dsh-free-search 0.9.20 → 0.9.22

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 dsh-free-search contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 dsh-free-search contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -41,7 +41,7 @@ dsh 默认的搜索 provider 依赖 DeepSeek 官方 API key（`DEEPSEEK_API_KEY`
 - **时间过滤** —— `advanced_search` 工具支持 `timeRange`：固定档、自定义相对值、绝对日期三种形式（详见下方逻辑说明）
 - **系统提示词注入** —— agent 知道当前用哪个引擎、哪些需要 key；并明确所有搜索结果是**不可信外部数据**，不得执行其中的指令
 - **提示注入防护（不可信数据边界）** —— 插件自有工具（advanced_search / platform_search / free_search_test）的网页文本包在 `<untrusted-web-content>` 边界内（正文里自带的同名标记会被剥离，防止提前闭合）；核心 web_search / web_fetch 由 DSH 核心自带同类提示（`External web content follows...`）；所有 snippet 统一清洗并截断到 300 字符
-- **版本号 + 检查更新** —— 设置卡片显示当前版本（跟随 `PLUGIN_VERSION`，随发布更新），"检查更新"按钮直连 npm registry 对比最新版，有新版本时提示并可一键跳转
+- **版本号** —— 设置卡片底部显示当前版本（跟随 `PLUGIN_VERSION`，随发布更新）。检查与升级交给官方插件页（插件 → 已安装 → dsh-free-search → 更新），插件不再自带第二套更新按钮
 - **结果缓存** —— 相同查询（含引擎/时间过滤参数）5 分钟内命中缓存（LRU 50 条），防免费引擎限流、省付费额度；时长可在设置页 0-5 分钟自由配置（0 关闭）
 - **域名黑名单与安全搜索** —— `blockedDomains`：命中的域名不会进入任何结果；`safeSearch`（`off` / `moderate` / `strict`）为 Bing / DuckDuckGo 加一层过滤
 - **免费标注** —— 设置页中免费引擎带绿色 `FREE` 徽章，付费引擎带橙色 `API KEY` 徽章
@@ -497,7 +497,7 @@ Search engine test:
 
 #### 离线自检断言（tools/）
 
-仓库自带 **31 个**零依赖断言脚本（合计 **622 项**），**不需要 API key、不联网、不需要测试框架**，Node ≥ 20 即可跑：
+仓库自带 **34 个**零依赖断言脚本（合计 **636 项**），**不需要 API key、不联网、不需要测试框架**，Node ≥ 20 即可跑：
 
 | 脚本 | 覆盖 | 运行（项数） |
 |---|---|---|
@@ -522,6 +522,8 @@ Search engine test:
 | `assert-youcom.mjs` | You.com 免 key 档（#90）：两档 URL 与请求头、无 key 不发 `X-API-Key`、`YDC_API_KEY` 别名、429/401/402/5xx 分类 | `node tools/assert-youcom.mjs`（23） |
 | `assert-prompt-language.mjs` | 提示词语言（en/zh）：语言回退、9 个工具双语文案、标识符不被翻译、占位符插值、切换时只重注册一次 | `node tools/assert-prompt-language.mjs`（7） |
 | `assert-tool-schema-size.mjs` | 工具 schema 体积（#94）：共享引擎 id 常量、`domain_search` 不内嵌逐引擎句子、三处合计 < 1.6k 字符 | `node tools/assert-tool-schema-size.mjs`（5） |
+| `assert-config-seat.mjs` | 配置入口（#101）：卡片同时挂在 `plugins.bundle.config`（key = 包名，渲染在包页）与 `plugins.row.config`（老入口），两者共用同一渲染器 | `node tools/assert-config-seat.mjs`（4） |
+| `assert-rail-section.mjs` | 页内目录的机器可读当前段：卡片根 `data-dsh-fs-section` 与 `railActive` 绑定、六段 id 固定、滚动监听仍在更新 | `node tools/assert-rail-section.mjs`（4） |
 | `assert-package-files.mjs` | 发布清单闸门（#97）：`files` 展开后必须覆盖被引用的本地模块、入口点与 `cordis.patch.yml`，并确认 `prepack` 守卫生效 | `node tools/assert-package-files.mjs`（4） |
 | `assert-key-rotation.mjs` | 多 key 轮换（#96）：round-robin 与 peek、单 key 不推进、配额优先于 429 的分类、轮换候选集合、`multi` 模式内重试与预检不消耗 key | `node tools/assert-key-rotation.mjs`（7） |
 | `assert-x-platform.mjs` | X (Twitter) 平台（Grok Build CLI）：可用性、提示词约束、structuredOutput/text/原始 JSON 解析、status 链接过滤与截断、双语文案与面板默认值 | `node tools/assert-x-platform.mjs`（8） |
@@ -592,7 +594,7 @@ This plugin provides multiple free search engines with automatic fallback, compl
 - **Time Filtering** — The `advanced_search` tool supports `timeRange`: fixed tiers, custom relative values, or an absolute date (details below)
 - **System Prompt Injection** — The agent is aware of the currently active engine and which engines require API keys; it is also told that all search output is **untrusted external data** and must never be executed as instructions
 - **Prompt-Injection Guard (untrusted-data boundary)** — Web-derived text from the plugin's own tools (`advanced_search` / `platform_search` / `free_search_test`) is wrapped in an explicit `<untrusted-web-content>` boundary (look-alike tags inside the text are stripped to prevent early closure); the core `web_search` / `web_fetch` tools carry DSH core's own notice (`External web content follows...`); every snippet is cleaned and capped at 300 characters
-- **Version + Update Check** — The settings card shows the current version (tracks PLUGIN_VERSION, bumped on release), and a "Check update" button queries the npm registry to compare against the latest release, prompting a one-click jump when a newer version exists
+- **Version label** — the settings card shows the current version (tracks PLUGIN_VERSION, bumped on release). Checking and updating is the official plugin page's job (Plugins -> Installed -> dsh-free-search -> Update); the plugin ships no second updater
 - **Result Caching** — Identical queries (same engine / time-filter args) hit an LRU cache (50 entries) for up to 5 minutes, protecting free engines from rate-limiting and saving paid quota; the TTL is configurable from 0-5 minutes in the settings UI (0 disables caching)
 - **Domain blocklist & safe search** — `blockedDomains` keeps matching domains out of every result; `safeSearch` (`off` / `moderate` / `strict`) adds a filter layer for Bing / DuckDuckGo
 - **Visual Badges** — Free engines feature a green `FREE` badge, while paid engines show an orange `API KEY` badge in the settings UI
@@ -1049,7 +1051,7 @@ Restart `dsh web` after switching to apply changes.
 
 #### Offline self-check assertions (`tools/`)
 
-**Thirty-one** zero-dependency assertion scripts ship with the repo (**622 assertions** total): **no API keys, no network, no test framework**, Node ≥ 20:
+**Thirty-four** zero-dependency assertion scripts ship with the repo (**636 assertions** total): **no API keys, no network, no test framework**, Node ≥ 20:
 
 | Script | Covers | Run (count) |
 |---|---|---|
@@ -1074,6 +1076,8 @@ Restart `dsh web` after switching to apply changes.
 | `assert-youcom.mjs` | You.com keyless tier (#90): both URLs and headers, no `X-API-Key` without a key, the `YDC_API_KEY` alias, and 429/401/402/5xx classification | `node tools/assert-youcom.mjs` (23) |
 | `assert-prompt-language.mjs` | Prompt language (en/zh): fallback rules, bilingual copy for all 9 tools, identifiers left untranslated, placeholder interpolation, and one re-registration per language change | `node tools/assert-prompt-language.mjs` (7) |
 | `assert-tool-schema-size.mjs` | Tool schema budget (#94): one shared engine-id constant, no per-engine sentences in `domain_search`, the three schemas under 1.6k chars combined | `node tools/assert-tool-schema-size.mjs` (5) |
+| `assert-config-seat.mjs` | Config entry point (#101): the card is registered on `plugins.bundle.config` (keyed by the package name, rendered on the bundle page) and on `plugins.row.config` (older entry), both sharing one renderer | `node tools/assert-config-seat.mjs` (4) |
+| `assert-rail-section.mjs` | Machine-readable active section for the in-page rail: the card root's `data-dsh-fs-section` tracks `railActive`, the six section ids are fixed, and the scroll spy still updates it | `node tools/assert-rail-section.mjs` (4) |
 | `assert-package-files.mjs` | Packaging gate (#97): after expanding `files`, every imported local module, the entry points and `cordis.patch.yml` must be published, and the `prepack` guard must be wired | `node tools/assert-package-files.mjs` (4) |
 | `assert-key-rotation.mjs` | Multi-key rotation (#96): round-robin and peek, single keys never advancing, quota classification ahead of 429, the rotation-candidate set, and in-engine retries that keep multi-mode preflight from consuming keys | `node tools/assert-key-rotation.mjs` (7) |
 | `assert-x-platform.mjs` | X (Twitter) platform via the Grok Build CLI: availability, prompt guardrails, structuredOutput/text/raw JSON parsing, status-link filtering and caps, bilingual copy and panel defaults | `node tools/assert-x-platform.mjs` (8) |

package/lib/client.js

@@ -123,9 +123,6 @@ window.__ModuleLoader__.load({
       ".dshfs-save:hover:not(:disabled){background:#0077ed;transform:translateY(-1px);box-shadow:0 2px 4px rgba(0,0,0,.15)}",
       ".dshfs-save:active:not(:disabled){transform:scale(0.98)}",
       "@media (prefers-color-scheme: dark){.dshfs-save{background:#0a84ff;color:#ffffff}.dshfs-save:hover:not(:disabled){background:#1e8eff}}",
-      ".dshfs-upgrade{border:1px solid rgba(52,199,89,.4);background:rgba(52,199,89,.15);color:#248a3d}",
-      "@media (prefers-color-scheme: dark){.dshfs-upgrade{color:#30d158}}",
-      ".dshfs-upgrade:hover:not(:disabled){background:rgba(52,199,89,.25)}",
       ".dshfs-badge{background:rgba(0,0,0,.05);color:#1d1d1f;white-space:nowrap;border-radius:999px;flex:none;padding:2px 8px;font-size:11px;font-weight:600;letter-spacing:0.3px}",
       "@media (prefers-color-scheme: dark){.dshfs-badge{background:rgba(255,255,255,.1);color:#f5f5f7}}",
       ".dshfs-badgeAuto{background:rgba(175,82,222,.15);color:#af52de;border:1px solid rgba(175,82,222,.2)}",
@@ -140,15 +137,7 @@ window.__ModuleLoader__.load({
       "@media (prefers-color-scheme: dark){.dshfs-langToggle{color:#a1a1a6}}",
       ".dshfs-update{color:#cc7a00;flex:none;font-size:12px;white-space:nowrap;border:1px solid rgba(255,149,0,.3);background:rgba(255,149,0,.12);border-radius:999px;padding:2px 8px}",
       "@media (prefers-color-scheme: dark){.dshfs-update{color:#ff9f0a}}",
-      ".dshfs-updateOk{color:#248a3d;flex:none;font-size:12px;white-space:nowrap;border:1px solid rgba(52,199,89,.3);background:rgba(52,199,89,.12);border-radius:999px;padding:2px 8px}",
-      "@media (prefers-color-scheme: dark){.dshfs-updateOk{color:#30d158}}",
       ".dshfs-updateLine{display:flex;align-items:center;gap:10px;flex-wrap:wrap}",
-      ".dshfs-updatePill{display:inline-flex;align-items:center;gap:6px;border:1px solid rgba(0,113,227,.2);background:rgba(0,113,227,.1);color:#0071e3;font:inherit;font-size:13px;font-weight:500;line-height:1;cursor:pointer;padding:6px 12px;border-radius:999px;text-decoration:none;white-space:nowrap;transition:all 180ms cubic-bezier(.4,0,.2,1)}",
-      "@media (prefers-color-scheme: dark){.dshfs-updatePill{color:#0a84ff;background:rgba(10,132,255,.15);border-color:rgba(10,132,255,.25)}}",
-      ".dshfs-updatePill:hover:not(:disabled){background:rgba(0,113,227,.15);border-color:rgba(0,113,227,.3)}",
-      "@media (prefers-color-scheme: dark){.dshfs-updatePill:hover:not(:disabled){background:rgba(10,132,255,.2);border-color:rgba(10,132,255,.4)}}",
-      ".dshfs-updatePill:disabled{opacity:.5;cursor:default}",
-      ".dshfs-updateIcon{flex:none;display:block}",
       ".dshfs-version{color:#6e6e73;font-size:12px;font-variant-numeric:tabular-nums;white-space:nowrap}",
       "@media (prefers-color-scheme: dark){.dshfs-version{color:#a1a1a6}}"
     ].join("");
@@ -255,18 +244,6 @@ window.__ModuleLoader__.load({
         testOk: (r) => `✓ ${r.count} 条结果（引擎: ${r.engine}）${r.content ? ` — ${r.content}` : ""}${r.sample ? ` · 例如 "${r.sample.slice(0, 40)}"` : ""}`,
         testFail: (e) => `✗ ${e}`,
         toggleLang: "EN",
-        checkUpdate: "检查更新",
-        checkingUpdate: "检查中…",
-        updateAvailable: (c, l) => `发现新版本 v${l}（当前 v${c}）`,
-        updateLatest: (c) => `已是最新版本 v${c}`,
-        updateCheckFailed: "检查更新失败（无法访问 npm registry）",
-        updateView: "查看 →",
-        hasUpdate: "有更新",
-        upgrade: "升级",
-        upgrading: "升级中…",
-        upgradeLinkMode: "（本地开发模式，升级请用 git pull）",
-        upgradeDone: (l) => `升级到 v${l} 完成，重启 dsh 后生效`,
-        upgradeFailed: (m) => `升级失败：${m}`,
         safeSearchLabel: "安全搜索过滤 (adlt)",
         safeSearchOff: "关闭 —— 引擎默认（不加参数）",
         safeSearchModerate: "中等 —— Bing 默认",
@@ -388,18 +365,6 @@ window.__ModuleLoader__.load({
         testOk: (r) => `✓ ${r.count} results (engine: ${r.engine})${r.content ? ` — ${r.content}` : ""}${r.sample ? ` · e.g. "${r.sample.slice(0, 40)}"` : ""}`,
         testFail: (e) => `✗ ${e}`,
         toggleLang: "中文",
-        checkUpdate: "Check update",
-        checkingUpdate: "Checking…",
-        updateAvailable: (c, l) => `New version v${l} available (current v${c})`,
-        updateLatest: (c) => `You're on the latest version v${c}`,
-        updateCheckFailed: "Update check failed (cannot reach npm registry)",
-        updateView: "View →",
-        hasUpdate: "Update available",
-        upgrade: "Upgrade",
-        upgrading: "Upgrading…",
-        upgradeLinkMode: "(local dev install - use git pull to update)",
-        upgradeDone: (l) => `Upgraded to v${l} - restart dsh to apply`,
-        upgradeFailed: (m) => `Upgrade failed: ${m}`,
         safeSearchLabel: "Safe search filter (adlt)",
         safeSearchOff: "Off - engine default (no filtering)",
         safeSearchModerate: "Moderate - Bing default",
@@ -437,7 +402,7 @@ window.__ModuleLoader__.load({
     };
     const tt = (lang) => I18N[String(lang ?? "").trim().toLowerCase() === "zh" ? "zh" : "en"];
     // 当前插件版本（与 lib/index.js 的 PLUGIN_VERSION 保持一致；跟随上游 v0.7.5）
-    const PLUGIN_VERSION = "0.9.19";
+    const PLUGIN_VERSION = "0.9.22";
     const PLUGIN_REPO_URL = "https://github.com/DDDMUC/dsh-free-search";
     // 右侧浮动目录（#85）：条目顺序即页面顺序，anchor 是页面里对应 field 的 id。
     const NAV_ITEMS = [
@@ -585,15 +550,6 @@ window.__ModuleLoader__.load({
       return response.json();
     }
 
-    async function bridgeCheckUpdate() {
-      const response = await fetch(`${BRIDGE_PREFIX}/check-update`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: "{}",
-      });
-      return response.json();
-    }
-
     async function bridgeCredentialsStatus() {
       const response = await fetch(`${BRIDGE_PREFIX}/credentials-status`, {
         method: "POST",
@@ -736,9 +692,6 @@ window.__ModuleLoader__.load({
       const [saveError, setSaveError] = react.useState("");
       const [testing, setTesting] = react.useState(false);
       const [testResult, setTestResult] = react.useState(null);
-      const [checkingUpdate, setCheckingUpdate] = react.useState(false);
-      const [upgrading, setUpgrading] = react.useState(false);
-      const [updateInfo, setUpdateInfo] = react.useState(null);
       // 回退优先级/池列表行内 key 输入：引擎 id → [当前值, setter]（zhihu 两引擎共享 ZHIHU_API_KEY）
       const KEY_INPUTS = {
         anysearch: [anysearchKey, setAnysearchKey],
@@ -1040,51 +993,6 @@ window.__ModuleLoader__.load({
         }
       };
 
-      const runCheckUpdate = async () => {
-        setCheckingUpdate(true);
-        setUpdateInfo(null);
-        setFailed(false);
-        setSaveError("");
-        try {
-          const result = await bridgeCheckUpdate();
-          if (result.ok) {
-            setUpdateInfo({ ok: true, ...result.value });
-          } else {
-            setUpdateInfo({ ok: false });
-          }
-        } catch {
-          setUpdateInfo({ ok: false });
-        } finally {
-          setCheckingUpdate(false);
-        }
-      };
-
-      const runUpdate = async () => {
-        setUpgrading(true);
-        setUpdateInfo(null);
-        setFailed(false);
-        setSaveError("");
-        try {
-          const response = await fetch(`${BRIDGE_PREFIX}/update`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: "{}",
-          });
-          const result = await response.json();
-          if (result.ok) {
-            setUpdateInfo({ ok: true, hasUpdate: false, upgraded: true, message: result.value.message, latest: result.value.latest });
-          } else {
-            setUpdateInfo({ ok: false, upgradeFailed: result.message ?? "upgrade failed" });
-          }
-        } catch {
-          setUpdateInfo({ ok: false, upgradeFailed: "request failed" });
-        } finally {
-          setUpgrading(false);
-        }
-      };
-
-      // 浮动目录（#85）：放在卡片右侧的页面留白里，绝对定位不参与卡片布局，
-      // 所以正文宽度和 0.9.8 完全一致；留白不足（窄窗口/卡片贴边）时直接隐藏。
       react.useEffect(() => {
         if (!open) return undefined;
         const place = () => {
@@ -1327,6 +1235,7 @@ window.__ModuleLoader__.load({
 
       return react_jsx_runtime.jsx("li", {
         className: (open ? "dshfs-card dshfs-cardOpen" : "dshfs-card") + (pageMode ? " dshfs-pageMode" : ""),
+        "data-dsh-fs-section": railActive,
         children: [
           react_jsx_runtime.jsx("button", {
             type: "button",
@@ -1373,6 +1282,7 @@ window.__ModuleLoader__.load({
                             react_jsx_runtime.jsx("button", {
                               type: "button",
                               className: "dshfs-railItem" + (railActive === item.id ? " dshfs-railItemActive" : ""),
+                              "data-dsh-fs-section": item.id,
                               onClick: () => goToSection(item.id),
                               children: [
                                 react_jsx_runtime.jsx("span", { className: "dshfs-railDot" }),
@@ -2023,86 +1933,7 @@ react_jsx_runtime.jsx("div", {
                         className: "dshfs-footerLeft",
                         children: [
                           react_jsx_runtime.jsx("span", { className: "dshfs-version", children: "v" + PLUGIN_VERSION }),
-                          updateInfo && updateInfo.ok && updateInfo.hasUpdate && !updateInfo.installable
-                            ? react_jsx_runtime.jsx("a", {
-                                className: "dshfs-updatePill",
-                                href: updateInfo.updateUrl,
-                                target: "_blank",
-                                rel: "noopener noreferrer",
-                                title: t.updateAvailable(updateInfo.current, updateInfo.latest),
-                                children: [
-                                  react_jsx_runtime.jsx("svg", {
-                                    className: "dshfs-updateIcon",
-                                    viewBox: "0 0 16 16",
-                                    width: 14,
-                                    height: 14,
-                                    "aria-hidden": "true",
-                                    children: react_jsx_runtime.jsx("path", {
-                                      d: "M8 2.2v6.4M5.2 6.4 8 9.2l2.8-2.8M3 10.8v1.4c0 .9.7 1.6 1.6 1.6h6.8c.9 0 1.6-.7 1.6-1.6v-1.4",
-                                      fill: "none",
-                                      stroke: "currentColor",
-                                      strokeWidth: 1.6,
-                                      strokeLinecap: "round",
-                                      strokeLinejoin: "round",
-                                    }),
-                                  }),
-                                  t.hasUpdate,
-                                ],
-                              })
-                            : react_jsx_runtime.jsx("button", {
-                                className: "dshfs-updatePill",
-                                type: "button",
-                                title: updateInfo && updateInfo.ok && updateInfo.hasUpdate ? t.updateAvailable(updateInfo.current, updateInfo.latest) : undefined,
-                                onClick: updateInfo && updateInfo.ok && updateInfo.hasUpdate ? runUpdate : runCheckUpdate,
-                                disabled: upgrading || checkingUpdate || saving || !ready,
-                                children: [
-                                  react_jsx_runtime.jsx("svg", {
-                                    className: "dshfs-updateIcon",
-                                    viewBox: "0 0 16 16",
-                                    width: 14,
-                                    height: 14,
-                                    "aria-hidden": "true",
-                                    children: react_jsx_runtime.jsx("path", {
-                                      d: "M8 2.2v6.4M5.2 6.4 8 9.2l2.8-2.8M3 10.8v1.4c0 .9.7 1.6 1.6 1.6h6.8c.9 0 1.6-.7 1.6-1.6v-1.4",
-                                      fill: "none",
-                                      stroke: "currentColor",
-                                      strokeWidth: 1.6,
-                                      strokeLinecap: "round",
-                                      strokeLinejoin: "round",
-                                    }),
-                                  }),
-                                  upgrading
-                                    ? t.upgrading
-                                    : checkingUpdate
-                                      ? t.checkingUpdate
-                                      : updateInfo && updateInfo.ok && updateInfo.hasUpdate
-                                        ? t.hasUpdate
-                                        : t.checkUpdate,
-                                ],
-                              }),
-                          updateInfo && updateInfo.ok
-                            ? updateInfo.upgraded
-                              ? react_jsx_runtime.jsx("span", {
-                                  className: "dshfs-updateOk",
-                                  children: t.upgradeDone(updateInfo.latest),
-                                })
-                              : updateInfo.hasUpdate
-                                ? updateInfo.installable
-                                  ? null
-                                  : react_jsx_runtime.jsx("span", {
-                                      className: "dshfs-version",
-                                      children: t.upgradeLinkMode,
-                                    })
-                                : react_jsx_runtime.jsx("span", {
-                                    className: "dshfs-updateOk",
-                                    children: t.updateLatest(updateInfo.current),
-                                  })
-                            : updateInfo && !updateInfo.ok
-                              ? react_jsx_runtime.jsx("span", {
-                                  className: "dshfs-failed",
-                                  children: updateInfo.upgradeFailed ? t.upgradeFailed(updateInfo.upgradeFailed) : t.updateCheckFailed,
-                                })
-                              : null,
+
                         ],
                       }),
                       react_jsx_runtime.jsx("div", {
@@ -2187,6 +2018,21 @@ react_jsx_runtime.jsx("div", {
       // description 必须传函数：ui-commands 读回的是 contribution.description()，
       // 传字符串会抛 TypeError: contribution.description is not a function；该异常
       // 会让整份 "/" 候选列表一起失败，菜单空白、其他命令也一起点不到。
+      // #101: also claim the bundle-level seat (keyed by the package name) so the
+      // card renders on the bundle page itself, between the description and the
+      // rows. The row-level seat stays registered for the older entry point.
+      ctx.slots.inject("plugins.bundle.config", () =>
+        ctx.slots.register(
+          {
+            name: "plugins.bundle.config",
+            key: "dsh-free-search",
+          },
+          (slotProps) =>
+            slotProps && slotProps.view === "summary"
+              ? summaryText()
+              : react_jsx_runtime.jsx(FreeSearchCard, { page: true })
+        )
+      );
       ctx.inject(["commandUi"], (sctx) => {
         const command = sctx.get("commandUi");
         sctx.effect(() => {

package/lib/domain_filter.js

@@ -1,100 +1,100 @@
-// #72 域名黑名单：在结果进入上下文前过滤内容农场（CSDN 等）。
-// 匹配语义（issue #72 约定）：
-//   - 域名相等或其子域命中（csdn.net 覆盖 blog.csdn.net）
-//   - 忽略大小写；www. 前缀归一；无 scheme / 无路径；
-//   - 不做正则（notcsdn.net 不得被 csdn.net 命中）
-// 生效方式：provider.search 入口按当次请求的 blockedDomains 设置"活动黑名单"，
-// uniqueSources 在收敛（去重 + limit）之前过滤——被屏蔽条目让位给后续候选，
-// 因此 maxResults 仍能填满，且 truncated 只在真正触及上限时为 true。
-
-let active = [];
-/**
- * 配置清洗：把用户随手填的域名/URL 归一成裸域名规则。
- * 处理 trim、scheme、路径/query/hash、端口、www.、大小写、去重（保序）、丢弃空值与非法行。
- *
- * 为什么要服务端兜底：blockedDomains 是 .volatile() 配置，用户可以直接编辑 YAML 绕过 UI，
- * 所以规范化必须在 setActiveBlockedDomains 里做，而不是只做在设置页。
- * isDomainBlocked 的匹配语义不受影响——规则只是被清洗成更可靠的等价形式。
- */
-export function normalizeDomainList(list) {
-  if (!Array.isArray(list)) return [];
-  const out = [];
-  const seen = new Set();
-  for (const raw of list) {
-    let s = String(raw ?? "").trim().toLowerCase();
-    if (!s) continue;
-    // 去 scheme（http:// https:// 或其它的 protocol://）
-    s = s.replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
-    // 去路径 / query / hash
-    const cut = s.search(/[/?#]/);
-    if (cut >= 0) s = s.slice(0, cut);
-    if (!s) continue;
-    // 去端口（仅当冒号后是纯数字）
-    const colon = s.lastIndexOf(":");
-    if (colon >= 0 && /^\d+$/.test(s.slice(colon + 1))) s = s.slice(0, colon);
-    // 去 www. 前缀与尾随点号
-    s = s.replace(/^www\./, "").replace(/\.+$/, "");
-    // 只接受"看起来像域名"的行：空格、下划线、中文等直接丢弃（它们永远匹配不到 host）
-    if (!s || !/^[a-z0-9][a-z0-9.-]*$/.test(s) || s.startsWith(".")) continue;
-    if (seen.has(s)) continue;
-    seen.add(s);
-    out.push(s);
-  }
-  return out;
-}
-
-/** 设置本次搜索生效的黑名单（provider.search / research 入口调用）。空数组 = 不过滤。 */
-export function setActiveBlockedDomains(list) {
-  active = normalizeDomainList(list);
-}
-export function getActiveBlockedDomains() {
-  return [...active];
-}
-
-function normalizeHost(host) {
-  return String(host ?? "").toLowerCase().trim().replace(/^www\./, "");
-}
-function normalizeRule(domain) {
-  return String(domain ?? "").toLowerCase().trim().replace(/^www\./, "").replace(/\/+$/, "");
-}
-
-/** 单个 URL 是否命中黑名单；URL 无法解析时返回 false（不误伤）。 */
-export function isDomainBlocked(url, blocked = active) {
-  if (!blocked || blocked.length === 0) return false;
-  let host;
-  try {
-    host = normalizeHost(new URL(String(url)).hostname);
-  } catch {
-    return false;
-  }
-  if (!host) return false;
-  return blocked.some((raw) => {
-    const rule = normalizeRule(raw);
-    if (!rule) return false;
-    return host === rule || host.endsWith("." + rule);
-  });
-}
-
-/** 列表过滤：结果条目统一为 { url } 形态，命中黑名的整条丢弃（保持原顺序=让位语义）。 */
-export function filterBlockedDomains(items, blocked = active) {
-  if (!blocked || blocked.length === 0) return items;
-  return items.filter((item) => !isDomainBlocked(item?.url, blocked));
-}
-
-/**
- * 结果级收口：引擎返回的 { sources } 在交给上层（provider 返回值 / multi 合并 /
- * runEngineTest / 工具 execute）之前统一过滤。
- *
- * 为什么需要它：uniqueSources 只是 40+ 个引擎里 29 个的"收敛去重"helper，
- * searchAnysearch / searchPlatform 等 11 个引擎并不经过它（各自直接 return sources）。
- * 只在 uniqueSources 里过滤会漏掉这些引擎——#72 首版就是这么漏的。
- * 因此过滤必须落在"结果离开引擎"的所有咽喉点上，而不是某一个 helper 里。
- *
- * 无黑名单 / 无命中时原样返回（零分配），调用方可以直接重新赋值。
- */
-export function applyBlockedFilterToResult(result) {
-  if (!result || !Array.isArray(result.sources)) return result;
-  const sources = filterBlockedDomains(result.sources);
-  if (sources.length === result.sources.length) return result;
-  return { ...result, sources };
-}
+// #72 域名黑名单：在结果进入上下文前过滤内容农场（CSDN 等）。
+// 匹配语义（issue #72 约定）：
+//   - 域名相等或其子域命中（csdn.net 覆盖 blog.csdn.net）
+//   - 忽略大小写；www. 前缀归一；无 scheme / 无路径；
+//   - 不做正则（notcsdn.net 不得被 csdn.net 命中）
+// 生效方式：provider.search 入口按当次请求的 blockedDomains 设置"活动黑名单"，
+// uniqueSources 在收敛（去重 + limit）之前过滤——被屏蔽条目让位给后续候选，
+// 因此 maxResults 仍能填满，且 truncated 只在真正触及上限时为 true。
+
+let active = [];
+/**
+ * 配置清洗：把用户随手填的域名/URL 归一成裸域名规则。
+ * 处理 trim、scheme、路径/query/hash、端口、www.、大小写、去重（保序）、丢弃空值与非法行。
+ *
+ * 为什么要服务端兜底：blockedDomains 是 .volatile() 配置，用户可以直接编辑 YAML 绕过 UI，
+ * 所以规范化必须在 setActiveBlockedDomains 里做，而不是只做在设置页。
+ * isDomainBlocked 的匹配语义不受影响——规则只是被清洗成更可靠的等价形式。
+ */
+export function normalizeDomainList(list) {
+  if (!Array.isArray(list)) return [];
+  const out = [];
+  const seen = new Set();
+  for (const raw of list) {
+    let s = String(raw ?? "").trim().toLowerCase();
+    if (!s) continue;
+    // 去 scheme（http:// https:// 或其它的 protocol://）
+    s = s.replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
+    // 去路径 / query / hash
+    const cut = s.search(/[/?#]/);
+    if (cut >= 0) s = s.slice(0, cut);
+    if (!s) continue;
+    // 去端口（仅当冒号后是纯数字）
+    const colon = s.lastIndexOf(":");
+    if (colon >= 0 && /^\d+$/.test(s.slice(colon + 1))) s = s.slice(0, colon);
+    // 去 www. 前缀与尾随点号
+    s = s.replace(/^www\./, "").replace(/\.+$/, "");
+    // 只接受"看起来像域名"的行：空格、下划线、中文等直接丢弃（它们永远匹配不到 host）
+    if (!s || !/^[a-z0-9][a-z0-9.-]*$/.test(s) || s.startsWith(".")) continue;
+    if (seen.has(s)) continue;
+    seen.add(s);
+    out.push(s);
+  }
+  return out;
+}
+
+/** 设置本次搜索生效的黑名单（provider.search / research 入口调用）。空数组 = 不过滤。 */
+export function setActiveBlockedDomains(list) {
+  active = normalizeDomainList(list);
+}
+export function getActiveBlockedDomains() {
+  return [...active];
+}
+
+function normalizeHost(host) {
+  return String(host ?? "").toLowerCase().trim().replace(/^www\./, "");
+}
+function normalizeRule(domain) {
+  return String(domain ?? "").toLowerCase().trim().replace(/^www\./, "").replace(/\/+$/, "");
+}
+
+/** 单个 URL 是否命中黑名单；URL 无法解析时返回 false（不误伤）。 */
+export function isDomainBlocked(url, blocked = active) {
+  if (!blocked || blocked.length === 0) return false;
+  let host;
+  try {
+    host = normalizeHost(new URL(String(url)).hostname);
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  return blocked.some((raw) => {
+    const rule = normalizeRule(raw);
+    if (!rule) return false;
+    return host === rule || host.endsWith("." + rule);
+  });
+}
+
+/** 列表过滤：结果条目统一为 { url } 形态，命中黑名的整条丢弃（保持原顺序=让位语义）。 */
+export function filterBlockedDomains(items, blocked = active) {
+  if (!blocked || blocked.length === 0) return items;
+  return items.filter((item) => !isDomainBlocked(item?.url, blocked));
+}
+
+/**
+ * 结果级收口：引擎返回的 { sources } 在交给上层（provider 返回值 / multi 合并 /
+ * runEngineTest / 工具 execute）之前统一过滤。
+ *
+ * 为什么需要它：uniqueSources 只是 40+ 个引擎里 29 个的"收敛去重"helper，
+ * searchAnysearch / searchPlatform 等 11 个引擎并不经过它（各自直接 return sources）。
+ * 只在 uniqueSources 里过滤会漏掉这些引擎——#72 首版就是这么漏的。
+ * 因此过滤必须落在"结果离开引擎"的所有咽喉点上，而不是某一个 helper 里。
+ *
+ * 无黑名单 / 无命中时原样返回（零分配），调用方可以直接重新赋值。
+ */
+export function applyBlockedFilterToResult(result) {
+  if (!result || !Array.isArray(result.sources)) return result;
+  const sources = filterBlockedDomains(result.sources);
+  if (sources.length === result.sources.length) return result;
+  return { ...result, sources };
+}