dsh-cindy-host 0.1.37 → 0.1.38

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.38 — 2026-11-07
+
+- Show a valid `run_code` description in Cindy's collapsed tool label as a Host-only display alias. Normalize the preview to one bounded line, remove control/bidi-spoofing characters, and cap it at 120 Unicode code points without changing original input or full details.
+- Keep execution tool names, call/result identities, other tools and exact-name special cards unchanged. Share the projection between live and history reads; invalid/missing descriptions retain the original name. Add focused display/input-immutability/pairing regressions; handset rendering remains separate acceptance.
+
 ## 0.1.37 — 2026-11-06
 
 - Use explicit source-order history snapshots for both validated persistence and the hot fallback reader. Preserve legacy raw order, reconcile live reasoning through native history-live client identities, and page by source cuts; unknown cursors now fail explicitly rather than silently skipping history.

package/README.md

@@ -4,12 +4,12 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.37** stabilizes source-order history pagination, per-controller history delivery state and bounded interim reasoning updates. It retains 0.1.36's interruption controls and the earlier diagnostics, question synchronization, authentication and native capability subsets. Host regressions do not establish that handset white-screen issues are resolved.
+Version **0.1.38** shows valid `run_code` work descriptions in Cindy's collapsed tool labels without renaming execution tools or changing call/result pairing. It retains the earlier history stability, interruption controls and native capability subsets. Host regressions do not establish handset rendering or white-screen acceptance.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.37
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.38
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
@@ -95,6 +95,10 @@ Organization ID/slug/domain and email discovery check both regions. A found orga
 
 This feature ships in 0.1.33; installation and runtime activation are verified separately. Tests cover protocol, real local callbacks, settings-panel state, credential races and both regions' actual runtime URL routing with fake credentials. Real Apple/enterprise identity providers and iOS discovery/file round trips still require an authorized test account after deployment. See [authentication flow notes](doc/auth-login.md). The new browser flow is exposed by the settings page; the older interactive CLI is not a replacement for that UI on Windows.
 
+## Tool work titles on Cindy mobile (0.1.38)
+
+The Host projects `run_code` calls with a non-empty string `description` as `run_code · <description>` in Cindy’s collapsed tool row. Titles are normalized to one line and limited to a 120-code-point preview; the original input, code and full description remain in expanded details. Calls without a valid title and all other tool names keep their existing mapping. Live events and history use the same projection, and results remain paired by `toolUseId`. This is a Host-only display alias, not a renamed DSH execution tool. Reload an updated Host to apply it; existing phone-cached history may need reloading. Handset rendering has not been acceptance-tested.
+
 ## Thinking content on Cindy mobile (0.1.33)
 
 The Host sends DSH-provided public reasoning text/summaries as native structured `thinking` content (`{ text }`), not ordinary prose strings. Expand the work/activity group, then its thinking row, to read it. No Cindy or DSH core patch is needed. Models that expose no reasoning text still have nothing to show; signatures and provider-private replay metadata are never forwarded.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-message-row.js

@@ -69,8 +69,26 @@ function parseToolArguments(raw) {
  */
 const TOOL_NAME_BY_DSH_NAME = { todo_write: 'TodoWrite' };
 
-/** Map one DSH tool name to the phone's vocabulary. */
-function cindyToolName(name) {
+/**
+ * Project a tool name for Cindy's read-only transcript, never for execution.
+ * Mobile's generic tool row uses toolName as its collapsed label and leaves
+ * input.description in expanded details. Only run_code needs this display alias;
+ * special card names (notably TodoWrite) must retain their exact vocabulary.
+ */
+function cindyToolName(name, input) {
+  if (name === 'run_code' && input !== null && typeof input === 'object'
+    && !Array.isArray(input) && typeof input.description === 'string') {
+    // One bounded line, without control/bidi characters that could spoof the name.
+    // Keep the original input intact for expanded details and result pairing by ID.
+    const title = input.description
+      .replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, ' ')
+      .replace(/\s+/gu, ' ').trim();
+    const characters = Array.from(title);
+    if (characters.length > 0) {
+      const preview = characters.length > 120 ? `${characters.slice(0, 119).join('')}…` : title;
+      return `${name} · ${preview}`;
+    }
+  }
   return TOOL_NAME_BY_DSH_NAME[name] ?? name;
 }
 
@@ -379,17 +397,19 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
           ? `${sessionId}:reasoning-stream:${identity.turn}:${identity.step}:${index}` : clientId;
         rows.push({ ...base, clientId: logical, content: { text: block.text } });
         return;
-      case 'tool-call':
+      case 'tool-call': {
+        const input = parseToolArguments(block.arguments);
         rows.push({
           ...base,
           toolUseId: typeof block.id === 'string' ? block.id : null,
           content: {
-            toolName: typeof block.name === 'string' ? cindyToolName(block.name) : '',
-            input: parseToolArguments(block.arguments),
+            toolName: typeof block.name === 'string' ? cindyToolName(block.name, input) : '',
+            input,
             ...(typeof block.id === 'string' ? { toolUseId: block.id } : {}),
           },
         });
         return;
+      }
       case 'tool-result':
         rows.push({
           ...base,

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.37';
+export const HOST_PLUGIN_VERSION = '0.1.38';