dsh-advisor-group 0.1.0

package/LICENSE

@@ -0,0 +1,15 @@
+Apache License 2.0
+
+Copyright (c) 2026 dsh-advisor-group contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,100 @@
+# dsh-advisor-group
+
+> A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH) plugin that lets the main model consult **multiple expert advisor models** in a retro chat-group card — for professional, long-tail world-knowledge, high-risk, or uncertain questions.
+
+[![dsh-plugin](https://img.shields.io/badge/DSH%20plugin-dsh--plugin-3f8cff)](https://github.com/topics/dsh-plugin)
+
+---
+
+## ✨ Features
+
+- **Auto-deepen consultation pipeline** — one `ask_advisors` call runs up to `maxRounds` rounds automatically: each round is a *driver deep-question → advisor A → advisor B (sees A) → advisor C (sees A+B) → …* sequential relay, closed by a driver-generated synthesis conclusion.
+- **Three ways to activate** — `@顾问群` mention (force-start), same question repeated 3 times without resolution, or main-model self-assessed confidence below the threshold.
+- **Real streaming** — advisors stream thinking chain + Markdown body via the DSH `ctx.llm` channel, with a direct-http fallback (OpenAI / Anthropic / Gemini compatible protocols) and incremental 200ms throttling.
+- **SSE replay with resync** — `/advisor-group/stream` serves `eventId`/`bootId` framed frames, a 500-frame / 5-minute ring buffer, and `event: resync` on restart or gap.
+- **Retro CRT chat cards** — green/amber/blue CRT themes, scanlines, LIVE/DONE headers, auto-expanded thinking panel with auto-scroll; advisor Markdown rendered with a link-protocol whitelist (headings, lists, code, quotes, links, tables).
+- **Provider presets (11 platforms · 26 presets)** — DeepSeek, Moonshot Kimi, Kimi Code, Aliyun Bailian, Zhipu AI, OpenAI, Claude, Gemini, SiliconFlow, AIHubMix, OpenRouter (OpenAI/Anthropic-compatible variants included).
+- **Security-minded by design** — API keys use official `SecretField` semantics (never returned to the browser; `apiKeysByProvider` key history is server-side only), SSRF-guarded diagnostics (https-only / loopback, no IP literals, no redirects), per-boot token auth on `/advisor-group/*` routes, and an atomic 50 consultations/day quota persisted across restarts.
+- **Runtime toggle** — `toggle_advisor_group` enables/disables the plugin and persists the flag to settings.
+
+## ✅ Compatibility
+
+| Surface | Status |
+|---|---|
+| Harness | DeepSeek Harness `0.1.2-rc.1` |
+| Node | `^22.19.0 \|\| >=24.0.0` |
+| Platforms | DSH Web (client bundle) + headless host logic |
+
+## 📦 Installation
+
+```sh
+# 1. Install the plugin (one package, everything included)
+dsh plugin --profile web add dsh-advisor-group
+
+# 2. Restart DSH web
+npx @deepseek-ai/dsh web
+```
+
+> **From source (development)**
+> ```sh
+> npm install --legacy-peer-deps --no-audit --no-fund
+> npm run build
+> dsh plugin --profile web add ./dsh-advisor-group-0.1.0.tgz   # after npm pack
+> ```
+
+## 🚀 Quick start
+
+1. Restart DSH web and hard-refresh the browser (`Ctrl+Shift+R`).
+2. Go to **Settings → Plugins → Advisor Group**: configure your advisors (provider route + model; use *获取模型列表* to pull the authoritative model list) and tune `maxRounds`, thresholds, and the UI theme.
+3. Just start a conversation:
+   - type `@顾问群` in your question to force a consultation, or
+   - ask a professional/uncertain question — the plugin escalates automatically when appropriate.
+
+`ask_advisors` tools available to the model: `ask_advisors`, `toggle_advisor_group`.
+
+## ⚙️ Configuration
+
+| Key | Type | Default | Description |
+|---|---|---|---|
+| `enabled` | boolean | `true` | Enable advisor group |
+| `discussion.maxRounds` | number | `2` | Total rounds of the auto-deepen pipeline (each round = driver question + all advisors in relay) |
+| `discussion.maxAdvisorsPerCall` | number | `3` | Max advisors per call (1–10) |
+| `discussion.autoDeepen` | boolean | `true` | Run the auto-deepen pipeline (driver follow-ups + final synthesis) |
+| `discussion.driverModel` | object | – | Fallback driver model `{provider, model}` when the session header cannot be read |
+| `discussion.advisorTimeoutMs` | number | `120000` | Per-advisor call timeout (ms, 1000–600000), applied to both channels |
+| `trigger.requireClassifier` | boolean | `true` | Run the pre-classifier before starting |
+| `trigger.allowWebFallback` | boolean | `true` | Allow classifier to recommend web search |
+| `trigger.confidenceThreshold` | number | `0.6` | Escalate when main-model confidence is below this |
+| `ui.theme` | string | `retro-green` | Chat card theme (`retro-green` / `retro-amber` / `retro-blue`) |
+| `ui.showTimestamps` | boolean | `true` | Show timestamps |
+| `ui.autoExpand` | boolean | `true` | Auto-expand card |
+| `advisors` | array | `[]` | Advisor list (provider/model/baseURL/apiKey/apiKeyEnv/protocol…, keys are `role('secret')`) |
+
+> `discussion.parallel` and `discussion.stopOnConsensus` are deprecated leftovers kept only for stored-config compatibility.
+
+## 🔒 Security & privacy
+
+- Direct API keys can be stored in the DSH `settings.yaml` (marked secret, never returned to the browser by `describe`); prefer `apiKeyEnv` (env-var mode) if you don't want keys on disk.
+- `/advisor-group/*` routes use a per-boot shared token for local single-user use — **not** multi-user auth. Add a reverse-proxy auth layer before LAN exposure.
+- Diagnostics endpoints resolve the real key server-side and validate the target URL against an https-only / loopback SSRF guard; DNS-rebinding protection is a documented out-of-scope limitation.
+- Daily quota (50 new consultations) is persisted to `$DSH_HOME/storages/advisor-group/daily-guard.json` (UTC day key), so restarts don't reset it.
+- Classifier shadow mode appends one observation sample per non-forced classification (read-only `/advisor-group/shadow`), used for threshold tuning only — never influences behavior.
+
+## ⚠️ Known limitations
+
+- Disconnecting the SSE stream does not cancel in-flight advisor calls (per-advisor timeout `discussion.advisorTimeoutMs` is the fallback); refreshing keeps the consultation completing in the background.
+- The lightweight Markdown renderer does not support nested lists, inline HTML, or complex tables.
+- Preset default model lists are best-effort approximations — `ask_advisors` refuses to start (with a precise reason) while any advisor has an empty model; use *获取模型列表* for the authoritative list.
+
+## 🛠️ Development
+
+```sh
+npm install --legacy-peer-deps --no-audit --no-fund
+npm run typecheck
+npm test        # 64 tests, incl. provider streaming contracts against a local fake LLM server
+npm run build   # tsdown; client bundle must NOT be built with minify: true
+```
+
+## 📄 License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-advisor-group contributors.

package/README.zh.md

@@ -0,0 +1,100 @@
+# dsh-advisor-group
+
+> [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）插件：主模型在遇到**专业、长尾世界知识、高风险或不确定**的问题时，召集多位**专家顾问模型**，在复古 CRT 聊天组卡片中真流式对话。
+
+[![dsh-plugin](https://img.shields.io/badge/DSH%20plugin-dsh--plugin-3f8cff)](https://github.com/topics/dsh-plugin)
+
+---
+
+## ✨ 功能特性
+
+- **自动深挖咨询流水线**：一次 `ask_advisors` 自动跑满 `maxRounds` 轮——每轮 = *驱动模型深挖追问 → 顾问 A → 顾问 B（看到 A）→ 顾问 C（看到 A+B）→ …* 顺序接力，最后驱动模型产出**综合结论**。
+- **三种触发方式**：`@顾问群` 提及（强制启动）、同一问题重复 3 次未解决、主模型自评置信度低于阈值。
+- **真流式双通道**：顾问思维链 + Markdown 正文经 DSH `ctx.llm` 实时流式返回（增量 200ms 节流），并提供 direct-http 兜底（OpenAI / Anthropic / Gemini 兼容协议）。
+- **SSE 回放 + 断连恢复**：`/advisor-group/stream` 按 `eventId`/`bootId` 帧推送，每会话 500 条 / 5 分钟环形缓冲，重启或缺口发 `event: resync`。
+- **复古 CRT 聊天组卡片**：绿/琥珀/蓝三主题、扫描线、LIVE/DONE 标题、💭 思考面板默认展开自动滚底；顾问正文走轻量 Markdown 渲染（链接协议白名单，支持标题/列表/代码/引用/链接/表格）。
+- **供应商预设（11 平台 · 26 预设）**：DeepSeek、月之暗面 Kimi、Kimi Code、阿里云百炼、智谱 AI、OpenAI、Claude、Gemini、硅基流动、AIHubMix、OpenRouter（含 OpenAI / Anthropic 兼容变体）。
+- **注重安全**：API Key 采用官方 `SecretField` 语义（浏览器永不回显；`apiKeysByProvider` 供应商密钥档案仅存服务端）；诊断端点 SSRF 加固（仅 https/loopback、拒绝 IP 字面量与重定向）；`/advisor-group/*` 路由启动期 token 鉴权；每日新咨询 50 次**原子配额**，持久化跨重启。
+- **运行时开关**：`toggle_advisor_group` 启停插件并持久化到设置。
+
+## ✅ 兼容性
+
+| 项目 | 状态 |
+|---|---|
+| Harness | DeepSeek Harness `0.1.2-rc.1` |
+| Node | `^22.19.0 \|\| >=24.0.0` |
+| 平台 | DSH Web（客户端 bundle）+ headless 宿主逻辑 |
+
+## 📦 安装
+
+```sh
+# 1. 安装插件（一个包全都有）
+dsh plugin --profile web add dsh-advisor-group
+
+# 2. 重启 dsh web
+npx @deepseek-ai/dsh web
+```
+
+> **从源码开发安装**
+> ```sh
+> npm install --legacy-peer-deps --no-audit --no-fund
+> npm run build
+> dsh plugin --profile web add ./dsh-advisor-group-0.1.0.tgz   # 先 npm pack
+> ```
+
+## 🚀 快速开始
+
+1. 重启 dsh web 并硬刷新浏览器（`Ctrl+Shift+R`）。
+2. 打开 **设置 → 插件 → 顾问群**：配置顾问（提供商路由 + 模型，用「获取模型列表」拉取权威清单），按需调整 `maxRounds`、阈值与 UI 主题。
+3. 直接开聊：
+   - 提问时带 `@顾问群` 强制发起咨询，或
+   - 直接提专业/不确定的问题——插件会按需自动升级。
+
+模型可用工具：`ask_advisors`、`toggle_advisor_group`。
+
+## ⚙️ 配置项
+
+| 键 | 类型 | 默认 | 说明 |
+|---|---|---|---|
+| `enabled` | boolean | `true` | 启用顾问群 |
+| `discussion.maxRounds` | number | `2` | 自动深挖流水线总轮数（每轮 = 驱动追问 + 全体顾问接力） |
+| `discussion.maxAdvisorsPerCall` | number | `3` | 单次咨询最大顾问数（1–10） |
+| `discussion.autoDeepen` | boolean | `true` | 启用自动深挖流水线（驱动追问 + 综合结论） |
+| `discussion.driverModel` | object | – | 兜底驱动模型 `{provider, model}`（会话头信息不可读时） |
+| `discussion.advisorTimeoutMs` | number | `120000` | 单顾问调用超时（毫秒，1000–600000），双通道均生效 |
+| `trigger.requireClassifier` | boolean | `true` | 发起前先跑前置分类器 |
+| `trigger.allowWebFallback` | boolean | `true` | 分类器建议联网搜索时返回该提示 |
+| `trigger.confidenceThreshold` | number | `0.6` | 主模型置信度低于该值时升级 |
+| `ui.theme` | string | `retro-green` | 卡片主题（retro-green / retro-amber / retro-blue） |
+| `ui.showTimestamps` | boolean | `true` | 显示时间戳 |
+| `ui.autoExpand` | boolean | `true` | 自动展开卡片 |
+| `advisors` | array | `[]` | 顾问列表（provider/model/baseURL/apiKey/apiKeyEnv/protocol…，key 均标 `role('secret')`） |
+
+> `discussion.parallel` 与 `discussion.stopOnConsensus` 为弃用遗留项，仅保留以兼容已存配置。
+
+## 🔒 安全与隐私
+
+- 直连 API Key 可存于 DSH `settings.yaml`（标 secret，官方 `describe` 绝不回传浏览器）；不想落盘请用 `apiKeyEnv` 环境变量模式。
+- `/advisor-group/*` 路由为**单机共享 token**（本地单用户使用），不是多用户鉴权；暴露局域网必须外层加反代鉴权。
+- 诊断端点服务端按存档 key 解析真实值再打供应商，并对目标 URL 做 https-only/loopback SSRF 校验；DNS rebinding 记为文档化已知边界。
+- 每日配额（新咨询 50 次）持久化在 `$DSH_HOME/storages/advisor-group/daily-guard.json`（UTC 日切），重启不再归零。
+- 分类器影子模式：每次非强制分类追加一条观测样本（只读 `/advisor-group/shadow`），仅用于阈值调优，绝不干预行为。
+
+## ⚠️ 已知限制
+
+- SSE 断连**不取消在途顾问调用**（以 `discussion.advisorTimeoutMs` 超时兜底）；刷新后咨询后台完成，durable 卡片重建完整内容。
+- 轻量 Markdown 渲染器不支持嵌套列表 / 内联 HTML / 复杂表格。
+- 预设默认模型清单为近似值——任一顾问模型为空时 `ask_advisors` 快速失败（附原因）；用「获取模型列表」拉取权威清单。
+
+## 🛠️ 开发
+
+```sh
+npm install --legacy-peer-deps --no-audit --no-fund
+npm run typecheck
+npm test        # 64 单测（含本地假 LLM 服务器上的供应商流式契约）
+npm run build   # tsdown；客户端 bundle 禁用 minify: true
+```
+
+## 📄 许可证
+
+[Apache License 2.0](LICENSE) © 2026 dsh-advisor-group contributors.

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+# dsh-advisor-group bundle layer: register the scaffolded plugin as a bundle row.
+# This file is the `dsh.bundle.patch` layer (see package.json#dsh.bundle.patch).
+# Layer semantics: a YAML array of row verbs; `insert` adds plugin rows to the
+# composed config. A row's `id` must be unique within the layer stack; `name`
+# resolves the plugin module through the installed package (package.json#main).
+- insert:
+    # `id`: stable row identifier used by later layers to override this row.
+    - id: dsh-advisor-group
+      # `name`: the module the loader imports; resolves to this package entry.
+      name: dsh-advisor-group