dsh-code-server-app 0.3.68 → 0.3.69

package/README.en.md

@@ -524,8 +524,8 @@ data call changes; the caller stays as it is).
   committed hand-written source: there is no build step anywhere on that chain).
 
 > Verified locally (BM: Windows 11 ARM64): the whole tree/dependency chain hangs directly off the plugin's
-> dependency table — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.138.0, a 50.9 MB tarball),
-> the pure-JS inner dependencies plus the 8 platform-independent repacks in `dependencies`, and the 8
+> dependency table — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.139.1, a 44.4 MB tarball),
+> the pure-JS inner dependencies plus the 7 platform-independent repacks in `dependencies`, and the 8
 > platform-specific repacks (win32-arm64 / win32-x64) in `optionalDependencies` with their own os/cpu gates;
 > the original names are restored by junctions created at runtime (`lib/native.js`)
 > → healthz 200 → stopped → fully recycled.
@@ -566,13 +566,13 @@ pnpm run promote -- <version>
 | Sub-package | Content | os/cpu |
 |---|---|---|
 | `@jinsiyu/dshcs-vscode-server@<code-server version>` | the trimmed VS Code tree (`lib/vscode` + `out/browser` + `src/browser`; **without** code-server's `out/node` and its 136 runtime deps) | platform-independent |
-| `@jinsiyu/dshcs-<name>[-win32-<arch>]` ×16 | the VS Code inner packages that need building (node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / …) | gated when platform-specific |
+| `@jinsiyu/dshcs-<name>[-win32-<arch>]` ×15 | the VS Code inner packages that need building (node-pty / @vscode/sqlite3 / kerberos / ssh2 / …) | gated when platform-specific |
 | `lib/vendored.json` (**not** a package) | the "original name → repack sub-package" table shipped inside the plugin; `lib/native.js` uses it to create the junctions. Since 0.3.45 there is **no platform aggregator** | — |
 
 | Goal | Command |
 |---|---|
 | **Build from the latest upstream release** | `pnpm run vendor:latest` (= `--force`): pulls `code-server@latest`'s tree into `vendor/vscode`; afterwards you **must** re-run `repack:build` and republish every sub-package |
-| **Pin a version** | `pnpm run vendor:vscode -- --version 4.138.0` |
+| **Pin a version** | `pnpm run vendor:vscode -- --version 4.139.1` |
 | **Snapshot from an existing tree** | `pnpm run vendor:vscode -- --from <code-server dir>` (seconds) |
 | **Rebuild every sub-package** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
 | **Rebuild only the tree + dependency table** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack` (reuses the natives already in `repack/build`; also rewrites `lib/vendored.json` and the plugin dependency table) |
@@ -864,7 +864,7 @@ The main package is only **~110KB** (the plugin's own code plus the launcher); e
 - the **pure-JS part** of VS Code's inner dependencies (35 packages: xterm / katex / typescript / ws / tar …) is
   declared in the plugin's `dependencies` and installed by pnpm into the profile's `node_modules` (hoisted);
 - the **binary part** comes entirely from `@jinsiyu/dshcs-*` sub-packages, declared **directly on the plugin's own
-  dependency table** (since 0.3.45): the 8 platform-independent repacks (`node-pty` / `koffi` / `ssh2` /
+  dependency table** (since 0.3.45): the 7 platform-independent repacks (`node-pty` / `ssh2` /
   `cpu-features` / `@parcel/watcher` / `@vscode/fs-copyfile` / `@vscode/proxy-agent` / `@microsoft/mxc-sdk`) go into
   `dependencies` under their real names; the 8 platform-specific ones (`@vscode/sqlite3` / `spdlog` / `kerberos` /
   `deviceid` / `native-watchdog` / `windows-registry` / `windows-process-tree` / `windows-ca-certs`) go into
@@ -1028,7 +1028,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### Upgrading the VS Code tree (upstream = a code-server release)
 
 - **The version is decided at pack time**: `pnpm run vendor:latest` (= `--force`) pulls the tree of the npm **latest**
-  release; or use `pnpm run vendor:vscode -- --version 4.138.0` / `DSHCS_CODE_SERVER_VERSION`.
+  release; or use `pnpm run vendor:vscode -- --version 4.139.1` / `DSHCS_CODE_SERVER_VERSION`.
   With an existing `vendor/vscode`, a plain `pnpm pack` never upgrades (it is a no-op).
   **Source-tree precedence (fixed in 0.2.13)**: an explicit `--from` uses that tree, while an explicit
   `--force`/`--version` now **always goes to the registry** — before the fix a local source tree won
@@ -1043,14 +1043,21 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - **A version bump means rebuilding and republishing the sub-packages** (all with the same script):
   1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → the new tree package
      (`@jinsiyu/dshcs-vscode-server@<new version>`) and the natives rebuilt against the new inner dependencies (the
-     script also rewrites the plugin's pure-JS `dependencies`, writes the 16 repacks under their real names into
+     script also rewrites the plugin's pure-JS `dependencies`, writes the 15 repacks under their real names into
      `dependencies` / `optionalDependencies`, and rewrites `lib/vendored.json`);
   2. `pnpm run publish:repacks` → publish; then bump the plugin version → `pnpm pack`
      → publish the plugin.
+- **When upstream drops a module from the dependency graph**: declare it in `scripts/repack-platforms.json`'s
+  **`dropped`** list — deleting it from `modules` alone is **not** enough, because the generator's
+  "keep entries this analysis cannot see" branch resurrects old table rows verbatim (measured 2026-09-30 while
+  dropping `koffi`). `dropped` is honoured in both places (analysis + keep branch), so one rebuild removes it from
+  `lib/vendored.json` and the plugin dependency table; `test-vendored-table.mjs` guards against its return.
+  Example: only `@github/copilot-sdk` (already excluded by `EXCLUDE`) depends on `koffi`, no code in the tree
+  imports it, and our repack never contained a native binding (`cnoke` build disabled by `allowScripts: false`).
 - `productPath` (`<quality>-<commit>`, part of the client WebSocket path) is **computed from `lib/vscode/product.json`**,
   so upgrading the tree needs no code change — but the routes are registered at activation, so restart `dsh web` afterwards.
 - **No runtime auto-upgrade anymore**: nothing fetches latest at startup; the version is fully determined by the bundled artifact.
-- Bundled locally right now: the tree of `code-server@4.138.0` (VS Code 1.138.0, `productPath=stable-59c988c7…`).
+- Bundled locally right now: the tree of `code-server@4.139.1` (VS Code 1.139.1, `productPath=stable-53c2f325…`).
 
 ### Compatibility with the old install locations
 

package/README.md

@@ -472,7 +472,7 @@ seq,并且 `/sync` 回应里带 `lastSeq`(高水位),扩展据此自查游标是
   (客户端半部与提问面板都是入库的手写源码 —— 整条链上**没有任何构建步骤**)。
 
 > 本机(BM: Windows 11 ARM64)实测:树/依赖全链路是"平台子包直挂插件依赖"供给 ——
-> 树包 `@jinsiyu/dshcs-vscode-server`(当前 4.138.0,50.9 MB tgz)、纯 JS 内部依赖与 8 个平台无关
+> 树包 `@jinsiyu/dshcs-vscode-server`(当前 4.139.1,44.4 MB tgz)、纯 JS 内部依赖与 7 个平台无关
 > 重打包包直接进插件 `dependencies`、8 个平台专属重打包包按 win32-arm64/x64 进
 > `optionalDependencies`(包自带 os/cpu 自动选),原始名字由 `lib/native.js` 补 junction 还原
 > → healthz 200 → 停止 → 回收全链路验证。
@@ -520,7 +520,7 @@ pnpm run promote -- <version>
 | 子包 | 内容 | os/cpu |
 |---|---|---|
 | `@jinsiyu/dshcs-vscode-server@<code-server 版本>` | 精简 VS Code 树(`lib/vscode` + `out/browser` + `src/browser`,**不含** code-server 的 `out/node` 与 136 个运行时依赖) | 平台无关 |
-| `@jinsiyu/dshcs-<名字>[-win32-<arch>]` ×16 | VS Code 内部依赖里需要构建的原生包(node-pty / @vscode/sqlite3 / kerberos / koffi / ssh2 / spdlog / …) | 平台专属带 os/cpu |
+| `@jinsiyu/dshcs-<名字>[-win32-<arch>]` ×15 | VS Code 内部依赖里需要构建的原生包(node-pty / @vscode/sqlite3 / kerberos / ssh2 / spdlog / …) | 平台专属带 os/cpu |
 | `lib/vendored.json`(**不是包**) | 「原名 → 重打包子包」表,随插件发布;运行时由 `lib/native.js` 据此补 junction。0.3.45 起**不再产出平台聚合包** | — |
 
 > argon2 已随 code-server 服务层一起移除(0.2.0):`auth` 固定 `none`,需要对外访问请用 `serve: dsh`。
@@ -528,7 +528,7 @@ pnpm run promote -- <version>
 | 目标 | 命令 |
 |---|---|
 | **打最新版(上游 code-server 发行版)** | `pnpm run vendor:latest`(= `--force`):从 registry 取 `code-server@latest` 的树到 `vendor/vscode`;之后**必须**重跑 `repack:build` 并重发全部子包 |
-| **指定版本** | `pnpm run vendor:vscode -- --version 4.138.0` |
+| **指定版本** | `pnpm run vendor:vscode -- --version 4.139.1` |
 | **从已装好的树快照** | `pnpm run vendor:vscode -- --from <code-server 目录>`(秒级) |
 | **开发期让树可直接跑** | `pnpm run vendor:vscode -- --dev-links`(额外把 `lib/vscode/node_modules` 用 junction 补上) |
 | **完整重打子包** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack`(不给 `--from` 会自动 npm install 解包 + 编译,耗时)。`--target` 只决定**本次在这台机器上构建哪些目标**(原生包要现编,所以 Linux 目标在 Linux 机器或 `repacks.yml` 的 Linux 腿上构建);产品覆盖哪些目标、每模块在哪些目标上有子包,由 `scripts/repack-platforms.json` 决定 |
@@ -801,7 +801,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-
 - VS Code 内部依赖里**纯 JS 的部分**(35 个:xterm / katex / typescript / ws / tar …)也写在插件
   `dependencies`,由 pnpm 装到 profile 的 `node_modules`(hoisted);
 - **二进制部分**全部由 `@jinsiyu/dshcs-*` 子包提供,且**直接挂在插件依赖上**(0.3.45 起):
-  平台无关的 8 个(`node-pty` / `koffi` / `ssh2` / `cpu-features` / `@parcel/watcher` /
+  平台无关的 7 个(`node-pty` / `ssh2` / `cpu-features` / `@parcel/watcher` /
   `@vscode/fs-copyfile` / `@vscode/proxy-agent` / `@microsoft/mxc-sdk`)写进插件 `dependencies`(真名);
   平台专属的 8 个(`@vscode/sqlite3` / `spdlog` / `kerberos` / `deviceid` / `native-watchdog` /
   `windows-registry` / `windows-process-tree` / `windows-ca-certs`)**按 `scripts/repack-platforms.json`
@@ -993,7 +993,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### 升级 VS Code 树(上游 = code-server 发行版)
 
 - **打包期决定版本**:`pnpm run vendor:latest`(= `--force`)取 npm **最新版 code-server** 的树并重建 `vendor/vscode`;
-  也可 `pnpm run vendor:vscode -- --version 4.138.0` 或设 `DSHCS_CODE_SERVER_VERSION`。
+  也可 `pnpm run vendor:vscode -- --version 4.139.1` 或设 `DSHCS_CODE_SERVER_VERSION`。
   已有 `vendor/vscode` 时,不带 `--force`/`--version` 不会升级(日常 `pnpm pack` 是 no-op)。
   **源树优先级(0.2.13 修正)**:显式 `--from` 用给定树;显式 `--force`/`--version` **一定走 registry**
   —— 修正前它们会被"本机已有源树"抢走(`defaultSourceTree()` 先命中 `vendor/code-server` 或 profile 里的旧树),
@@ -1006,13 +1006,19 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - **换版本后重新出子包并发布**(全部由同一个脚本):
   1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → 新的树包
      (`@jinsiyu/dshcs-vscode-server@<新版本>`)以及按新内部依赖重建的原生包
-     (脚本会把新的「纯 JS 直装集」写进插件 `dependencies`,并把 16 个重打包包按真名写进
+     (脚本会把新的「纯 JS 直装集」写进插件 `dependencies`,并把 15 个重打包包按真名写进
      `dependencies` / `optionalDependencies`、重写 `lib/vendored.json`);
   2. `pnpm run publish:repacks` → 发布;然后 bump 插件版本 → `pnpm pack` → 发布插件。
+- **上游把某个模块从依赖图里去掉时**:在 `scripts/repack-platforms.json` 的 **`dropped`** 里声明它 ——
+  **不能只从 `modules` 里删**:生成器的「跨平台保留」会把「本次分析看不到的条目」从旧表原样复活
+  (2026-09-30 丢 `koffi` 时实测)。`dropped` 两处都认(分析 + 保留分支),重跑一次即从
+  `lib/vendored.json` 与插件依赖表里消失;`test-vendored-table.mjs` 有守卫断言它不会再出现。
+  例:`koffi` 只有 `@github/copilot-sdk`(已被 EXCLUDE 排除)依赖它,树里没有任何代码 import 它,
+  而我们的重打包包本来也不含原生产物(`cnoke` 编译被 `allowScripts: false` 禁掉)⇒ 直接丢弃。
 - `productPath`(`<quality>-<commit>`,客户端 WS 路径的组成)**从 `lib/vscode/product.json` 现算**,
   升级树后无需改代码 —— 但也意味着切版本后必须重启 dsh web(路由在激活期注册)。
 - **不再有运行期自动升级**:不会在启动时联网取 latest;版本完全由内置产物决定。
-- 本机当前内置:`code-server@4.138.0` 的树(VS Code 1.138.0,`productPath=stable-59c988c7…`)。
+- 本机当前内置:`code-server@4.139.1` 的树(VS Code 1.139.1,`productPath=stable-53c2f325…`)。
 
 ### 兼容旧安装位
 

package/lib/vendored.json

@@ -124,11 +124,6 @@
         "linux-arm64"
       ]
     },
-    {
-      "alias": "koffi",
-      "package": "@jinsiyu/dshcs-koffi",
-      "version": "3.1.2"
-    },
     {
       "alias": "node-pty",
       "package": "@jinsiyu/dshcs-node-pty",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.3.68",
+  "version": "0.3.69",
   "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs), plus an editor bridge (assets/extensions/dshcs-editor-bridge) that gives the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and lets editor gestures drive the session. The bridge is completely read-only: all four of its routes (/health, /sync, /old, /event) are reads. Asking DSH from the editor opens a floating dialog inside the DSH page (draggable, resizable, bottom-right): the plugin's client half sends the question as user input (POST /api/code-server/ask/send) and renders that session's new content with DSH's own Markdown renderer - the same @deepseek-ai/dsh-client-ui-primitives instance the UI uses, required from the page's module table, so typography, highlighting and math match the interface and a renderer version mismatch is impossible. Thinking appears as collapsed rows and approval requests (writing outside the workspace / running commands) can be answered in place: whole-plugin write route POST /api/code-server/ask/approve, constrained to pending in-process requests and the outcomes allowed-once/rejected; dialog-first for 5 minutes, handed back to the official card the moment the dialog closes, never auto-approved. There is no build step anywhere: lib/client.js (client half including the dialog panel) and the extension are committed hand-written source, devDependencies holds a single test-only entry, and the published package carries no frontend bundle. Also: the tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so produced-file chips, delivered-file previews and inline prose mentions open in the workbench; the IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs does not reload it; opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen); a workspace switch re-navigates the workbench with the new ?folder= without restarting the IDE process. Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions only get an upgrade notice on the settings page. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). The diff the bridge opens always has the real pre-write text on the left, taken from result.value.before in tools/post-execute into a bounded snapshot cache and fetched by opaque key over the read-only GET /old, so files that are not open in the editor work too. No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -77,15 +77,15 @@
   },
   "license": "MIT",
   "dependencies": {
+    "@devcontainers/cli": "0.88.0",
     "@jinsiyu/dshcs-cpu-features": "0.0.10",
-    "@jinsiyu/dshcs-koffi": "3.1.2",
     "@jinsiyu/dshcs-microsoft-mxc-sdk": "0.8.0",
     "@jinsiyu/dshcs-node-pty": "1.2.0-beta.15",
     "@jinsiyu/dshcs-parcel-watcher": "2.5.6",
     "@jinsiyu/dshcs-ssh2": "1.17.0",
     "@jinsiyu/dshcs-vscode-fs-copyfile": "2.0.0",
     "@jinsiyu/dshcs-vscode-proxy-agent": "0.44.0",
-    "@jinsiyu/dshcs-vscode-server": "4.138.0",
+    "@jinsiyu/dshcs-vscode-server": "4.139.1",
     "@microsoft/1ds-core-js": "3.2.13",
     "@microsoft/1ds-post-js": "3.2.13",
     "@vscode/iconv-lite-umd": "0.7.1",

package/scripts/vendor-repacks.mjs

@@ -129,6 +129,7 @@ function isPlatformSpecific(pkg) {
 
 /** 分析一棵树:返回 { repack: Map(name -> {dir,pkg,platformSpecific}), declare: [{name,version}] }。 */
 function analyze(tree) {
+  const { dropped } = readRepackPlatforms();
   const VS = join(tree, 'lib', 'vscode');
   const packages = collect(join(VS, 'node_modules'));
   const vsManifest = readJson(join(VS, 'package.json'));
@@ -155,6 +156,7 @@ function analyze(tree) {
   const declare = [];
   for (const name of Object.keys(vsManifest.dependencies ?? {})) {
     if (excluded(name)) { console.log(`  [排除 Copilot] ${name}`); continue; }
+    if (dropped.has(name)) { console.log(`  [不再依赖] ${name}(见 repack-platforms.json 的 dropped)`); continue; }
     const dir = resolveDep(VS, name);
     if (dir === null) { console.warn(`  ⚠ 找不到 ${name}`); continue; }
     if (needsRepack(dir)) {
@@ -165,7 +167,7 @@ function analyze(tree) {
     }
   }
   for (const [dir, pkg] of packages) {
-    if (excluded(pkg.name) || repack.has(pkg.name)) continue;
+    if (excluded(pkg.name) || dropped.has(pkg.name) || repack.has(pkg.name)) continue;
     if (needsRepack(dir)) repack.set(pkg.name, { dir, pkg, platformSpecific: isPlatformSpecific(pkg) });
   }
   const extNm = join(VS, 'extensions', 'node_modules');
@@ -593,6 +595,8 @@ function readRepackPlatforms() {
     console.warn('  ⚠ 读不到 scripts/repack-platforms.json 的 targets ⇒ 平台政策退化为「构建目标即全部目标」,'
       + '每模块白名单与跨平台保留都会失效');
   }
+  /** 明确不再依赖的模块(声明里的 dropped):既不进重打包集,也不许被「跨平台保留」复活。 */
+  const dropped = new Set(list(doc?.dropped) ?? []);
   const perModule = new Map();
   for (const [alias, spec] of Object.entries(doc?.modules ?? {})) {
     if (spec === null || typeof spec !== 'object') continue;
@@ -603,7 +607,7 @@ function readRepackPlatforms() {
       version: typeof spec.version === 'string' && spec.version !== '' ? spec.version : null,
     });
   }
-  return { allTargets, publishedTargets: list(doc?.publishedTargets), perModule };
+  return { allTargets, publishedTargets: list(doc?.publishedTargets), perModule, dropped };
 }
 
 /** 平台政策落到分析结果上:
@@ -657,6 +661,11 @@ function applyPlatformPolicy(modules, platforms, allTargets) {
   const kept = [];
   for (const e of [...previous.values()]) {
     if (e === null || typeof e !== 'object' || typeof e.alias !== 'string' || seen.has(e.alias)) continue;
+    // dropped:声明里明确不再依赖的模块 —— 保留分支必须让路,否则旧表条目会被原样复活(2026-09-30 实测)。
+    if (platforms.dropped.has(e.alias)) {
+      console.log(`  · ${e.alias}:按声明 dropped 丢弃,不再保留进表`);
+      continue;
+    }
     const decl = declared(e.alias);
     kept.push({
       alias: e.alias,

package/vendor/VENDOR.json

@@ -1,12 +1,12 @@
 {
-  "codeServerVersion": "4.138.0",
-  "vscodeVersion": "1.138.0",
-  "productPath": "stable-59c988c744a240b05b039f57b856a5312f19d5b1",
+  "codeServerVersion": "4.139.1",
+  "vscodeVersion": "1.139.1",
+  "productPath": "stable-53c2f3253bcf32886706fc023e794bbeb253c90f",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-22T15:01:29.067Z",
+  "preparedAt": "2026-09-30T03:42:55.871Z",
   "source": "registry",
-  "node": "v24.20.0",
+  "node": "v24.21.0",
   "platform": "linux",
   "arch": "x64",
-  "sizeMB": 198.3
+  "sizeMB": 163.8
 }