dsh-composer-ux 0.15.2 → 0.15.4

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 本项目遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [0.15.4] — 2026-09-30（移除侧边栏那枚重启按钮）
+
+起因（用户原话）：**「移除这里的重启按钮」**（配图是侧边栏底部，「移动访问」下面那枚）。
+
+按问清的结果：**只删这一枚**。现在重启有两个入口 ——
+标题栏条上那枚（`shell.overlay`，随手能点）与设置页抬头那枚（点下去会先说清"现在有几个会话在跑"）。
+
+- 删掉 `sidebar.footer.action` 的注册与 `RestartFooterAction.tsx`（git 历史里仍在，注释里写了怎么加回来）；
+- 槽位清单断言 9 → 8；把"侧边栏那枚在"这条断言改成「它不在了 + 标题栏那枚在」（正反都钉住）。
+
+## 验证
+
+- `npm test`：**2357 passed / 0 failed**（23 个套件）。
+- 变异：**161/161**（本次是纯删除，没有新增可被变异的代码路径，故不加变异 —— 用两条直接断言钉住）。
+
+## [0.15.3] — 2026-09-30（修好重启被 403 挡住的根因 + 按参考插件把按钮摆到标题栏条）
+
+起因（用户原话）：**「参考一下这个，看这个的重启方式是怎么样的，并把按钮位置调成这个插件的样子
+https://github.com/HHHEEEWWW/dsh-quick-restart」**。
+
+### 1. 根因：来源判据太窄，桌面版必然被拒
+
+读它的 `lib/index.js` 逐字看到这一行：`if (!origin || origin === 'null' || /^dsh-app:\/\//iu.test(origin)) return ''`
+—— **桌面版壳的页面来源是 `dsh-app://`，它直接放行**，跨站防线交给客户端必须带的自定义头
+（`x-dsh-quick-restart: 1`，跨站页面加不了自定义头）。我们原来的判据要求 `Origin` 与 `Host` 逐字同源，
+于是桌面版**两枚按钮都 403**。现在对齐它的判据：
+
+- 放行 `dsh-app://`、没有 Origin、`Origin: null`；
+- http 来源仍要求与 Host 同源，且 Host 必须是回环（新增 `origin-not-loopback`）；
+- 转发头多认一个 `x-forwarded-host`；
+- 新增防跨站头 `x-composer-ux-restart: 1`（宿主先卡它、再判来源；客户端两处请求都带上）。
+
+### 2. 按钮按它的摆放挪到标题栏条（只改位置，不重做样式）
+
+新增一枚挂在 `shell.overlay`：贴顶 + `right: calc(100% - env(titlebar-area-x) - env(titlebar-area-width))`，
+正好落在原生「最小化」按钮左边；高 28px、最小宽 104px；`-webkit-app-region: no-drag`（否则点不着）；
+只在 `data-windows-titlebar` 存在时（Windows 桌面壳）渲染。颜色与两步确认仍是我们自己的，
+侧边栏与设置页那两枚**保留**。
+
+## 验证
+
+- `npm test`：**2356 passed / 0 failed**（23 个套件；守卫断言按新判据重写 + 槽位 8→9）。
+- 变异测试：**161/161 全部被咬住**（新增 FI `dsh-app://` 又被拒 / FJ 转发头少认一个；
+  移除旧的 A —— 它挡的是"来源判据"，现在由 FI/FJ 直接钉在判据本身上）。
+- `typecheck` 0 错误。
+
+## 升级说明
+
+- 装完**需要手动重启一次 DSH**（界面上的按钮在旧版本里还是 403）：
+  `C:\Users\fangwen\.dsh\launcher\restart-webui.bat`。
+
 ## [0.15.2] — 2026-09-30（重启被挡时，现在会说清是哪一条不满足）
 
 起因（用户截图）：**侧边栏与设置页两枚「重启」都报** `restart is limited to same-origin loopback requests`。

package/README.md

@@ -506,7 +506,7 @@ Windows 上 DSH 给模型的终端工具是 **PowerShell**（工具名 `pwsh`）
 | 工具循环的消息形状 / 轮次封顶 / 异常必须降级 | 同上第 6 节（假 llm 驱动整条循环，逐条检查 `role:'tool'` 与 `toolCallId`） |
 | 工具路径：默认关、开了才派、**查完吐散文必须回落**、拿不到工作目录就不派 | `test/quick-commands.mjs` 5g 节（13 条，真路由 + 假 llm） |
 | 工具读到的内容不进台账 | 同 5g 节：断言台账里只有工具名与次数、没有读到的文件内容 |
-| 变异守卫真的会咬人，且**必须是指定的那条测试变红** | `npm run test:mutations`：**160 条全部咬住**（判据是 `red.some(line => line.includes(item.expect))`，不是"有红就行"） |
+| 变异守卫真的会咬人，且**必须是指定的那条测试变红** | `npm run test:mutations`：**161 条全部咬住**（判据是 `red.some(line => line.includes(item.expect))`，不是"有红就行"） |
 | 发布门禁三条判据 | `npm run gates` 全过；`check:tag` 实测 `v0.12.0` 的 tag 名与所指提交里的版本一致 |
 | 三平台 CI | GitHub Actions：ubuntu / windows / macos × Node 20（`npm ci → typecheck → build → test → check:pack → check:docs`） |
 
@@ -640,9 +640,9 @@ node build.mjs                    # 产出 lib/index.js + lib/client.js
                                   #   ⚠️ 宿主半会**内联** schemastery / cosmokit：
                                   #   优先用 DSH 检出里的 vendor 副本，检出不在时退到 node_modules
                                   #   里同版本的 npm 包（两者逐字节相同）——CI 上走的就是退路
-npm test                          # 23 个套件；当前 2351 passed, 0 failed（2026-09-29 实测；CI 三平台同样全绿）
+npm test                          # 23 个套件；当前 2357 passed, 0 failed（2026-09-29 实测；CI 三平台同样全绿）
                                   #   走 scripts/run-tests.mjs：顺带把"多少套件/多少条"记进 test/.last-run.json
-npm run test:mutations            # 手动跑：变异测试，证明那套护栏真的在咬人（160 条，须单独跑）
+npm run test:mutations            # 手动跑：变异测试，证明那套护栏真的在咬人（161 条，须单独跑）
                                   #   同样记录结果，供下面的文档门禁核对
 npm run gates                     # 发版门禁三条一起跑：tag 指向 / 包内容 / 文档数字
 npm run check:tag                 #   ① tag 名里的版本 == 该 tag 所指提交里的 package.json 版本

package/lib/client.js

@@ -1006,6 +1006,8 @@ var REPO_URL = "https://github.com/fangwen9527/dsh-composer-ux";
 var RESTART_API_PATH = "/composer-ux/restart";
 var USAGE_API_PATH = "/composer-ux/usage";
 var MODELS_API_PATH = "/composer-ux/models";
+var RESTART_CSRF_HEADER = "x-composer-ux-restart";
+var RESTART_CSRF_VALUE = "1";
 var SYNC_API_PATH = "/composer-ux/sync-prices";
 var ENABLED_FIELD = "enabled";
 var KEYS_ENABLED_FIELD = "keysEnabled";
@@ -3518,7 +3520,7 @@ function PanelResizeHandles({ useLive, actions }) {
   );
 }
 
-// src/client/RestartFooterAction.tsx
+// src/client/RestartTitlebarButton.tsx
 var import_react3 = require("react");
 
 // src/client/restart-screen.ts
@@ -3808,7 +3810,10 @@ async function requestRestart(fetcher = fetch) {
   let oldBoot = "";
   let logPath = "";
   try {
-    const status = await fetcher("/composer-ux/restart", { cache: "no-store" });
+    const status = await fetcher("/composer-ux/restart", {
+      cache: "no-store",
+      headers: { [RESTART_CSRF_HEADER]: RESTART_CSRF_VALUE }
+    });
     if (status.ok) {
       const facts = await status.json();
       oldBoot = typeof facts.boot === "string" ? facts.boot : "";
@@ -3822,7 +3827,7 @@ async function requestRestart(fetcher = fetch) {
   try {
     const response = await fetcher("/composer-ux/restart", {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", [RESTART_CSRF_HEADER]: RESTART_CSRF_VALUE },
       body: "{}"
     });
     const parsed = await response.json().catch(() => ({}));
@@ -3835,108 +3840,97 @@ async function requestRestart(fetcher = fetch) {
   }
 }
 
-// src/client/RestartFooterAction.tsx
+// src/client/RestartTitlebarButton.tsx
 var import_jsx_runtime3 = require("react/jsx-runtime");
+var STYLE_ID = "composer-ux-titlebar-style";
 var ARMED_RESET_MS = 4e3;
-function RestartIcon() {
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("svg", { width: "14", height: "14", viewBox: "0 0 16 16", "aria-hidden": "true", focusable: "false", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(
-      "path",
-      {
-        d: "M8 2.5a5.5 5.5 0 1 0 5.2 3.7",
-        fill: "none",
-        stroke: "currentColor",
-        strokeWidth: "1.4",
-        strokeLinecap: "round"
-      }
-    ),
-    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("path", { d: "M13.4 2.2v4h-4", fill: "none", stroke: "currentColor", strokeWidth: "1.4", strokeLinecap: "round", strokeLinejoin: "round" })
-  ] });
+var STYLE = [
+  "@keyframes composer-ux-titlebar-spin{to{transform:rotate(360deg)}}",
+  ".composer-ux-titlebar{position:absolute;top:0;z-index:30;-webkit-app-region:no-drag;",
+  "right:calc(100% - env(titlebar-area-x,0px) - env(titlebar-area-width,calc(100% - 138px)));",
+  "height:var(--dsh-windows-titlebar-height,40px);display:flex;align-items:center;padding-right:6px}",
+  ".composer-ux-titlebar>button{display:inline-flex;align-items:center;gap:6px;height:28px;min-width:104px;",
+  "padding:0 12px;border:0.5px solid var(--dsw-alias-border-l2,rgba(255,255,255,.16));border-radius:7px;",
+  "background:var(--dsw-alias-bg-layer-1,#0b0b0e);color:var(--dsw-alias-label-primary,#f7f7fa);",
+  "font:inherit;font-size:12px;font-weight:600;line-height:1;cursor:pointer;white-space:nowrap}",
+  ".composer-ux-titlebar>button:disabled{cursor:default;opacity:.85}",
+  ".composer-ux-titlebar>button[data-error]{border-color:rgba(229,72,77,.6);color:#ffb7b9}"
+].join("");
+function ensureStyle() {
+  if (typeof document === "undefined" || document.getElementById(STYLE_ID) !== null) return;
+  const style = document.createElement("style");
+  style.id = STYLE_ID;
+  style.textContent = STYLE;
+  document.head.append(style);
+}
+function Icon({ spin }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
+    "svg",
+    {
+      width: "14",
+      height: "14",
+      viewBox: "0 0 16 16",
+      "aria-hidden": "true",
+      focusable: "false",
+      style: spin ? { animation: "composer-ux-titlebar-spin 1s linear infinite" } : void 0,
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("path", { d: "M8 2.5a5.5 5.5 0 1 0 5.2 3.7", fill: "none", stroke: "currentColor", strokeWidth: "1.4", strokeLinecap: "round" }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("path", { d: "M13.4 2.2v4h-4", fill: "none", stroke: "currentColor", strokeWidth: "1.4", strokeLinecap: "round", strokeLinejoin: "round" })
+      ]
+    }
+  );
 }
-function RestartFooterAction({ wide = false }) {
+function RestartTitlebarButton() {
   const [armed, setArmed] = (0, import_react3.useState)(false);
   const [busy, setBusy] = (0, import_react3.useState)(false);
-  const [note2, setNote] = (0, import_react3.useState)("");
-  let resetTimer = null;
-  const arm = () => {
-    setArmed(true);
-    setNote("");
-    if (resetTimer !== null) window.clearTimeout(resetTimer);
-    resetTimer = window.setTimeout(() => {
-      setArmed(false);
-    }, ARMED_RESET_MS);
-  };
-  const go = () => {
+  const [error, setError] = (0, import_react3.useState)("");
+  const [visible, setVisible] = (0, import_react3.useState)(false);
+  (0, import_react3.useEffect)(() => {
+    ensureStyle();
+    try {
+      setVisible(document.documentElement.hasAttribute("data-windows-titlebar"));
+    } catch {
+      setVisible(false);
+    }
+  }, []);
+  if (!visible) return null;
+  const label = busy ? "\u91CD\u542F\u4E2D\u2026" : armed ? "\u786E\u8BA4\u91CD\u542F\uFF1F" : error === "" ? "\u91CD\u542F" : "\u91CD\u8BD5";
+  const click = () => {
+    if (busy) return;
+    if (!armed) {
+      setArmed(true);
+      setError("");
+      window.setTimeout(() => {
+        setArmed(false);
+      }, ARMED_RESET_MS);
+      return;
+    }
     setArmed(false);
     setBusy(true);
-    setNote("");
+    setError("");
     void requestRestart().then((result) => {
-      setBusy(false);
       if (!result.ok) {
-        setNote(result.error);
+        setBusy(false);
+        setError(result.error);
         return;
       }
       enterRestartScreen({ oldBoot: result.oldBoot, logPath: result.logPath });
     });
   };
-  const label = busy ? "\u91CD\u542F\u4E2D\u2026" : armed ? "\u786E\u8BA4\u91CD\u542F\uFF1F" : "\u91CD\u542F";
-  const title = note2 !== "" ? `\u91CD\u542F\u5931\u8D25\uFF1A${note2}` : armed ? "\u518D\u70B9\u4E00\u6B21\u786E\u8BA4\u91CD\u542F\uFF08\u4F1A\u628A\u6B63\u5728\u8DD1\u7684\u4F1A\u8BDD\u6253\u65AD\uFF09" : "\u91CD\u542F DSH \u670D\u52A1\uFF08\u4F1A\u6253\u65AD\u6B63\u5728\u8DD1\u7684\u4F1A\u8BDD\uFF1B\u786E\u8BA4\u540E\u4F1A\u663E\u793A\u91CD\u542F\u8FDB\u5EA6\u5E76\u81EA\u52A8\u56DE\u5230\u9875\u9762\uFF09";
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: "composer-ux-titlebar", "data-composer-ux": "restart-titlebar", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
     "button",
     {
       type: "button",
-      "data-composer-ux": "restart-footer",
-      "aria-label": "\u91CD\u542F DSH",
-      title,
+      title: error === "" ? armed ? "\u518D\u70B9\u4E00\u6B21\u786E\u8BA4\u91CD\u542F\uFF08\u4F1A\u6253\u65AD\u6B63\u5728\u8DD1\u7684\u4F1A\u8BDD\uFF09" : "\u91CD\u542F DSH\uFF08\u66F4\u65B0\u63D2\u4EF6\u540E\u7528\uFF1B\u786E\u8BA4\u540E\u663E\u793A\u91CD\u542F\u8FDB\u5EA6\u5E76\u81EA\u52A8\u56DE\u5230\u9875\u9762\uFF09" : `\u91CD\u542F\u5931\u8D25\uFF1A${error}`,
       disabled: busy,
-      style: wide ? wideStyle(armed) : railStyle(armed),
-      onMouseDown: (event) => {
-        event.preventDefault();
-      },
-      onClick: () => {
-        if (armed) go();
-        else arm();
-      },
+      "data-error": error === "" ? void 0 : true,
+      onClick: click,
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(RestartIcon, {}),
-        wide ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: label }) : null
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Icon, { spin: busy }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: label })
       ]
     }
-  );
-}
-function wideStyle(armed) {
-  return {
-    font: "inherit",
-    cursor: "pointer",
-    display: "inline-flex",
-    alignItems: "center",
-    gap: 6,
-    height: 32,
-    padding: "0 14px",
-    borderRadius: 999,
-    whiteSpace: "nowrap",
-    flexShrink: 0,
-    fontSize: 12,
-    border: `1px solid ${armed ? "var(--dsw-alias-label-primary, #111)" : "var(--dsw-alias-border-l2, #d1d5db)"}`,
-    background: armed ? "var(--dsw-alias-bg-layer-2, rgba(0,0,0,0.06))" : "var(--dsw-alias-bg-layer-1, #fff)",
-    color: "var(--dsw-alias-label-primary, inherit)"
-  };
-}
-function railStyle(armed) {
-  return {
-    font: "inherit",
-    cursor: "pointer",
-    display: "inline-flex",
-    alignItems: "center",
-    justifyContent: "center",
-    width: 36,
-    height: 36,
-    borderRadius: 8,
-    flexShrink: 0,
-    border: "none",
-    background: armed ? "var(--dsw-alias-bg-layer-2, rgba(0,0,0,0.06))" : "transparent",
-    color: armed ? "var(--dsw-alias-label-primary, #111)" : "var(--dsw-alias-label-secondary, #4b5563)"
-  };
+  ) });
 }
 
 // src/client/SettingsSection.tsx
@@ -5733,7 +5727,10 @@ function useRestart() {
   const [detail2, setDetail] = (0, import_react7.useState)("");
   const [blocked, setBlocked] = (0, import_react7.useState)(null);
   const readFacts = async () => {
-    const response = await fetch(RESTART_API_PATH, { cache: "no-store" });
+    const response = await fetch(RESTART_API_PATH, {
+      cache: "no-store",
+      headers: { [RESTART_CSRF_HEADER]: RESTART_CSRF_VALUE }
+    });
     if (!response.ok) return { error: `HTTP ${String(response.status)}` };
     const parsed = await response.json();
     return {
@@ -5805,7 +5802,7 @@ function useRestart() {
       try {
         const response = await fetch(RESTART_API_PATH, {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: { "content-type": "application/json", [RESTART_CSRF_HEADER]: RESTART_CSRF_VALUE },
           body: "{}"
         });
         const parsed = await response.json();
@@ -8587,12 +8584,12 @@ function apply(ctx) {
       commitBook(withInsertMode(book.getSnapshot(), promptId, mode));
     }
   };
-  slots.inject("sidebar.footer.action", () => slots.register({
-    name: "sidebar.footer.action",
-    id: "composer-ux-restart",
-    order: 50,
+  slots.inject("shell.overlay", () => slots.register({
+    name: "shell.overlay",
+    id: "composer-ux-restart-titlebar",
+    order: 12,
     label: "\u91CD\u542F"
-  }, RestartFooterAction));
+  }, RestartTitlebarButton));
   maybeShowRestartDone();
   slots.inject("settings.section", () => slots.register({
     name: "settings.section",