dsh-film 0.3.1 → 0.3.3

package/README.md

@@ -37,14 +37,14 @@ A film workbench for DeepSeek Harness and VibeDev: three right-sidebar tabs —
 **从 GitHub Release 安装**：插件页的“包名或地址”和上面的命令也接受 Release 里的 `.tgz` 直链，例如
 
 ```
-https://github.com/CrisLIUning/dsh-film/releases/download/v0.3.1/dsh-film-0.3.1.tgz
+https://github.com/VibeDev-Si/dsh-film/releases/download/v0.3.3/dsh-film-0.3.3.tgz
 ```
 
 直链不经过安装源，需要本机能直接访问 GitHub（或配好代理）。包约 3 MB。网速很慢时仍可能超过 pnpm 默认的 60 秒下载时限而失败：这时改为按包名从中国大陆镜像源安装；也可以把时限调长：pnpm 11（DeepSeek Harness 和 VibeDev 桌面版自带的就是它）不再从 `~/.npmrc` 读取这个设置，要在 pnpm 的全局配置 `config.yaml` 里加一行 `fetchTimeout: 600000`（Windows：`%LOCALAPPDATA%\pnpm\config\config.yaml`；macOS：`~/Library/Preferences/pnpm/config.yaml`；Linux：`~/.config/pnpm/config.yaml`），或设环境变量 `pnpm_config_fetch_timeout=600000`；pnpm 10 及更早的版本则在 `~/.npmrc` 里加 `fetch-timeout=600000`。
 
 **刚发布的版本**：pnpm 11 默认只安装发布满一天的版本（`minimumReleaseAge`）。第一个版本不受影响：按包名安装一个此前没有任何版本的包时，pnpm 照样装上它，并把它记进 `minimumReleaseAgeExclude`。之后每次发布新版本，头一天按包名安装得到的是上一个版本；要马上装新版本，按确切版本安装（包名写成 `dsh-film@<版本>`），或者用上面的 Release 直链。
 
-**不能从 Git 仓库安装**：不要在插件页填仓库地址 `https://github.com/CrisLIUning/dsh-film`，也不要对它运行 `dsh plugin add`。`lib/`、`client/` 和 `apps/`（分镜画布和导演台的前端）都是构建产物，不在 git 里，从仓库安装会失败（不会留下装了却用不了的插件）。
+**不能从 Git 仓库安装**：不要在插件页填仓库地址 `https://github.com/VibeDev-Si/dsh-film`，也不要对它运行 `dsh plugin add`。`lib/`、`client/` 和 `apps/`（分镜画布和导演台的前端）都是构建产物，不在 git 里，从仓库安装会失败（不会留下装了却用不了的插件）。
 
 **「VibeDev 账号与模型」插件是可选的**：只有在分镜画布里生成图片和视频才需要另装 [@vibedev-si/dsh-vibedev](https://github.com/VibeDev-Si/dsh-vibedev)（原 dsh-media，包名 `@vibedev-si/dsh-vibedev`，装法相同；在侧边栏底部或「设置 → VibeDev 账号」登录 VibeDev，走 VibeDev 网关，按用量从 VibeDev 余额扣费）。不装也能写剧本、排分镜和调度导演台；从 VibeDev 插件中心安装影视工作台时会把它一并装上。分镜画布给每个视频模型列出的模式与该插件实际接受的一致：声明不收首帧的线路（Seedance 2.5（VibeDev）、2.5 30s（VibeDev）、2.5 480p 30s（山海）和三条 lec 线路；Seedance 2.5 特价按次收首帧，仍有图生视频）不显示“图生视频”，接一张图时改走“全能参考”，图作为参考图发送；以前保存成“图生视频”的节点在这些线路上也按全能参考生成。
 
@@ -56,13 +56,19 @@ Requires DeepSeek Harness 0.2.x or VibeDev (VibeDev Next), which is built on it.
 
 - **Plugin page** (recommended): Plugins → Add plugin → install a third-party plugin by package name, enter `dsh-film`, pick the npm registry or the China mirror under the install source, and install.
 - **Command line**: for the DeepSeek Harness desktop app, quit it fully, then run `dsh plugin --profile desktop add dsh-film` (the `dsh` command is installed from the app menu). VibeDev Next's command is `vibedev-app` (app menu → Manage vibedev-app Command…): quit the app fully, then run `vibedev-app plugin --profile desktop add dsh-film`; it keeps its data in `~/.vibedev-app`, which `dsh` does not reach. With the npm `dsh` CLI, run `dsh plugin add dsh-film`.
-- **GitHub Release**: the plugin page and the commands also take the release asset URL, e.g. `https://github.com/CrisLIUning/dsh-film/releases/download/v0.3.1/dsh-film-0.3.1.tgz`. It is fetched straight from GitHub, not through a registry. The file is about 3 MB; if a very slow connection still hits pnpm's default 60-second fetch timeout, install by name from the mirror instead, or raise the timeout — pnpm 11 (the one the desktop apps ship) no longer reads it from `~/.npmrc`, so add `fetchTimeout: 600000` to pnpm's global `config.yaml` (Windows `%LOCALAPPDATA%\pnpm\config\config.yaml`, macOS `~/Library/Preferences/pnpm/config.yaml`, Linux `~/.config/pnpm/config.yaml`) or set `pnpm_config_fetch_timeout=600000`; pnpm 10 and earlier take `fetch-timeout=600000` in `~/.npmrc`.
+- **GitHub Release**: the plugin page and the commands also take the release asset URL, e.g. `https://github.com/VibeDev-Si/dsh-film/releases/download/v0.3.3/dsh-film-0.3.3.tgz`. It is fetched straight from GitHub, not through a registry. The file is about 3 MB; if a very slow connection still hits pnpm's default 60-second fetch timeout, install by name from the mirror instead, or raise the timeout — pnpm 11 (the one the desktop apps ship) no longer reads it from `~/.npmrc`, so add `fetchTimeout: 600000` to pnpm's global `config.yaml` (Windows `%LOCALAPPDATA%\pnpm\config\config.yaml`, macOS `~/Library/Preferences/pnpm/config.yaml`, Linux `~/.config/pnpm/config.yaml`) or set `pnpm_config_fetch_timeout=600000`; pnpm 10 and earlier take `fetch-timeout=600000` in `~/.npmrc`.
 - **A fresh release**: pnpm 11 installs only versions published at least a day ago (`minimumReleaseAge`). The very first version is not held back: installing by name a package with no earlier version installs it and adds it to `minimumReleaseAgeExclude`. After each later release, an install by name gets the previous version for a day; to get the new one at once, install the exact version (`dsh-film@<version>`) or use the release URL.
 - **Not from the git repository**: `lib/`, `client/` and `apps/` (the storyboard and director desk front ends) are build outputs that are not in git, so installing from the repository URL fails (it does not leave a plugin that cannot work).
 - **The VibeDev account & models plugin is optional**: only image and video generation on the storyboard needs [@vibedev-si/dsh-vibedev](https://github.com/VibeDev-Si/dsh-vibedev) (formerly dsh-media; sign in to VibeDev at the bottom of the sidebar or in Settings → VibeDev account). Everything else works without it; installing the workbench from the VibeDev Plugin Center installs it too. The storyboard lists for each video model the modes that plugin accepts: lanes that declare no first frame (Seedance 2.5 (VibeDev), 2.5 30s (VibeDev), 2.5 480p 30s (山海) and the three lec lanes; Seedance 2.5 特价按次 takes a first frame and keeps image-to-video) offer no image-to-video, and a single image goes as a 全能参考 (multi-reference) reference image instead, also for nodes saved as image-to-video earlier.
 
 Then open the right sidebar of a session that has a workspace and pick a part on its start page. The first time a film tab opens, the plugin creates the film — named after the workspace folder, 16:9, with an empty storyboard — with no form to fill in. Rename it and pick its frame in the header the three tabs share: click the title to edit it (up to 80 characters; Enter or clicking away saves, Esc cancels); the frame is the film's aspect ratio, which the storyboard canvas and the director desk use (16:9, 9:16, 1:1, 4:5, 21:9, 2.39:1). A 4:3 film made by 0.1.0 keeps and shows its frame. To upgrade, install the new version over the old one (no need to uninstall first), then restart DeepSeek Harness / VibeDev: until you do, the workbench shows a banner asking for the restart and does not open the storyboard or the director desk. Your film stays in the workspace's `film/` folder either way.
 
+### 0.3.3 版本说明 · 0.3.3 release note
+
+- **撤回了 0.3.2 的「相关组件」入口**：上一版加在剧本、分镜画布和导演台三个标签页尾的那张卡片（插件之间的推荐位）影响页面观感，已经整个去掉；怎么引荐、在哪引荐等重新设计之后再考虑。工作区 `film/` 里的作品和 VibeDev 账号登录都不受影响，其它功能与 0.3.1 一致。
+
+- **The 相关组件 (related components) entry from 0.3.2 is withdrawn**: the card 0.3.2 added to the end of the script, storyboard and director desk tabs — a recommendation slot between plugins — hurt how the pages looked, so it is gone entirely; how and where to point people at other plugins will be considered again after a redesign. The work in your workspace's `film/` folder and your VibeDev sign-in are unaffected, and everything else matches 0.3.1.
+
 ### 0.3.1 版本说明 · 0.3.1 release note
 
 - **配合改名后的「VibeDev 账号与模型」插件**（[@vibedev-si/dsh-vibedev](https://github.com/VibeDev-Si/dsh-vibedev)，原 dsh-media）：未登录时的提示改为指向侧边栏底部「登录 VibeDev」和「设置 → VibeDev 账号」（dsh-media 的设置页里并没有登录入口）；缺少插件时的提示写明新的插件名和包名；Agent 工具说明里的 dsh-media 改称 VibeDev 插件。功能没有变化：分镜画布照旧通过 `vibedevMedia` 服务生成，新旧两个插件都提供这个服务。
@@ -225,6 +231,14 @@ npm run build      # 先删掉 lib/ 和 client/，再构建 lib/（Host 一侧
 
 Only `lib/` and `client/` build from this repository. `apps/` is built by `node scripts/build-apps.mjs canvas` from sibling checkouts — `../canvas` on `feat/dsh-host` (vibedev-canvas) and `../director-desk` on `feat/dsh-procedural-mannequin` (vibedev-director-desk); both are private repositories, so only maintainers can rebuild `apps/`. The script replaces only `apps/canvas`: a checkout that comes from 0.1 must delete the other folders under `apps/` by hand, or the package check refuses to pack. The same step removes the files `scripts/app-excludes.mjs` lists (the director desk's experiment and smoke-test pages, benchmark image, and the model-runtime page with its toolchain, about 10 MB) and writes the app's licences and `THIRD-PARTY-NOTICES.txt` (every production npm dependency the bundle can contain, with version, licence, repository and licence text). `node scripts/build-apps.mjs notices canvas` rewrites only those, warning when a checkout is not at the commit the app's `component-build.json` records; `trim` only removes the excluded files. `prepack` builds and then runs `scripts/check-package.mjs`, which refuses to pack without the app, the licence and notice files (with the Apache License beside the director desk's glTF decoders when it has them), with a canvas catalogue that fails the check the agent's tools apply when they read it, with the FFmpeg AAC encoder still in the canvas build (an `aac-encoder` chunk or `licenses/FFmpeg-LGPL-2.1.txt`; this release does not ship it, and the page re-encodes sound with the browser's own AAC encoder), with anything but `canvas` under `apps/`, with a top-level `vendor/` or `models/`, with excluded files present, with stale files in `lib/`, or with build-machine paths in `lib/` or `client/`. `publishConfig` sends `npm publish` to the npm registry.
 
+## 可信发布 · Trusted publishing
+
+维护者先在本地构建私有前端、运行类型检查和测试、打出已测 tgz，再为对应源码创建版本标签和附带 `dsh-film-<版本>.tgz` 的正式 GitHub Release。`.github/workflows/publish.yml` 通过 npm OIDC 发布这个原包，不在公共 runner 上重建私有画布和导演台。工作流核对 tag、源码和包内版本、Release 附件摘要；相同版本已发布且字节一致则跳过，内容不同则拒绝；发布后下载 npm 完整包再比对。手动重试未发布版本时，工作流 ref 选对应版本标签。
+
+npm Trusted Publisher 填 GitHub owner `VibeDev-Si`、repository `dsh-film`、workflow `publish.yml`，Environment 留空，勾选 **Allow npm publish**；需要管理 `latest` / `next` 时同时勾选 **Allow npm dist-tag**。仓库不保存 npm token。可信发布不授权 `npm deprecate`，弃用操作仍需交互认证。
+
+Maintainers build and test locally, including the private front ends, then attach the tested archive to the matching tagged GitHub Release. The OIDC workflow publishes those exact bytes, validates the Release digest and source version, refuses conflicting immutable npm versions, and verifies the published tarball. Configure the owner/repository/workflow above; retries of an unpublished version run on its tag ref. Deprecation uses separate interactive authentication.
+
 ## 许可 · License
 
 本插件以 MIT 许可证发布，见 `LICENSE`。包里还带着别人的代码，许可证和第三方声明放在这些地方：

package/client/client.workbench.js

@@ -693,7 +693,7 @@ window.__ModuleLoader__.load({ id: "dsh-film", chunk: "client.workbench.js", fac
 		* an older dictionary, whose translate function echoes keys it lacks.
 		*/
 		/** The version this bundle was built as (tsdown defines it); `dev` where nothing does (node tests). */
-		const CLIENT_VERSION = "0.3.1";
+		const CLIENT_VERSION = "0.3.3";
 		/**
 		* Whether the page should ask for a restart.
 		* @param client - the version this page was built as.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-film",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "VibeDev 影视工作台：在 DeepSeek Harness 和 VibeDev 的右侧侧栏里写剧本、排分镜和调度导演台，Agent 用影视工具协同改片 · Film workbench for DeepSeek Harness and VibeDev: screenplay, storyboard canvas and director desk in the right sidebar, with film tools for the agent",
   "type": "module",
   "main": "lib/index.js",
@@ -53,13 +53,13 @@
     "storyboard",
     "ai-agent"
   ],
-  "homepage": "https://github.com/CrisLIUning/dsh-film#readme",
+  "homepage": "https://github.com/VibeDev-Si/dsh-film#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/CrisLIUning/dsh-film.git"
+    "url": "git+https://github.com/VibeDev-Si/dsh-film.git"
   },
   "bugs": {
-    "url": "https://github.com/CrisLIUning/dsh-film/issues"
+    "url": "https://github.com/VibeDev-Si/dsh-film/issues"
   },
   "license": "MIT",
   "engines": {