5 11C12.3284 11 13 10.3284 13 9.5C13 8.67157 12.3284 8 11.5 8C10.6716 8 10 8.67157 10 9.5C10 10.3284 10.6716 11 11.5 11Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/assets/desktop_call/bundle.js

@@ -45764,6 +45764,14 @@ function summarizeDiagPayload(payload = {}) {
 function diagLog(label, payload = {}) {
   try {
     console.log(`[DesktopCallDiag] ${label} ${safeJsonStringify(payload)}`);
+    try {
+      postToWebHostBridge({
+        type: "diag",
+        label,
+        detail: payload
+      });
+    } catch (_) {
+    }
   } catch (error) {
     console.log(
       `[DesktopCallDiag] ${label} ${safeJsonStringify({
@@ -46334,6 +46342,30 @@ function safeJsonStringify(value) {
     return "{}";
   }
 }
+function resolveWebHostCallRequestId() {
+  try {
+    const parsed = JSON.parse(String(window.name || "{}"));
+    return safeString(parsed?.callRequestId);
+  } catch (_) {
+    return "";
+  }
+}
+function postToWebHostBridge(message) {
+  if (!window.parent || window.parent === window) {
+    return false;
+  }
+  const callRequestId = resolveWebHostCallRequestId();
+  if (!callRequestId) {
+    return false;
+  }
+  const payload = typeof message === "string" ? message : safeJsonStringify(message);
+  window.parent.postMessage({
+    channel: "jotmo-desktop-call",
+    callRequestId,
+    message: payload
+  }, window.location.origin);
+  return true;
+}
 function escapeHtml(value) {
   return safeString(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
@@ -46443,9 +46475,11 @@ function postToFlutter(type, extra = {}) {
     message: safeString(extra.message)
   });
   const bridge = resolveFlutterBridge();
+  const postedToWebHost = postToWebHostBridge(payload);
   diagLog("post_to_flutter", {
     type,
     hasBridge: Boolean(bridge),
+    postedToWebHost,
     roomId: statePayload.roomId,
     callId: statePayload.callId,
     mediaType: statePayload.mediaType,
@@ -46455,12 +46489,52 @@ function postToFlutter(type, extra = {}) {
     connectionRole: state.connectionRole
   });
   if (!bridge) {
+    if (postedToWebHost) {
+      return true;
+    }
     console.warn("[DesktopCall] flutter bridge unavailable", payload);
     return false;
   }
   bridge.postMessage(payload);
   return true;
 }
+function postLocalTerminalToWebHost(type, message) {
+  const peer = getFlutterPeer();
+  const payload = safeJsonStringify({
+    type,
+    roomId: state.activeRoomId,
+    callId: state.activeCallId,
+    mediaType: state.activeMediaType,
+    statusText: safeString(message),
+    phase: CALL_PHASE.ending,
+    hasActiveCall: false,
+    audioEnabled: state.audioEnabled,
+    videoEnabled: state.videoEnabled,
+    speakerEnabled: state.speakerEnabled,
+    elapsedLabel: state.elapsedLabel,
+    caller: {
+      name: state.caller.name,
+      avatar: state.caller.avatar
+    },
+    peer: {
+      name: peer.name,
+      avatar: peer.avatar
+    },
+    userData: state.lastUserData,
+    reason: "local_hangup_hint",
+    message: safeString(message)
+  });
+  const posted = postToWebHostBridge(payload);
+  diagLog("local_terminal_web_host_hint", {
+    type,
+    posted,
+    roomId: state.activeRoomId,
+    callId: state.activeCallId,
+    mediaType: state.activeMediaType,
+    phase: state.phase
+  });
+  return posted;
+}
 function setStatusText(text) {
   state.lastStatusText = safeString(text);
 }
@@ -49191,8 +49265,22 @@ function markTerminalEmitted(payload = {}) {
   state.terminalBridgeKey = resolveCallSessionKey(payload);
 }
 async function finalizeTerminalState(type, payload = {}, statusText) {
+  diagLog("finalize_terminal_state_start", {
+    type,
+    payload: summarizeDiagPayload(payload),
+    statusText,
+    pendingLocalTerminalAction: state.pendingLocalTerminalAction,
+    terminalBridgeKey: state.terminalBridgeKey,
+    sessionKey: resolveCallSessionKey(payload)
+  });
   updateCallIdentity(payload);
   if (isTerminalAlreadyEmitted(payload)) {
+    diagLog("finalize_terminal_state_duplicate_skip", {
+      type,
+      payload: summarizeDiagPayload(payload),
+      terminalBridgeKey: state.terminalBridgeKey,
+      sessionKey: resolveCallSessionKey(payload)
+    });
     return;
   }
   markTerminalEmitted(payload);
@@ -49220,6 +49308,12 @@ async function finalizeTerminalState(type, payload = {}, statusText) {
   await cleanupActiveMedia();
   resetRuntimeState({ preserveBootstrap: true });
   render();
+  diagLog("finalize_terminal_state_done", {
+    type,
+    resolvedStatusText,
+    phase: state.phase,
+    terminalBridgeKey: state.terminalBridgeKey
+  });
 }
 async function attachRemoteView(userId) {
   const normalizedUserId = safeString(userId);
@@ -49696,13 +49790,18 @@ async function hangupCall() {
   if (!state.engine) {
     return;
   }
+  const engine = state.engine;
   state.pendingLocalTerminalAction = "hangup";
-  try {
-    await state.engine.hangup();
-  } catch (error) {
+  diagLog("hangup_call_start", captureRuntimeSnapshot({
+    pendingLocalTerminalAction: state.pendingLocalTerminalAction
+  }));
+  postLocalTerminalToWebHost("end", "\u901A\u8BDD\u5DF2\u7ED3\u675F");
+  void engine.hangup().catch(() => {
     state.pendingLocalTerminalAction = "";
-    throw error;
-  }
+    diagLog("hangup_call_engine_failed", captureRuntimeSnapshot());
+  });
+  await finalizeTerminalState("end", {}, "\u901A\u8BDD\u5DF2\u7ED3\u675F");
+  diagLog("hangup_call_done", captureRuntimeSnapshot());
 }
 async function requestToggleFullscreen() {
   state.activeDevicePopover = "";

package/assets/desktop_call/gallery-linear.svg

@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M7.2 21H16.8C19.8 21 21 19.8 21 16.8V7.2C21 4.2 19.8 3 16.8 3H7.2C4.2 3 3 4.2 3 7.2V16.8C3 19.8 4.2 21 7.2 21Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M8.5 10C9.32843 10 10 9.32843 10 8.5C10 7.67157 9.32843 7 8.5 7C7.67157 7 7 7.67157 7 8.5C7 9.32843 7.67157 10 8.5 10Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M3.67 17.95L7.37 15.46C7.96 15.06 8.81 15.11 9.34 15.57L9.59 15.79C10.17 16.29 11.1 16.29 11.68 15.79L14.8 13.11C15.38 12.61 16.31 12.61 16.89 13.11L20.85 16.51" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/assets/desktop_call/index.html

@@ -24,10 +24,11 @@
         const listeners = [];
         window.JotmoDesktopCallBridge = {
           postMessage(message) {
+            const payload = typeof message === "string" ? message : JSON.stringify(message);
             parent.postMessage({
               channel: "jotmo-desktop-call",
               callRequestId: context.callRequestId,
-              message,
+              message: payload,
             }, location.origin);
           },
         };
@@ -65,7 +66,8 @@
           }
         };
         ["process", "global", "module", "require"].forEach(blockGlobal);
-        import("./bundle.js").catch((error) => {
+        const bundleUrl = `./bundle.js?callRequestId=${encodeURIComponent(context.callRequestId || "idle")}`;
+        import(bundleUrl).catch((error) => {
           window.__JOTMO_DESKTOP_CALL_HOST__.postFlutterMessage(JSON.stringify({
             type: "fatal_error",
             message: error instanceof Error ? error.message : "呼叫界面加载失败",

package/assets/desktop_call/manifest.json

@@ -4,7 +4,7 @@
   "callEnginePackage": "@trtc/call-engine-lite-js",
   "callEngineRange": "^3.5.9",
   "upstreamBundleSha256": "6ff59d3eb9ce4d7556ba4054bac0df22ae279a7bccc56ccbf5712b6f475c95ce",
-  "bundleSha256": "dadd84a0f617a80bd969ed144db356edc6a82a58b4490483d45006813ee03278",
+  "bundleSha256": "839e0376d8916472d99fe4b0cbcc39b165c3dc96ac00b31b15fb3910bcdf6917",
   "iconSha256": "583d7dbd34069c5b50ca294a071637bbd3beed913cecdb91a202c001004eed45",
   "outgoingOnly": true
 }

package/assets/windows/manifest.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "platform": "win32",
+  "arch": "x64",
+  "file": "arkme-credential-helper.exe",
+  "sha256": "8b598f3f4facb0c785c3fbc29ccddb75a08e90528ba02a55fc6c996442ec4a16",
+  "sourceSha256": "7e2267aa232d4fbe785d2ab88bd707ab6edacd88bd454fda7f8017ddfc0335b6",
+  "goVersion": "go version go1.25.5 darwin/arm64"
+}

package/cordis.patch.yml

@@ -6,6 +6,7 @@
         authBaseUrl: https://api.jotmo.cc
         subjectBaseUrl: https://subject.jotmo.cc
         recordBaseUrl: https://record.jotmo.cc
+        dataBaseUrl: https://data.jotmo.cc
         chatBaseUrl: https://chat.jotmo.cc
         botBaseUrl: https://bot.jotmo.cc
         imBaseUrl: https://im.jotmo.cc
@@ -25,6 +26,7 @@
         relatedRecordingsEnabled: true
         geetestCaptchaId: ec81315ab8b0f18a7bfa13602d01e307
         interwovenMomentsEnabled: true
+        chatMemberJoinEventsEnabled: true
         allowNonLoopback: false
         allowProduction: true
         updateCheckEnabled: true

package/docs/consumer-plugin-contract.md

@@ -2,7 +2,7 @@
 
 `@senguoyun/dsh-arkme` owns authentication, OS credential-store access, SQLite caching, account isolation, remote synchronization, and retry semantics. A generated Consumer plugin owns only presentation and user interaction.
 
-The bundled UI uses only official DSH slots: `sidebar.footer.action` owns the launcher, inline Arkme directory, and a non-modal translucent React portal that floats the Arkme message surface over the center column; `settings.general.item` owns account controls. The plugin never registers or replaces `conversation`, so the native DSH Conversation remains mounted and remains perceptible through and around the frosted card. Consumers must not depend on private `sidebar.workspaces.virtual` or `main.surface` extensions.
+The bundled UI uses only official DSH slots. `sidebar`, `conversation`, and `details` compose the resident Arkme product shell; `settings.section` owns the single `arkme-account` section inside native DSH Settings; `shell.overlay` owns lifecycle dialogs. DSH owns Settings chrome, ordering, and scrolling, while `ArkmeSettingsSurface` owns only Arkme account content and actions. Consumers must not depend on private `sidebar.workspaces.virtual` or `main.surface` extensions.
 
 ## Browser SDK
 
@@ -91,6 +91,8 @@ Plugin update discovery and acknowledgement are lifecycle concerns owned by the
 
 `capabilities().features.outgoingCall` reports whether the Provider's bundled private-chat outgoing-call flow is installed. Contract v1 does not expose a Browser SDK method for starting or preparing calls: short-lived UserSig, room bootstrap data, raw user IDs, and WebRTC account values stay inside the built-in Host/runtime path. Consumers must not invoke raw `calls.outgoing.*` operations or recreate a credential-bearing call API.
 
+`capabilities().features.callHistory === true` advertises Browser-safe call-history access. `callHistory()` returns recent call records with opaque account-scoped `callRef` values, display metadata, result labels, summary status and summary previews. `callDetail(callRef)` accepts only an unchanged `callRef` from the Provider and returns safe metadata, participants, summary and transcript text. `retryCallSummary(callRef)` is a write-like operation and must only run from a current explicit human request to retry or regenerate that call summary. Consumers must never expect or reconstruct raw room IDs, WebRTC credentials, recording URLs, video URLs, signed media URLs or upstream tokens from this contract.
+
 `profile()` exposes only UI-safe fields: display name, nickname, avatar reference, Arkme ID, optional one-time Arkme ID change availability, account type, creation time, binding flags, and masked phone/email. Raw phone, raw email, real name, and credentials are intentionally excluded from contract v1. The model-facing `arkme_id_set` tool owns the one-time write workflow; the Browser SDK does not expose a profile mutation method.
 
 `readImage(avatarRef)` resolves an opaque image reference returned by `profile()` or `listSources()`. Private chats expose one optional `avatarRef`. Groups expose the preferred additive `groupAvatar` presentation plus legacy `avatarRefs`: `groupAvatar.slots` preserves the server-selected order for up to five members, including safe phone-default or generic fallbacks when a real image is absent, while legacy `avatarRefs` contains only resolvable real images. `memberCount`, `strategy`, and `computedAtMillis` describe the snapshot without exposing member or session identities. The Provider refreshes an authorized public profile image before downloading it and returns bounded PNG/JPEG/WebP/GIF base64 bytes; signed URLs, STS credentials and bearer tokens never enter the browser contract. Consumers must use `imageDataUrl()` (or decode the payload themselves) instead of concatenating OSS URLs or fetching an avatar reference directly.
@@ -105,6 +107,10 @@ Chat items returned by `readSource()` may include an opaque sender `avatarRef`.
 
 Timeline items may include `contentBlocks` for image, video, audio, and file content. Long articles use the owner contract's `templateKind: 8`; `displayKind: 1` remains accepted only as a compatibility signal for previously sent plugin records. Each block's `mediaRef` is account-bound and short-lived. Render it with `sdk.mediaUrl(mediaRef)`; never decode or persist it. `upload()` sends a browser file only to the same-origin plugin route and returns an Arkme asset descriptor for `sendRich()`.
 
+`capabilities().features.forwardContent === true` advertises expanded `readSource()` forward snapshots. `forwardRecords.items` may contain `sourceType`, `segments` (speaker, full text, relative start/end milliseconds), `contentBlocks` and `mediaUnavailable`. Segment audio also uses `contentBlocks`, never raw URLs. The same snapshot is returned to the built-in UI and `arkme_source_read`. Missing optional fields on older Providers mean text-only rendering, not an error. Unknown source types remain `unknown`; filenames must not determine recording type. No original chat name or source access is implied. A transcript with no attachment is not playable. `truncated` marks bounded output (100 flattened records, nesting depth four; up to 500 segments per record / 2000 total; 32 attachments per record). Display it as partial, never silently claim a complete archive.
+
+Consumers retain no additional resources for a one-shot `readSource()`. If they call `subscribe()`, invoke its returned unsubscribe function on disposal. Refresh the received timeline when a media reference expires; do not query the private original recording or cache/decode its reference. Unsupported `contractVersion` is rejected by `capabilities()`; an absent optional `forwardContent` feature falls back to the existing text snapshot.
+
 Long-article detail and update calls always include the opaque `sourceRef` and stable record UID. The Provider reloads the Record owner detail, verifies source membership and author ownership, and forwards the current `version` to the existing CAS update endpoint. A failed or stale update must retain the editor content and must never be retried by creating a second record. Draft helpers persist only title, body and duration in Provider state and isolate them by account, source and edited record.
 
 The Provider exposes one facade while preserving owner boundaries: default-category/topic reads and sends go to Record, while private/group reads and sends go to Chat. Consumers must not treat these business objects as interchangeable merely because they share the same UI shell.

package/docs/plugin-release.md

@@ -0,0 +1,23 @@
+# 插件自动发版
+
+日常功能分支不修改 `package.json.version` 或 `arkme.updateNotice`。功能合并到 `master` 后，由发版负责人在 GitHub 的 **Actions → 准备插件发版 → Run workflow** 中选择发版级别并填写一句更新说明。
+
+该工作流会自动创建 `release/v<版本号>` 发版 PR，并在其中更新版本号、插件内更新说明和 GitHub Release 链接，随后执行完整测试、类型检查和构建。
+
+合并该发版 PR 后，发布工作流会再次验证代码，发布 npm 包、创建 `v<版本号>` Git Tag，并生成 GitHub Release。
+
+## 一次性配置
+
+在 npm 包 `@senguoyun/dsh-arkme` 的发布设置中创建 GitHub Trusted Publisher，绑定：
+
+- GitHub Organization：`arkme-senx`
+- Repository：`arkme-dsh-plugin`
+- Workflow：`publish-plugin-release.yml`
+
+Trusted Publisher 配置完成后，GitHub Actions 通过短期身份凭据发布 npm，不需要把 npm Token 保存到 GitHub Secrets。
+
+## 版本选择
+
+- `patch`：修复和小优化，如 `0.1.19 → 0.1.20`。
+- `minor`：新增一组用户可见能力，如 `0.1.19 → 0.2.0`。
+- `major`：存在不兼容变更时使用。

package/docs/third-party-notices.md

@@ -0,0 +1,13 @@
+# Third-party notices
+
+## Mediabunny 1.55.2
+
+The browser bundle includes unmodified Mediabunny code, copyright (c) Vanilagy,
+licensed under the Mozilla Public License 2.0 (MPL-2.0).
+
+- License: https://www.mozilla.org/MPL/2.0/
+- Exact source distribution (includes `src` and `LICENSE`): https://registry.npmjs.org/mediabunny/-/mediabunny-1.55.2.tgz
+- Project: https://github.com/Vanilagy/mediabunny
+
+Mediabunny is used to demux/remux AAC voice media for local browser playback.
+It is not used to upload media or run an external transcoding service.