dsh-code-server-app 0.3.66 → 0.3.67

package/README.en.md

@@ -708,6 +708,10 @@ pnpm test:installed          # install smoke: assert on what was **installed int
                              # (default <DSH_HOME>/profiles/web): every `files` entry present, repack
                              # packages complete for this platform, no missing natives, the installed
                              # copy imports, the tree is in place — nothing the repo suite can see
+pnpm test:metadata           # plugin-page icon & copy contract: icon relativeness / media-type whitelist /
+                             # realpath inside the package / ≤256 KiB / covered by `files`; dictionary
+                             # en.json anchor, language ids, identical key sets, copy length caps, and the
+                             # silent "dictionaries must be exported" guard
 ```
 
 **The dist-tag policy is unchanged**: `release.yml` only publishes `next` and never touches `latest`; `latest` is
@@ -1110,6 +1114,22 @@ guide page (and in DSH's own file clicks), and diagnostics stay out of the UI
 reports the tree version / `productPath` / server entry, VS Code inner dependencies and **prebuilt native packages**
 (platform aggregator name + resolved module count) for scripts, and the DSH host log carries the `[code-server]` lines.
 
+### Plugin-page icon and copy (since 0.3.67)
+
+The **icon and the title/description of the plugin row and card are resolved by the host from package metadata** —
+they are not drawn by our client half:
+
+| Item | Source | Hard constraints (host `readPluginMeta` / `iconOf`) |
+|---|---|---|
+| Icon | `package.json` top-level `"icon": "./assets/favicon.svg"` | must be a **relative path** (absolute paths or any scheme throw); extension must be **svg / png / jpg / jpeg / webp**; must stay inside the package directory after realpath; must be a regular file; **≤ 256 KiB**. The host inlines it as `data:…;base64` for the client's `<img src>` |
+| Title / description | `locale/en.json` (the anchor) plus `locale/zh.json`, shaped `{"meta":{"title":…,"description":…}}` | filenames must be language ids and are de-duplicated case-insensitively; **without `en.json` there are no dictionaries at all**; dictionaries are located through the **module resolver**, so `exports` must expose `./locale/*.json` |
+
+Two **silent failure modes** (the UI says nothing, it just degrades): an illegal or missing icon falls back to the
+placeholder artwork; dictionaries that are not exported leave the English UI showing the 2000-character
+`description` from `package.json` (that one is for the npm page — plugin-page copy always comes from the
+dictionaries). Regression: `pnpm test:metadata` (`scripts/test-plugin-metadata.mjs`, which also pins the
+"dictionaries must be exported" and "copy length caps" traps).
+
 ## Config (`config` in cordis.patch.yml; all have defaults)
 
 | Key | Default | Description |

package/README.md

@@ -572,6 +572,8 @@ pnpm test:package-files      # 发布物白名单守卫:files 里的模块**递
 pnpm test:installed          # 安装冒烟:对**已装进 profile 的产物**做断言(默认 <DSH_HOME>/profiles/web)
                              # files 白名单每条都在 / 重打包包在当前平台齐全 / 原生模块无缺失 /
                              # 已安装副本能 import / 树在位 —— 仓库回归看不出这一类
+pnpm test:metadata           # 插件页图标与文案守约:icon 的相对性/格式白名单/包内 realpath/≤256 KiB/files 覆盖,
+                             # 词典的 en.json 锚点/语言 id/键集一致/长度上限,以及"词典必须在 exports 里"这条静默失败守卫
 ```
 
 > `test:bridge-routes` 会把 `DSH_HOME` 指向临时目录(否则它会 adopt 开发机上正在跑的那个实例,
@@ -1068,6 +1070,19 @@ host 探测顺序:`@jinsiyu/dshcs-vscode-server/vscode`(**0.2.0+ 正式布局**)
 > 与 `fullscreenOnOpen`,客户端立即生效。**新增设置键后首次使用前需重启 dsh web**:
 > 新线的表单只展示**活动且可唯一定位**的条目里的 **volatile** 字段,旧线要重新注册设置命名空间。
 
+### 插件页的图标与文案(0.3.67 起)
+
+插件页那一行/那张卡的**图标与标题描述由宿主从包元数据解析**,不是我们画在客户端里的:
+
+| 项 | 来源 | 硬约束(宿主 `readPluginMeta` / `iconOf`) |
+|---|---|---|
+| 图标 | `package.json` 顶层 `"icon": "./assets/favicon.svg"` | 必须**相对路径**(绝对路径或带 scheme 一律抛错);扩展名只认 **svg / png / jpg / jpeg / webp**;realpath 后必须留在包目录内;必须是常规文件;**≤ 256 KiB**。宿主转成 `data:…;base64` 交给前端 `<img src>` |
+| 标题 / 描述 | `locale/en.json`(锚点)+ `locale/zh.json`,格式 `{"meta":{"title":…,"description":…}}` | 文件名必须是语言 id 且按小写去重;**`en.json` 缺了就等于没有词典**;词典经**模块解析器**定位 ⇒ `exports` 里必须有 `./locale/*.json` |
+
+两个**静默失败**模式(界面上什么都不说,只退化):图标非法/缺失 ⇒ 退回占位图形;词典没导出 ⇒
+英文界面继续显示 `package.json` 里那段 2000 字的 `description`(那段是给 npm 页面看的,插件页文案一律走词典)。
+回归:`pnpm test:metadata`(`scripts/test-plugin-metadata.mjs`,含"词典必须在 `exports` 里""文案长度上限"两条陷阱守卫)。
+
 ## 配置(cordis.patch.yml 的 `config`,均有默认值)
 
 | 键 | 默认 | 说明 |

package/lib/client.js

@@ -1241,7 +1241,8 @@ let React = require('react')
           guide: [{
             order: 20,
             title: function () { return 'Code Server' },
-            description: function () { return '在右侧栏标签里运行 VS Code 网页版,跟随当前会话工作区;产物/交付文件点击后在此打开。' },
+            // 与插件页文案(locale/zh.json)同一句口径,只多一句本入口的特有信息
+            description: function () { return '在 DSH 右侧栏运行 VS Code 网页版,跟随会话工作区;产物/交付文件(含正文提及)点击后在此打开。' },
             icon: CodeServerIcon,
           }],
         })

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Code Server",
+    "description": "VS Code in DSH's right sidebar, following the session workspace; the agent reads unsaved buffers, diagnostics and the active selection."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Code Server",
+    "description": "在 DSH 右侧栏运行 VS Code 网页版，跟随会话工作区；agent 可读未保存缓冲区、诊断与选区，编辑器手势可驱动会话。"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.3.66",
+  "version": "0.3.67",
   "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs), plus an editor bridge (assets/extensions/dshcs-editor-bridge) that gives the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and lets editor gestures drive the session. The bridge is completely read-only: all four of its routes (/health, /sync, /old, /event) are reads. Asking DSH from the editor opens a floating dialog inside the DSH page (draggable, resizable, bottom-right): the plugin's client half sends the question as user input (POST /api/code-server/ask/send) and renders that session's new content with DSH's own Markdown renderer - the same @deepseek-ai/dsh-client-ui-primitives instance the UI uses, required from the page's module table, so typography, highlighting and math match the interface and a renderer version mismatch is impossible. Thinking appears as collapsed rows and approval requests (writing outside the workspace / running commands) can be answered in place: whole-plugin write route POST /api/code-server/ask/approve, constrained to pending in-process requests and the outcomes allowed-once/rejected; dialog-first for 5 minutes, handed back to the official card the moment the dialog closes, never auto-approved. There is no build step anywhere: lib/client.js (client half including the dialog panel) and the extension are committed hand-written source, devDependencies holds a single test-only entry, and the published package carries no frontend bundle. Also: the tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so produced-file chips, delivered-file previews and inline prose mentions open in the workbench; the IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs does not reload it; opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen); a workspace switch re-navigates the workbench with the new ?folder= without restarting the IDE process. Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions only get an upgrade notice on the settings page. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). The diff the bridge opens always has the real pre-write text on the left, taken from result.value.before in tools/post-execute into a bounded snapshot cache and fetched by opaque key over the read-only GET /old, so files that are not open in the editor work too. No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -9,9 +9,11 @@
   },
   "type": "module",
   "main": "lib/index.js",
+  "icon": "./assets/favicon.svg",
   "exports": {
     ".": "./lib/index.js",
     "./client": "./lib/client.js",
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "dsh": {
@@ -56,6 +58,8 @@
     "lib/vendored.json",
     "assets/favicon.ico",
     "assets/favicon.svg",
+    "locale/en.json",
+    "locale/zh.json",
     "assets/extensions/dshcs-open-file",
     "assets/extensions/dshcs-editor-bridge",
     "scripts/vendor-vscode-server.mjs",
@@ -177,6 +181,7 @@
     "test:dsh-resolve": "node scripts/test-dsh-resolve.mjs",
     "test:child-node": "node scripts/test-child-node.mjs",
     "test:package-files": "node scripts/test-package-files.mjs",
+    "test:metadata": "node scripts/test-plugin-metadata.mjs",
     "test:bridge-routes": "node scripts/test-bridge-routes.mjs",
     "test:edit-snapshot": "node scripts/test-edit-snapshot.mjs",
     "test:bridge-extension": "node scripts/test-bridge-extension.mjs",

package/vendor/VENDOR.json

@@ -3,7 +3,7 @@
   "vscodeVersion": "1.138.0",
   "productPath": "stable-59c988c744a240b05b039f57b856a5312f19d5b1",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-22T13:10:27.713Z",
+  "preparedAt": "2026-09-22T14:47:24.370Z",
   "source": "registry",
   "node": "v24.20.0",
   "platform": "linux",