@xmanrui/dsh-im 4.17.0 → 4.17.1

package/README.en.md

@@ -226,6 +226,8 @@ DingTalk menus use a shared template built into the plugin; no template setup is
 
 ## Local development
 
+The Web profile is verified with unmodified DSH `0.1.2-alpha.4`, `0.1.2-alpha.5`, `0.1.2-rc.1`, `0.1.3-alpha.1`, and `0.1.5-alpha.1`. All use the same dsh-im management RPC adapter through the public Connection `/api` Fetch registry; no DSH patch or rebuild is required. After upgrading the plugin, restart the Host and refresh the settings page so both sides use the same plugin build.
+
 ```sh
 npm install
 npm run check
@@ -242,7 +244,7 @@ IM management RPCs accept loopback browsers by default. When a Web profile is de
     rpcAuthority: trusted-host
 ```
 
-`trusted-host` reuses Harness's Host/Origin fence; it is not user authentication. Anyone who can reach that LAN authority can inspect bot status, scan or submit application credentials, reconnect bots, and remove bots. Enable it only on a trusted network.
+`trusted-host` allows trusted authorities to reach IM management after Harness browser authentication and Host/Origin checks. The default `loopback` policy additionally requires loopback Host and Origin values; update and inbound TTL management always remain loopback-only.
 
 ### Bot chat message language
 

package/README.md

@@ -232,6 +232,8 @@ Logo 由 dsh-im 的浏览器适配显示，无需修改 DSH。适配保留原始
 
 ## 本地开发
 
+Web profile 已验证兼容原版 DSH `0.1.2-alpha.4`、`0.1.2-alpha.5`、`0.1.2-rc.1`、`0.1.3-alpha.1` 和 `0.1.5-alpha.1`。这些版本共用 dsh-im 的管理 RPC 适配，通过 Connection 的公开 `/api` Fetch 注册接口工作，无需修改或重新编译 DSH。升级插件后重启 Host 并刷新设置页，使 Host 和客户端使用同一版插件。
+
 ```sh
 npm install
 npm run check
@@ -248,7 +250,7 @@ IM 管理 RPC 默认仅接受回环浏览器。如果 Web profile 在受信任
     rpcAuthority: trusted-host
 ```
 
-`trusted-host` 只复用 Harness 的 Host／Origin 防护，不是用户认证。启用后，能访问该局域网地址的人也能查看机器人状态、扫码或提交应用凭据、重连和删除机器人；只应在可信网络中使用。
+`trusted-host` 允许已通过 Harness 浏览器认证和 Host／Origin 检查的受信任地址访问 IM 管理接口。默认 `loopback` 还要求回环 Host 和 Origin；更新与入站 TTL 管理始终仅允许回环访问。
 
 ### 聊天消息语言
 

package/lib/client.js

@@ -566,12 +566,23 @@ __export(index_exports, {
   name: () => name
 });
 module.exports = __toCommonJS(index_exports);
+
+// plugin-src/management-rpc.mjs
+function rpcEndpoint(channel4) {
+  if (!/^\/[A-Za-z0-9._~-]+$/.test(channel4)) throw new TypeError("Invalid IM RPC channel");
+  return `dsh-im${channel4}`;
+}
+function callManagementRpc(connection, channel4, method, payload, signal) {
+  return connection.rpc.call("/api", rpcEndpoint(channel4), { method, payload }, signal);
+}
+
+// plugin-src/client/index.js
 var React28 = __toESM(require("react"), 1);
 
 // package.json
 var package_default = {
   name: "@xmanrui/dsh-im",
-  version: "4.17.0",
+  version: "4.17.1",
   description: "\u628A\u5341\u79CD IM \u673A\u5668\u4EBA\u548C\u516C\u7F51 AI Office \u63A5\u5165\u672C\u673A DeepSeek Harness\u3002 Connect ten IM channels and a public AI Office to a local DeepSeek Harness.",
   keywords: [
     "deepseek-harness",
@@ -668,12 +679,13 @@ var package_default = {
       platform: "web"
     },
     compatibility: {
-      dsh: "0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.1",
+      dsh: "0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1",
       dshReleases: {
         "0.1.2-alpha.4": "compatible",
         "0.1.2-alpha.5": "compatible",
         "0.1.2-rc.1": "compatible",
-        "0.1.3-alpha.1": "compatible"
+        "0.1.3-alpha.1": "compatible",
+        "0.1.5-alpha.1": "compatible"
       },
       profiles: [
         "web"
@@ -17516,20 +17528,20 @@ function apply(ctx) {
       for (const dispose of disposers.reverse()) dispose();
     };
   }, "im-settings: install combined channel styles");
-  const feishuRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(FEISHU_RPC_CHANNEL, endpoint, payload, signal);
-  const weixinRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(WEIXIN_RPC_CHANNEL, endpoint, payload, signal);
-  const dingtalkRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(DINGTALK_RPC_CHANNEL, endpoint, payload, signal);
-  const qqRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(QQ_RPC_CHANNEL, endpoint, payload, signal);
-  const wecomRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(WECOM_RPC_CHANNEL, endpoint, payload, signal);
-  const wecomAppRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(WECOM_APP_RPC_CHANNEL, endpoint, payload, signal);
-  const telegramRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(TELEGRAM_RPC_CHANNEL, endpoint, payload, signal);
-  const discordRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(DISCORD_RPC_CHANNEL, endpoint, payload, signal);
-  const whatsappRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(WHATSAPP_RPC_CHANNEL, endpoint, payload, signal);
-  const slackRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(SLACK_RPC_CHANNEL, endpoint, payload, signal);
-  const officeRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(OFFICE_RPC_CHANNEL, endpoint, payload, signal);
-  const updateRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(UPDATE_RPC_CHANNEL, endpoint, payload, signal);
-  const deliveryRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(DELIVERY_RPC_CHANNEL, endpoint, payload, signal);
-  const globalSettingsRpcCall = (endpoint, payload, signal) => ctx.connection.rpc.call(GLOBAL_SETTINGS_RPC_CHANNEL, endpoint, payload, signal);
+  const feishuRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, FEISHU_RPC_CHANNEL, endpoint, payload, signal);
+  const weixinRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, WEIXIN_RPC_CHANNEL, endpoint, payload, signal);
+  const dingtalkRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, DINGTALK_RPC_CHANNEL, endpoint, payload, signal);
+  const qqRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, QQ_RPC_CHANNEL, endpoint, payload, signal);
+  const wecomRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, WECOM_RPC_CHANNEL, endpoint, payload, signal);
+  const wecomAppRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, WECOM_APP_RPC_CHANNEL, endpoint, payload, signal);
+  const telegramRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, TELEGRAM_RPC_CHANNEL, endpoint, payload, signal);
+  const discordRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, DISCORD_RPC_CHANNEL, endpoint, payload, signal);
+  const whatsappRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, WHATSAPP_RPC_CHANNEL, endpoint, payload, signal);
+  const slackRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, SLACK_RPC_CHANNEL, endpoint, payload, signal);
+  const officeRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, OFFICE_RPC_CHANNEL, endpoint, payload, signal);
+  const updateRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, UPDATE_RPC_CHANNEL, endpoint, payload, signal);
+  const deliveryRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, DELIVERY_RPC_CHANNEL, endpoint, payload, signal);
+  const globalSettingsRpcCall = (endpoint, payload, signal) => callManagementRpc(ctx.connection, GLOBAL_SETTINGS_RPC_CHANNEL, endpoint, payload, signal);
   const workspaceDirectoryPicker = Object.freeze({
     listDirectory: (path, signal) => callWorkspaceDirectoryApi(ctx, "listDirectory", path, signal),
     pickDirectory: () => callWorkspaceDirectoryApi(ctx, "pickDirectory")