dsh-daily-brief 2.0.2 → 2.0.4

package/README.md

@@ -27,9 +27,10 @@
 ## 环境要求
 
 - Windows 10/11（弹窗与计划任务依赖 Windows；其他平台只能生成 HTML）。
+- DeepSeek Harness 核心 **≥ 0.2.1-rc.3**（已声明 `engines.dsh`，在 0.2.2-rc.1 上验证）。
 - 已安装 DeepSeek Harness，并能用 `plugin_manager` 安装本地插件目录。
 - 本机有 Microsoft Edge 或 Google Chrome（用于独立窗口）。
-- Node.js 随 DSH 提供；若要跑测试，需要 Node 18+。
+- Node.js 20+（随 DSH 提供；跑测试也用它）。
 
 ## 安装
 
@@ -176,6 +177,7 @@ Outlook 日历 →「设置 → 共享日历 → 发布日历」→ 复制 ICS
 | 桌面窗口没出现 | 检查是否安装 Edge/Chrome；查看 `logs\runner.log` 的投递记录 |
 | 飞书/ManageBac 抓不到条目 | 多为前端渲染或需要登录：改用日历 ICS 订阅，或在「添加来源」里填入 Cookie |
 | Outlook 邮箱填密码后报错 / 连不上 | Microsoft 已停用 IMAP 密码登录，但不再需要 Azure：按上面「Outlook 怎么办」把邮件转发到 Gmail / QQ，再添加接收邮箱；或直接用 Outlook 日历的 ICS 链接 |
+| 插件市场里安装失败，任务日志是 `pnpm` 且提到 `@napi-rs/canvas-*` / `@img/sharp-*` 或 `EPERM`/`EBUSY` | 失败发生在市场对整个 DSH profile 做 pnpm 重解析时（删宿主自带的原生可选包，被运行中的 DSH 占用），与插件包无关。完全退出 DSH（含托盘）后重装；仍失败就在终端执行 `dsh plugin add dsh-daily-brief` 取真正的错误行 |
 
 ## 配置参考（`config.json`）
 

package/lib/engine/runner.js

@@ -233,6 +233,9 @@ export async function runBriefing(options = {}) {
   const config = store.loadConfig();
   const now = options.now ? new Date(options.now) : new Date();
   if (Number.isNaN(now.getTime())) throw new Error(`无效的 --now 时间：${options.now}`);
+  // A pinned --now run stays on that clock; wall time is only the default, so a
+  // replayed schedule never publishes early because the machine clock is late.
+  const clockNow = () => (options.now ? now.getTime() : Date.now());
   const dryRun = Boolean(options.dryRun);
   const deliver = options.deliver !== false && !dryRun;
   const force = Boolean(options.force);
@@ -301,7 +304,7 @@ export async function runBriefing(options = {}) {
       // Preparing can take longer than the lead time (slow sources). If the
       // publish instant has arrived, deliver here instead of waiting for a
       // trigger that IgnoreNew may have already swallowed.
-      if (Date.now() < plan.publishAt.getTime() - PUBLISH_EARLY_MS) {
+      if (clockNow() < plan.publishAt.getTime() - PUBLISH_EARLY_MS) {
         return {
           ok: true,
           phase,

package/lib/host/routes.js

@@ -1,14 +1,52 @@
 /**
- * Loopback HTTP surface used by the client panel (relative `api/daily-brief/*`).
- * Every mutating call must carry the private header; all calls are loopback-only.
+ * Host HTTP surface used by the client panel (relative `api/daily-brief/*`).
+ *
+ * The plugin owns this route, so it also owns the request policy. On hosts that
+ * expose DSH's Connection service every call passes the same Host/Origin fence
+ * and browser-session check as the built-in `/api` bridge
+ * (`connection.requestRejection`). That covers both the Web GUI and the Desktop
+ * renderer: the `dsh-app` scheme forwards an authenticated, same-origin request
+ * for the panel, so no plugin-specific header is needed.
+ *
+ * Hosts without that service keep the historical local-only gate, now strict:
+ * the request must come from loopback *and* carry `x-daily-brief-client: 1`.
  */
 const PREFIX = '/api/daily-brief';
+const CLIENT_HEADER = 'x-daily-brief-client';
 
 function isLoopback(req) {
   const address = req.socket?.remoteAddress || '';
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
 }
 
+/**
+ * Decide whether one request may reach the panel API.
+ * @returns `undefined` when admitted, otherwise the status and error to answer with.
+ */
+function admissionFailure(ctx, req) {
+  let connection;
+  try {
+    connection = typeof ctx.get === 'function' ? ctx.get('connection') : ctx.connection;
+  } catch {
+    connection = undefined;
+  }
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const status = connection.requestRejection(req);
+      if (!status) return undefined;
+      return {
+        status,
+        error: status === 401 ? '需要 DSH 网页会话认证' : '请求来源不受信任',
+      };
+    } catch {
+      return { status: 503, error: '暂时无法校验请求来源' };
+    }
+  }
+  if (!isLoopback(req)) return { status: 403, error: '仅限本机访问' };
+  if (req.headers[CLIENT_HEADER] !== '1') return { status: 403, error: '客户端标识无效' };
+  return undefined;
+}
+
 function sendJson(res, status, body) {
   const payload = JSON.stringify(body ?? null);
   res.statusCode = status;
@@ -55,12 +93,13 @@ export function registerRoutes(ctx, service) {
     const sub = url.pathname.slice(PREFIX.length) || '/';
     const method = req.method || 'GET';
 
-    if (!isLoopback(req)) {
-      sendJson(res, 403, { error: '仅限本机访问' });
+    const failure = admissionFailure(ctx, req);
+    if (failure) {
+      sendJson(res, failure.status, { error: failure.error });
       return;
     }
 
-    // The exported page is opened by the user directly; it needs no header.
+    // `/artifact` has no panel client of its own; admission above is the guard.
     if (sub === '/artifact' && method === 'GET') {
       const id = url.searchParams.get('id') || 'latest';
       const briefing = await service.getBriefing(id);
@@ -88,13 +127,6 @@ export function registerRoutes(ctx, service) {
       return;
     }
 
-    // The Desktop renderer reaches these routes through the dsh-app scheme handler,
-    // which cannot attach custom headers on preflighted reads; loopback is the guard.
-    if (req.headers['x-daily-brief-client'] !== undefined && req.headers['x-daily-brief-client'] !== '1') {
-      sendJson(res, 403, { error: '客户端标识无效' });
-      return;
-    }
-
     try {
       if (sub === '/state' && method === 'GET') {
         sendJson(res, 200, await service.getState());

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "dsh-daily-brief",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
+  "engines": {
+    "node": ">=20",
+    "dsh": ">=0.2.1-rc.3"
+  },
   "description": "Daily briefing plugin for DeepSeek Harness: X, RSS/Atom/JSON/ICS, YouTube, Bilibili, Steam, Minecraft and status pages, mailboxes and calendars in one persona-styled card with a scheduled Windows popup.",
   "license": "MIT",
   "repository": {