@sparkelf/dsh-plus 0.1.0-rc.9 → 0.2.0-rc.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/plus/README.md
-README.md: 2f9e94124db0aa48ae4f0ba34e4feca7fce5a30d
-README.zh.md: af82ed3b2543bb765be6759ae582b65c67c7cf4f
+README.md: 6bba650085777934ec620db2c4595f1f86902fd0
+README.zh.md: f4326b76dc011c2f41693105937e6532a5a277b0

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-This distribution composes official `@deepseek-ai/dsh-base` and `@deepseek-ai/dsh-web-app` with the selected external sidebar, mobile bridge, plugin market, GenUI package, five complete Plus capability packages, and nine independent patch packages. It owns only ordered composition, minimum compatibility metadata, dependency closure, explicit materialization, and the credential-free deployment lock; capability behavior and patch payloads stay in their owning packages.
+This distribution composes official `@deepseek-ai/dsh-base` and `@deepseek-ai/dsh-web-app` with selected Office, MinerU, mobile, market, GenUI, and Supervisor packages, four in-repository Plus capability packages, and twelve independent patch packages. It owns only ordered composition, minimum compatibility metadata, dependency closure, explicit materialization, and the credential-free deployment lock; capability behavior and patch payloads stay in their owning packages.
 
 ## Table of Contents
 
@@ -31,9 +31,11 @@ dsh plugin --profile plus exec dsh-plus apply --dsh-root /path/to/official-dsh
 dsh --profile plus
 ```
 
-The explicit apply step requires official revision `cd5ef8148158c3a752a658978873241fdf8e2bbc`, materializes every selected runtime package as a profile-direct dependency, applies all pending source payloads together, configures exact npm patches, removes retired Plus-owned entries, and writes `.dsh-plus/patchset.lock.json` with mode `0600`. Version conflicts and source mismatches fail before profile installation or source mutation. The package has no install lifecycle script.
+The explicit rc24 apply step requires official revision `fb2c4b9e698e30edb738bca4cf0618587db7d203`, applies every pending source payload, configures exact npm patches, removes retired Plus-owned entries, and writes `.dsh-plus/patchset.lock.json` with mode `0600`. Patched official source workspaces always replace clean CLI packages in the profile scope. The profile resolves SQL Workbench 0.5.0, Workbench Vault 0.1.1, SSH Manager 0.7.0, API Client 0.5.0, Supervisor 0.1.4, GenUI 0.9.9, dshmarket 1.45.1, OfficeCLI 0.1.1, MinerU 0.1.1, and Mobile Bridge 0.2.11 from npm. Version conflicts, source mismatches, missing bundles, and runtime closure drift stop promotion.
 
-Official DSH supplies onboarding, Workspace selection, Session export, Turn folding, and the base image path. The external `@changfenhuang/dsh-genui` bundle owns generated UI, including inline interactive charts emitted by the model as `dsh-ui`. The temporary GenUI streaming EChart patch targets only `0.9.6` and retires after [upstream PR #87](https://github.com/omdsh-dev/dsh-genui/pull/87) ships in npm and the real inline-chart path passes. DataOps and Document Attachments mount only when their endpoint environment variables exist. Agent Teams is excluded because the official packages are private experimental workspaces and shipped profiles disable them.
+Official DSH supplies Sidebar navigation, file and text preview, Session search, generic file upload, durable attachment cards, read-only model paths, onboarding, Workspace selection, Session export, and Turn folding. Plus configures the official SQLite Session query provider to open on first search with a durable derived index at `$DSH_HOME/storages/session-query.sqlite`; canonical compressed JSONL remains the history source. Plus adds an OfficeCLI tool for original DOCX/XLSX/PPTX production and a MinerU PDF tool that consumes the official uploaded-file path without a prompt hook. It replaces mixed English `Session` wording in the Simplified-Chinese export UI, places the desktop Session-log action immediately before Trajectory search while retaining its Header position on phones, and keeps composer permission and model popovers inside the center column with 12px horizontal clearance. `@changfenhuang/dsh-genui@0.9.9` now contains the previously patched streaming EChart behavior. The registry-pinned Supervisor manages the materialized runtime and restores Sessions interrupted by its own restart. DataOps and MinerU mount only when their endpoint environment variables exist. Agent Teams remains excluded because official shipped profiles disable those private experimental packages.
+
+Plus explicitly selects `browserAuthentication: disabled`: its Web URL is clean and opens without a process-token exchange or browser cookie, while Connection still applies the official Host/Origin trust fence. Every process that can reach an accepted authority can therefore use the complete Host API, including Shell, files, and Sessions. The official `web` profile keeps the upstream `required` default; only the Plus composition opts out.
 
 -----
 
@@ -68,6 +70,7 @@ Independent by itself. The profile changes a request prefix only when one of its
 
 This Dev Note is working context for maintainers; shipped behavior, limits, and rationale live in the sections above, the package code, and the linked Agent Note.
 
-- The [distribution Agent Note](../../../.agents/notes/proposed/architecture/2026-08-29-ranged-plus-patchset-distribution.md) owns package forms, inventory, materialization, and deletion rules; `src/apply.ts` and `cordis.patch.yml` own the executable profile behavior.
+- The [distribution Agent Note](../../../.agents/notes/implemented/architecture/2026-08-29-ranged-plus-patchset-distribution.md) owns package forms, inventory, materialization, and deletion rules; `src/apply.ts` and `cordis.patch.yml` own the executable profile behavior.
+- No runtime invariant companion is published because profile and patchset validity is checked before materialization and the bundle owns no independent runtime observation.
 
 </details>

package/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-bundle"
 
 ## 概述
 
-该distribution把official `@deepseek-ai/dsh-base`及`@deepseek-ai/dsh-web-app`与selected external sidebar、mobile bridge、plugin market、GenUI package、五个完整Plus capability packages及九个independent patch packages组合起来。它只持有ordered composition、minimum compatibility metadata、dependency closure、explicit materialization及credential-free deployment lock；capability behavior和patch payloads仍属于各自package。
+该distribution把official `@deepseek-ai/dsh-base`及`@deepseek-ai/dsh-web-app`与selected Office、MinerU、mobile、market、GenUI及Supervisor packages、四个in-repository Plus capability packages及十二个independent patch packages组合起来。它只持有ordered composition、minimum compatibility metadata、dependency closure、explicit materialization及credential-free deployment lock；capability behavior和patch payloads仍属于各自package。
 
 ## 目录
 
@@ -31,9 +31,11 @@ dsh plugin --profile plus exec dsh-plus apply --dsh-root /path/to/official-dsh
 dsh --profile plus
 ```
 
-explicit apply步骤要求official revision `cd5ef8148158c3a752a658978873241fdf8e2bbc`，把每个selected runtime package materialize为profile-direct dependency，一次应用全部pending source payloads，配置exact npm patches，删除retired Plus-owned entries，并以`0600` mode写入`.dsh-plus/patchset.lock.json`。version conflict和source mismatch会在profile installation或source mutation前失败。该package没有install lifecycle script。
+rc24 explicit apply步骤固定official revision `fb2c4b9e698e30edb738bca4cf0618587db7d203`，一次应用全部pending source payloads，配置exact npm patches，删除retired Plus-owned entries，并以`0600` mode写入`.dsh-plus/patchset.lock.json`。profile中的patched official source workspaces始终覆盖clean CLI packages。profile从npm解析SQL Workbench 0.5.0、Workbench Vault 0.1.1、SSH Manager 0.7.0、API Client 0.5.0、Supervisor 0.1.4、GenUI 0.9.9、dshmarket 1.45.1、OfficeCLI 0.1.1、MinerU 0.1.1及Mobile Bridge 0.2.11。version conflict、source mismatch、bundle缺失和runtime closure drift都会阻止promotion。
 
-Official DSH提供onboarding、Workspace selection、Session export、Turn folding及base image path。External `@changfenhuang/dsh-genui` bundle拥有generated UI，包括模型以`dsh-ui`输出的inline interactive charts。Temporary GenUI streaming EChart patch只target `0.9.6`；[upstream PR #87](https://github.com/omdsh-dev/dsh-genui/pull/87)进入npm且真实inline-chart path通过后退役。DataOps和Document Attachments仅在对应endpoint environment variables存在时mount。Agent Teams被排除，因为official packages属于private experimental workspaces且shipped profiles会禁用它们。
+Official DSH提供Sidebar navigation、file与text preview、Session search、generic file upload、durable attachment cards、model-visible readonly paths、onboarding、Workspace selection、Session export及Turn folding。Plus把official SQLite Session query provider配置为首次搜索时打开，持久派生索引位于`$DSH_HOME/storages/session-query.sqlite`，canonical compressed JSONL仍为history source。Plus增加用于生成原始DOCX/XLSX/PPTX的OfficeCLI工具，以及无需prompt hook、直接消费official uploaded-file path的MinerU PDF工具；同时把简体中文导出界面中混用的英文`Session`替换为中文，在桌面端把会话日志操作放到Trajectory搜索框紧邻左侧，在手机上保留其Header位置，并让composer permission与model popover保持在center column内且水平边缘各留12px间距。`@changfenhuang/dsh-genui@0.9.9`已内含此前patch的streaming EChart behavior。registry-pinned Supervisor管理materialized runtime并恢复被自身restart中断的Sessions。DataOps和MinerU仅在对应endpoint environment variables存在时mount。Agent Teams仍被排除，因为official shipped profiles禁用这些private experimental packages。
+
+Plus显式选择`browserAuthentication: disabled`：其Web URL保持clean，无需process-token exchange或browser cookie即可打开，同时Connection仍执行official Host/Origin trust fence。因此所有能访问accepted authority的进程都能使用包含Shell、files与Sessions在内的完整Host API。official `web` profile保留upstream `required` default；只有Plus composition选择关闭。
 
 -----
 
@@ -68,6 +70,7 @@ Official DSH提供onboarding、Workspace selection、Session export、Turn foldi
 
 该开发备注是maintainer working context；shipped behavior、limits及rationale以以上sections、package code及linked Agent Note为准。
 
-- [Distribution Agent Note](../../../.agents/notes/proposed/architecture/2026-08-29-ranged-plus-patchset-distribution.zh.md)持有package forms、inventory、materialization及deletion rules；`src/apply.ts`和`cordis.patch.yml`持有executable profile behavior。
+- [Distribution Agent Note](../../../.agents/notes/implemented/architecture/2026-08-29-ranged-plus-patchset-distribution.zh.md)持有package forms、inventory、materialization及deletion rules；`src/apply.ts`和`cordis.patch.yml`持有executable profile behavior。
+- 该package不发布`./invariant` companion，因为profile与patchset validity会在materialization前检查，且bundle没有independent runtime observation。
 
 </details>

package/cordis.patch.yml

@@ -1,6 +1,16 @@
 - id: subagent-model-selection-settings
   disabled: true
 
+- id: connection
+  config:
+    trustedHosts: !!js ctx.webRuntime.trustedHosts
+    browserAuthentication: disabled
+
+- id: session-query-sqlite
+  config:
+    path: !!js dshHomePath('storages/session-query.sqlite')
+    openAt: first-search
+
 - insert:
     - id: plus-backup
       name: '@sparkelf/dsh-plugin-backup'
@@ -17,21 +27,14 @@
         toolCallTimeoutMs: 60000
         failOnStartupError: false
 
-    - id: plus-document-parser
-      name: '@sparkelf/dsh-plugin-document-attachments'
-      disabled: !!js "!process.env.DSH_MINERU_ENDPOINT"
-      config:
-        provider: mineru
-        maxDirectMarkdownBytes: 1048576
-        maxRequestBytes: 402653184
-
-    - id: plus-document-parser-mineru
-      name: '@sparkelf/dsh-plugin-document-attachments/mineru'
-      disabled: !!js "!process.env.DSH_MINERU_ENDPOINT"
+    # A disabled root node carries the package's Web Settings entry into the
+    # client inventory; the startup nodes below exclusively own Host schemas.
+    - id: plus-subagent-settings-client
+      name: '@sparkelf/dsh-plugin-subagent-settings'
       config:
-        endpoint: !!js process.env.DSH_MINERU_ENDPOINT
-        timeoutMs: 120000
-        maxResponseBytes: 67108864
+        provider: spawn
+        enabled: false
+        enableRunInBackground: false
 
     - id: plus-subagent-settings
       name: '@sparkelf/dsh-plugin-subagent-settings/startup'