dsh-cursor-subscription 0.5.6 → 0.5.8

package/AGENTS.md

@@ -32,6 +32,23 @@ Then ensure `dsh-cursor-subscription` is listed in the profile
 `package.json` under `dsh.profile.bundles` (the `dsh plugin add` command does
 this automatically for published packages).
 
+pnpm (11+) applies a built-in 24-hour `minimumReleaseAge` supply-chain gate, so a
+range such as `^0.5.0` never selects a version published within the last 24
+hours. Right after a release, a plain `add` or `update` therefore falls back to
+the newest release older than 24 hours — for a young package, the earliest
+published version. Install the newest release by exempting this package by name
+in the profile `pnpm-workspace.yaml`:
+
+```yaml
+minimumReleaseAgeExclude:
+  - dsh-cursor-subscription
+```
+
+Requesting one version explicitly (`dsh plugin --profile web add
+dsh-cursor-subscription@0.5.8`) also works: pnpm then appends that single
+version to the same list. Do not set `minimumReleaseAge: 0` just to install this
+plugin; that drops the protection for every package in the profile.
+
 Update with `dsh plugin --profile web update dsh-cursor-subscription`.
 Uninstall with `dsh plugin --profile web remove dsh-cursor-subscription`.
 
@@ -44,7 +61,9 @@ dsh --profile web --dump-config
 
 Success requires:
 
-1. The requested package version appears once.
+1. The requested package version appears once. A version older than the one
+   requested means pnpm's 24-hour release-age gate resolved the range; see
+   Install.
 2. `cursor-subscription` appears once in the composed config after install
    or update, and is absent after uninstall.
 3. No unrelated profile or plugin changed.
@@ -61,6 +80,14 @@ streamed reply appears in the conversation.
 
 - If the settings page reports "无法读取 Cursor 状态" the loopback RPC failed;
   confirm the plugin bundle is listed once in the composed config.
+- A boot failure reading `plugin tree failed to load: failed to apply loader
+  entry cursor-subscription ... cannot get property "webServer" without inject`
+  means a plugin build that mounted its account channel through
+  `connection.rpc.handle` ran against a DSH whose Connection plugin no longer
+  declares `webServer` (for example DSH 0.1.5-rc.1). Install version 0.5.8 or
+  later, whose channel mount passes an owner context that declares `webServer`.
+  Do not fix this by adding `webServer` to the plugin's own `inject`: the failing
+  read happens on the providing plugin's scope and stays broken.
 - A "Cursor subscription is not signed in" error on a model call means the
   credential store is empty; the user must complete the browser login flow.
 - Cursor's Agent protocol is undocumented and changes; a transport or

package/README.md

@@ -33,6 +33,13 @@ dsh --profile web --dump-config
 
 The installed package list should contain exactly one `dsh-cursor-subscription`, and the composed configuration should contain exactly one `cursor-subscription` entry.
 
+pnpm 11 and later ship a built-in 24-hour `minimumReleaseAge` gate, so a plain `add` never selects a version published within the last 24 hours. Right after a release, install it explicitly (`dsh plugin --profile web add dsh-cursor-subscription@0.5.8`) or exempt this package by name in the profile's `pnpm-workspace.yaml`:
+
+```yaml
+minimumReleaseAgeExclude:
+  - dsh-cursor-subscription
+```
+
 ### Local Development Installation
 
 Run the following command in the profile directory, such as `%USERPROFILE%\.dsh\profiles\web`:
@@ -68,6 +75,8 @@ If DSH is running, restart it manually after installation or an update.
 - **DSH still reports that you are signed out after sign-in:** Make sure the browser completed the entire authorization flow and redirected to the completion page. Polling waits for up to approximately 2.5 minutes.
 - **The model list is empty:** `GetUsableModels` depends on the account type. If discovery fails, the plugin uses its built-in model list, and you can still enter a model name manually.
 - **Requests return 401:** If the access token has expired and the refresh token is no longer valid, sign in again from the settings page.
+- **DSH fails to start with `cannot get property "webServer" without inject`:** The installed DSH's Connection plugin does not declare `webServer`, which the older channel registration relied on. Install version 0.5.8 or later of this plugin.
+- **A plain install picks an old version:** pnpm's built-in 24-hour `minimumReleaseAge` gate skips releases published within the last day. Install an explicit version or exempt this package by name; see the installation section.
 - **The server protocol changed:** Cursor's Agent protocol is unpublished. If requests fail, check for a plugin update.
 
 ## Scope and Support

package/README_zh.md

@@ -39,6 +39,16 @@ dsh --profile web --dump-config
 安装列表中应只有一个 `dsh-cursor-subscription`，配置中应只有一个
 `cursor-subscription` 条目。
 
+pnpm 11 及以后内置了 24 小时的 `minimumReleaseAge` 供应链防护：普通 `add`
+不会选择 24 小时内发布的版本。刚发布完新版本时，请显式指定版本安装
+（`dsh plugin --profile web add dsh-cursor-subscription@0.5.8`），或在 profile 的
+`pnpm-workspace.yaml` 里按包名豁免：
+
+```yaml
+minimumReleaseAgeExclude:
+  - dsh-cursor-subscription
+```
+
 ### 本地开发安装
 
 在 profile 目录（如 `%USERPROFILE%\.dsh\profiles\web`）执行：
@@ -81,6 +91,11 @@ dsh plugin --profile web remove dsh-cursor-subscription   # 卸载
 - **模型列表为空**：`GetUsableModels` 依赖账户类型，失败时插件会使用内置模型列表，
   仍可手动输入模型名。
 - **请求报 401**：令牌过期且 refresh token 失效时，需要在设置页重新登录。
+- **DSH 启动失败并报 `cannot get property "webServer" without inject`**：当前 DSH 的
+  Connection 插件不再自己声明 `webServer`，旧版插件注册账户通道时依赖了它。请安装
+  0.5.8 或更高版本的本插件。
+- **普通安装装到的是旧版本**：pnpm 内置的 24 小时 `minimumReleaseAge` 防护会跳过
+  最近一天内发布的版本。请显式指定版本安装，或按包名豁免该包；见安装章节。
 - **服务端协议变更**：Cursor 的 Agent 协议是未公开接口，若请求失败请检查插件更新。
 
 ## 边界与支持

package/lib/index.js

@@ -124,6 +124,8 @@ export const inject = ["llm", "credentials", "connection"];
 export const PROVIDER = "cursor-subscription";
 export const CREDENTIAL_REF = credentialRef("CURSOR_SUBSCRIPTION_OAUTH");
 export const CHANNEL = "/cursor-subscription";
+/** Connection registry options: accept the account channel from loopback Hosts only. */
+const LOOPBACK_RPC = Object.freeze({ authority: "loopback" });
 
 export const CURSOR_BASE_URL = "https://api2.cursor.sh";
 export const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
@@ -2917,9 +2919,26 @@ export function apply(ctx, config = {}) {
 		modelsProvider: adapter,
 		settings: settingsController,
 	});
-	ctx.effect(
-		() => ctx.connection.rpc.handle(CHANNEL, handler, { authority: "loopback" }),
-		"cursor-subscription: loopback account RPC",
-	);
+	// Mount the loopback account channel through Connection. `rpc.handle`
+	// registers the channel on the Context that reads the Connection service,
+	// but resolves that Context's `webServer` through the providing plugin's own
+	// scope, so it only works while the Connection plugin itself declares
+	// `webServer`. @deepseek-ai/dsh-client-connection 0.1.5-rc.1 declares
+	// `credentials` alone and mounts `/api` from a nested `webServer` Context, so
+	// `rpc.handle` fails the entire plugin tree with
+	// `cannot get property "webServer" without inject`. Calling the same registry
+	// method Connection uses internally with an explicit owner Context that
+	// declares `webServer` reuses Connection's envelope, trust fence, and browser
+	// authentication, and keeps the route on this plugin's fiber. Fall back to
+	// the public `rpc.handle` if that registry method ever disappears.
+	ctx.inject(["connection", "webServer"], (webCtx) => {
+		const connection = webCtx.connection;
+		webCtx.effect(() => {
+			if (typeof connection.register === "function") {
+				return connection.register(webCtx, CHANNEL, handler, LOOPBACK_RPC);
+			}
+			return connection.rpc.handle(CHANNEL, handler, LOOPBACK_RPC);
+		}, "cursor-subscription: loopback account RPC");
+	});
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cursor-subscription",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "packageManager": "pnpm@11.19.0",
   "description": "Cursor subscription for DeepSeek Harness with browser login, token refresh, model discovery, and the Cursor Agent chat protocol",
   "type": "module",
@@ -65,7 +65,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.0-rc.6 <0.2.0",
     "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
     "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
     "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.6",