dsh-custom-mode 1.0.2 → 1.0.4

package/client.js

@@ -45,7 +45,9 @@ try {
 
       const react = require("react")
 
-      const ROUTE = "/custom-mode"
+      // 路由注册在平台的共享 `/api` 频道上（由载体在分发前施加信任与鉴权），
+      // 所以这里的路径必须带 `/api` 前缀。
+      const ROUTE = "/api/custom-mode"
 
       const NS = "settings.customMode"
 

package/index.mjs

@@ -1,44 +1,43 @@
 /**
- * Host half: the 「自定义模式」 settings page — now an ASSISTANT MANAGER.
+ * Host half: the 「自定义模式」 settings page — an ASSISTANT MANAGER.
  *
- * It serves one private HTTP route and its sub-paths; the browser half calls them
+ * It registers five exact routes on the platform's shared `/api` channel; the browser half calls them
  * with `fetch`:
  *
- *   GET  /custom-mode              — every assistant this feature manages.
- *   GET  /custom-mode/state?id=…   — one assistant: base mode, rows, switches, prompt.
- *   POST /custom-mode/state        — { id, mode, overrides, prompt, name, description }:
- *                                    validate, render a fresh `agent.cordis.yml`, write both files.
- *   POST /custom-mode/create       — { name, description }: seed a new assistant from the
- *                                    packaged template and give it the standard base mode.
- *   POST /custom-mode/delete       — { id }: remove a locally authored assistant.
- *   POST /custom-mode/reorder      — { id, direction }: move one assistant up/down in the
- *                                    picker order by writing `order` into each `preset.yml`.
+ *   GET  /api/custom-mode              — every assistant this feature manages.
+ *   GET  /api/custom-mode/state?id=…   — one assistant: base mode, rows, switches, prompt.
+ *   POST /api/custom-mode/state        — { id, mode, overrides, prompt, name, description }:
+ *                                        validate, render a fresh `agent.cordis.yml`, write both files.
+ *   POST /api/custom-mode/create       — { name, description }: seed a new assistant from the
+ *                                        packaged template and give it the standard base mode.
+ *   POST /api/custom-mode/delete       — { id }: remove a locally authored assistant.
+ *   POST /api/custom-mode/reorder      — { id, direction }: move one assistant up/down in the
+ *                                        picker order by writing `order` into each `preset.yml`.
  *
- * Why one PREFIX route instead of five exact ones: the registered route table keys
- * on (kind, path), so a prefix claims `/custom-mode` and everything under it while
- * staying one registration to dispose. `dsh-host-webserver` matches a prefix route
- * on the exact path too, so the list endpoint lives at the route path itself.
+ * **Why `/api` and not the raw `webServer` table**: the carrier that owns the `/api` channel applies the
+ * platform's trust and authentication policy — loopback/`trustedHosts` Host check, `Sec-Fetch-Site`,
+ * `Origin`, and the signed browser-session cookie — *before* dispatching to a route. Registering there
+ * makes the fence part of the structure: a route cannot exist without it. Registering on the raw table
+ * instead puts the route outside that policy and leaves "check the request first" as a rule a human has
+ * to remember — and an earlier version of this plugin, doing exactly that, let an unauthenticated GET
+ * read the whole system prompt and an unauthenticated cross-site POST rewrite `prompt.md` (every official
+ * route answered 401; a plain form post needs no preflight, so CORS would not have helped either). The
+ * registered paths are absolute *including* `/api`, which is what the platform's own packages pass.
  *
- * Why a private route instead of a Remote namespace or `dsh-settings`: this
- * plugin then owns no Cordis service name and cannot collide with anything, and
- * it stays independent of the settings API whose helper names differ between dsh
- * releases (see docs/ARCHITECTURE.md).
+ * **Why exact routes rather than one prefix**: the Fetch registry matches exact paths. Five registrations
+ * cost nothing and each declares the methods it owns, so the method table doubles as the guarantee that a
+ * prefetched `GET …/create` cannot create anything — that method is simply not registered for that path.
  *
- * A route registered on the raw `webServer` table is however OUTSIDE the
- * platform's browser-trust fence, which only guards the channels the Connection
- * service mounts (`/`, `/api`, …). Measured on 0.1.6-alpha.1: an unauthenticated
- * POST with `content-type: text/plain` rewrote `prompt.md`, while every official
- * route answered 401 — and a cross-site form post needs no preflight, so any page
- * the user visited could have rewritten their agent's system prompt. The route
- * therefore runs the platform's own check first, via
- * `ctx.connection.requestRejection(req)` (Host/Origin fence + browser auth),
- * which is the same verdict `/api` gets.
+ * Why a private route instead of a Remote namespace or `dsh-settings`: this plugin then owns no Cordis
+ * service name and cannot collide with anything, and it stays independent of the settings API whose helper
+ * names differ between dsh releases (see docs/ARCHITECTURE.md §5).
  *
  * Storage is deliberately file-only and stateless: the composition file IS the
  * saved state, so no second document can drift from it. The page derives which
  * rows the user changed by diffing against the same shipped base mode.
  */
 
+import { randomBytes } from 'node:crypto'
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { PROMPT_PATH, COMPOSITION_PATH, ROUTE_PATH, PRESET_DIR } from './paths.mjs'
@@ -64,7 +63,7 @@ import {
   userPresetRoot,
 } from './assistants.mjs'
 
-export { PROMPT_PATH, COMPOSITION_PATH, ROUTE_PATH, PRESET_DIR, PRESET_META_PATH }
+export { PROMPT_PATH, COMPOSITION_PATH, ROUTE_PATH, API_PREFIX, PRESET_DIR, PRESET_META_PATH }
 
 /** The list endpoint is the route path itself; the rest hang off it. */
 const STATE_PATH = ROUTE_PATH + '/state'
@@ -81,6 +80,12 @@ const METHODS = {
   [REORDER_PATH]: ['POST'],
 }
 
+/** 只告警一次：避免每个请求都刷同一行日志。 */
+let warnedRosterShape = false
+
+/** 应用层请求体上限；平台的 buffered cap 是第一道，这个是我们自己的兜底（见 handler 里的注释）。 */
+const MAX_BODY_BYTES = 4 * 1024 * 1024
+
 /** Longest display name / description the page accepts, so one paste cannot bloat every picker. */
 const MAX_NAME = 80
 const MAX_DESCRIPTION = 400
@@ -424,92 +429,35 @@ export async function deleteAssistant(rows, input, agentPresets) {
   return { ok: true, id, note: '已删除「' + id + '」。正在使用它的会话不受影响；新建会话时不再出现。' }
 }
 
-/** Send JSON with no-store caching, so a save is never read back stale. */
-function sendJson(res, status, value) {
-  const body = JSON.stringify(value)
-  res.writeHead(status, {
-    'content-type': 'application/json; charset=utf-8',
-    'cache-control': 'no-store',
-    'content-length': String(Buffer.byteLength(body, 'utf8')),
-  })
-  res.end(body)
-}
-
-/** Read a request body with a hard cap. */
-async function readBody(req) {
-  const chunks = []
-  let size = 0
-  for await (const chunk of req) {
-    size += chunk.length
-    if (size > 4_000_000) throw new Error('请求体过大（上限 4MB）')
-    chunks.push(chunk)
-  }
-  return Buffer.concat(chunks).toString('utf8')
-}
-
 /**
- * The request's path and query.
+ * The plugin's HTTP surface, registered on the platform's **shared `/api` channel**.
  *
- * A missing or unparsable `url` resolves to the route path itself, which is the
- * list endpoint — the lenient branch exists so a malformed request reads as an
- * ordinary list call instead of throwing inside the fence.
- */
-function requestUrl(req) {
-  const raw =
-    req !== null && typeof req === 'object' && typeof req.url === 'string' && req.url !== '' ? req.url : ROUTE_PATH
-  try {
-    return new URL(raw, 'http://localhost')
-  } catch {
-    return new URL(ROUTE_PATH, 'http://localhost')
-  }
-}
-
-/**
- * Rejection status for one request, or undefined when it may proceed.
- *
- * The platform's fence is verified through the Connection service, which is where
- * the Host/Origin check and the browser-session check live:
+ * `ctx.connection.fetch.register({ path, methods, requestBody, fetch })` mounts one exact route under
+ * `/api`, and the carrier applies its trust and authentication policy **before** dispatch. That is a
+ * structural guarantee, not a convention: a route cannot exist without the fence, so "did you remember
+ * to check?" is not a question anyone has to answer. An earlier version of this plugin registered on the
+ * raw `ctx.webServer` table and called `ctx.connection.requestRejection` by hand — measured then, an
+ * unauthenticated GET returned the whole system prompt and an unauthenticated cross-site POST rewrote
+ * `prompt.md`, while every official route answered 401.
  *
- *  - Host must be loopback (or a declared trusted authority) → defeats DNS
- *    rebinding, where the socket reaches this server but the Host names the
- *    attacker's domain;
- *  - `Sec-Fetch-Site: cross-site` and a mismatching `Origin` are refused → defeats
- *    a malicious page posting to this local port (a simple form post needs no
- *    preflight, so CORS alone would not have stopped it);
- *  - the signed `dsh-auth-*` cookie must be present → without the browser session
- *    that the launch URL establishes, the route is closed.
+ * Measured on 0.1.6-alpha.2 with a throwaway probe plugin (see `docs/MEASUREMENTS.md` §16):
  *
- * The service is resolved lazily, per request, and NOT through `inject`: measured
- * on 0.1.6-alpha.1, `connection` is provided after this bundle row's `apply` runs,
- * so an `inject` here would park the plugin in `pending` for no reason — while by
- * request time the service is always there.
+ *     GET  /api/<route>                                  no session cookie → 401 unauthorized
+ *     GET  /api/<route>   Origin: https://evil.example   cross-site        → 403
+ *     GET  /api/<route>   Host: evil.example             DNS-rebinding shape → 403
+ *     GET  /api/<route>                                  session cookie    → 200
+ *     POST /api/<route>   on a route that owns GET only                    → 404 (never dispatched)
  *
- * When the service is absent the route FAILS CLOSED. A dead settings page is a
- * visible, honest failure; an unauthenticated write path that rewrites the agent's
- * system prompt is a silent one.
+ * The paths are absolute *including* `/api` — that is what the platform's own packages pass
+ * (`/api/present.host`, `/api/changes.summary`), despite the type saying "below /api".
  */
-let warnedMissingConnection = false
-function connectionRejection(ctx, req) {
-  const connection = ctx.get('connection')
-  if (connection !== undefined && typeof connection.requestRejection === 'function') {
-    return connection.requestRejection(req)
-  }
-  if (!warnedMissingConnection) {
-    warnedMissingConnection = true
-    console.error(
-      'custom-mode: connection 服务不可用（DSH 版本不匹配？），已拒绝该设置页的所有请求以保守处理。' +
-        'prompt.md 与 custom_prompt 工具不受影响。',
-    )
-  }
-  return 503
-}
+const API_PREFIX = '/api'
 
 /**
  * Where the settings page can exist at all.
  *
- * The page is a WEB page: without `webServer` there is nothing to serve the route on,
- * and without `agentPresets` the assistant list cannot be built. The tui profile has
- * neither.
+ * The page is a WEB page: without `connection` there is no `/api` channel to register on, and without
+ * `agentPresets` the assistant list cannot be built. The tui profile has neither.
  *
  * These must NOT go into the row's own `inject`. Measured on 0.1.6-alpha.1:
  * `./install.sh --profile tui` — a usage both `install.sh --help` and the READMEs
@@ -520,11 +468,11 @@ function connectionRejection(ctx, req) {
  *     custom-mode (dsh-custom-mode): pending (waiting for services: webServer, agentPresets)
  *
  * That is the SAME line a broken installation prints, so it teaches users to ignore the
- * one warning that matters. Instead the row always activates, and the route is
+ * one warning that matters. Instead the row always activates, and the routes are
  * registered from a scoped fiber that waits for those two services (`ctx.inject`),
  * which is the dynamic form of the same declaration.
  */
-const WEB_SERVICES = ['webServer', 'agentPresets']
+const WEB_SERVICES = ['connection', 'agentPresets']
 
 export function apply(ctx) {
   // Before anything else: make sure the preset tree on disk is complete.
@@ -549,10 +497,14 @@ export function apply(ctx) {
     // Compatibility guard: this plugin reads host APIs that a future DSH release could
     // reshape. Check them once and say so plainly, instead of letting every request
     // fail with an opaque 500.
-    const missing = []
-    if (typeof scope.agentPresets?.list !== 'function') missing.push('agentPresets.list()')
-    if (typeof scope.agentPresets?.remove !== 'function') missing.push('agentPresets.remove()')
-    if (typeof scope.webServer?.register !== 'function') missing.push('webServer.register()')
+    // 数据表形式：以后新增一处耦合点，只要在这里加一行 —— README 的耦合点清单与本表同源，
+    // 让"上游改了 API 形状"在启动日志里就能看见，而不是等用户报"设置页白屏"。
+    const REQUIRED_APIS = [
+      ['agentPresets.list()', () => typeof scope.agentPresets?.list === 'function'],
+      ['agentPresets.remove()', () => typeof scope.agentPresets?.remove === 'function'],
+      ['connection.fetch.register()', () => typeof scope.connection?.fetch?.register === 'function'],
+    ]
+    const missing = REQUIRED_APIS.filter(([, probe]) => !probe()).map(([name]) => name)
     if (missing.length > 0) {
       console.error(
         'custom-mode: 当前 DSH 版本缺少所需 API：' +
@@ -586,86 +538,97 @@ export function apply(ctx) {
     /** The roster, or an empty list — discovery itself reports broken rows rather than throwing. */
     const roster = async () => {
       const rows = await scope.agentPresets.list()
-      return Array.isArray(rows) ? rows : []
+      if (!Array.isArray(rows)) {
+        // 形状变了：静默返回空列表会让页面显示"一个助手都没有"，比报错更难查（曾经就因为
+        // 缺少这种告警，一个 API 形状变化以"设置页白屏"的形式出现）。
+        if (!warnedRosterShape) {
+          warnedRosterShape = true
+          console.error('custom-mode: agentPresets.list() 没有返回数组（DSH 版本不匹配？），助手列表将为空。')
+        }
+        return []
+      }
+      return rows
     }
 
-    const handler = async (req, res) => {
-      try {
-        // The fence comes first, before any method dispatch: the GET leaks the whole
-        // system prompt and the POST rewrites it, so neither may run unauthenticated.
-        const rejection = connectionRejection(scope, req)
-        if (rejection !== undefined) {
-          // 401/403 与平台对 /api 的措辞一致；503 是"我们自己保守关闭"（connection 服务
-          // 取不到），它既不是未授权也不是被禁止，别把响应体写成 forbidden 误导排查的人。
-          const reason = rejection === 401 ? 'unauthorized' : rejection === 403 ? 'forbidden' : 'unavailable'
-          res.writeHead(rejection, { 'content-type': 'text/plain; charset=utf-8' })
-          res.end(reason)
-          return
-        }
+    /**
+     * One Fetch-shaped handler for the whole surface.
+     *
+     * `pathname` is the logical path (without the `/api` prefix) so the method table above stays the
+     * single place where the surface is described.
+     */
+    /**
+     * JSON response with the page's caching policy attached.
+     *
+     * `no-store` because every one of these answers is state the page then displays: a cached
+     * `GET /api/custom-mode/state` would show the user rows they already changed. (The old
+     * hand-rolled response helper set the same header; dropping it here would have been a silent
+     * regression.)
+     */
+    const json = (value, status = 200) =>
+      Response.json(value, { status, headers: { 'cache-control': 'no-store' } })
 
-        const url = requestUrl(req)
-        const pathname = url.pathname
-        const methods = METHODS[pathname]
-        if (methods === undefined) {
-          sendJson(res, 404, { ok: false, error: '未知的子路径：' + pathname })
-          return
-        }
-        // Per-path method table, not a global GET/POST gate: `create` and `delete`
-        // are POST-only, and letting a GET fall through to them would create an
-        // assistant off a link a browser prefetched.
-        if (!methods.includes(req.method)) {
-          sendJson(res, 405, { ok: false, error: '只支持 ' + methods.join(' 与 ') })
-          return
-        }
-        if (req.method === 'GET' && pathname === ROUTE_PATH) {
+    const handle = async (request, pathname) => {
+      try {
+        const url = new URL(request.url)
+        if (request.method === 'GET' && pathname === ROUTE_PATH) {
           await ensureShipped()
-          sendJson(res, 200, readList(await roster()))
-          return
+          return json(readList(await roster()))
         }
-        if (req.method === 'GET' && pathname === STATE_PATH) {
+        if (request.method === 'GET' && pathname === STATE_PATH) {
           await ensureShipped()
-          sendJson(res, 200, readState(await roster(), url.searchParams.get('id') ?? ''))
-          return
+          return json(readState(await roster(), url.searchParams.get('id') ?? ''))
+        }
+
+        // Backstop on request size. `requestBody: 'buffered'` means the platform applies its own
+        // JSON cap, but that cap is the host's configuration, not a contract — measured on Windows,
+        // a 5 MB body reached us happily. This keeps one authenticated request from making us buffer
+        // an unbounded amount; the platform's cap remains the primary guard.
+        const declared = Number(request.headers.get('content-length') ?? '')
+        if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+          return json({ ok: false, error: `请求体过大（上限 ${String(MAX_BODY_BYTES)} 字节）` }, 413)
         }
 
         // Everything below writes, so the body is read and parsed exactly once.
-        const raw = await readBody(req)
         let parsed
         try {
-          parsed = JSON.parse(raw)
+          parsed = await request.json()
         } catch {
-          sendJson(res, 400, { ok: false, error: '请求体不是合法 JSON' })
-          return
+          return json({ ok: false, error: '请求体不是合法 JSON' }, 400)
         }
         await ensureShipped()
         if (pathname === STATE_PATH) {
           const result = saveState(await roster(), parsed)
-          sendJson(res, result.ok === true ? 200 : 400, result)
-          return
+          return json(result, result.ok === true ? 200 : 400)
         }
         if (pathname === CREATE_PATH) {
           const result = createAssistant(await roster(), parsed)
-          sendJson(res, result.ok === true ? 200 : 400, result)
-          return
+          return json(result, result.ok === true ? 200 : 400)
         }
         if (pathname === REORDER_PATH) {
           const result = reorderAssistant(await roster(), parsed)
-          sendJson(res, result.ok === true ? 200 : 400, result)
-          return
+          return json(result, result.ok === true ? 200 : 400)
         }
         const result = await deleteAssistant(await roster(), parsed, scope.agentPresets)
-        sendJson(res, result.ok === true ? 200 : 400, result)
+        return json(result, result.ok === true ? 200 : 400)
       } catch (error) {
-        sendJson(res, 500, { ok: false, error: describe(error) })
+        return json({ ok: false, error: describe(error) }, 500)
       }
     }
 
-    // A PREFIX route claims `/custom-mode` and every sub-path under it, which keeps
-    // the endpoints to one registration and one disposer.
-    scope.effect(
-      () => scope.webServer.register({ kind: 'prefix', path: ROUTE_PATH, handler }),
-      'custom-mode.route',
-    )
+    // One registration per exact path — the platform's Fetch registry matches exact paths, not prefixes —
+    // each declaring the methods it owns. The method table doubles as the guarantee that a prefetched
+    // `GET /api/custom-mode/create` cannot create anything: that method is not registered for that path.
+    for (const [pathname, methods] of Object.entries(METHODS)) {
+      scope.effect(
+        () => scope.connection.fetch.register({
+          path: API_PREFIX + pathname,
+          methods: [...methods],
+          requestBody: 'buffered',
+          fetch: (request) => handle(request, pathname),
+        }),
+        'custom-mode.route' + pathname,
+      )
+    }
   })
 }
 
@@ -677,7 +640,10 @@ export function apply(ctx) {
  * prompt，而这个文件正是"用户的提示词"。
  */
 function writeAtomic(file, text) {
-  const temporary = `${file}.tmp-${String(process.pid)}`
+  // 临时名必须**每个请求唯一**：只带 pid 时，同一进程内两个并发保存会争同一个临时名，
+  // Windows 上两个 rename 指向同一目标会以 EPERM 失败（实测：10 并发保存 2 例 400），
+  // 而 POSIX 上 rename 原子覆盖、静默地后写胜出 —— 也就是说这个缺陷只在 Windows 显现。
+  const temporary = `${file}.tmp-${String(process.pid)}-${randomBytes(4).toString('hex')}`
   writeFileSync(temporary, text, 'utf8')
   renameSync(temporary, file)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-custom-mode",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Custom modes and custom prompts for DeepSeek Harness (dsh): edit a mode's system prompt on the settings page (it takes effect on the next model step), choose its base mode, switch plugins row by row, and keep several assistants side by side.",
   "license": "MIT",
   "type": "module",

package/preset/prompt-tool.mjs

@@ -25,7 +25,8 @@
  * needs no isolate realm.
  */
 
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { randomBytes } from 'node:crypto'
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -188,7 +189,10 @@ function makeDefinition(modeName) {
       if (verdict.ok !== true) return verdict.error
       try {
         mkdirSync(dirname(PROMPT_PATH), { recursive: true })
-        writeFileSync(PROMPT_PATH, args.text, 'utf8')
+        // 与设置页同一条纪律：临时文件 + rename。读取器（prompt-reader.mjs）按 mtime+size 缓存，
+        // 非原子写会让它有机会读到写了一半的提示词 —— 设置页早已改用原子写，这里原先还是
+        // 直接 writeFileSync，属于"自我标准不一致"。
+        writeAtomic(PROMPT_PATH, args.text)
         return '已写入 ' + PROMPT_PATH + '（' + String(args.text.length) + ' 字符）。本会话下一步模型调用即使用新提示词。'
       } catch (error) {
         return '写入失败：' + String((error && error.message) || error)
@@ -204,3 +208,15 @@ export function apply(ctx, config = {}) {
   const definition = makeDefinition(resolveModeName(config))
   ctx.effect(() => ctx.tools.register(definition), 'custom-prompt.tool')
 }
+
+/**
+ * 写文件：同目录临时文件 + rename（rename 在同一文件系统内原子）。
+ *
+ * 临时名带 pid 与随机后缀：同一进程内的并发写必须各用各的临时名，否则 Windows 上两个
+ * rename 指向同一目标会以 EPERM 失败。
+ */
+function writeAtomic(file, text) {
+  const temporary = `${file}.tmp-${String(process.pid)}-${randomBytes(4).toString('hex')}`
+  writeFileSync(temporary, text, 'utf8')
+  renameSync(temporary, file)
+}