dsh-code 1.0.4 → 1.0.5

package/README.md

@@ -25,21 +25,23 @@ DeepSeek Harness 将模型、工具、存储、策略和界面作为插件，通
 
 ## 二、快速开始
 
-需要 Node `^22.19 || >=24` 和预览版 `dsh` CLI（当前版本线：`@deepseek-ai/dsh@0.1.1-rc.2`）。未配置模型时仍可进入 TUI、查看会话和使用非模型功能；在 `/model` 中按 `a` 可管理 API key、OAuth 与设备码登录。
+需要 Node `^22.19 || >=24` 和预览版 `dsh` CLI（当前版本线：`@deepseek-ai/dsh@0.1.2-rc.1`）。未配置模型时仍可进入 TUI、查看会话和使用非模型功能；在 `/model` 中按 Tab 进入供应商管理，配置 API key、OAuth 与设备码登录。
 
 ### 1. 安装与更新
 
 初次安装和更新使用同一组指令：
 
 ```sh
-npm install -g @deepseek-ai/dsh@0.1.1-rc.2 dsh-code@1.0.3
+npm install -g @deepseek-ai/dsh@0.1.2-rc.1 dsh-code@1.0.5
 npm install -g pnpm
-dsh plugin --profile cli add dsh-code@1.0.3
+dsh plugin --profile cli add dsh-code@1.0.5
 ```
 
-> 提示：pnpm 会忽略发布不足 24 小时的包，因此发布首日请使用精确版本 `dsh-code@1.0.3`；24 小时后可省略版本号。npm 安装不受此限制。
+> 提示：pnpm 会忽略发布不足 24 小时的包，因此发布首日请使用精确版本 `dsh-code@1.0.5`；24 小时后可省略版本号。npm 安装不受此限制。
 >
-> 版本对齐：dsh-code 1.0.3 面向 dsh `0.1.1-rc.2` 构建，全部 Harness 依赖均精确锁定为 `0.1.1-rc.2`。请保持全局 dsh 与 dsh-code 同步，避免宿主与插件混用候选版本。rc.2 已删除旧的 DeepSeek 配置项 `maxRequestImageBytes`。
+> 版本对齐：dsh-code 1.0.5 面向 dsh `0.1.2-rc.1` 构建，全部 Harness 依赖均精确锁定为 `0.1.2-rc.1`。已安装的用户运行 `deepseek update --apply` 即可按同一条版本线一起升级全局宿主与 cli profile 中的插件，本地开发挂载（`link:`）不受影响。
+>
+> 升级说明：上游从本版本起将内置 `code` 预设更名为 `ptc`；旧会话与旧参数中记录的 `code` 会自动映射到 `ptc`，无需手动迁移。
 
 ### 2. 启动指令
 
@@ -121,7 +123,7 @@ DSH-Code 的重点是让 DSH 的 Agent、模型、工具和持久会话可以直
 
 ```sh
 dsh --profile cli                    # 新建 standard 会话
-dsh --profile cli --mode code        # 使用指定 Agent Preset 启动
+dsh --profile cli --mode ptc         # 使用指定 Agent Preset 启动（standard/minimal/cordis/ptc）
 dsh --profile cli --continue         # 恢复当前目录最新会话
 dsh --profile cli --resume abc123    # 按 id 或唯一前缀恢复会话
 dsh --profile cli --session my-id    # 使用指定 id 新建会话
@@ -158,7 +160,7 @@ dsh --profile cli --session my-id    # 使用指定 id 新建会话
 | 命令 | 用途 |
 | --- | --- |
 | `/diff [--staged\|ref]` | 按文件查看工作区、暂存区或指定 ref 的 Git diff |
-| `/review [--staged\|ref]` | 使用只读权限审查 Git 改动 |
+| `/review [--staged\|ref]` | 使用只读权限审查 Git 改动；新会话中可直接使用，审查提示词作为首条消息建立会话 |
 | `/todos` | 查看当前会话的完整 todo 列表 |
 | `/agents` | 查看当前会话创建的 subagent 会话 |
 | `/jobs` | 查看后台任务及其运行状态 |

package/bin/deepseek.mjs

@@ -4,7 +4,7 @@ import { spawn, spawnSync } from 'node:child_process'
 import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { homedir } from 'node:os'
-import { join, resolve } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const packageRequire = createRequire(import.meta.url)
@@ -49,6 +49,81 @@ export function profileHasDshCode(profileDir = cliProfileDir(), fileExists = exi
   }
 }
 
+/** The dsh-code dependency the cli profile declares (e.g. '1.0.5' or 'link:C:/repo'). */
+export function profileDependencySpec(profileDir = cliProfileDir(), fileExists = existsSync, readFile = readFileSync) {
+  const manifest = join(profileDir, 'package.json')
+  if (!fileExists(manifest)) return undefined
+  try {
+    const raw = JSON.parse(readFile(manifest, 'utf8'))
+    const spec = raw?.dependencies?.['dsh-code']
+    return typeof spec === 'string' ? spec : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** The dsh-code version the cli profile actually resolves and boots. */
+export function profileMountedVersion(profileDir = cliProfileDir(), fileExists = existsSync, readFile = readFileSync) {
+  const manifest = join(profileDir, 'node_modules', 'dsh-code', 'package.json')
+  if (!fileExists(manifest)) return undefined
+  try {
+    return JSON.parse(readFile(manifest, 'utf8'))?.version ?? undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** The harness release line a dsh-code release expects, read from its peers. */
+export function harnessLineFromPeers(peers) {
+  if (typeof peers !== 'object' || peers === null) return undefined
+  const anchor = peers['@deepseek-ai/dsh-session']
+  if (typeof anchor === 'string' && anchor !== '') return anchor
+  for (const [name, spec] of Object.entries(peers)) {
+    if (name.startsWith('@deepseek-ai/dsh-') && typeof spec === 'string' && spec !== '') return spec
+  }
+  return undefined
+}
+
+/**
+ * Decide what `update --apply` installs. The global DSH launcher is pinned
+ * to the harness line the target dsh-code release declares in its peers,
+ * so the launcher can never move ahead of the plugin it must boot. A
+ * profile that mounts a local checkout (link:/file:) keeps its mount.
+ */
+export function updatePlan({ latestCode, peers, profileSpec }) {
+  const line = harnessLineFromPeers(peers)
+  return {
+    dshSpec: line === undefined ? '@deepseek-ai/dsh@latest' : `@deepseek-ai/dsh@${line}`,
+    lineLocked: line !== undefined,
+    codeSpec: `dsh-code@${latestCode}`,
+    profileStep: !(typeof profileSpec === 'string' && /^(link|file):/iu.test(profileSpec)),
+  }
+}
+
+/** Run wrapper-owned child steps in order, stopping at the first failure. */
+export function runSequence(steps, spawnProcess = spawn) {
+  return new Promise(resolve => {
+    const run = index => {
+      const step = steps[index]
+      if (step === undefined) {
+        resolve(0)
+        return
+      }
+      const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(step.command)
+      const child = spawnProcess(step.command, step.args, { stdio: 'inherit', ...(needsShell ? { shell: true } : {}) })
+      child.once('error', error => {
+        console.error(`dsh-code: ${step.label} failed: ${error.message}`)
+        resolve(1)
+      })
+      child.once('exit', (code, signal) => {
+        if (code === 0) run(index + 1)
+        else resolve(code ?? 1)
+      })
+    }
+    run(0)
+  })
+}
+
 /** Npm global-prefix roots that may contain DSH when this launcher is globally linked to a checkout. */
 export function globalDshRoots() {
   return [...new Set([
@@ -133,6 +208,144 @@ function launchChild(command, args) {
   return child
 }
 
+/**
+ * How to invoke npm. The JavaScript entrypoint is preferred: running it
+ * with this process's node avoids the Windows .cmd shim, whose shell
+ * workaround draws a Node deprecation warning on every call.
+ */
+export function npmInvocation({
+  fileExists = existsSync,
+  roots = globalDshRoots(),
+  resolvePackage = packageRequire.resolve,
+} = {}) {
+  const besideNode = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js')
+  if (fileExists(besideNode)) return { command: process.execPath, args: [besideNode] }
+  for (const root of roots) {
+    try {
+      const cli = resolvePackage('npm/bin/npm-cli.js', { paths: [root] })
+      return { command: process.execPath, args: [cli] }
+    } catch {
+      // The next configured global prefix may own npm instead.
+    }
+  }
+  return { command: process.platform === 'win32' ? 'npm.cmd' : 'npm', args: [] }
+}
+
+/**
+ * Read one `npm view` field as JSON, or undefined when the query fails.
+ * The subject arrives as argument parts: without a shell, a space inside
+ * one argument would reach npm as a single selector and fail.
+ */
+function viewJson(subjectParts, spawnCommand = spawnSync, invocation = npmInvocation()) {
+  const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(invocation.command)
+  const result = spawnCommand(invocation.command, [...invocation.args, 'view', ...subjectParts, '--json'], { encoding: 'utf8', windowsHide: true, ...(needsShell ? { shell: true } : {}) })
+  if (result.status !== 0) return undefined
+  try {
+    return JSON.parse(result.stdout)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The version of @deepseek-ai/dsh this launcher would boot, when present.
+ * Probes the same surfaces rawDshCommand resolves: the adjacent global
+ * install first, then every configured npm global prefix.
+ */
+function installedDshVersion({
+  platform = process.platform,
+  moduleUrl = import.meta.url,
+  fileExists = existsSync,
+  roots = globalDshRoots(),
+  resolvePackage = packageRequire.resolve,
+} = {}) {
+  const readVersion = path => {
+    try {
+      return JSON.parse(readFileSync(path, 'utf8')).version
+    } catch {
+      return undefined
+    }
+  }
+  if (platform === 'win32') {
+    const adjacent = fileUrlToWindowsPath(new URL('../../@deepseek-ai/dsh/package.json', moduleUrl))
+    if (fileExists(adjacent)) return readVersion(adjacent)
+  } else {
+    try {
+      const adjacent = fileURLToPath(new URL('../../@deepseek-ai/dsh/package.json', moduleUrl))
+      if (fileExists(adjacent)) return readVersion(adjacent)
+    } catch {
+      // A non-file URL or an unreadable sibling falls through to the roots.
+    }
+  }
+  for (const root of roots) {
+    try {
+      return readVersion(resolvePackage('@deepseek-ai/dsh/package.json', { paths: [root] }))
+    } catch {
+      // The next configured global prefix may own DSH instead.
+    }
+  }
+  return undefined
+}
+
+/** Show what is installed, what is latest, and what the cli profile boots. */
+function printUpdateStatus() {
+  const codeLatest = viewJson(['dsh-code', 'version'])
+  const dshLatest = viewJson(['@deepseek-ai/dsh', 'version'])
+  const dshInstalled = installedDshVersion()
+  const spec = profileDependencySpec()
+  const mounted = profileMountedVersion()
+  console.log(`dsh-code: ${packageVersion} (this launcher), latest ${codeLatest ?? 'unknown'}`)
+  console.log(`@deepseek-ai/dsh: ${dshInstalled ?? 'not found'} (global), latest ${dshLatest ?? 'unknown'}`)
+  console.log(`cli profile: ${mounted !== undefined ? `dsh-code ${mounted}` : spec ?? 'not mounted'}`)
+  console.log('Run `deepseek update --apply` to upgrade the global packages and the cli profile together.')
+}
+
+/**
+ * Upgrade the global launcher and the cli profile plugin together. The
+ * global install is pinned to the harness line the new dsh-code release
+ * declares, the profile follows through `dsh plugin add` with the same
+ * pinned spec, and the mounted version is verified at the end.
+ */
+async function applyUpdate({
+  view = viewJson,
+  resolveCommand = rawDshCommand,
+  spawnProcess = spawn,
+} = {}) {
+  const npm = npmInvocation()
+  const latestCode = view(['dsh-code', 'version'], undefined, npm)
+  if (latestCode === undefined) {
+    console.error('dsh-code: could not read the latest dsh-code version from npm')
+    process.exitCode = 1
+    return
+  }
+  const peers = view([`dsh-code@${latestCode}`, 'peerDependencies'], undefined, npm)
+  const plan = updatePlan({ latestCode, peers, profileSpec: profileDependencySpec() })
+  if (!plan.lineLocked) {
+    console.log('dsh-code: could not read the compatible harness line; installing @deepseek-ai/dsh@latest')
+  }
+  const steps = [{ command: npm.command, args: [...npm.args, 'install', '-g', plan.dshSpec, plan.codeSpec], label: 'npm install' }]
+  if (plan.profileStep) {
+    const command = resolveCommand(['plugin', '--profile', 'cli', 'add', plan.codeSpec])
+    if (command === undefined) {
+      console.error('dsh-code: could not resolve the dsh command for the profile update')
+      process.exitCode = 1
+      return
+    }
+    steps.push({ command: command.command, args: command.args, label: 'dsh plugin add' })
+  } else {
+    console.log('cli profile mounts a local checkout; leaving the profile untouched')
+  }
+  const code = await runSequence(steps, spawnProcess)
+  const mounted = profileMountedVersion()
+  if (mounted !== undefined) console.log(`cli profile now mounts dsh-code ${mounted}`)
+  if (code === 0 && plan.profileStep && mounted !== latestCode) {
+    console.error(`dsh-code: the cli profile still mounts ${mounted ?? 'nothing'}; run: dsh plugin --profile cli add ${plan.codeSpec}`)
+    process.exitCode = 1
+    return
+  }
+  process.exitCode = code
+}
+
 /** Run one wrapper-owned operational command. */
 export function launchOperation(args = process.argv.slice(2)) {
   const operation = operationName(args)
@@ -161,17 +374,14 @@ export function launchOperation(args = process.argv.slice(2)) {
     }
     return launchChild(command.command, command.args)
   }
-  if (args.includes('--apply')) {
-    return launchChild(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['install', '-g', '@deepseek-ai/dsh', 'dsh-code'])
-  }
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
-  const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(npm)
-  for (const name of ['@deepseek-ai/dsh', 'dsh-code']) {
-    const result = spawnSync(npm, ['view', name, 'version'], { encoding: 'utf8', windowsHide: true, ...(needsShell ? { shell: true } : {}) })
-    console.log(`${name}: ${result.status === 0 ? String(result.stdout).trim() : 'version check failed'}`)
+  if (operation === 'update') {
+    if (args.includes('--apply')) {
+      void applyUpdate()
+      return true
+    }
+    printUpdateStatus()
+    return true
   }
-  console.log('Run `deepseek update --apply` to install the latest versions.')
-  return true
 }
 
 /** Launch the installed DSH CLI while preserving its exit status and stdio. */

package/cordis.patch.yml

@@ -40,6 +40,8 @@
   disabled: true
 - id: tool-skill
   disabled: true
+- id: command-goal
+  disabled: true
 - id: tool-goal
   disabled: true
 - id: plan-mode
@@ -68,15 +70,9 @@
   disabled: true
 - id: tool-todo
   disabled: true
-- id: tool-web
-  config:
-    # web_fetch is a core TUI capability, not an opt-in: the fetch provider
-    # (web-fetch-http below) needs no API key. The per-preset tool-web rows
-    # keep `fetch: false` on the agent plane; through the scope-layered tool
-    # registry the preset's web_search shadows the host's same-name tool while
-    # the host's web_fetch stays visible, so every model still sees both.
-    fetch: true
-    searchTimeoutMs: 60000
+# tool-web keeps the 0.1.2-rc.1 base default (web_fetch enabled over the
+# bundled web-fetch-http provider): the host row exposes web_fetch while the
+# per-preset agent-plane rows keep their own fetch stance.
 
 - insert:
     # Code Mode is a core execution capability, not a Web component.
@@ -111,11 +107,13 @@
     - id: cordis-host-runner
       name: '@deepseek-ai/dsh-cordis-host-runner'
 
-    # Anonymous public HTTP(S) fetch provider for web_fetch (no key): the web
-    # service and its search provider stay on the host plane (dsh-base), and
-    # this row is what makes fetching real URLs work out of the box.
-    - id: web-fetch-http
-      name: '@deepseek-ai/dsh-web-fetch-http'
+    # Host-owned opt-in the preset delegation tools sample: standard/ptc's
+    # tool-subagent rows set `modelSelectionSettings: true`, whose start
+    # resolves this service and fails the whole preset mount when absent
+    # ("failed to apply loader entry delegation (cordis:group)"). The upstream
+    # web-app bundle adds this host row in 0.1.2-rc.1; dsh-base does not ship it.
+    - id: subagent-model-selection-settings
+      name: '@deepseek-ai/dsh-tool-subagent/model-selection-settings'
 
     # Interactive provider authorization. The base bundle supplies the
     # credential store; mounting the neutral authorization seam wakes the