dsh-bot-team 1.1.0 → 1.3.0

package/host/update-check.js

@@ -0,0 +1,351 @@
+/** Read-only npm update detection. No install operations or recurring work. */
+import { randomUUID } from 'node:crypto';
+import semver from 'semver';
+
+export const UPDATE_REGISTRY_URL = 'https://registry.npmjs.org/dsh-bot-team';
+export const RELEASE_NOTES_URL = 'https://github.com/shper/dsh-bot-team/blob/main/CHANGELOG.md';
+export const RELEASE_NOTES_SOURCE_URL = 'https://raw.githubusercontent.com/shper/dsh-bot-team/main/CHANGELOG.md';
+const NPM_PACKAGE_URL = 'https://www.npmjs.com/package/dsh-bot-team';
+const SEMVER_OPTIONS = { includePrerelease: true };
+
+const isRecord = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const own = (value, key) => Object.hasOwn(value, key);
+const validVersion = value => typeof value === 'string' && semver.valid(value) ? value.trim() : null;
+const versionUrl = version => version ? NPM_PACKAGE_URL + '/v/' + encodeURIComponent(version) : NPM_PACKAGE_URL;
+
+/**
+ * DSH app-boot documents this getter as the single version used for admission.
+ * Its implementation reads the running app-boot package's own manifest. Do not
+ * infer a runtime from this plugin's engines range or a workspace installation.
+ * The runtime resolver supplies this host module; bare Node/embedders may not.
+ */
+export async function resolveDshRuntimeVersion(load = () => import('@deepseek-ai/dsh-app-boot')) {
+  try {
+    const host = await load();
+    return validVersion(await host.getDshRuntimeVersion());
+  } catch {
+    return null;
+  }
+}
+
+function acceptsRange(runtimeVersion, range) {
+  return typeof range === 'string' && range.trim() !== '' &&
+    semver.validRange(range, SEMVER_OPTIONS) !== null && semver.satisfies(runtimeVersion, range, SEMVER_OPTIONS);
+}
+
+/** Match DSH admission semantics, including prerelease runtimes and peer fallback. */
+function compatibilityOf(manifest, runtimeVersion) {
+  if (!runtimeVersion) return 'unknown';
+  if (own(manifest, 'engines')) {
+    if (!isRecord(manifest.engines)) return 'incompatible';
+    if (own(manifest.engines, 'dsh')) {
+      return acceptsRange(runtimeVersion, manifest.engines.dsh) ? 'compatible' : 'incompatible';
+    }
+  }
+  if (own(manifest, 'peerDependencies')) {
+    if (!isRecord(manifest.peerDependencies)) return 'incompatible';
+    for (const [name, range] of Object.entries(manifest.peerDependencies)) {
+      if (typeof range !== 'string') return 'incompatible';
+      if (name !== '@deepseek-ai/dsh' && !name.startsWith('@deepseek-ai/dsh-')) continue;
+      const effective = ['workspace:^', 'workspace:~', 'workspace:*'].includes(range) ? runtimeVersion : range;
+      if (!acceptsRange(runtimeVersion, effective)) return 'incompatible';
+    }
+  }
+  return 'compatible';
+}
+
+class UpdateCheckError extends Error {}
+
+function manifestOf(versions, version) {
+  const manifest = own(versions, version) ? versions[version] : null;
+  if (!isRecord(manifest) || manifest.version !== version) return null;
+  if (own(manifest, 'name') && manifest.name !== 'dsh-bot-team') return null;
+  return manifest;
+}
+
+function selectVersions(metadata, currentVersion, runtimeVersion) {
+  if (!validVersion(currentVersion)) throw new UpdateCheckError('Current plugin version is not valid SemVer.');
+  if (!isRecord(metadata) || !isRecord(metadata['dist-tags']) || !isRecord(metadata.versions)) {
+    throw new UpdateCheckError('npm returned invalid package metadata.');
+  }
+  const latestVersion = validVersion(metadata['dist-tags'].latest);
+  if (!latestVersion || semver.prerelease(latestVersion) !== null) {
+    throw new UpdateCheckError('npm latest does not identify a stable version.');
+  }
+  const latest = manifestOf(metadata.versions, latestVersion);
+  if (!latest) throw new UpdateCheckError('npm latest version metadata is missing or invalid.');
+
+  let availableVersion = null;
+  // npm latest is the stable release ceiling: a newer next/beta tag, even if
+  // its version string is stable, is never automatically recommended.
+  for (const version of Object.keys(metadata.versions)) {
+    if (!validVersion(version) || semver.prerelease(version) !== null ||
+      !semver.gt(version, currentVersion) || semver.gt(version, latestVersion)) continue;
+    const manifest = manifestOf(metadata.versions, version);
+    if (!manifest || compatibilityOf(manifest, runtimeVersion) !== 'compatible') continue;
+    if (!availableVersion || semver.gt(version, availableVersion)) availableVersion = version;
+  }
+  return {
+    runtimeVersion,
+    latestVersion,
+    availableVersion,
+    hasUpdate: availableVersion !== null,
+    // These two fields describe latest, even when a lower version is safe.
+    compatibility: compatibilityOf(latest, runtimeVersion),
+    requiredDsh: typeof latest.engines?.dsh === 'string' ? latest.engines.dsh : null,
+    releaseNotesUrl: RELEASE_NOTES_URL,
+    updateUrl: versionUrl(availableVersion || latestVersion),
+  };
+}
+
+function cancelBody(body, reason) {
+  try { void body?.cancel(reason).catch(() => {}); } catch { /* already closed/locked */ }
+}
+
+async function readResponseText(response, signal, maxBytes) {
+  if (signal.aborted) {
+    cancelBody(response.body, signal.reason);
+    throw signal.reason;
+  }
+  if (!response.ok) {
+    cancelBody(response.body);
+    throw new UpdateCheckError('npm registry returned HTTP ' + response.status + '.');
+  }
+  const contentLength = Number(response.headers?.get('content-length'));
+  if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+    cancelBody(response.body);
+    throw new UpdateCheckError('npm package metadata exceeds the size limit.');
+  }
+  if (typeof response.body?.getReader !== 'function') {
+    cancelBody(response.body);
+    throw new UpdateCheckError('npm returned an unreadable response body.');
+  }
+  const reader = response.body.getReader();
+  const cancel = () => cancelBody(reader, signal.reason);
+  signal.addEventListener('abort', cancel, { once: true });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (signal.aborted) throw signal.reason;
+      if (done) break;
+      size += value.byteLength;
+      if (size > maxBytes) throw new UpdateCheckError('npm package metadata exceeds the size limit.');
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+  } catch (error) {
+    cancelBody(reader, error);
+    throw error;
+  } finally {
+    signal.removeEventListener('abort', cancel);
+    reader.releaseLock();
+  }
+}
+
+/** Exact version headings only; Unreleased and headings inside code are ignored. */
+function extractReleaseNotes(markdown, version) {
+  const lines = markdown.split(/\r?\n/);
+  let start = -1;
+  let fence = null;
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    const marker = /^ {0,3}(`{3,}|~{3,})/.exec(line)?.[1];
+    if (marker) {
+      if (!fence) fence = marker;
+      else if (marker[0] === fence[0] && marker.length >= fence.length) fence = null;
+      continue;
+    }
+    if (fence) continue;
+    const heading = /^##[ \t]+(.+)$/.exec(line)?.[1];
+    if (start !== -1 && /^#{1,2}[ \t]+/.test(line)) return lines.slice(start, index).join('\n').trim() || null;
+    if (!heading) continue;
+    const closingBracket = heading.indexOf(']');
+    const token = heading.startsWith('[')
+      ? (closingBracket > 1 ? heading.slice(1, closingBracket) : null)
+      : heading.split(/[ \t]/)[0];
+    if (token === version) start = index + 1;
+  }
+  return start === -1 ? null : lines.slice(start).join('\n').trim() || null;
+}
+
+/**
+ * One checker per service. fetch/getRuntimeVersion/now are injectable so tests
+ * exercise the real startup path without network requests or environment flags.
+ * GET reads snapshot(); check({ force: true }) bypasses only the success cache,
+ * always joining an existing request. Errors keep the last successful fields.
+ */
+export class UpdateChecker {
+  constructor({ currentVersion, fetch: fetchImpl = globalThis.fetch,
+    getRuntimeVersion = resolveDshRuntimeVersion, now = Date.now,
+    timeoutMs = 10000, maxBytes = 2 * 1024 * 1024, cacheTtlMs = 5 * 60 * 1000,
+    notesTimeoutMs = 2000, notesMaxBytes = 128 * 1024,
+    onChange = () => {} } = {}) {
+    this.fetch = fetchImpl;
+    this.getRuntimeVersion = getRuntimeVersion;
+    this.now = now;
+    this.timeoutMs = timeoutMs;
+    this.maxBytes = maxBytes;
+    this.cacheTtlMs = cacheTtlMs;
+    this.notesTimeoutMs = notesTimeoutMs;
+    this.notesMaxBytes = notesMaxBytes;
+    this.onChange = onChange;
+    this.inFlight = null;
+    this.controller = null;
+    this.disposed = false;
+    this.lastSuccessAt = null;
+    this.state = {
+      instanceId: randomUUID(),
+      revision: 0,
+      status: 'idle',
+      currentVersion,
+      runtimeVersion: null,
+      latestVersion: null,
+      availableVersion: null,
+      hasUpdate: false,
+      compatibility: null,
+      requiredDsh: null,
+      checkedAt: null,
+      error: null,
+      releaseNotes: null,
+      releaseNotesVersion: null,
+      releaseNotesUrl: RELEASE_NOTES_URL,
+      updateUrl: versionUrl(validVersion(currentVersion)),
+    };
+  }
+
+  snapshot() { return { ...this.state }; }
+
+  publish(fields) {
+    this.state = { ...this.state, ...fields, revision: this.state.revision + 1 };
+    try { this.onChange(this.snapshot()); } catch { /* observers cannot fail a check */ }
+  }
+
+  async request(signal, onMetadata) {
+    signal.throwIfAborted();
+    const [metadata, rawRuntimeVersion] = await Promise.all([
+      Promise.resolve().then(async () => {
+        const response = await this.fetch(UPDATE_REGISTRY_URL, {
+          method: 'GET',
+          headers: { accept: 'application/vnd.npm.install-v1+json' },
+          redirect: 'error',
+          cache: 'no-store',
+          signal,
+        });
+        const text = await readResponseText(response, signal, this.maxBytes);
+        try { return JSON.parse(text); }
+        catch { throw new UpdateCheckError('npm returned invalid JSON.'); }
+      }),
+      Promise.resolve().then(() => this.getRuntimeVersion()).catch(() => null),
+    ]);
+    const result = {
+      ...selectVersions(metadata, this.state.currentVersion, validVersion(rawRuntimeVersion)),
+      releaseNotes: null, releaseNotesVersion: null,
+    };
+    onMetadata(result);
+    const notesVersion = result.availableVersion ||
+      (semver.gt(result.latestVersion, this.state.currentVersion) ? result.latestVersion : null);
+    if (notesVersion) {
+      const releaseNotes = await this.readReleaseNotes(notesVersion, signal);
+      if (releaseNotes) return { ...result, releaseNotes, releaseNotesVersion: notesVersion };
+    }
+    return result;
+  }
+
+  async readReleaseNotes(version, signal) {
+    const controller = new AbortController();
+    const cancel = () => controller.abort(signal.reason);
+    if (signal.aborted) return null;
+    signal.addEventListener('abort', cancel, { once: true });
+    const timer = setTimeout(() => controller.abort(), this.notesTimeoutMs);
+    let onAbort;
+    const cancelled = new Promise((_, reject) => {
+      onAbort = () => reject(controller.signal.reason);
+      controller.signal.addEventListener('abort', onAbort, { once: true });
+    });
+    try {
+      const text = await Promise.race([
+        Promise.resolve().then(async () => {
+          controller.signal.throwIfAborted();
+          const response = await this.fetch(RELEASE_NOTES_SOURCE_URL, {
+            method: 'GET', headers: { accept: 'text/plain' }, redirect: 'error',
+            cache: 'no-store', signal: controller.signal,
+          });
+          return readResponseText(response, controller.signal, this.notesMaxBytes);
+        }),
+        cancelled,
+      ]);
+      return extractReleaseNotes(text, version);
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', cancel);
+      controller.signal.removeEventListener('abort', onAbort);
+      controller.abort();
+    }
+  }
+
+  check({ force = false } = {}) {
+    if (this.disposed) return Promise.resolve(this.snapshot());
+    if (this.inFlight) return this.inFlight;
+    const age = this.lastSuccessAt === null ? Infinity : this.now() - this.lastSuccessAt;
+    if (!force && this.state.status === 'ready' && age >= 0 && age < this.cacheTtlMs) {
+      return Promise.resolve(this.snapshot());
+    }
+    const previous = this.snapshot();
+    const controller = new AbortController();
+    this.controller = controller;
+    let onAbort;
+    const cancelled = new Promise((_, reject) => {
+      onAbort = () => reject(controller.signal.reason);
+      controller.signal.addEventListener('abort', onAbort, { once: true });
+    });
+    const timer = setTimeout(() => controller.abort(new UpdateCheckError('Update check timed out.')), this.timeoutMs);
+    // The race also bounds injected/custom fetch implementations which ignore
+    // AbortSignal. Late completions never publish a stale result after dispose.
+    let metadataResult = null;
+    const ready = result => {
+      this.lastSuccessAt = this.now();
+      this.publish({ ...result, status: 'ready', checkedAt: new Date(this.lastSuccessAt).toISOString(), error: null });
+    };
+    this.inFlight = Promise.race([Promise.resolve().then(() => this.request(controller.signal, result => { metadataResult = result; })), cancelled])
+      .then(result => {
+        if (!this.disposed) ready(result);
+      })
+      .catch(error => {
+        if (!this.disposed) {
+          // A notes timeout must not discard a successful npm version lookup.
+          if (metadataResult) ready(metadataResult);
+          else this.publish({ status: 'error', error: error instanceof UpdateCheckError
+            ? error.message : 'Unable to check the npm registry.' });
+        }
+      })
+      .finally(() => {
+        clearTimeout(timer);
+        controller.signal.removeEventListener('abort', onAbort);
+        controller.abort();
+        this.controller = null;
+        this.inFlight = null;
+        if (this.disposed && this.state.status === 'checking') {
+          this.state = { ...previous, revision: this.state.revision + 1 };
+        }
+      })
+      .then(() => this.snapshot());
+    this.publish({ status: 'checking', error: null });
+    return this.inFlight;
+  }
+
+  dispose() {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.controller?.abort(new UpdateCheckError('Update check cancelled.'));
+  }
+}

package/host/util.js

@@ -27,14 +27,15 @@ export function resolveConfig(raw = {}) {
     migrateLegacyLayout: raw.migrateLegacyLayout !== false,
     maxParallelTurns: positiveInt(raw.maxParallelTurns, 3, 1, 8),
     maxContextMessages: positiveInt(raw.maxContextMessages, 40, 5, 200),
-    turnTimeoutMs: positiveInt(raw.turnTimeoutMs, 300000, 5000, 3600000),
+    // Native sessions may wait for approval, children, or a continuing goal.
+    // Zero follows the native lifecycle instead of imposing a five-minute cap.
+    turnTimeoutMs: raw.turnTimeoutMs === 0 || raw.turnTimeoutMs === undefined ? 0 : positiveInt(raw.turnTimeoutMs, 0, 5000, 3600000),
     maxMessageChars: positiveInt(raw.maxMessageChars, 40000, 1000, 200000),
     maxGroups: positiveInt(raw.maxGroups, 50, 1, 500),
     enableModelTools: raw.enableModelTools !== false,
     botSandbox: raw.botSandbox !== false,
     botApprovalPolicy: raw.botApprovalPolicy === 'never' ? 'never' : 'ask',
     autoDispatchReady: raw.autoDispatchReady === true,
-    maxTurnsPerHour: positiveInt(raw.maxTurnsPerHour, 120, 1, 10000),
     dailyTokenBudget: positiveInt(raw.dailyTokenBudget, 5000000, 1000, 100000000),
     toolWaitTimeoutMs: positiveInt(raw.toolWaitTimeoutMs, 180000, 10000, 900000),
     maxMembersPerGroup: positiveInt(raw.maxMembersPerGroup, 12, 1, 50),

package/host/workspace.js

@@ -18,7 +18,8 @@
  */
 import os from 'node:os';
 import path from 'node:path';
-import { mkdir, readdir, rename, rmdir, stat, unlink } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { access, mkdir, readdir, realpath, rename, rmdir, stat, unlink } from 'node:fs/promises';
 
 export function dshHomeDir() {
   return process.env.DSH_HOME || path.join(os.homedir(), '.dsh');
@@ -60,6 +61,39 @@ export function sessionCwdMatches(headerCwd, workspaceCwd) {
     && path.resolve(headerCwd) === path.resolve(workspaceCwd);
 }
 
+/** Normalize a user-selected host path without creating any project directories. */
+export function normalizeWorkspacePath(value) {
+  if (typeof value !== 'string' || value.length > 4096 || value.includes('\0')) {
+    throw Object.assign(new Error('workspaceCwd 必须是有效的目录路径'), { code: 'invalid-input' });
+  }
+  let target = value.trim();
+  if (!target) return '';
+  if (target === '~') target = os.homedir();
+  else if (target.startsWith('~/')) target = path.join(os.homedir(), target.slice(2));
+  if (!path.isAbsolute(target)) {
+    throw Object.assign(new Error('workspaceCwd 必须是绝对路径（可使用 ~/）'), { code: 'invalid-input' });
+  }
+  return path.resolve(target);
+}
+
+/** Resolve symlinks and verify an existing, readable/searchable local directory. */
+export async function validateProjectWorkspace(value) {
+  const target = normalizeWorkspacePath(value);
+  if (!target) throw Object.assign(new Error('项目目录不能为空'), { code: 'invalid-input' });
+  try {
+    const canonical = await realpath(target);
+    if (!(await stat(canonical)).isDirectory()) {
+      throw new Error('请选择文件夹，而不是文件');
+    }
+    await access(canonical, constants.R_OK | constants.X_OK);
+    return canonical;
+  } catch (error) {
+    const reason = error?.code === 'ENOENT' ? '目录不存在' : error?.code === 'EACCES' || error?.code === 'EPERM'
+      ? '目录不可访问' : String(error?.message || error);
+    throw Object.assign(new Error('无法引入项目目录：' + reason), { code: 'invalid-input' });
+  }
+}
+
 export async function pathExists(target) {
   try {
     await stat(target);
@@ -167,7 +201,7 @@ export async function migrateLegacyLayout({ repo, config, logger }) {
     const legacyWorkspace = current ? isInside(current, legacyRoot) : false;
     const previousDirectWorkspace = current ? isPreviousDirectWorkspace(config, group, current) : false;
     if (current && !legacyWorkspace && !previousDirectWorkspace) {
-      await ensureWorkspaceDir(current, logger);
+      // A user-owned project may have moved or become unavailable. Never recreate it.
       continue;
     }
     if (current && current !== target) await moveWorkspace(current, target, logger, summary);

package/index.js

@@ -11,7 +11,7 @@ import { resolveConfig } from './host/util.js';
 // Package is published as dsh-bot-team; the Cordis plugin id stays bot-team,
 // matching the built-in pattern (dsh-tool-bash → name "tool-bash").
 export const name = 'bot-team';
-export const inject = ['agents', 'storageDomain', 'connection', 'tools', 'agentPresets'];
+export const inject = ['agents', 'storageDomain', 'connection', 'tools', 'agentPresets', 'sessionQuery', 'workspaceController'];
 
 export function apply(ctx, rawConfig = {}) {
   const config = resolveConfig(rawConfig && typeof rawConfig === 'object' ? rawConfig : {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-bot-team",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Bot Team: single chats and multi-agent group chat for DeepSeek Harness. Every bot gets a direct chat; create groups/topics, organize them into collapsible custom folders with drag ordering, add full-capability bot agents (files, search, web, workspace, commands, skills) with their own model and BOT.md persona/working rules, attach files or pick skills with + or / in the composer, @mention them to assign tasks, review each other's work, and run multi-round discussions and tasks. The UI follows DSH zh/en, and group timelines export to Markdown, HTML or a paginated PDF with selectable text.",
   "type": "module",
   "exports": {
@@ -18,7 +18,8 @@
     "locale/*.json",
     "icon.svg",
     "LICENSE",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "dsh": {
     "bundle": {
@@ -29,7 +30,8 @@
       "immediately": true,
       "inject": [
         "@deepseek-ai/dsh-client-ui-layout",
-        "@deepseek-ai/dsh-client-ui-sidebar"
+        "@deepseek-ai/dsh-client-ui-sidebar",
+        "@deepseek-ai/dsh-client-ui-workspace"
       ]
     }
   },
@@ -52,8 +54,7 @@
   "homepage": "https://github.com/shper/dsh-bot-team#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/shper/dsh-bot-team.git",
-    "directory": "bot-team"
+    "url": "git+https://github.com/shper/dsh-bot-team.git"
   },
   "bugs": {
     "url": "https://github.com/shper/dsh-bot-team/issues"
@@ -69,6 +70,13 @@
     "prepublishOnly": "npm run check && npm test"
   },
   "dependencies": {
-    "fontkit": "^2.0.4"
+    "fontkit": "^2.0.4",
+    "semver": "^7.8.5"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-app-boot": "*"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-app-boot": { "optional": true }
   }
 }