dsh-code-server-app 0.3.59 → 0.3.63

package/LICENSE-Apache-2.0.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.en.md

@@ -50,7 +50,7 @@ A static profile plugin (npm package with host + client bundle) that ships the *
     the narrow-viewport handling). When the button is missing it keeps the current mode and logs one `console.warn` — panel
     rendering is never affected.
 - **Resident IDE (0.2.2, on by default)**: switching to another tab or collapsing the sidebar and coming back **no longer reloads** code-server — unsaved editor buffers, terminals and debug sessions all stay put (see "Why switching tabs no longer reloads" below).
-- The settings card has exactly **three settings**: "**Claim types**", "**Fullscreen on open**" and "Resident in background" — no other rows (0.2.7 removed the "Entry", "dependency install" and "environment check" rows).
+- The settings card has exactly **four settings**: "**Claim types**", "**Fullscreen on open**", "Resident in background" and "**FIM completion (experimental, off by default)**" — no other rows (0.2.7 removed the "Entry", "dependency install" and "environment check" rows).
   Open the IDE from the **Code Server box** on the sidebar's guide page, or by clicking DSH's own produced-file chips / delivered-file previews / inline file names;
   diagnostics stay out of the UI — the `[code-server]` lines in the DSH host log are the place to look (`/api/code-server/status` still returns `env` for scripts).
   The old `windowedOpen` (open in a window) and `reserveComposer` were **removed in 0.2.6**: leftover keys in an old settings document neither fail nor apply (they are no longer part of the schema).
@@ -354,10 +354,15 @@ Regression: the "push → take → clear, twice" case in `scripts/test-bridge-ro
 The token lives in `<extensionsDir>/.dshcs-bridge/bridge.json`, **readable by any process of the same local
 user**, so:
 
-1. **`/code-server-bridge/*` is read-only, with `/approve` as the single exception.** No route writes files,
+1. **`/code-server-bridge/*` is read-only, with two bounded exceptions.** No route writes files,
    edits documents, runs commands, or spawns processes. A leaked token is therefore bounded to "sees information
    that is in the editor" and **can never** become arbitrary file writes or command execution. A whitelist
    assertion in `scripts/test-bridge-routes.mjs` guards this.
+   `/complete` (0.3.61, **experimental FIM completion, off by default**) is the one route that makes a **model
+   call**: it takes two strings (the text before/after the cursor) and returns one string. It still writes
+   nothing and runs nothing, is disabled unless the setting is on (403 otherwise), and is bounded by
+   length/rate/concurrency/timeout caps — so the worst case for a leaked token grows only to "spends a little
+   completion budget and reads back one completion".
    `/old` (added in 0.3.55) lives under the same invariant: it only reads the bounded cache of "pre-write copies of
    the last few agent writes" (≤8 entries, ≤1 MB each, ≤4 MB total, 5-minute TTL) by **opaque key**, 404s when it
    is gone, takes no path argument (so it cannot read arbitrary files) and does not consume (repeat polls get the
@@ -394,6 +399,64 @@ as stated for the loopback port.
 Diagnostics: `GET /api/code-server/status` exposes
 `bridge: { enabled, live, toolsRegistered, supported, url, file }` — **never the token** (that only exists in the file).
 
+## FIM completion (experimental, since 0.3.61, **off by default**)
+
+When you pause while typing, a grey continuation appears after the cursor (Tab accepts, Esc discards).
+It is **off by default**; turn it on with that row in the settings card — it takes effect immediately
+(no host restart, no reinstall).
+
+| Item | Value |
+|---|---|
+| Endpoint | DeepSeek **FIM (Beta)**: `POST https://api.deepseek.com/beta/completions`, params `prompt` (prefix) + `suffix` (suffix) |
+| Model | `deepseek-flash` (the model the official FIM doc uses — also this deployment's default) |
+| Credential | Reuses the `DEEPSEEK_API_KEY` DSH already has: `ctx.get('credentials').resolve(...)`, the same path the official adapter takes (falling back to the launch environment) |
+| Measured latency | **112–416 ms** (non-streaming; streaming was *slower*, hence non-streaming on purpose) |
+| When it fires | After a ≥250 ms pause and only past the gates: non-empty selection / non-`file` document / empty context / document >20k lines — those **never send a request** |
+
+**How it is wired in (option A)**: FIM speaks the Completions API, while `ctx.llm.stream(GenerateOptions)`
+only knows `messages` (no `prompt`/`suffix`; `purpose` is a closed union of `'compaction' | 'session-title'`).
+So the plugin **registers its own LLM adapter route** `dshcs-fim`: the prefix/suffix travel inside a
+`messages` envelope with a fixed marker (`dshcs-fim/1 `), and the adapter decodes it before hitting that
+endpoint. The call therefore still goes **through DSH's LLM service** — cancellation, timeouts, terminal
+chunks and stable error codes all follow the service contract (instead of the plugin bypassing it with a
+raw fetch). Evidence and measurements: B6/B7 of `docs/analysis-continuedev-reuse.md`.
+
+**Three knobs (0.3.62, all in the settings card, effective immediately)**:
+
+| Setting | Default | Effect |
+|---|---|---|
+| Pause in ms | `250` | How long typing must stop before a request. Range 100–3000 ms (clamped on save); the endpoint round trip measured **112–416 ms**, so the pause *is* the perceived latency |
+| Allow multi-line | on | Off ⇒ the host returns the first line only; an empty first line means no completion. Turn it off to be less intrusive |
+| Disable by glob | empty | In these files **no request is sent at all**. Semantics: `*` does not cross directories, `**` does, a pattern without `/` matches the basename, a pattern with `/` matches any path suffix (so `vendor/**` and `src/*.ts` work at any depth), a trailing `/` means `/**`. Example: `*.md;vendor/**;**/dist/**` |
+
+> Both sides implement these semantics independently (the extension is a static file shipped with the package
+> and cannot import host code); `scripts/test-fim.mjs` pins their equivalence with one shared (pattern, path)
+> corpus.
+
+**Safety and bounds** (this is the only capability of the plugin that sends content out):
+
+- **Still read-only**: the extension never writes files and never runs commands — it only *proposes* text;
+  insertion happens when you press Tab;
+- The bridge gains its fifth route `POST /complete` (**the only route that makes a model call**) only while
+  the setting is on; with it off the route answers 403 and no request is made;
+- Bounded: prefix/suffix ≤6000/2000 chars (120/40 lines, whichever comes first), output ≤2000 chars,
+  4 s timeout, 120 ms minimum interval, concurrency 1, 60 calls/minute; over-limit requests are rejected
+  (409/429) and the extension simply shows no completion for that beat;
+- One more layer in the extension: turning the setting off disposes the provider immediately (no requests at
+  all), and identical context hits a local 2-minute cache;
+
+**Usage is visible in exactly two places**: these calls are **not session requests**, so they are not written
+to the session log and DSH's own token accounting (per-turn usage, context pressure, telemetry) **excludes
+them**. Usage therefore shows up in ① the IDE status bar's DSH item — a `$(zap) 1.2k` counter when on, with
+input/output/cache-read/last-latency/last-error on hover, and ② the `fim` field of
+`GET /api/code-server/status` (same snapshot).
+
+**Known limits**: the model occasionally invents an insertion where nothing is needed (2/2 reproduced at a
+cursor position that needed none); the filter pipeline strips code fences and control markers, but "should
+this be completed at all" stays your call — Esc or typing on makes it disappear. A more reliable shape needs
+a faster completion route, or DSH making completion a first-class request (at which point only the adapter's
+data call changes; the caller stays as it is).
+
 ## Legacy DSH (unsupported since 0.2.3)
 
 **Behaviour**: when `sidebarRightTabs` / `sidebarRight` cannot be found, the plugin registers a single settings card:
@@ -457,7 +520,7 @@ Diagnostics: `GET /api/code-server/status` exposes
   committed hand-written source: there is no build step anywhere on that chain).
 
 > Verified locally (BM: Windows 11 ARM64): the whole tree/dependency chain hangs directly off the plugin's
-> dependency table — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.137.0, a 50.8 MB tarball),
+> dependency table — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.138.0, a 50.9 MB tarball),
 > the pure-JS inner dependencies plus the 8 platform-independent repacks in `dependencies`, and the 8
 > platform-specific repacks (win32-arm64 / win32-x64) in `optionalDependencies` with their own os/cpu gates;
 > the original names are restored by junctions created at runtime (`lib/native.js`)
@@ -505,7 +568,7 @@ pnpm run promote -- <version>
 | Goal | Command |
 |---|---|
 | **Build from the latest upstream release** | `pnpm run vendor:latest` (= `--force`): pulls `code-server@latest`'s tree into `vendor/vscode`; afterwards you **must** re-run `repack:build` and republish every sub-package |
-| **Pin a version** | `pnpm run vendor:vscode -- --version 4.137.0` |
+| **Pin a version** | `pnpm run vendor:vscode -- --version 4.138.0` |
 | **Snapshot from an existing tree** | `pnpm run vendor:vscode -- --from <code-server dir>` (seconds) |
 | **Rebuild every sub-package** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
 | **Rebuild only the tree + dependency table** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack` (reuses the natives already in `repack/build`; also rewrites `lib/vendored.json` and the plugin dependency table) |
@@ -956,7 +1019,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### Upgrading the VS Code tree (upstream = a code-server release)
 
 - **The version is decided at pack time**: `pnpm run vendor:latest` (= `--force`) pulls the tree of the npm **latest**
-  release; or use `pnpm run vendor:vscode -- --version 4.137.0` / `DSHCS_CODE_SERVER_VERSION`.
+  release; or use `pnpm run vendor:vscode -- --version 4.138.0` / `DSHCS_CODE_SERVER_VERSION`.
   With an existing `vendor/vscode`, a plain `pnpm pack` never upgrades (it is a no-op).
   **Source-tree precedence (fixed in 0.2.13)**: an explicit `--from` uses that tree, while an explicit
   `--force`/`--version` now **always goes to the registry** — before the fix a local source tree won
@@ -971,13 +1034,14 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - **A version bump means rebuilding and republishing the sub-packages** (all with the same script):
   1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → the new tree package
      (`@jinsiyu/dshcs-vscode-server@<new version>`) and the natives rebuilt against the new inner dependencies (the
-     script also rewrites the plugin's pure-JS `dependencies` and both aggregator versions);
-  2. `pnpm run republish:repacks` (`pnpm run publish:repacks`) → publish; then bump the plugin version → `pnpm pack`
+     script also rewrites the plugin's pure-JS `dependencies`, writes the 16 repacks under their real names into
+     `dependencies` / `optionalDependencies`, and rewrites `lib/vendored.json`);
+  2. `pnpm run publish:repacks` → publish; then bump the plugin version → `pnpm pack`
      → publish the plugin.
 - `productPath` (`<quality>-<commit>`, part of the client WebSocket path) is **computed from `lib/vscode/product.json`**,
   so upgrading the tree needs no code change — but the routes are registered at activation, so restart `dsh web` afterwards.
 - **No runtime auto-upgrade anymore**: nothing fetches latest at startup; the version is fully determined by the bundled artifact.
-- Bundled locally right now: the tree of `code-server@4.137.0` (VS Code 1.137.0, `productPath=stable-b11dabda…`).
+- Bundled locally right now: the tree of `code-server@4.138.0` (VS Code 1.138.0, `productPath=stable-59c988c7…`).
 
 ### Compatibility with the old install locations
 
@@ -996,8 +1060,12 @@ persisted via the official settings domain (`settingsScope`, namespace `code-ser
 | `claimExtensions` | `*` + three exclusion groups (preview-friendly / executables / Office; full lists in the "Claim types" section) | **Claim types** (0.2.11, replaces 0.2.5's `fileOpenScope`): decides by extension which files go to VS Code, semicolon-separated; `*` claims every other type, `!ext` excludes (exclusion wins). The default leaves the four categories DSH's preview renders well (markdown/html/images/PDF) to DSH and sends everything else to the IDE; an empty value claims nothing. **Scope (session vs absolute) is no longer distinguished** |
 | `fullscreenOnOpen` | `true` | **Fullscreen on open** (0.2.9): opening the Code Server tab (including clicking a file) switches the right sidebar to fullscreen (fills the window); off keeps DSH's default push mode (side by side with the conversation). Only the moment of opening is affected — a manual "Exit fullscreen" is never fought back |
 | `keepResident` | `true` | **Resident in background**: on, the host preloads the IDE into a parked surface right after start — switching tabs or collapsing the sidebar never reloads it and the first open needs no cold start; off loads it only when the panel is opened (saves memory) |
+| `fim` | `false` | **FIM completion (experimental, 0.3.61)**: when on, pausing while typing shows a grey inline continuation (Tab accepts, Esc discards). **Off by default** — it is the only capability of this plugin that sends content out (a bounded slice of code around the cursor, per completion), and those calls **do not enter DSH's token accounting**, so usage is visible only in the IDE status bar. See the "FIM completion" section |
+| `fimDebounceMs` | `250` | **FIM · pause in milliseconds** (0.3.62): how long typing must stop before one completion request is sent. Effective range **100–3000 ms**, clamped on save (same rule as the host); empty/invalid falls back to 250 |
+| `fimMultiline` | `true` | **FIM · allow multi-line completions** (0.3.62): off means the host returns the first line only (an empty first line = no completion this time). The model does invent insertions where none are needed, and multi-line amplifies that noise |
+| `fimDisableGlobs` | empty | **FIM · disable by glob** (0.3.62): semicolon/newline separated. `*` does not cross directories, `**` does, a pattern without `/` matches the basename, a pattern with `/` matches any path suffix, and a trailing `/` means `/**`. Examples: `*.md`, `vendor/**`, `**/dist/**`. **Checked on both sides**: the extension first (no request at all), the host again |
 
-(Since 0.2.9 the card keeps only those three settings; `windowedOpen` and `reserveComposer` are gone — leftover keys in an old
+(Since 0.2.9 the card keeps only those settings (0.3.61 added FIM completion, 0.3.62 its three sub-rows); `windowedOpen` and `reserveComposer` are gone — leftover keys in an old
 settings document neither fail nor apply. `serve` remains a key in the settings namespace (usable from a settings document) but
 has **no card row** — see "Serving mode".)
 
@@ -1130,6 +1198,22 @@ What remains on the plugin side:
   **built-in** extension (in `lib/vscode/extensions`), so users cannot remove it from the extensions panel, and the
   installer re-syncs it whenever its content changes.
 
+## Third-party and license
+
+This project is **MIT**-licensed (see [`LICENSE`](LICENSE)). Its experimental **FIM completion** feature was
+**designed with reference to** [continuedev/continue](https://github.com/continuedev/continue)
+(Apache License 2.0, Copyright 2023 Continue) — specifically the settings taxonomy of upstream
+`tabAutocompleteOptions` (`debounceDelay`, `useAutocompleteMultilineCompletions`, `disableInFiles`) and its
+debounce / cursor-window / filtering / bounded-cache approach.
+
+**No source code, template strings or files from continuedev/continue are included here** (completion
+requests target DeepSeek's official FIM (Beta) endpoint; the prompt shape comes from DeepSeek's docs and
+local measurement). The standard Apache License 2.0 text ships as
+[`LICENSE-Apache-2.0.txt`](LICENSE-Apache-2.0.txt), and the per-location reference log is
+[`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) — so Apache-2.0's obligations (notices, marking modified
+files, keeping an upstream NOTICE if one appears) are already satisfied should a code fragment ever be ported
+in. Apache-2.0 grants no trademark rights; this project does not use "Continue" as a name or in promotion.
+
 ## Known limitations
 
 - **~~The editor bridge needs DSH to provide `webServer`~~ no longer true (fixed in 0.3.13)**: the bridge now runs

package/README.md

@@ -62,7 +62,7 @@
     含窄视口下的连带处理)。按钮找不到时保持原模式并 `console.warn` 一条,绝不影响面板渲染。
 - **IDE 常驻(0.2.2 起,默认开)**:切到别的标签/收起侧栏再回来**不再重载** code-server——
   未保存的编辑缓冲区、终端、调试会话都留在原处(见下方「为什么切标签不再重载」)。
-- 设置卡片只有**三个设置**:「**认领类型**」「**打开即全屏**」与「**后台常驻(切标签不重载)**」——没有其它行(0.2.7 起移除「入口」「依赖安装」「环境检测」)。
+- 设置卡片只有**四组设置**:「**认领类型**」「**打开即全屏**」「**FIM 补全(实验性,默认关;含停顿毫秒数 / 允许多行 / 按 glob 禁用三个子项)**」与「**后台常驻(切标签不重载)**」——没有其它行(0.2.7 起移除「入口」「依赖安装」「环境检测」)。
   打开 IDE 用右侧栏「开始」页的 **Code Server 入口框**,或直接点官方的产物 chip / 交付卡片 / 正文文件名;
   诊断看 DSH host 日志里的 `[code-server]` 输出(`/api/code-server/status` 仍返回 `env` 供脚本排查)。
   旧版的 `windowedOpen`(窗口化打开)、`reserveComposer` 已在 0.2.6 移除:旧设置文档里残留的这两个键不会报错,只是被忽略(不再出现在 schema 里)。
@@ -200,7 +200,7 @@ DSH 用**资源地址**命名文件,`openFile` 只负责把地址交给右侧栏
 边界(说清楚,不夸大):这一层挡的是"本机其它应用/端口扫描器/浏览器页面"顺手访问你的 IDE;
 **同用户的本地恶意程序**本来就能直接读你的文件、也能读那个令牌文件 —— 那不在本插件的威胁模型内。
 
-- 在 `cordis.patch.yml` 的 `config.serve`(或设置文档里的 `code-server.serve`)切换,下次启动生效 —— **设置卡片不提供这一行**(卡片只有认领类型/打开即全屏/后台常驻三个设置)。
+- 在 `cordis.patch.yml` 的 `config.serve`(或设置文档里的 `code-server.serve`)切换,下次启动生效 —— **设置卡片不提供这一行**(卡片只有认领类型/打开即全屏/后台常驻/FIM 补全四个设置)。
 - `dsh` 模式的实际收益:单一 URL/单一端口(远程访问 DSH 即可用 IDE)、不再暴露额外回环端口、认证与 DSH 同级。
 - `dsh` 模式的两点**已知取舍**:
   1. iframe 与 DSH **同源** → 该模式下不再挂 `sandbox`(同源 + `allow-same-origin` 可被 frame 自行摘除,属"看起来有防护");
@@ -365,6 +365,51 @@ seq,并且 `/sync` 回应里带 `lastSeq`(高水位),扩展据此自查游标是
 诊断:`GET /api/code-server/status` 的 `bridge` 字段返回
 `{ enabled, live, toolsRegistered, supported, url, file }` —— **不含令牌**(令牌只在那个文件里)。
 
+## FIM 补全(实验性,0.3.61 起,**默认关**)
+
+在编辑器里打字停顿时,光标后出现灰色续写(Tab 接受、Esc 丢弃)。**默认关闭**,在设置卡片里那一行开启,开启后即时生效(不用重启宿主、也不用重装插件)。
+
+| 项 | 值 |
+|---|---|
+| 端点 | DeepSeek **FIM(Beta)**:`POST https://api.deepseek.com/beta/completions`,参数 `prompt`(前缀)+ `suffix`(后缀) |
+| 模型 | `deepseek-flash`(官方 FIM 文档的示例模型,也就是本部署的默认模型) |
+| 凭据 | 复用 DSH 里已有的 `DEEPSEEK_API_KEY`:`ctx.get('credentials').resolve(...)`,与官方适配器同一条路(取不到再退回启动环境变量) |
+| 实测延迟 | **112–416 ms**(非流式;流式反而更慢 ⇒ 故意用非流式) |
+| 触发条件 | 停顿 ≥250ms 且通过门控:有选区 / 非 `file` 文档 / 空上下文 / 文档 >2 万行 —— 这几种**根本不发请求** |
+
+**它怎么接进来的(方案 A)**:FIM 走的是 Completions API,而 `ctx.llm.stream(GenerateOptions)` 的词汇表里
+只有 `messages`(没有 `prompt`/`suffix`,`purpose` 还是封闭联合 `'compaction' | 'session-title'`)⇒ 插件
+**自己注册一个 LLM 适配器路由** `dshcs-fim`:把前缀/后缀装进一条带固定前缀(`dshcs-fim/1 `)的 messages 信封,
+适配器解出信封再打那个端点。这样这条调用**仍然走 DSH 的 LLM 服务** —— 取消、超时、终态 chunk、稳定错误码
+都按服务契约走(而不是插件自己直连绕过服务层)。依据与实测数据见 `docs/analysis-continuedev-reuse.md` 的 B6/B7。
+
+**三个可调项(0.3.62,都在设置卡里,即时生效)**:
+
+| 设置 | 默认 | 作用 |
+|---|---|---|
+| 停顿毫秒数 | `250` | 打字停下多久才请求一次。范围 100–3000ms(保存时夹取);**实测端点往返 112–416ms**,所以停顿基本就是"感知到的延迟" |
+| 允许多行补全 | 开 | 关掉后宿主只回第一行;首行是空白 ⇒ 这次不补。想更克制(少被打扰)就关掉它 |
+| 按 glob 禁用 | 空 | 这些文件里**根本不发请求**。语义:`*` 不跨目录、`**` 跨目录、不含 `/` 的模式只匹配文件名、含 `/` 的模式按**路径尾段**匹配(所以 `vendor/**`、`src/*.ts` 在任何层级都生效)、`/` 结尾视作 `/**`。例:`*.md;vendor/**;**/dist/**` |
+
+> 这三项的语义在**宿主与扩展各有一份实现**(扩展是随包分发的静态文件,不能 import 宿主代码),
+> 一致性由 `scripts/test-fim.mjs` 用同一组(模式,路径)语料对两侧做等价断言钉住。
+
+**安全与边界**(这是本插件唯一会把内容发出去的能力):
+
+- **只读不变**:扩展仍然不写文件、不执行命令 —— 它只"提议"一段文本,插入由你按 Tab 完成;
+- 只有开启后桥才有第五条路由 `POST /complete`(**唯一一条会发起模型调用**的);没开一律 403,不发任何请求;
+- 有界:前后缀各 ≤6000/2000 字符(120/40 行,字符与行数取先到者)、输出 ≤2000 字符、单次 4s 超时、
+  最小间隔 120ms、并发 1、每分钟 60 次;超限的请求被拒(409/429),扩展这一轮就当"这次没有补全";
+- 扩展侧还有一层:关掉开关后立刻注销 provider(连请求都不发),相同前后文 2 分钟内直接命中本地缓存;
+
+**用量只在两处可见**:这条调用**不是会话请求**,不写会话日志 ⇒ DSH 自己的 token 计量(逐轮用量、
+上下文压力、遥测)**都不含它**。所以用量显示在:① IDE 状态栏的 DSH 项 —— 开启后多一格 `$(zap) 1.2k`,
+悬停看输入 / 输出 / 缓存命中 / 最近耗时 / 最近错误;② `GET /api/code-server/status` 的 `fim` 字段(同一份快照)。
+
+**已知限制**:模型偶尔会在"并不需要补"的位置硬凑一段(实测在不该补的位置 2/2 复现);过滤管线会剥掉代码围栏与
+控制标记,但"该不该补"最终由你判断 —— Esc 或继续打字都会让它消失。更稳的形态要等更快的完成路由,
+或者 DSH 把 completion 做成一等请求(那时把适配器里的取数换成新 API 即可,调用方一行不用改)。
+
 ## 旧版 DSH(0.2.3 起不再支持)
 
 **行为**:探测不到 `sidebarRightTabs` / `sidebarRight` 时,插件只注册一张设置卡片,内容是:
@@ -422,7 +467,7 @@ seq,并且 `/sync` 回应里带 `lastSeq`(高水位),扩展据此自查游标是
   (客户端半部与提问面板都是入库的手写源码 —— 整条链上**没有任何构建步骤**)。
 
 > 本机(BM: Windows 11 ARM64)实测:树/依赖全链路是"平台子包直挂插件依赖"供给 ——
-> 树包 `@jinsiyu/dshcs-vscode-server`(当前 4.137.0,50.8 MB tgz)、纯 JS 内部依赖与 8 个平台无关
+> 树包 `@jinsiyu/dshcs-vscode-server`(当前 4.138.0,50.9 MB tgz)、纯 JS 内部依赖与 8 个平台无关
 > 重打包包直接进插件 `dependencies`、8 个平台专属重打包包按 win32-arm64/x64 进
 > `optionalDependencies`(包自带 os/cpu 自动选),原始名字由 `lib/native.js` 补 junction 还原
 > → healthz 200 → 停止 → 回收全链路验证。
@@ -478,7 +523,7 @@ pnpm run promote -- <version>
 | 目标 | 命令 |
 |---|---|
 | **打最新版(上游 code-server 发行版)** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 的树到 `vendor/vscode`;之后**必须**重跑 `repack:build` 并重发全部子包 |
-| **指定版本** | `pnpm run vendor:vscode -- --version 4.137.0` |
+| **指定版本** | `pnpm run vendor:vscode -- --version 4.138.0` |
 | **从已装好的树快照** | `pnpm run vendor:vscode -- --from <code-server 目录>`(秒级) |
 | **开发期让树可直接跑** | `pnpm run vendor:vscode -- --dev-links`(额外把 `lib/vscode/node_modules` 用 junction 补上) |
 | **完整重打子包** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自动 npm install 解包 + 编译,耗时)。`--target` 只决定**本次在这台机器上构建哪些目标**(原生包要现编,所以 Linux 目标在 Linux 机器或 `repacks.yml` 的 Linux 腿上构建);产品覆盖哪些目标、每模块在哪些目标上有子包,由 `scripts/repack-platforms.json` 决定 |
@@ -940,7 +985,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### 升级 VS Code 树(上游 = code-server 发行版)
 
 - **打包期决定版本**:`pnpm run vendor:latest`(= `--force`)取 npm **最新版 code-server** 的树并重建 `vendor/vscode`;
-  也可 `pnpm run vendor:vscode -- --version 4.137.0` 或设 `DSHCS_CODE_SERVER_VERSION`。
+  也可 `pnpm run vendor:vscode -- --version 4.138.0` 或设 `DSHCS_CODE_SERVER_VERSION`。
   已有 `vendor/vscode` 时,不带 `--force`/`--version` 不会升级(日常 `pnpm pack` 是 no-op)。
   **源树优先级(0.2.13 修正)**:显式 `--from` 用给定树;显式 `--force`/`--version` **一定走 registry**
   —— 修正前它们会被"本机已有源树"抢走(`defaultSourceTree()` 先命中 `vendor/code-server` 或 profile 里的旧树),
@@ -959,7 +1004,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - `productPath`(`<quality>-<commit>`,客户端 WS 路径的组成)**从 `lib/vscode/product.json` 现算**,
   升级树后无需改代码 —— 但也意味着切版本后必须重启 dsh web(路由在激活期注册)。
 - **不再有运行期自动升级**:不会在启动时联网取 latest;版本完全由内置产物决定。
-- 本机当前内置:`code-server@4.137.0` 的树(VS Code 1.137.0,`productPath=stable-b11dabda…`)。
+- 本机当前内置:`code-server@4.138.0` 的树(VS Code 1.138.0,`productPath=stable-59c988c7…`)。
 
 ### 兼容旧安装位
 
@@ -988,8 +1033,12 @@ host 探测顺序:`@jinsiyu/dshcs-vscode-server/vscode`(**0.2.0+ 正式布局**)
 | `claimExtensions` | `*` + 三组排除(预览友好 / 可执行文件 / Office 文档;完整清单见「认领类型」一节) | **认领类型**(0.2.11,取代 0.2.5 的 `fileOpenScope`):按扩展名决定哪些文件交给 VS Code,分号分隔;`*` = 其余类型也认领,`!ext` = 不认领(排除优先)。默认把 DSH 预览渲染得好的四类(markdown/html/图片/PDF)**以及可执行文件(0.3.51)与 Office 文档(0.3.51)**留给 DSH,其余全进 IDE;清空 = 不认领任何文件。**不再区分 session/absolute 作用域** |
 | `fullscreenOnOpen` | `true` | **打开即全屏**(0.2.9):打开 Code Server 标签(含点开文件)时自动把右侧栏切到全屏(铺满窗口);关闭则保持 DSH 默认的 push(与对话并排)。只影响打开那一刻,用户点「退出全屏」不会被抢回去 |
 | `keepResident` | `true` | **后台常驻**:开启后宿主启动即把 IDE 预加载到"停放区",切标签/收起侧栏不重载、首次打开免等待;关闭则只在打开面板时加载(省内存) |
+| `fim` | `false` | **FIM 补全(实验性,0.3.61)**:开启后编辑器里打字停顿会出现灰字续写(Tab 接受 / Esc 丢弃)。**默认关闭** —— 它是本插件唯一会把内容发出去的能力(每次补全把光标附近有上限的一小段代码交给模型),而且这条调用**不进 DSH 的 token 计量**,用量只在 IDE 状态栏可见。详见「FIM 补全」一节 |
+| `fimDebounceMs` | `250` | **FIM · 停顿毫秒数**(0.3.62):打字停下多久才发一次补全请求。有效范围 **100–3000ms**,保存时按它夹取(与宿主同一套规则);空/非法值回落 250 |
+| `fimMultiline` | `true` | **FIM · 允许多行补全**(0.3.62):关掉后宿主只回第一行(首行为空 = 这次不补)。实测模型在不该补的位置会硬凑,多行会放大这种噪声 |
+| `fimDisableGlobs` | 空 | **FIM · 按 glob 禁用**(0.3.62):分号/换行分隔。`*` 不跨目录、`**` 跨目录、不含 `/` 的模式只匹配文件名、含 `/` 的模式按路径尾段匹配、`/` 结尾视作 `/**`。例:`*.md`、`vendor/**`、`**/dist/**`。**两边都判**:扩展侧先判(根本不发请求),宿主侧再判一遍 |
 
-(0.2.9 起卡片只留上面三个设置;`windowedOpen` 与 `reserveComposer` 已移除 —— 旧设置文档里残留的键既不报错也不生效。
+(0.2.9 起卡片只留上面这些设置(0.3.61 加 FIM 补全,0.3.62 加它的三个子项);`windowedOpen` 与 `reserveComposer` 已移除 —— 旧设置文档里残留的键既不报错也不生效。
 `serve` 仍是设置命名空间里的键(便于用设置文档切换),但**没有卡片行**,见「服务方式」。)
 
 0.2.7 起卡片**没有**「入口」「依赖安装」「环境检测」三行:入口在右侧栏「开始」页的 Code Server 入口框(或官方的文件点击),
@@ -1113,6 +1162,19 @@ desktop profile 由 `apps/desktop-host` 把 `/api/*` 交给同一个 `createShar
     ```
   - 影响面:不只本插件——**任何**客户端插件升级后都可能继续跑旧代码;发布后请按上面的标记法确认渲染器真的换了 bundle。
 
+## 第三方与许可
+
+本项目自身以 **MIT** 发布(见 [`LICENSE`](LICENSE))。实验性 **FIM 补全**的设计**参考**了
+[continuedev/continue](https://github.com/continuedev/continue)(Apache License 2.0,Copyright 2023 Continue)——
+具体是它 `tabAutocompleteOptions` 的设置项划分(`debounceDelay` / `useAutocompleteMultilineCompletions` /
+`disableInFiles`)与停顿去抖、光标附近窗口、过滤、有界缓存的思路。
+
+**本项目不含 continuedev/continue 的任何源码片段、模板字符串或整份文件**(补全请求走 DeepSeek 官方
+FIM(Beta)端点,提示词形态由其官方文档与本机实测确定)。标准 Apache-2.0 全文随包分发
+([`LICENSE-Apache-2.0.txt`](LICENSE-Apache-2.0.txt)),逐处参考登记见
+[`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) —— 将来若真移植代码片段,Apache-2.0 的义务
+(声明、标注被改动文件、保留上游 NOTICE)已经就位。Apache-2.0 不含商标授权,本项目不使用 "Continue" 作名称或宣传。
+
 ## 已知限制
 
 - **~~编辑器桥需要 DSH 提供 `webServer`~~ 已不成立(0.3.13 修正)**:桥改走**本机 IPC**

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,60 @@
+# 第三方声明(Third-Party Notices)
+
+本项目 `dsh-code-server-app` 自身以 **MIT** 许可发布(见 [`LICENSE`](LICENSE))。
+在开发过程中**参考**过下列第三方开源项目,本文件登记参考范围、许可与本项目的处理方式。
+
+---
+
+## continuedev/continue —— Apache License 2.0
+
+| 项 | 值 |
+|---|---|
+| 上游 | https://github.com/continuedev/continue |
+| 参考时修订 | `5522c6f44ca0ac3528b37244818fbfa39b5af470`(`refs/heads/main`,2026-09-21 取) |
+| 许可 | **Apache License 2.0**,Copyright 2023 Continue |
+| 上游 `NOTICE` | **没有**(已核对根目录清单;将来若出现,按 Apache-2.0 一并保留) |
+| 许可全文 | [`LICENSE-Apache-2.0.txt`](LICENSE-Apache-2.0.txt)(标准 Apache-2.0 文本,11,357 字节,含 §9 与 APPENDIX) |
+
+### 参考了什么(逐处登记)
+
+| 本项目位置 | 参考内容 | 是否含上游代码 |
+|---|---|---|
+| `lib/fim-adapter.mjs`、`assets/extensions/dshcs-editor-bridge/lib/fim-completion.js` | 实验性 **FIM(幽灵)补全**的**设计**:停顿去抖、只送光标附近的窗口、结果过滤与单行化、有界缓存、按文件禁用;以及**设置项划分**(对应上游 `tabAutocompleteOptions` 的 `debounceDelay` / `useAutocompleteMultilineCompletions` / `disableInFiles`) | **否**,独立实现 |
+| `lib/index.js`、`lib/client.js`、`assets/extensions/dshcs-editor-bridge/extension.js` | 上述设计在本插件内的接线(桥的第五条路由、设置卡三行、内联补全 provider) | 否 |
+| `docs/analysis-continuedev-reuse.md` | 对上游模块的**事实性描述与判定**(路径、字节数、blob sha、用途) | 否(事实与评述) |
+
+**本项目的全部源码均为独立编写,不含 continuedev/continue 的任何源码片段、模板字符串或整份文件。**
+补全请求走的是 DeepSeek 官方的 FIM(Beta)端点(`POST https://api.deepseek.com/beta/completions`,
+参数 `prompt` + `suffix`),提示词形态由该官方文档与本机实测确定,与上游的 FIM 模板表无关
+(那张表在本机路由上实测不可用,见 `docs/analysis-continuedev-reuse.md` 的 B6)。
+
+### 将来若要移植上游代码片段,按 Apache-2.0 必须做到
+
+1. **标注被改动的文件**:在每个移植文件头部写明 `来源: continuedev/continue@<sha> <path> · Apache-2.0 · 已改动`;
+2. **保留版权与许可声明**:本文件 + `LICENSE-Apache-2.0.txt` 已经随包分发,移植时无需新增文件;
+3. **上游 `NOTICE` 若出现则一并保留**;
+4. **不含商标授权**:Apache-2.0 不授予商标权 —— 不得用 "Continue" 作为本项目的名称、包名或宣传语。
+
+---
+
+## 随包分发的第三方依赖
+
+本包依赖的第三方包(`@jinsiyu/dshcs-*`、`@vscode/*`、`@xterm/*`、`zod` 等)各自带有许可与声明文件,
+随 `node_modules` 一并分发,不在此重复登记;内嵌的 VS Code 树自带 `ThirdPartyNotices.txt`。
+
+---
+
+## English summary
+
+`dsh-code-server-app` is MIT-licensed (see `LICENSE`). Its experimental **FIM completion** feature was
+**designed with reference to** [continuedev/continue](https://github.com/continuedev/continue)
+(Apache License 2.0, Copyright 2023 Continue) — specifically the settings taxonomy of upstream
+`tabAutocompleteOptions` (`debounceDelay`, `useAutocompleteMultilineCompletions`, `disableInFiles`) and its
+debounce / cursor-window / filter / bounded-cache approach.
+
+**No source code, template strings, or files from continuedev/continue are included in this project**;
+every implementation here is independently written, and the completion requests target DeepSeek's official
+FIM (Beta) endpoint as documented by DeepSeek. The standard Apache License 2.0 text ships as
+`LICENSE-Apache-2.0.txt` so that Apache-2.0's obligations (notices, marking modified files, preserving an
+upstream `NOTICE` if one appears) are already satisfied should a code fragment ever be ported in.
+Apache-2.0 grants no trademark rights: "Continue" must not be used as this project's name or in its promotion.