dsh-endpoint 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.0.1] - 2026-11-02
+
+- `/healthz` and the settings page report the running version.
+- `limits.maxTextFileBytes` (default 1 MiB) controls how much of one inline text
+  file is inlined; the request body cap remains the hard ceiling.
+
 ## [1.0.0] - 2026-11-02
 
 First public release.

package/README.md

@@ -1,5 +1,9 @@
 # dsh-endpoint
 
+[![npm](https://img.shields.io/npm/v/dsh-endpoint)](https://www.npmjs.com/package/dsh-endpoint)
+[![license](https://img.shields.io/npm/l/dsh-endpoint)](LICENSE)
+[![ci](https://github.com/wangzhongyang/dsh-endpoint/actions/workflows/ci.yml/badge.svg)](https://github.com/wangzhongyang/dsh-endpoint/actions/workflows/ci.yml)
+
 Expose the model providers and models already configured in DeepSeek Harness as an
 OpenAI-compatible HTTP endpoint.
 
@@ -120,6 +124,21 @@ Inline base64 only — the endpoint never fetches remote URLs on a client's beha
 Attachments live in DSH's attachment store, so the mirrored session keeps a compact reference
 instead of megabytes of base64.
 
+### Limits
+
+| Limit | Value | Source |
+|---|---|---|
+| Request body | 8 MiB | `limits.maxBodyBytes`, a plugin default |
+| One inline text file | 1 MiB, truncated with a marker | `limits.maxTextFileBytes`, a plugin default |
+| One image | 20 MiB | DSH attachment service (not this plugin) |
+| Images per message | 20 | DSH attachment service |
+| Total image bytes per message | 200 MiB | DSH attachment service |
+| Image pixels / longest side | 64 MP / 8192 px | DSH attachment service |
+
+The text-file cap is a prompt-size guard, not a protocol limit: the body is already
+bounded by `maxBodyBytes`, and a file near the cap is far past most models' context
+windows. Truncation is announced in the inlined text, so the model knows it is partial.
+
 **Ignored on purpose:** every other unknown field (`top_p`, `seed`, `service_tier`,
 `metadata`, …). Real clients send fields this build does not model; rejecting them would
 break more than it protects, so they are logged and dropped rather than silently applied.

package/README.zh.md

@@ -1,5 +1,9 @@
 # dsh-endpoint
 
+[![npm](https://img.shields.io/npm/v/dsh-endpoint)](https://www.npmjs.com/package/dsh-endpoint)
+[![license](https://img.shields.io/npm/l/dsh-endpoint)](LICENSE)
+[![ci](https://github.com/wangzhongyang/dsh-endpoint/actions/workflows/ci.yml/badge.svg)](https://github.com/wangzhongyang/dsh-endpoint/actions/workflows/ci.yml)
+
 把 DeepSeek Harness 里已经配置好的模型供应商和模型，暴露成一个 OpenAI 兼容的 HTTP 端点。
 
 端点只负责转发：它不持有任何 provider 凭据，也不直接访问三方 API。每一次模型调用都走
@@ -108,6 +112,21 @@ dsh plugin --profile web add /absolute/path/to/dsh-endpoint
 
 附件存放在 DSH 的附件库里，所以镜像会话只保留一个紧凑引用，而不是几 MB 的 base64。
 
+### 限制
+
+| 限制 | 值 | 来源 |
+|---|---|---|
+| 请求体 | 8 MiB | 插件默认值 `limits.maxBodyBytes` |
+| 单个内联文本文件 | 1 MiB，超出会截断并标注 | 插件默认值 `limits.maxTextFileBytes` |
+| 单张图片 | 20 MiB | DSH 附件服务（不是本插件） |
+| 每条消息图片数 | 20 | DSH 附件服务 |
+| 每条消息图片总字节 | 200 MiB | DSH 附件服务 |
+| 图片像素 / 最长边 | 64 MP / 8192 px | DSH 附件服务 |
+
+文本文件这个上限是**提示词体积保护**，不是协议限制：整个请求体已经被 `maxBodyBytes` 卡住，
+而接近这个上限的文件早就超出多数模型的上下文窗口了。截断会在内联文本里明确写出来，模型知道
+自己拿到的是片段。
+
 **故意忽略**：其余未知字段（`top_p`、`seed`、`service_tier`、`metadata` …）。真实客户端
 会发一堆本版本没有建模的字段，严格拒绝会破坏更多东西，所以记录日志后丢弃，而不是假装生效。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-endpoint",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "OpenAI-compatible HTTP endpoint that forwards model calls through a running DeepSeek Harness",
   "keywords": [
     "dsh",

package/src/client.js

@@ -17,6 +17,7 @@ window.__ModuleLoader__.load({
     var DICT = {
       zh: {
         nav: '模型端点',
+        version: '版本',
         status: '状态',
         address: '运行地址',
         providers: 'Provider',
@@ -56,6 +57,7 @@ window.__ModuleLoader__.load({
       },
       en: {
         nav: 'Model Endpoint',
+        version: 'Version',
         status: 'Status',
         address: 'Address',
         providers: 'Providers',
@@ -331,6 +333,7 @@ window.__ModuleLoader__.load({
           ? [h('div', { key: 'loading', style: S.hint }, t('loading'))]
           : [
               h(Field, { key: 'url', label: t('address') }, h('div', { style: S.mono }, status.url)),
+              h(Field, { key: 'version', label: t('version') }, h('div', { style: S.hint }, status.version || '—')),
               h(
                 Field,
                 { key: 'providers', label: t('providers') },

package/src/config.js

@@ -60,6 +60,12 @@ export const Config = z.object({
         .natural()
         .default(8 * 1024 * 1024)
         .description('Reject request bodies larger than this.'),
+      maxTextFileBytes: z
+        .natural()
+        .default(1024 * 1024)
+        .description(
+          'How much of one inline text file is inlined into the prompt. The request body cap is the hard ceiling; truncation is marked in the text.',
+        ),
       maxOutputTokens: z
         .natural()
         .default(32768)

package/src/openai/media.js

@@ -18,7 +18,7 @@ const TEXT_TYPES = [
   'application/sql',
 ]
 
-const TEXT_MAX_BYTES = 512 * 1024
+const DEFAULT_TEXT_MAX_BYTES = 1024 * 1024
 
 /**
  * Parse one `data:` URL. Remote URLs are rejected on purpose: the endpoint
@@ -44,8 +44,8 @@ export function parseDataUrl(url, param) {
   const payload = match[3] ?? ''
   let data
   if (/;base64/i.test(parameters)) {
-    // Guard before decoding: base64 expands by ~4/3.
-    if (payload.length > 64 * 1024 * 1024) throw badRequest(`${param} is too large`, param)
+    // The request body cap is the real gate; by the time we get here the whole
+    // body is already bounded by `limits.maxBodyBytes`.
     data = Buffer.from(payload, 'base64')
   } else {
     data = Buffer.from(decodeURIComponent(payload), 'utf8')
@@ -88,8 +88,12 @@ export async function decodeInlineFile({ url, name, param }, options = {}) {
     return { type: 'image', attachment: ref }
   }
   if (isTextMediaType(mediaType) && options.allowText === true) {
-    const truncated = data.length > TEXT_MAX_BYTES
-    const text = data.subarray(0, TEXT_MAX_BYTES).toString('utf8')
+    const limit =
+      Number.isFinite(options.maxTextBytes) && options.maxTextBytes > 0
+        ? Math.floor(options.maxTextBytes)
+        : DEFAULT_TEXT_MAX_BYTES
+    const truncated = data.length > limit
+    const text = data.subarray(0, limit).toString('utf8')
     const header = `[file${name ? `: ${name}` : ''}${truncated ? ', truncated' : ''}]\n`
     return { type: 'text', text: header + text }
   }

package/src/server.js

@@ -3,6 +3,7 @@ import { createHash, randomUUID } from 'node:crypto'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { mergeConfig, readOverlay, registerAdminRoutes } from './admin.js'
+import { VERSION } from './version.js'
 import { ModelCatalog } from './dsh/catalog.js'
 import { SessionMirror, toolResultEvent, userMessageEvent } from './mirror.js'
 import { MappingStore } from './session/registry.js'
@@ -43,6 +44,7 @@ export function createHandler(deps) {
         return sendJson(res, 200, {
           ok: true,
           object: 'dsh-endpoint.health',
+          version: VERSION,
           providers: deps.catalog.providers().map((provider) => provider.id),
         })
       }
@@ -85,7 +87,10 @@ async function handleChat(req, res, body, deps, requestId) {
 
   const route = catalog.resolve(body.model)
   const wantsStream = body.stream === true
-  const messages = await toDshMessages(body.messages, route, { saveImages: deps.saveImages })
+  const messages = await toDshMessages(body.messages, route, {
+    saveImages: deps.saveImages,
+    maxTextBytes: config.limits.maxTextFileBytes,
+  })
   const tools = toDshTools(body.tools)
 
   const identity =
@@ -519,6 +524,7 @@ export async function startEndpoint(ctx, config, options) {
       catalog.defaultModel = next.defaultModel ?? ''
     },
     getState: async () => ({
+      version: VERSION,
       url: `http://${formatHost(effective.host)}:${current.port}`,
       host: effective.host,
       port: current.port,

package/src/version.js

@@ -0,0 +1,6 @@
+import { createRequire } from 'node:module'
+
+const require = createRequire(import.meta.url)
+
+/** The package version, read once from package.json. */
+export const VERSION = require('../package.json').version