@xrn1997/dsh-session-delete 0.5.0 → 0.6.1

package/package.json

@@ -1,117 +1,122 @@
-{
-  "name": "@xrn1997/dsh-session-delete",
-  "version": "0.5.0",
-  "description": "在 DeepSeek Harness 里删除会话：删除=移入回收站（可恢复），另设显式彻底删除",
-  "type": "module",
-  "packageManager": "pnpm@11.25.0",
-  "main": "lib/index.js",
-  "types": "lib/types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/types/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./client": {
-      "types": "./lib/types/client/index.d.ts",
-      "default": "./lib/client.js"
-    },
-    "./locale/*.json": "./locale/*.json",
-    "./package.json": "./package.json"
-  },
-  "icon": "./icon.svg",
-  "files": [
-    "lib/index.js",
-    "lib/client.js",
-    "lib/types/**/*.d.ts",
-    "locale",
-    "icon.svg",
-    "cordis.patch.yml",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=24",
-    "dsh": ">=0.1.7-rc.2 <0.3.0-0"
-  },
-  "scripts": {
-    "build": "tsdown && tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint .",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "pack:dry": "npm pack --dry-run --ignore-scripts",
-    "prepack": "npm run build",
-    "gates": "pnpm typecheck && pnpm lint && pnpm test && pnpm build && pnpm run pack:dry"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.4",
-    "react": "^18.3.1"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.4",
-    "@eslint/js": "^10.0.1",
-    "@testing-library/dom": "^10.4.2",
-    "@testing-library/jest-dom": "^6.10.0",
-    "@testing-library/react": "^16.3.3",
-    "@types/node": "24.19.0",
-    "@types/react": "18.3.31",
-    "@types/react-dom": "18.3.5",
-    "@types/semver": "^7.8.0",
-    "eslint": "^10.14.0",
-    "eslint-plugin-react-hooks": "^7.1.1",
-    "globals": "^17.13.0",
-    "jsdom": "^26.1.0",
-    "react": "^18.3.1",
-    "react-dom": "18.3.1",
-    "semver": "^7.8.5",
-    "tsdown": "0.23.0",
-    "typescript": "5.9.3",
-    "typescript-eslint": "^8.72.1",
-    "vitest": "3.2.7"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-locale"
-      ],
-      "platform": "web"
-    },
-    "compatibility": {
-      "dshReleases": {
-        "0.2.0-rc.2": "compatible",
-        "0.2.1-rc.1": "compatible",
-        "0.2.1-rc.2": "compatible",
-        "0.2.1-rc.3": "compatible",
-        "0.2.1-rc.5": "compatible"
-      }
-    }
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/xrn1997/dsh-session-delete.git"
-  },
-  "homepage": "https://github.com/xrn1997/dsh-session-delete#readme",
-  "bugs": {
-    "url": "https://github.com/xrn1997/dsh-session-delete/issues"
-  },
-  "keywords": [
-    "dsh",
-    "deepseek-harness",
-    "plugin",
-    "session",
-    "trash",
-    "delete"
-  ],
-  "author": "xrn1997",
-  "license": "Apache-2.0",
-  "dependencies": {
-    "react-markdown": "^10.1.0",
-    "remark-gfm": "^4.0.1"
-  }
-}
+{
+  "name": "@xrn1997/dsh-session-delete",
+  "version": "0.6.1",
+  "description": "在 DeepSeek Harness 里删除会话：删除=移入回收站（可恢复），另设显式彻底删除",
+  "type": "module",
+  "packageManager": "pnpm@11.25.0",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./locale/*.json": "./locale/*.json",
+    "./package.json": "./package.json"
+  },
+  "icon": "./icon.svg",
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/types/**/*.d.ts",
+    "locale",
+    "icon.svg",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=24",
+    "dsh": ">=0.1.7-rc.2 <0.3.0-0"
+  },
+  "scripts": {
+    "build": "tsdown && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "pack:dry": "npm pack --dry-run --ignore-scripts",
+    "prepack": "npm run build",
+    "gates": "pnpm typecheck && pnpm lint && pnpm test && pnpm build && pnpm run pack:dry"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "react": "^18.3.1"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@eslint/js": "^10.0.1",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/jest-dom": "^6.10.0",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "24.19.0",
+    "@types/react": "18.3.31",
+    "@types/react-dom": "18.3.5",
+    "@types/semver": "^7.8.0",
+    "eslint": "^10.14.0",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "globals": "^17.13.0",
+    "jsdom": "^26.1.0",
+    "react": "^18.3.1",
+    "react-dom": "18.3.1",
+    "react-markdown": "^10.1.0",
+    "remark-gfm": "^4.0.1",
+    "semver": "^7.8.5",
+    "tsdown": "0.23.0",
+    "typescript": "5.9.3",
+    "typescript-eslint": "^8.72.1",
+    "vitest": "3.2.7"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-context-menu"
+      ],
+      "platform": "web"
+    },
+    "compatibility": {
+      "dshReleases": {
+        "0.2.0-rc.2": "compatible",
+        "0.2.1-rc.1": "compatible",
+        "0.2.1-rc.2": "compatible",
+        "0.2.1-rc.3": "compatible",
+        "0.2.1-rc.5": "compatible",
+        "0.2.2-rc.1": "compatible"
+      }
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xrn1997/dsh-session-delete.git"
+  },
+  "homepage": "https://github.com/xrn1997/dsh-session-delete#readme",
+  "bugs": {
+    "url": "https://github.com/xrn1997/dsh-session-delete/issues"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "session",
+    "trash",
+    "delete"
+  ],
+  "author": "xrn1997",
+  "license": "Apache-2.0"
+}

package/lib/types/api/request-trust.d.ts

@@ -1,45 +0,0 @@
-/**
- * 请求栅栏：判一条打到 `/dsh-session-delete-api` 的请求归不归本插件办。
- *
- * 两件事分开：**归属**（Host / Origin / Referer 是不是本次部署自己的）与**身份**（远程客户端是不是
- * 宿主的已认证 Web 客户端）。绑定策略归宿主 webserver 配置——它只接受具体接口 IP 字面量、拒绝
- * wildcard——所以「谁能到达」不是本插件能替它决定的事；栅栏本身只防 browser confused deputy，
- * 身份留给宿主（见 ②）。口径与宿主 `/api` 的 `isTrustedApiRequest`（asar
- * `dsh-client-connection/lib/index.js`）对齐，差别只有一条：本模块多查 Referer，因为
- * `GET /attachment` 是二进制段（见末段）。
- *
- * 两条放行支，外加一条缺席规则：
- * ① 头栅栏全过 ∧ 源地址回环 ∧ Host 属于本次部署（回环名 / 监听 bind 字面量）——本机工具与转发落在
- *    回环的桌面壳；
- * ② 宿主 `connection` 服务的 `requestRejection` 放行——远程浏览器。它自带宿主的 Host 白名单
- *    （含部署声明的 `trustedHosts`）与「已认证 live peer」，身份就是那次 `dsh web` 打印的 URL 换来的
- *    签名 cookie，不在本插件里复刻；
- * ③ 身份层缺席（`src/ports/connection-port.ts` 报 `absent`，宿主无 `connection` 服务或成员改名）
- *    ⇒ 远程一律拒（fail-closed：退回「只有本机」，LAN 上表现为 403 而不是静默放行）。
- *
- * **DNS rebinding 由 Host 归属判据挡**：`Origin === Host` 只证两者同名，不证这个名字属于本部署；
- * 回环 socket 也不构成豁免（重绑到 `127.0.0.1` 的攻击正是回环源地址）。对浏览器来说 Host 是重绑伪造
- * 不了的那个头——它按连接目标填，而 `Origin` 是页面自己的名字——所以归属判定先于任何本机 / 远程
- * 分支，别在它前面加 fast-path。
- *
- * 末段：`GET /attachment` 的响应不是 opaque 的「读不出内容」——页面若已知某个 `sha256:…` 内容哈希，
- * 就能把它当 `<img src>` 跨源渲染出来。那条请求不带 Origin，靠 Referer 判同源挡；宿主 `/api` 没有
- * 二进制段，所以它的栅栏不需要这一条。
- */
-import type { IncomingMessage } from 'node:http';
-import type { ConnectionPort } from '../ports/connection-port.js';
-export type RequestTrustVerdict = 'allowed' | 'untrusted' | 'unauthenticated';
-export interface RequestTrustFacts {
-    /** 监听器绑定的那个具体接口 IP 字面量；老代次没有这个 getter 时为 `undefined`（bind 支退化，仍 fail-closed）。 */
-    readonly bindHost: string | undefined;
-    /** 宿主的 Web 身份面；端口每次请求惰性解析服务，缺席由它报 `absent`。 */
-    readonly connection: ConnectionPort;
-}
-/**
- * 这条请求归不归本插件办。`untrusted` = 归属不对（跨源 / 重绑 / 头不成形）；`unauthenticated` =
- * 归属对但远程客户端没带宿主身份（原文会提示用 `dsh web` 打印的 URL 打开）。
- *
- * 远程支的两个失败裁决由端口翻译宿主的区分（401 = 缺身份、403 = 归属不对）。身份层缺席（端口报
- * `absent`）一律按归属不对处理：那时没有可换的身份，不能让原文提示用户去补一个不存在的东西。
- */
-export declare function judgeRequest(req: IncomingMessage, facts: RequestTrustFacts): RequestTrustVerdict;

package/lib/types/ports/connection-port.d.ts

@@ -1,33 +0,0 @@
-/**
- * 宿主 `connection` 服务（`dsh-client-connection` 的 `HostConnectionService`，`super(ctx, "connection")`）
- * 的窄镜像：`requestRejection(request)` 一次做宿主 `/api` 的那两道——Host/Origin 栅栏与「已认证 live peer」。
- *
- * **每次请求惰性解析服务**，不在激活时取一次：插件与 `client-connection` 的激活顺序没有承诺，取早了
- * 会让远程支永远缺席（LAN 上全 403 且难排查）。`ctx.get` 是同步查表，代价可以忽略。
- *
- * **状态码在这里翻成裁决**（401 = 归属对、缺身份；403 = 归属不对；其余按归属不对处理），
- * 调用方拿到的就是自己的词表，不需要知道宿主用哪个码表达哪件事。成员名与返回值按 asar
- * `dsh-client-connection/lib/index.js` 原文读实。
- */
-import type { IncomingMessage } from 'node:http';
-import type { Context } from '@deepseek-ai/cordis';
-export type ConnectionVerdict = {
-    readonly kind: 'allowed';
-}
-/** 组成里没有这个服务（无 web 组成 / 老代次）——调用方 fail-closed。 */
- | {
-    readonly kind: 'absent';
-}
-/** 宿主认可归属，但这条请求没带已认证身份。 */
- | {
-    readonly kind: 'unauthenticated';
-}
-/** 宿主不认可归属（Host/Origin 栅栏不过，或它给出的其余状态码）。 */
- | {
-    readonly kind: 'untrusted';
-};
-export interface ConnectionPort {
-    verdictFor(req: IncomingMessage): ConnectionVerdict;
-}
-/** 成员抛错按「归属不对」拒绝（fail-closed）。 */
-export declare function createConnectionPort(ctx: Context): ConnectionPort;