dsh-code-server-app 0.3.57 → 0.3.59

package/lib/index.js

@@ -337,6 +337,31 @@ export function installBundledExtensions(extensionsDir, userDataDir, options = {
           }
         };
         walkDst('');
+        // 文件删完还要**收掉空目录**:0.3.59 删掉了整个 webview/ 子目录,只删文件的话会在用户的
+        // VS Code 树里留下一串空目录(实测:webview/、webview/src、webview/fonts 各 0 字节)。
+        // 自底向上收,只收"确实空了"的目录(非空的目录说明里面有别的东西,不动)。
+        const pruneEmptyDirs = (rel) => {
+          const abs = rel === '' ? dst : path.join(dst, rel);
+          let entries;
+          try {
+            entries = fs.readdirSync(abs, { withFileTypes: true });
+          } catch {
+            return;
+          }
+          for (const ent of entries) {
+            if (ent.isDirectory()) pruneEmptyDirs(rel === '' ? ent.name : `${rel}/${ent.name}`);
+          }
+          if (rel === '') return;
+          try {
+            if (fs.readdirSync(abs).length === 0) {
+              fs.rmdirSync(abs);
+              removed.push(`${rel}/`);
+            }
+          } catch {
+            // 竞态(别的东西刚写进来)或权限问题:保持原样,不影响主流程
+          }
+        };
+        pruneEmptyDirs('');
       }
       // 清理放错位置的副本:编辑器桥的旧用户级副本(0.3.11 及更早)/ dshcs-open-file 的旧用户级副本。
       const wrong = extensionTarget(extensionsDir, ext.name, ext.placement === 'builtin' ? 'user' : 'builtin', treeRoot);
@@ -755,22 +780,19 @@ export async function apply(ctx, config) {
   const bridgeApprovalBoard = createApprovalBoard();
   /**
    * 谁在"看着这个会话" —— 授权拦截据此决定要不要抢答(没人看就直接交给官方链路):
-   *   - `ids`:编辑器扩展面板声明要看的会话(每趟 /sync 上报);
    *   - `dialogIds`:DSH 页面里的对话框(0.3.24)声明要看的会话;
-   *   - `at`:最近一次声明的时间(超过 5s 视为没人看)。
+   *   - `at`:最近一次声明的时间(诊断用)。
+   *
+   * 0.3.59:编辑器扩展的 webview 面板退役后只剩对话框一路 —— 以前还有 `ids`(扩展每趟 /sync 上报的
+   * 观看列表),两个来源求并集、还要按心跳新鲜度区分,现在都不需要了。
    */
-  const bridgeWatch = { ids: [], dialogIds: [], at: 0 };
-  /** 上次回给扩展的对话流修订号(0.3.27:没变化就不重传整份快照)。 */
-  let bridgeThreadRevSent = -1;
+  const bridgeWatch = { dialogIds: [], at: 0 };
   /** 上次记录过的"有没有人在看"(0.3.30:状态翻转才写诊断日志)。 */
   let bridgeWatchLogged = false;
   /** 首帧是否已写过诊断(0.3.31:"一直没人看"也要留下证据)。 */
   let bridgeWatchWroteFirst = false;
   /** 上次写过的 hasPanel 判据原文(变了才写,避免每 600ms 刷屏)。 */
   let bridgeHasPanelLine = '';
-  /** 客户端(self-declared)是否能把授权卡片画出来(0.3.30)。 */
-  let bridgeApprovalsUi = false;
-  let bridgeApprovalsUiLogged = false;
 
   /**
    * 授权/看护状态的**诊断日志**(0.3.30):写到 <home>/.dsh/code-server/bridge-approval.log。
@@ -795,36 +817,30 @@ export async function apply(ctx, config) {
 
   /** 当前所有"在看"的会话(去重)。 */
   function watchedSessions() {
-    const all = [...bridgeWatch.ids, ...bridgeWatch.dialogIds];
-    return [...new Set(all.filter((id) => typeof id === 'string' && id !== ''))].slice(0, 4);
+    return [...new Set(bridgeWatch.dialogIds.filter((id) => typeof id === 'string' && id !== ''))].slice(0, 4);
   }
   /** 现在有没有人在看(授权拦截的唯一判据)。 */
   function hasWatcher() {
-    const sessions = watchedSessions();
-    if (sessions.length === 0) return false;
-    // **对话框是宿主侧状态**(只在 /ask/close 时消失):不拿轮询新鲜度去判它 ——
-    // 浏览器把后台标签的定时器节流到分钟级时,900ms 的心跳一断、5 秒窗口就过期,
+    // 0.3.59 起只有对话框一路。**对话框是宿主侧状态**(只在 /ask/close 时消失),所以不拿轮询新鲜度
+    // 去判它 —— 浏览器把后台标签的定时器节流到分钟级时,900ms 的心跳一断、5 秒窗口就过期,
     // 我们会误判"没人看"而放弃拦截(用户实测:授权卡片因此跑到 DSH 界面)。
-    if (bridgeWatch.dialogIds.length > 0) return true;
-    // 编辑器面板靠 /sync 的 600ms 心跳;窗口放宽到 60 秒(正常心跳远小于它)。
-    return Date.now() - bridgeWatch.at < 60000;
+    return watchedSessions().length > 0;
   }
 
   const bridgeApproval = createApprovalInterceptor({
     board: bridgeApprovalBoard,
     holdMs: DEFAULT_HOLD_MS,
-    // **只在客户端能画卡片时才抢答**(0.3.30):面板/对话框在看 **且** 它自己声明 approvalsUi。
+    // **只在对话框真的能显示卡片时才抢答**(0.3.30 / 0.3.59 收紧)。
     // 反例(用户实测):面板处于"宿主没有对话流能力"的坏状态时我们仍然抢答 ⇒ 官方卡片不出现、
     // 面板也不画 ⇒ 用户看到的是"没弹出授权",请求在宿主里干等 5 分钟。
-    // 客户端能画卡片 = 编辑器面板自报可以的 **或** 对话框开着且有会话(0.3.33)。
-    // "活着"由 /ask/state 轮询证明)。0.3.31 的日志给出了反例:用户从**对话框**提问 ⇒
-    // 编辑器面板是 null ⇒ 旧判据误判成"画不出卡片",授权被让给了 DSH 界面。
+    // 0.3.59 起编辑器面板退役,"能显示卡片"只剩**对话框开着 + 有人看 + 客户端半部在轮询**一条路
+    // (客户端自己声明 approvalsUi 那条也随面板一起删了 —— 声明者已经不存在)。
     hasPanel: () => {
       const watcher = hasWatcher();
       const dialogCapable = askDialogLive();
-      const verdict = watcher && (bridgeApprovalsUi || dialogCapable);
+      const verdict = watcher && dialogCapable;
       // 判据的**原始值**一起落日志(0.3.35):只记结论的话,出问题还是只能猜。
-      const line = 'hasPanel -> ' + verdict + ' (hasWatcher=' + watcher + ' approvalsUi=' + bridgeApprovalsUi
+      const line = 'hasPanel -> ' + verdict + ' (hasWatcher=' + watcher
         + ' dialogLive=' + dialogCapable + ' polls=' + askDialog.polls + ' open=' + askDialog.open
         + ' session=' + String(askDialog.sessionId) + ')';
       if (line !== bridgeHasPanelLine) { bridgeHasPanelLine = line; bridgeDiag(line); }
@@ -839,11 +855,15 @@ export async function apply(ctx, config) {
   /**
    * 「问 DSH」对话框的宿主侧状态(0.3.24)。
    *
-   * 对话渲染从编辑器的 webview 面板搬到了 **DSH 页面里的浮动对话框**(client 半部,见 src/factory.js):
-   * 面板是编辑器里的一个 tab/一列,而用户要的是"像 DSH 那样的对话框"。host 这边只负责:
+   * 对话只有一个宿主:**DSH 页面里的浮动对话框**(client 半部,见 lib/client.js)。host 这边只负责:
    *   - 打开/关闭状态(编辑器扩展右键 → 桥 `/event` 上报 `ask-open`);
    *   - 状态与动作的 HTTP 面(`/api/code-server/ask/*`,与 DSH 同源、吃它的 cookie/Origin 校验);
-   *   - 把面板产物(thread.js / thread.css)交给对话框注入(Lib 版本与 DSH 界面同版本,见 build-webview.mjs)。
+   *   - 把"被看的会话"投影成有界条目流(见 lib/bridge-thread.mjs)与待决授权快照。
+   *
+   * **0.3.59 起不再往页面里送产物,也不再服务编辑器面板**:面板就在 `lib/client.js` 里,渲染器走
+   * DSH 页面的模块表(`react-dom/client` + `@deepseek-ai/dsh-client-ui-primitives`);
+   * `/ask/bundle` 路由、`askBundle()` 与编辑器里的 webview 面板在同一版里一起删掉
+   * (thread.js / thread.css / build-webview.mjs / esbuild 那一整套)。
    */
   const askDialog = { open: false, armed: false, mode: 'selection', at: 0, sessionId: null, polls: 0, lastPollAt: 0 };
 
@@ -852,8 +872,8 @@ export async function apply(ctx, config) {
    *
    * 0.3.24 的教训:宿主无条件报 `askDialog: true`,扩展于是不再开编辑器面板;而客户端半部只要没跑起来
    * (浏览器还缓存着旧 bundle / 没硬刷新),就**没有任何一方在看这个会话** ⇒ 授权悄悄落到 DSH 界面的
-   * 官方卡片,用户在编辑器里什么都看不到。现在只有**真的收到过 `/ask/state` 轮询**(5 秒内)才算有
-   * 这个能力;否则扩展退回编辑器面板 —— 那是验证过、能看能点的 UI。
+   * 官方卡片,用户在编辑器里什么都看不到。现在只有**真的收到过 `/ask/state` 轮询**(10 分钟内)才算有
+   * 这个能力;0.3.59 起不满足时扩展也不再退编辑器面板(那一半已退役),而是明确提示用户刷新/打开页面。
    */
   function askDialogLive() {
     // 对话框每 900ms 问一次 /ask/state —— 那就是"活跃心跳"。心跳一旦建立,在 TTL 内
@@ -922,7 +942,8 @@ export async function apply(ctx, config) {
       statusText: '',
       error: null,
       sessionId: snapshot.sessionId ?? askDialog.sessionId ?? null,
-      uiVersion: uiVersion(),
+      // 0.3.59:`uiVersion` 只服务过"面板内置渲染器与界面版本比对"那行告警 —— 面板退役后删掉。
+      // `dshVersion` 留着:诊断时一眼看出这套宿主跑在哪个 DSH 上。
       dshVersion: dshVersion(),
     };
   }
@@ -932,10 +953,12 @@ export async function apply(ctx, config) {
     return bridgeThread.rev(watchedSessions()) * 8 + bridgeApprovalBoard.rev() * 8 + (askDialog.open ? 1 : 0) + (askDialog.mode === 'file' ? 2 : 0);
   }
 
-  /** 对话框刷新它的"我在看"时间戳(每趟 /state 都算一次)。 */
+  /** 对话框刷新它的"我在看"时间戳(每趟 /state 都算一次)。
+   *  0.3.59 起这里也负责对齐会话流订阅:以前是扩展每 600ms 的 `/sync` 顺带做的。 */
   function refreshDialogWatch() {
     bridgeWatch.dialogIds = askDialog.open && askDialog.sessionId !== null ? [askDialog.sessionId] : [];
     bridgeWatch.at = Date.now();
+    bridgeThread.sync(watchedSessions());
   }
 
   /**
@@ -952,29 +975,6 @@ export async function apply(ctx, config) {
     return { status: ok ? 200 : 409, body: { ok, outcome: ok ? outcome : null } };
   }
 
-  /** 面板产物(thread.js / thread.css):对话框把它们注入 DSH 页面,所以由 host 读盘给文本。 */
-  let askBundleCache = null;
-  function askBundle() {
-    if (askBundleCache !== null) return askBundleCache;
-    const dir = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'assets', 'extensions', 'dshcs-editor-bridge', 'webview');
-    const read = (name) => {
-      try {
-        return fs.readFileSync(path.join(dir, name), 'utf8');
-      } catch {
-        return null;
-      }
-    };
-    const js = read('thread.js');
-    const css = read('thread.css');
-    // 产物缺失(打包漏了 build:webview)→ 明确报出来,不返回半个面板。
-    if (js === null || css === null) {
-      console.warn(`[code-server] 「问 DSH」对话框的产物缺失:${dir}(请在源码里跑 pnpm run build:webview)`);
-      return null;
-    }
-    askBundleCache = { js, css };
-    return askBundleCache;
-  }
-
 
   /** 本部署的 DSH 版本(诊断用;面板要的是下面那个"界面版本")。 */
   function dshVersion() {
@@ -988,36 +988,6 @@ export async function apply(ctx, config) {
     }
   }
 
-  /**
-   * 本部署**界面**的版本(0.3.22)。
-   *
-   * 面板里的 markdown 渲染器是从 `@deepseek-ai/dsh-client-ui-primitives` 打包进去的,而那份
-   * 渲染器就装在 `@deepseek-ai/dsh-web-frontend` 里(DSH Web 的前端包)。面板拿这个版本和
-   * 自己打包时的版本比一比,不一致就在面板顶部显示一行提示 —— 版本错配的排版差异不许静默。
-   */
-  function uiVersion() {
-    try {
-      const entry = dshEntry();
-      if (entry === undefined || entry === null) return null;
-      const dir = path.dirname(entry);
-      const candidates = [
-        path.join(dir, 'node_modules', '@deepseek-ai', 'dsh-web-frontend', 'package.json'),
-        path.join(dir, '..', 'dsh-web-frontend', 'package.json'),
-      ];
-      for (const candidate of candidates) {
-        try {
-          const manifest = JSON.parse(fs.readFileSync(candidate, 'utf8'));
-          if (typeof manifest.version === 'string') return manifest.version;
-        } catch {
-          // 下一个候选
-        }
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }
-
   /** 本次启动生成的新桥令牌;null = 本实例没有令牌(adopt 旧实例时会回读 bridge.json)。 */
   let bridgeToken = null;
   /** 桥的本机 IPC 监听口(0.3.13)。null = 未起(未启用/起失败)。*/
@@ -1084,15 +1054,17 @@ export async function apply(ctx, config) {
 
   /** 桥的路由(后缀 → Fetch 风格 handler)。做成函数而非常量:handler 声明在文件后段,
    *  函数声明会提升,而常量在挂载时可能还在 TDZ。
-   *  `/approve` 是唯一的非只读路由(只回答既有授权请求,见 handleBridgeApprove)。 */
+   *
+   *  **四条路由全部只读**:/health 探活、/sync 上报状态+取事件、/old 取写前原文、/event 上报意图
+   *  (请宿主打开对话框等)。提问与授权**不在这里** —— 它们走 DSH 同源的
+   *  `/api/code-server/ask/{send,approve}`,调用方是 DSH 页面里的插件客户端(client 半部),
+   *  吃 DSH 自己的 cookie/Origin 校验。 */
   function bridgeRouteTable() {
     return [
       { suffix: '/health', methods: ['GET'], fetch: handleBridgeHealth },
       { suffix: '/sync', methods: ['POST'], fetch: handleBridgeSync },
       { suffix: '/old', methods: ['GET'], fetch: handleBridgeOld },
-      { suffix: '/ask', methods: ['POST'], fetch: handleBridgeAsk },
       { suffix: '/event', methods: ['POST'], fetch: handleBridgeEvent },
-      { suffix: '/approve', methods: ['POST'], fetch: handleBridgeApprove },
     ];
   }
 
@@ -1159,12 +1131,12 @@ export async function apply(ctx, config) {
   });
 
   // 会话流与授权拦截都是**按会话**建立的(在 /ask 成功时 watch + intercept),
-  // 这里只登记卸载钩子:面板关掉 / IDE 停掉时把订阅与 pending 授权一起收干净。
+  // 这里只登记卸载钩子:对话框关掉 / IDE 停掉时把订阅与 pending 授权一起收干净。
   bridgeAnswerDispose = () => {
     bridgeThread.dispose();
     bridgeApproval.dispose();
     bridgeApprovalBoard.clear();
-    bridgeWatch.ids = [];
+    bridgeWatch.dialogIds = [];
     bridgeWatch.at = 0;
   };
 
@@ -1518,7 +1490,7 @@ export async function apply(ctx, config) {
 
   /** 已运行实例切换工作区:**只改"当前 workbench 目录",不重启进程**。
    *
-   *  为什么够用:工作区目录由客户端 URL 的 `&folder=<绝对路径>` 决定(见 src/factory.js 的
+   *  为什么够用:工作区目录由客户端 URL 的 `&folder=<绝对路径>` 决定(见 lib/client.js 的
    *  buildPageUrl),服务进程自己的 cwd 只影响它 spawn 时对相对路径的解析;真正"换目录"是
    *  workbench 拿新 folder 重新导航(客户端导航 iframe)。
    *  旧行为(0.2.11 及以前)在这里 stop('restart') + 重新 launch:切一次工作区就整进程重启,
@@ -2021,17 +1993,7 @@ export async function apply(ctx, config) {
     // 把当前最大 seq 一并回去:客户端据此自查"我的游标是不是跑到宿主前面去了"(跨版本升级、
     // 接管了别的宿主留下的游标文件等),发现后退回 since=0 重新对齐,免得永久失聪。
     const lastSeq = bridgeEvents.lastSeq();
-    // 面板声明它要看哪些会话(数组;空 = 关掉了)。据此对齐订阅 + 判断"面板在不在看"
-    // (授权拦截只在面板看着的时候才抢答,否则一律交给官方链路)。
-    const watch = Array.isArray(body.watch) ? body.watch.filter((id) => typeof id === 'string' && id !== '') : [];
-    bridgeWatch.ids = watch.slice(0, 4);
-    bridgeApprovalsUi = body.approvalsUi === true;
-    if (bridgeApprovalsUi !== bridgeApprovalsUiLogged) {
-      bridgeApprovalsUiLogged = bridgeApprovalsUi;
-      bridgeDiag('approvalsUi → ' + bridgeApprovalsUi + '(客户端可否显示授权卡片)');
-    }
     bridgeWatch.at = Date.now();
-    bridgeThread.sync(watchedSessions());
     // 看护状态变化就写一行;并且**首帧必写**(0.3.31:只记"翻转"会让"一直没人看"这种情况在日志里
     // 完全空白,事后无从判断 —— 上一轮就是这样被拖了一整轮)。
     const watchingNow = hasWatcher();
@@ -2039,118 +2001,30 @@ export async function apply(ctx, config) {
       bridgeWatchLogged = watchingNow;
       bridgeWatchWroteFirst = true;
       bridgeDiag('hasWatcher → ' + watchingNow
-        + ' (面板=[' + bridgeWatch.ids.join(',') + '] 对话框=[' + bridgeWatch.dialogIds.join(',') + ']'
-        + ' approvalsUi=' + bridgeApprovalsUi + ')');
+        + ' (对话框=[' + bridgeWatch.dialogIds.join(',') + '])');
     }
     // 请求过对话框、客户端半部却从没来问过 → 说清楚原因(多半是浏览器还缓存着旧的客户端 bundle)。
     if (askDialog.open && !askDialogLive() && askDialog.warned !== true) {
       askDialog.warned = true;
       console.warn('[code-server] 请求了「问 DSH」对话框,但客户端半部没有轮询 /ask/state:'
-        + '浏览器可能还在用旧的客户端 bundle(硬刷新 / 清 Code Cache)。'
-        + '此期间提问会退回编辑器面板,授权也在面板里批。');
+        + '浏览器可能还在用旧的客户端 bundle(硬刷新 / 清 Code Cache)。');
     }
-    // **对话流只在变化时回传**(0.3.27):以前每趟 /sync 都塞整份快照(≤120 条 × ≤8KB,可达 ~1MB / 600ms),
-    // 实测把 /sync 拖成 3 秒超时 —— 扩展收不到响应 ⇒ 面板看不到 approvals ⇒ 授权卡片永远不出现
-    // (卡片在宿主里干等到窗口结束才交给 DSH 界面)。现在给修订号,没变化就不重传。
-    const threadRev = bridgeThread.rev(watchedSessions());
-    const snapshot = bridgeThread.supported()
-      ? bridgeThread.snapshot(watchedSessions())
-      : { available: false, sessionId: null, cursor: null, rev: 0, entries: [], error: '宿主没有 sessionController.follow(DSH 版本过旧)' };
-    // **按"客户端已经拿到哪一版"决定发不发**(0.3.29 修):0.3.28 比的是宿主自己上次发过的版本,
-    // 于是"面板是后开的"这种情形下宿主认为没变化、什么都不发,面板手里一份快照都没有 ⇒ 旧模型把它
-    // 当成"宿主没有对话流能力"(用户实测到的那条误报)。现在由客户端用 threadRev 声明自己持有的版本;
-    // 不带这个字段的旧扩展一律收整份(不省流量,但绝不误报)。
-    const peerRev = Number.isSafeInteger(body.threadRev) ? body.threadRev : null;
-    const threadChanged = peerRev === null || peerRev !== threadRev || snapshot.available === false;
-    bridgeThreadRevSent = threadRev;
-    // 对话流走独立字段:每个会话给有界条目(见 lib/bridge-thread.mjs),
-    // 授权待决列表也一并回去(面板显示卡片)。
+    // **对话流不再经这里**(0.3.59):那是编辑器 webview 面板时代的分工 —— 面板退役后这条
+    // 每 600ms 一趟的通道上驮着 ≤1MB 的快照(0.3.27 还专门为它做过"没变化就不重传"的省流量),
+    // 现在全归 `/api/code-server/ask/state`:对话框每 900ms 只问修订号,没变化只回一个数字。
     return jsonResponse({
       ok: true,
       events,
       // 事件序号的高水位:扩展用它自查游标是否超前(超前 ⇒ 退回 since=0 重新对齐,避免永久失聪)。
       lastSeq,
-      // thread 缺省 = 没变化(扩展沿用上一份);threadRev 用来区分"没变化"与"旧宿主没有这个字段"。
-      threadRev,
-      thread: threadChanged ? snapshot : undefined,
-      approvals: bridgeApprovalBoard.snapshot(),
-      // 授权卡片要在面板上倒计时,窗口长度由 host 给(面板不猜)。
-      approvalHoldMs: DEFAULT_HOLD_MS,
-      dshVersion: dshVersion(),
-      // 界面版本:面板据此提示"内置渲染器与当前 DSH 界面版本不一致"。
-      uiVersion: uiVersion(),
-      // 能力探测(0.3.24;0.3.25 起以"客户端半部真的在轮询"为准):
-      // 只有对话框活着的时候才让扩展走 ask-open;否则扩展开编辑器面板(那里也能批授权)。
+      // 能力探测(0.3.24;0.3.25 起以"客户端半部真的在轮询 /ask/state"为准):
+      // 只有对话框活着的时候才让扩展走 ask-open;0.3.59 起不满足时扩展给一条提示(不再退编辑器面板)。
       askDialog: askDialogLive(),
       // 诊断用:请求过对话框但客户端没响应(浏览器缓存旧 bundle?)。
       askDialogRequested: askDialog.open,
     });
   }
 
-  async function handleBridgeAsk(request) {
-    const denied = bridgeRejection(request);
-    if (denied !== null) return denied;
-    let body;
-    try {
-      body = await readJsonBody(request);
-    } catch {
-      return jsonResponse({ ok: false, error: '请求体不是合法 JSON' }, 400);
-    }
-    const text = typeof body.text === 'string' ? body.text : '';
-    if (text === '') return jsonResponse({ ok: false, error: '需要 text 字段(要问 DSH 的话)' }, 400);
-    const file = typeof body.file === 'string' && body.file !== '' ? body.file : null;
-    const lineStart = Number.isSafeInteger(body.lineStart) ? body.lineStart : null;
-    const lineEnd = Number.isSafeInteger(body.lineEnd) ? body.lineEnd : null;
-    const selection = typeof body.selection === 'string' && body.selection !== '' ? body.selection : null;
-    // 交给 bridge-session.mjs(agent 投递);它内部特性探测 agents,缺失时返回
-    // {ok:false, code:'NO_AGENT'} —— 这里原样透传,并把 NO_AGENT 映射成 409。
-    const result = await deliverEditorPrompt(ctx, {
-      text,
-      file,
-      lineStart,
-      lineEnd,
-      selection,
-      languageId: typeof body.languageId === 'string' ? body.languageId : null,
-    });
-    // 会话流 + 授权拦截都在这里建立(只针对**被问过的**那个会话,agent 作用域):
-    //   - thread:面板像 DSH 对话那样显示"新内容"(见 lib/bridge-thread.mjs);
-    //   - approval:该会话的敏感动作(工作区外写入 / 命令执行)先在面板里问一句,
-    //     8 秒没人答就交给官方链路(见 lib/bridge-approval.mjs)。
-    if (result.ok === true && typeof result.sessionId === 'string' && result.sessionId !== '') {
-      const ok = bridgeThread.watch(result.sessionId);
-      if (!ok) console.warn('[code-server] 编辑器桥:会话订阅未建立(宿主没有 sessionController.follow)');
-      bridgeApproval.intercept(result.agent, result.sessionId);
-    }
-    // `agent` 是内部句柄,不能进 JSON。
-    const { agent: _agent, ...payload } = result;
-    void _agent;
-    return jsonResponse(payload, result.ok === true ? 200 : (result.code === 'NO_AGENT' ? 409 : 200));
-  }
-
-  /**
-   * 面板对授权请求的决策(0.3.22)。
-   *
-   * **这是命名空间里唯一的非只读路由**,约束写死在实现里:
-   *   - 只能回答**本 host 发起、仍未决**的请求(单次使用,用后即废);
-   *   - outcome 只接受 `allowed-once` / `rejected`;
-   *   - 不接受任何自由文本、路径或命令参数 —— 它只能"回答问题",不能"发起动作"。
-   */
-  async function handleBridgeApprove(request) {
-    const denied = bridgeRejection(request);
-    if (denied !== null) return denied;
-    let body;
-    try {
-      body = await readJsonBody(request);
-    } catch {
-      return jsonResponse({ ok: false, error: '请求体不是合法 JSON' }, 400);
-    }
-    const verdict = answerApproval(
-      typeof body.id === 'string' ? body.id : '',
-      typeof body.outcome === 'string' ? body.outcome : '',
-    );
-    return jsonResponse(verdict.body, verdict.status);
-  }
-
   // ---------------------------------------------------------------- 「问 DSH」对话框(client 半部)
 
   /** 对话框每 900ms 问一次:给修订号,没变就只回一个数字(不重传几十 KB 的对话流)。 */
@@ -2193,6 +2067,9 @@ export async function apply(ctx, config) {
     if (text === '') return jsonResponse({ ok: false, error: '需要 text 字段(要问 DSH 的话)' }, 400);
     const mode = body.mode === 'file' ? 'file' : askDialog.mode;
     const context = askContextFromCache(mode);
+    // 投递方式(0.3.59):默认跟着 DSH 自己的设置 `ui-conversation.busyEnter` 走(见
+    // lib/bridge-session.mjs 的 pickBusyEnter)—— 面板按 Enter 与主界面按 Enter 是同一个手势,
+    // 行为必须一致。显式传 `delivery: 'queue'|'steer'` 可覆盖(测试用,或将来在面板上做"插队"按钮)。
     const result = await deliverEditorPrompt(ctx, {
       text,
       file: context === null ? null : context.file,
@@ -2200,7 +2077,7 @@ export async function apply(ctx, config) {
       lineEnd: context === null ? null : context.lineEnd,
       selection: context === null ? null : context.selection,
       languageId: context === null ? null : context.languageId,
-    });
+    }, { delivery: typeof body.delivery === 'string' ? body.delivery : undefined });
     if (result.ok === true && typeof result.sessionId === 'string' && result.sessionId !== '') {
       askDialog.sessionId = result.sessionId;
       askDialog.mode = mode;
@@ -2213,7 +2090,7 @@ export async function apply(ctx, config) {
     return jsonResponse(payload, result.ok === true ? 200 : (result.code === 'NO_AGENT' ? 409 : 200));
   }
 
-  /** 对话框回答授权(与桥的 /approve 同一套校验)。 */
+  /** 对话框回答授权(与宿主内部 answerApproval 同一套校验:白名单 outcome + 只认仍未决的 id)。 */
   async function handleAskApprove(request) {
     let body;
     try {
@@ -2239,15 +2116,6 @@ export async function apply(ctx, config) {
     return jsonResponse({ ok: true });
   }
 
-  /** 面板产物(thread.js / thread.css)给对话框注入用。 */
-  async function handleAskBundle() {
-    const bundle = askBundle();
-    if (bundle === null) {
-      return jsonResponse({ ok: false, error: '面板产物缺失:请在插件源码里跑 pnpm run build:webview,或重装插件' }, 503);
-    }
-    return jsonResponse({ ok: true, rev: askRevision(), ...bundle });
-  }
-
   async function handleBridgeEvent(request) {
     const denied = bridgeRejection(request);
     if (denied !== null) return denied;
@@ -2283,7 +2151,7 @@ export async function apply(ctx, config) {
     { path: `${API_BASE}/ask/send`, methods: ['POST'], fetch: handleAskSend },
     { path: `${API_BASE}/ask/approve`, methods: ['POST'], fetch: handleAskApprove },
     { path: `${API_BASE}/ask/close`, methods: ['POST'], fetch: handleAskClose },
-    { path: `${API_BASE}/ask/bundle`, methods: ['GET'], fetch: handleAskBundle },
+    // 0.3.59 删掉了 `/ask/bundle`(面板产物不再存在:面板本体在 lib/client.js 里,渲染器走页面模块表)。
     // ---- 编辑器桥的 4 条路由**不在 /api 下**(0.3.9 修正)----
     // 原因:Connection 给 `/api` 装了 cookie fence(无 cookie → 401),而扩展宿主是 Node 进程、
     // 永远拿不到浏览器 cookie ⇒ 挂在这里的路由根本到不了(实测:带令牌也被 401/405 挡回)。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.3.57",
-  "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Since 0.3.0 the bundle also ships an editor bridge (assets/extensions/dshcs-editor-bridge): a read-only channel between the in-tree VS Code extension host and DSH, giving the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and letting editor gestures drive the session. Since 0.3.22 the ask panel renders that session's new content with DSH's own Markdown renderer (pinned to the deployed DSH UI version); since 0.3.23 it is a full-width dialog with collapsible thinking rows and can answer approval requests in place — the bridge's only non-read-only route (POST /approve, constrained to pending in-process requests and the outcomes allowed-once/rejected; panel-first for 5 minutes, handed back to the official card the moment the panel closes). The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). Since 0.3.55 the diff the bridge opens always has the real pre-write text on the left, even for files that are not open in the editor: the host reads the execution-local result.value.before in tools/post-execute (the durable tools/result projection deliberately omits value) into a bounded snapshot cache and the extension fetches it by opaque key over the read-only GET /old route; paths are resolved against the session cwd first, so relative file_path arguments are no longer dropped by the editor's workspace check. Since 0.3.56 the bridge actually delivers every diff: the event ring's sequence is monotonic for the lifetime of a host process (0.3.9-0.3.55 rewound it after every /sync, so at most one agent-edit per IDE session was ever delivered), /sync returns lastSeq, and the extension re-aligns its cursor by itself when it notices it ran ahead. No code-server Node layer, no argon2, no C++ toolchain.",
+  "version": "0.3.59",
+  "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs), plus an editor bridge (assets/extensions/dshcs-editor-bridge) that gives the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and lets editor gestures drive the session. The bridge is completely read-only: all four of its routes (/health, /sync, /old, /event) are reads. Asking DSH from the editor opens a floating dialog inside the DSH page (draggable, resizable, bottom-right): the plugin's client half sends the question as user input (POST /api/code-server/ask/send) and renders that session's new content with DSH's own Markdown renderer - the same @deepseek-ai/dsh-client-ui-primitives instance the UI uses, required from the page's module table, so typography, highlighting and math match the interface and a renderer version mismatch is impossible. Thinking appears as collapsed rows and approval requests (writing outside the workspace / running commands) can be answered in place: whole-plugin write route POST /api/code-server/ask/approve, constrained to pending in-process requests and the outcomes allowed-once/rejected; dialog-first for 5 minutes, handed back to the official card the moment the dialog closes, never auto-approved. There is no build step anywhere: lib/client.js (client half including the dialog panel) and the extension are committed hand-written source, devDependencies holds a single test-only entry, and the published package carries no frontend bundle. Also: the tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so produced-file chips, delivered-file previews and inline prose mentions open in the workbench; the IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs does not reload it; opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen); a workspace switch re-navigates the workbench with the new ?folder= without restarting the IDE process. Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions only get an upgrade notice on the settings page. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). The diff the bridge opens always has the real pre-write text on the left, taken from result.value.before in tools/post-execute into a bounded snapshot cache and fetched by opaque key over the read-only GET /old, so files that are not open in the editor work too. No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
     "type": "git",
@@ -67,30 +67,7 @@
     "README.en.md"
   ],
   "devDependencies": {
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-theme": "0.1.6-alpha.1",
-    "@deepseek-ai/schemastery": "3.18.2",
-    "@shikijs/langs": "4.3.1",
-    "anser": "2.3.5",
-    "clsx": "2.0.0",
-    "diff": "9.0.0",
-    "esbuild": "^0.25.0",
-    "katex": "0.16.47",
-    "mdast-util-from-markdown": "2.0.3",
-    "mdast-util-gfm": "3.1.0",
-    "mdast-util-math": "3.0.0",
-    "micromark-core-commonmark": "2.0.3",
-    "micromark-extension-gfm": "3.0.0",
-    "micromark-extension-math": "3.1.0",
-    "micromark-factory-space": "2.0.1",
-    "micromark-util-character": "2.1.1",
-    "micromark-util-classify-character": "2.0.1",
-    "micromark-util-sanitize-uri": "2.0.1",
-    "micromark-util-symbol": "2.0.1",
-    "micromark-util-types": "2.0.2",
-    "react": "18.3.1",
-    "react-dom": "18.3.1",
-    "shiki": "4.3.1"
+    "@deepseek-ai/schemastery": "3.18.2"
   },
   "license": "MIT",
   "dependencies": {
@@ -183,8 +160,6 @@
     "publish:repacks": "node scripts/publish-repacks.mjs",
     "publish:plugin": "node scripts/publish-plugin.mjs",
     "promote": "node scripts/promote.mjs",
-    "build:client": "node scripts/build-client.mjs",
-    "build:webview": "node scripts/build-webview.mjs",
     "test:apply": "node scripts/test-plugin-apply.mjs",
     "test:launcher-routes": "node scripts/test-launcher-routes.mjs",
     "test:fullscreen": "node scripts/test-sidebar-fullscreen.mjs",
@@ -193,6 +168,8 @@
     "test:workspace-cwd": "node scripts/test-workspace-cwd.mjs",
     "test:client-cwd": "node scripts/test-client-bundle-cwd.mjs",
     "test:client-tabs": "node scripts/test-client-bundle-tabs.mjs",
+    "test:client-entry": "node scripts/test-client-entry.mjs",
+    "test:ask-panel": "node scripts/test-ask-panel-inline.mjs",
     "test:client-seat": "node scripts/test-client-settings-seat.mjs",
     "test:dsh-resolve": "node scripts/test-dsh-resolve.mjs",
     "test:child-node": "node scripts/test-child-node.mjs",
@@ -200,7 +177,7 @@
     "test:bridge-routes": "node scripts/test-bridge-routes.mjs",
     "test:edit-snapshot": "node scripts/test-edit-snapshot.mjs",
     "test:bridge-extension": "node scripts/test-bridge-extension.mjs",
-    "test:webview": "node scripts/test-webview-bundle.mjs",
+    "test:ask-dialog": "node scripts/test-ask-dialog.mjs",
     "test:vendored": "node scripts/test-vendored-table.mjs"
   }
 }

package/vendor/VENDOR.json

@@ -3,7 +3,7 @@
   "vscodeVersion": "1.137.0",
   "productPath": "stable-b11dabdaca0d3369986975be285db92c8795cea5",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-19T12:45:33.503Z",
+  "preparedAt": "2026-09-20T15:36:43.387Z",
   "source": "registry",
   "node": "v24.20.0",
   "platform": "linux",