@wot-ui/cli 1.1.0 → 1.2.0

package/dist/{server-TCmh-5rB.mjs → server-CxOzENpT.mjs}

@@ -1,4 +1,4 @@
-import { _ as version, c as toComponentSummary, g as name, h as loadMetadataFile, i as lintProject, l as toDemoSummary, m as resolveVersion, n as getCliUpdateStatus, o as findComponent, s as listComponents } from "./update-check-DjA3lf-3.mjs";
+import { _ as version, c as toComponentSummary, g as name, h as loadMetadataFile, i as lintProject, l as toDemoSummary, m as resolveVersion, n as getCliUpdateStatus, o as findComponent, s as listComponents } from "./update-check-C6Y0GckX.mjs";
 import process from "node:process";
 import { McpServer, StdioServerTransport } from "@modelcontextprotocol/server";
 import * as z from "zod/v4";

package/dist/{update-check-DjA3lf-3.mjs → update-check-C6Y0GckX.mjs}

@@ -8,7 +8,7 @@ import { parse } from "@vue/compiler-sfc";
 
 //#region package.json
 var name = "@wot-ui/cli";
-var version = "1.1.0";
+var version = "1.2.0";
 
 //#endregion
 //#region src/data/loader.ts

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wot-ui/cli",
   "type": "module",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "面向 wot-ui 的 CLI、MCP 与数据提取工具集",
   "license": "MIT",
   "funding": "https://github.com/Moonofweisheng/sponsors",
@@ -35,6 +35,7 @@
   "files": [
     "data",
     "dist",
+    "runtime/*.mjs",
     "skills/wot-ui-cli",
     "skills/wot-ui-v2"
   ],
@@ -48,12 +49,14 @@
     "commander": "^14.0.0",
     "jsonc-parser": "^3.3.1",
     "smol-toml": "^1.7.0",
+    "yaml": "2.9.0",
     "zod": "^4.1.12"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^6.6.1",
     "@antfu/ni": "^28.0.0",
     "@antfu/utils": "^9.3.0",
+    "@fission-ai/openspec": "1.9.0",
     "@types/node": "^25.0.1",
     "@vitest/coverage-v8": "4.0.15",
     "baseline-browser-mapping": "^2.10.18",

package/runtime/deepseek-project-bridge.mjs

@@ -0,0 +1,197 @@
+import { createHash } from 'node:crypto'
+import { access, readFile, realpath, stat } from 'node:fs/promises'
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+
+export const inject = ['loader', 'tools']
+export const name = 'open-wot-project-bridge'
+export const declarationPath = '.dsh/wot-ui.json'
+
+export function digest(source) {
+  return createHash('sha256').update(source).digest('hex')
+}
+
+function keys(value, expected) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === expected.length && expected.every(key => Object.hasOwn(value, key))
+}
+
+export function parseDeclaration(source) {
+  let value
+  try {
+    value = JSON.parse(source)
+  }
+  catch { throw new Error('Invalid DeepSeek project JSON') }
+  const server = value?.server
+  if (!keys(value, ['schemaVersion', 'server']) || value.schemaVersion !== 1
+    || !keys(server, ['command', 'args']) || server.command !== 'npx'
+    || !Array.isArray(server.args) || server.args.length !== 3
+    || server.args[0] !== '-y' || server.args[2] !== 'mcp'
+    || typeof server.args[1] !== 'string'
+    || !/^@wot-ui\/cli(?:@[a-z\d][\w.+-]*)?$/i.test(server.args[1])) {
+    throw new Error('Unsupported DeepSeek project declaration; use wot mcp print --client deepseek')
+  }
+  return value
+}
+
+export function validateRegistry(config) {
+  if (!keys(config, ['schemaVersion', 'bridgeHash', 'projects']) || config.schemaVersion !== 1
+    || !/^[a-f\d]{64}$/.test(config.bridgeHash) || !Array.isArray(config.projects)
+    || config.projects.some(project => !keys(project, ['root', 'digest'])
+      || typeof project.root !== 'string' || !isAbsolute(project.root) || resolve(project.root) !== project.root
+      || !/^[a-f\d]{64}$/.test(project.digest))
+    || new Set(config.projects.map(project => project.root)).size !== config.projects.length) {
+    throw new Error('Conflicting or modified DeepSeek project bridge registration')
+  }
+  return config
+}
+
+export function within(root, path) {
+  const rel = relative(root, path)
+  return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
+}
+
+export async function gitRoot(cwd) {
+  let current = await realpath(cwd)
+  for (;;) {
+    try {
+      await access(join(current, '.git'))
+      return current
+    }
+    catch (error) {
+      if (error.code !== 'ENOENT')
+        throw error
+    }
+    const parent = dirname(current)
+    if (parent === current)
+      return undefined
+    current = parent
+  }
+}
+
+export class DeepseekProjectLocationError extends Error {}
+
+export async function installRoot(cwd) {
+  const root = await realpath(cwd)
+  if (!(await stat(root)).isDirectory())
+    throw new Error('DeepSeek project cwd must be a directory')
+  const git = await gitRoot(root)
+  if (git && git !== root)
+    throw new DeepseekProjectLocationError(`Run from the Git root using --cwd ${JSON.stringify(git)}`)
+  return root
+}
+
+export async function selectProject(cwd, projects) {
+  if (typeof cwd !== 'string' || !isAbsolute(cwd))
+    return undefined
+  const actual = await realpath(cwd)
+  const git = await gitRoot(actual)
+  const candidates = projects.filter(project => git ? project.root === git : within(project.root, actual))
+    .sort((a, b) => b.root.length - a.root.length)
+  for (const project of candidates) {
+    // A registration is tied to its real directory, not a movable symlink.
+    if (await realpath(project.root) === project.root)
+      return project
+  }
+}
+
+export async function readDeclaration(root) {
+  const path = join(root, declarationPath)
+  if (!within(root, await realpath(path)))
+    throw new Error('DeepSeek project declaration escapes its registered root')
+  const source = await readFile(path, 'utf8')
+  return { source, declaration: parseDeclaration(source) }
+}
+
+export async function apply(ctx, config) {
+  validateRegistry(config)
+  const mounts = new Map()
+  let stopped = false
+  let modulePromise
+  const cleanup = async () => {
+    stopped = true
+    await Promise.all([...mounts.values()].map(record => record.dispose()))
+  }
+  ctx.effect(() => cleanup)
+  ctx.on('agent/created', async ({ agent, signal }) => {
+    if (stopped || signal?.aborted || mounts.has(agent))
+      return
+    const record = {
+      disposed: false,
+      fiber: undefined,
+      disposal: undefined,
+      dispose() {
+        this.disposed = true
+        // Share pending/successful cleanup; let later lifecycles retry failures.
+        this.disposal ??= Promise.resolve().then(() => this.fiber?.dispose()).catch((error) => {
+          this.disposal = undefined
+          throw error
+        })
+        return this.disposal
+      },
+    }
+    mounts.set(agent, record)
+    const cancel = () => {
+      void record.dispose().catch(() => {})
+    }
+    signal?.addEventListener('abort', cancel, { once: true })
+    const release = agent.ctx.effect(() => async () => {
+      await record.dispose()
+      if (mounts.get(agent) === record)
+        mounts.delete(agent)
+    })
+    let diagnostic = 'project directory could not be resolved'
+    try {
+      const project = await selectProject(agent.session.header.cwd, config.projects)
+      if (!project) {
+        await release()
+        return
+      }
+      diagnostic = 'project declaration is unreadable or invalid'
+      const { source, declaration } = await readDeclaration(project.root)
+      diagnostic = 'project declaration changed; run init to renew its registration'
+      if (digest(source) !== project.digest)
+        throw new Error('Project declaration changed; run wot agent init --client deepseek again')
+      diagnostic = 'global wot-ui service conflicts with project isolation'
+      if (ctx.tools.schemas(agent).some(tool => tool.name.startsWith('mcp__wot-ui__')))
+        throw new Error('Global wot-ui service conflicts with project isolation; remove its user/profile registration')
+      diagnostic = 'host module resolution is incompatible with the project bridge'
+      modulePromise ??= Promise.all([
+        ctx.loader.import('@deepseek-ai/dsh-mcp-client'),
+        ctx.loader.import('@deepseek-ai/dsh-scope'),
+      ])
+      const [plugin, { scopeOf }] = await modulePromise
+      // A global client may be connecting or expose no tools yet. Inspect its
+      // public loader identity as well as the visible tool namespace.
+      diagnostic = 'global wot-ui registration conflicts with project isolation'
+      for (const entry of ctx.loader.entries()) {
+        if (!entry.disabled && scopeOf(entry.context) === undefined
+          && entry.options.name === '@deepseek-ai/dsh-mcp-client'
+          && (entry.fiber?.config ?? entry.options.config)?.serverName === 'wot-ui') {
+          throw new Error('Global wot-ui registration conflicts with project isolation')
+        }
+      }
+      if (stopped || record.disposed || signal?.aborted)
+        return
+      diagnostic = 'project MCP startup failed or was cancelled'
+      record.fiber = agent.ctx.plugin(plugin, {
+        ...declaration.server,
+        serverName: 'wot-ui',
+        transport: 'stdio',
+        cwd: project.root,
+        failOnStartupError: true,
+        reconnect: { enabled: false },
+      })
+      await record.fiber.await()
+      if (stopped || record.disposed || signal?.aborted)
+        await record.dispose()
+    }
+    catch {
+      await record.dispose().catch(() => {})
+      // Never log parser, command or plugin errors: they may include project secrets.
+      ctx.logger.warn(`open-wot: ${diagnostic}. Run wot agent doctor --client deepseek; reopen the session after fixing it.`)
+    }
+    finally {
+      signal?.removeEventListener('abort', cancel)
+    }
+  })
+}

package/skills/wot-ui-cli/references/overview.md

@@ -47,7 +47,7 @@
 | `doctor` | 检查文件和真实 MCP handshake |
 | `remove` | 删除 open-wot 托管内容 |
 
-`init/status/doctor/remove` 支持 `--client auto|all|claude|cursor|vscode|codex|opencode|antigravity`、`--scope`、`--with`、`--cwd`、`--format` 和 `--pin`。`init/remove` 支持 `--dry-run`、`--yes`；`doctor` 支持 `--timeout`。
+`init/status/doctor/remove` 支持 `--client auto|all|claude|cursor|vscode|codex|opencode|antigravity|deepseek`、`--scope`、`--with`、`--cwd`、`--format` 和 `--pin`。`init/remove` 支持 `--dry-run`、`--yes`；`doctor` 支持 `--timeout`。
 
 ### MCP
 
@@ -73,6 +73,7 @@
 | Codex | `.codex/config.toml` |
 | OpenCode | `opencode.json[c]` / `.opencode/opencode.json[c]` |
 | Antigravity | `.agents/mcp_config.json` |
+| DeepSeek Harness | `.dsh/wot-ui.json`（另需本机桥接登记） |
 
 一次接入所有客户端：
 
@@ -83,6 +84,8 @@ wot agent doctor --client all --timeout 30000
 
 默认 Agent 接入安装 MCP、`wot-ui-v2` Skill 和托管 Instructions。`wot-ui-cli` Skill 随 npm 包发布，但不默认安装到组件使用项目。
 
+DeepSeek 默认按项目隔离，初始化时会在 `$DSH_HOME`（默认 `~/.dsh`）安装共享 bridge 并登记项目；每台机器都需初始化，首次安装后需重启桌面版。显式接入请在 Git 根目录执行；`--client all` 初始化或移除时，如子目录不满足 DeepSeek 的项目 MCP 或 Skill 位置要求，会提示并跳过该客户端。`--scope user` 仅改变 MCP 配置位置，Skill 与 Instructions 仍在项目中。完整接入与迁移说明以 README 为准。
+
 MCP 提供 8 个 tools：
 
 ```text
@@ -104,6 +107,7 @@ src/application    MCP/Agent 编排和 ChangePlan
 src/mcp            Server、tools、prompts、adapters
 src/data           loader 和版本解析
 src/utils          文件、终端、项目扫描等公共能力
+runtime            DeepSeek 桌面项目加载 bridge
 scripts            extract、sync、compress
 data               多版本离线数据
 skills             Agent Skills
@@ -161,6 +165,6 @@ pnpm exec publint
 npm pack --dry-run --json
 ```
 
-发布包应包含 `dist/`、压缩数据、`data/versions.json`、`skills/wot-ui-v2` 和 `skills/wot-ui-cli`。
+发布包应包含 `dist/`、`runtime/deepseek-project-bridge.mjs`、压缩数据、`data/versions.json`、`skills/wot-ui-v2` 和 `skills/wot-ui-cli`。
 
 维护者使用 `pnpm release`。bumpp 默认更新版本、提交、创建 tag 并推送；`v*` tag 触发 GitHub Actions 发布。发布后检查 npm 版本、文件和 dist-tags，预发布版本不要占用 `latest`。