dsh-kaomoji 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/lang/zh-CN/
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-09-10
+
+### Changed
+
+- `auto` 模式的适用范围明确包含日常推荐、购物建议和实用 how-to 回答：这类
+  对话式回答同样会带一个颜文字，只有纯代码、正式技术交付和高风险内容跳过。
+
+## [0.1.1] - 2026-09-10
+
+### Added
+
+- 设置 RPC 默认信任范围改为 `trusted-host`：本机与 Host 声明的受信主机（如 Tailscale
+  组网的服务器）都能保存设置；可用 `settingsAuthority: loopback` 收紧回仅本机。
+- 设置卡片会显示 RPC 失败原因（来源不受信任 / Host 未加载 / 保存失败），不再静默只读。
+- `auto` 模式改为更积极地输出颜文字：友好的寒暄、闲聊、共情类回复都会带一个。
+
+### Fixed
+
+- 远程（Tailscale / 局域网）页面打开设置卡片时只能看、不能改的问题。
+
 ## [0.1.0] - 2026-09-09
 
 ### Added

package/README.en.md

@@ -26,7 +26,7 @@ largest Japanese kaomoji sites.
   instead of inventing malformed faces.
 - **12 mood buckets** — happy, love, sad, cry, angry, surprised, confused,
   shy, playful, encourage, thanks, sorry.
-- **Three frequency modes** — `auto` (default), `frequent`, `off`.
+- **Three frequency modes** — `auto` (default; greetings, casual chat, recommendations and empathetic replies get one), `frequent`, `off`.
 - **Placement control** — `inline` after the mood-matching sentence (default)
   or `end` of the reply.
 - **Visual settings card** under Settings → General, saved live without a restart.
@@ -62,12 +62,12 @@ Node.js `^22.19.0 || >=24.0.0`, pnpm 11.
 ```powershell
 cd "$env:USERPROFILE\.dsh\profiles\web"
 
-# Option A: install straight from GitHub (works today)
-dsh plugin --profile web add github:TianJie52009/dsh-kaomoji
-
-# Option B: install from npm (after the package is published)
+# Option A: install from npm (recommended)
 dsh plugin --profile web add dsh-kaomoji
 
+# Option B: install straight from GitHub (no npm release needed)
+dsh plugin --profile web add github:TianJie52009/dsh-kaomoji
+
 # Local development build
 pnpm add file:C:\path\to\dsh-kaomoji
 ```
@@ -102,15 +102,25 @@ Example `cordis.patch.yml`:
 
 | Key | Type | Default | Description |
 | --- | --- | --- | --- |
-| `mode` | `'off' \| 'auto' \| 'frequent'` | `'auto'` | `off` disables; `auto` uses kaomoji only when helpful; `frequent` adds one to every conversational reply (code-only/formal replies excluded) |
+| `mode` | `'off' \| 'auto' \| 'frequent'` | `'auto'` | `off` disables; `auto` adds one to greetings, casual chat, recommendations and empathetic replies; `frequent` adds one to every conversational reply (code-only/formal replies excluded) |
 | `placement` | `'inline' \| 'end'` | `'inline'` | Put the kaomoji after the best-matching sentence, or at the reply end |
 | `maxPerTurn` | `number` (1–5) | `1` | Max kaomoji per reply |
 | `customPrompt` | `string` | `''` | Extra style/scene guidance; cannot change mode, whitelist or limits |
 | `settingsFile` | `string` | `~/.dsh/dsh-kaomoji.json` | (advanced) user-settings file path |
+| `settingsAuthority` | `'trusted-host' \| 'loopback'` | `'trusted-host'` | Settings RPC trust scope: by default the local Host plus declared trusted hosts (Tailscale/LAN) may write; set `loopback` to restrict to the local machine |
 
 Card edits take effect immediately; deployment-default edits in
 `cordis.patch.yml` require a dsh restart.
 
+### Remote access (Tailscale / LAN)
+
+- If the dsh page is reachable remotely, the Host already trusts that origin;
+  with the default `settingsAuthority: trusted-host` the General card can save
+  settings from the remote session.
+- If the card reports that the origin is not trusted, add the host to the
+  server’s `trustedHosts` (dsh-client-connection) or temporarily switch to
+  `settingsAuthority: loopback` and edit on the server itself.
+
 ## Kaomoji library & attribution
 
 The built-in library lives in [`data/catalog.json`](./data/catalog.json), with a
@@ -196,6 +206,14 @@ npm publish --access public --registry https://registry.npmjs.org
 
 ## FAQ
 
+- **No kaomoji in replies?** Check, in order: (1) the Host half is mounted —
+  `dsh plugin --profile web add dsh-kaomoji` writes both `dependencies` and
+  `dsh.profile.bundles`; a bare `pnpm add` only loads the client card, so
+  re-install with the dsh CLI or add the `insert` row to `cordis.patch.yml`
+  and restart (the log should show `[dsh-kaomoji] 已挂载（mode=...）`);
+  (2) the mode — `auto` only fires on friendly/casual/empathetic replies, use
+  `frequent` for one per conversational reply; (3) the settings card status —
+  “Host not loaded” / “origin not trusted” also means the guidance is absent.
 - **Why does the model sometimes skip kaomoji in `auto` mode?** That is by
   design. Only `frequent` requires one per conversational reply.
 - **Can I use kaomoji outside the whitelist?** Yes — put the exact string in

package/README.md

@@ -17,7 +17,7 @@
 - **纯提示词方案**：不截断、不改写模型流，也不额外调用模型，稳定且对 KV 缓存友好。
 - **白名单防乱码**：模型只会从词库中逐字符复制颜文字，不会凭印象拼出坏字符。
 - **情绪分桶**：内置 12 个情绪分类（开心 / 心动 / 难过 / 大哭 / 生气 / 惊讶 / 困惑 / 害羞 / 俏皮 / 鼓励 / 感谢 / 道歉），并随规则给出可用样例。
-- **三种频率模式**：`auto`（智能点缀，默认）/ `frequent`（每条对话回复都带）/ `off`（关闭）。
+- **三种频率模式**：`auto`（智能：寒暄/闲聊/推荐建议/共情回复都会带一个，默认）/ `frequent`（每条对话回复都带）/ `off`（关闭）。
 - **放置位置可选**：贴在情绪最贴切的句子后（`inline`，默认）或固定在回复末尾（`end`）。
 - **可视化配置卡片**：卡片位于「设置 → 通用设置」，保存即生效、无需重启。
 - **零第三方运行时依赖**：只用 dsh 自带的 `systemPrompt` 服务与 Node 标准库。
@@ -59,7 +59,18 @@
 - Node.js `^22.19.0 || >=24.0.0`
 - pnpm 11（dsh 默认使用 pnpm）
 
-### 方式一：从 GitHub 直装（现在就能用）
+### 方式一：从 npm 安装（推荐）
+
+包已发布到 npm，直接安装即可，dsh CLI 会自动把插件加入 `dsh.profile.bundles`：
+
+```powershell
+cd "$env:USERPROFILE\.dsh\profiles\web"
+dsh plugin --profile web add dsh-kaomoji
+```
+
+> 包刚发布的 24 小时内，如果对方的 pnpm 开启了「新包安全期」，裸名安装可能暂时解析不到；这种情况可先用下面的 GitHub 方式安装。
+
+### 方式二：从 GitHub 直装（无需等 npm）
 
 无需等 npm 发布，dsh CLI 支持直接装 GitHub 仓库：
 
@@ -74,15 +85,10 @@ cd "$env:USERPROFILE\.dsh\profiles\web"
 pnpm add github:TianJie52009/dsh-kaomoji
 ```
 
-### 方式二：从 npm 安装（包发布后）
+### 方式三：本地开发版
 
 ```powershell
-cd "$env:USERPROFILE\.dsh\profiles\web"
-
-# dsh CLI 会自动把插件加入 dsh.profile.bundles
-dsh plugin --profile web add dsh-kaomoji
-
-# 本地开发版：先把仓库 clone/解压到本地，再把路径换成该目录
+# 先把仓库 clone/解压到本地，再把路径换成该目录
 pnpm add file:C:\path\to\dsh-kaomoji
 ```
 
@@ -112,14 +118,20 @@ pnpm add file:C:\path\to\dsh-kaomoji
 
 | 配置项 | 类型 | 默认值 | 说明 |
 | --- | --- | --- | --- |
-| `mode` | `'off' \| 'auto' \| 'frequent'` | `'auto'` | `off` 关闭；`auto` 只在确有助益时使用；`frequent` 每条对话回复都带一个（纯代码 / 正式技术交付除外） |
+| `mode` | `'off' \| 'auto' \| 'frequent'` | `'auto'` | `off` 关闭；`auto` 寒暄/闲聊/推荐建议/共情回复都会带一个；`frequent` 每条对话回复都带一个（两者都跳过纯代码 / 正式技术交付） |
 | `placement` | `'inline' \| 'end'` | `'inline'` | 放在情绪最贴切的句子/短段后，或固定在回复末尾 |
 | `maxPerTurn` | `number`（1–5） | `1` | 每条回复最多允许的颜文字数量 |
 | `customPrompt` | `string` | `''` | 附加风格/场景说明；不能改变模式、白名单或数量上限 |
 | `settingsFile` | `string` | `~/.dsh/dsh-kaomoji.json` | （进阶）用户设置持久化文件路径 |
+| `settingsAuthority` | `'trusted-host' \| 'loopback'` | `'trusted-host'` | 设置 RPC 信任范围：默认允许本机与 Host 声明的受信主机（Tailscale/局域网）保存设置；改成 `loopback` 则仅本机可改 |
 
 卡片里的修改即时写入用户层并热生效；修改 `cordis.patch.yml` 的部署默认值后需重启 dsh。
 
+### 远程访问（Tailscale / 局域网）
+
+- 只要能正常远程打开 dsh 页面，说明 Host 已信任该来源；默认 `settingsAuthority: trusted-host` 下，通用设置卡片可以直接修改并保存。
+- 如果卡片提示「当前来源不在 Host 的信任列表里」，说明服务端 `@deepseek-ai/dsh-client-connection` 没有把该域名/IP 加进 `trustedHosts`；先在服务端配置受信主机，或临时改用 `settingsAuthority: loopback` 并到服务器本机编辑。
+
 ## 词库来源与许可
 
 内置词库见 [`data/catalog.json`](./data/catalog.json)，每个分类都标注了 kaomojiya.org 对应的来源页：
@@ -199,6 +211,22 @@ npm publish --access public --registry https://registry.npmjs.org
 
 ## FAQ
 
+### 回答里没有颜文字？
+
+按顺序检查：
+
+1. **Host 半是否真的挂载了**：`dsh plugin --profile web add dsh-kaomoji` 会把插件同时写进 `dependencies` 和 `dsh.profile.bundles`；如果只用 `pnpm add` 手动装，client 卡片会出现但 Host 不会注入提示词。重新用 dsh CLI 安装一次，或在 profile 的 `cordis.patch.yml` 里补：
+
+   ```yaml
+   - insert:
+       - id: dsh-kaomoji
+         name: dsh-kaomoji
+   ```
+
+   然后重启 dsh，日志里应出现 `[dsh-kaomoji] 已挂载（mode=...）`。
+2. **确认模式**：默认 `auto` 只在友好/闲聊/共情等场景使用；想要每条对话回复都带，在通用设置卡片切到「高频」，或在 `cordis.patch.yml` 写 `mode: frequent`。
+3. **看设置卡片状态**：卡片提示「Host 未加载」或「来源不受信任」时，提示词也不会注入，先按上面的步骤修好挂载/信任。
+
 ### 为什么模型偶尔没有加颜文字？
 
 `auto` 模式本来就不要求每回合使用；只有 `frequent` 才要求「对话回复都带一个」。如果 `frequent` 下仍经常漏掉，多半是回复被模型判为纯代码/正式交付，或上下文里其它 persona 指令更强势——可用 `customPrompt` 再强调一次。

package/lib/client.js

@@ -56,7 +56,7 @@ window.__ModuleLoader__.load({
       "mode.off": "关闭",
       "mode.off.desc": "不使用颜文字",
       "mode.auto": "智能",
-      "mode.auto.desc": "适合表达友好、共情或俏皮情绪时自然使用",
+      "mode.auto.desc": "寒暄、闲聊、推荐建议、共情回复都会带一个",
       "mode.frequent": "高频",
       "mode.frequent.desc": "每条对话回复都带一个（纯代码/正式交付除外）",
       "field.placement": "放置位置",
@@ -69,7 +69,8 @@ window.__ModuleLoader__.load({
       "action.reset": "恢复默认",
       "status.loading": "正在读取设置…",
       "status.saved": "已保存，下一次回复生效。",
-      "status.unsupported": "设置仅在 Host 本机（loopback）页面可修改。",
+      "status.unsupported": "Host 未加载颜文字插件或该来源不被信任，无法保存设置。",
+      "status.forbidden": "当前来源不在 Host 的信任列表里，无法保存设置。",
       "status.error": "保存失败，请重试。",
     };
 
@@ -80,7 +81,7 @@ window.__ModuleLoader__.load({
       "mode.off": "Off",
       "mode.off.desc": "No kaomoji",
       "mode.auto": "Smart",
-      "mode.auto.desc": "Use naturally when a friendly, empathetic, or playful mood fits",
+      "mode.auto.desc": "Greetings, casual chat, recommendations and empathetic replies get one",
       "mode.frequent": "Frequent",
       "mode.frequent.desc": "One kaomoji in every conversational reply (code-only/formal excluded)",
       "field.placement": "Placement",
@@ -93,7 +94,8 @@ window.__ModuleLoader__.load({
       "action.reset": "Reset to defaults",
       "status.loading": "Loading settings…",
       "status.saved": "Saved — applies to the next reply.",
-      "status.unsupported": "Settings can only be changed on the Host’s local (loopback) page.",
+      "status.unsupported": "The Host did not load the kaomoji plugin, or this origin is not trusted.",
+      "status.forbidden": "This origin is not in the Host trust list, so settings cannot be saved.",
       "status.error": "Save failed, please retry.",
     };
 
@@ -211,12 +213,12 @@ window.__ModuleLoader__.load({
      * 轻量快照 store（getSnapshot/subscribe），slot runtime 会把它包装成
      * useKaomoji(selector) hook。所有写操作都串行经过 loopback RPC。
      */
-    function createSettingsStore(rpc, isLoopback) {
+    function createSettingsStore(rpc) {
       let snapshot = {
-        status: isLoopback ? "loading" : "unavailable",
+        status: "loading",
         settings: cloneSettings(DEFAULT_SETTINGS),
         revision: undefined,
-        writable: Boolean(isLoopback),
+        writable: true,
         saveError: null,
         justSaved: false,
       };
@@ -238,16 +240,24 @@ window.__ModuleLoader__.load({
         return task;
       };
 
+      const fail = (code) => {
+        publish({
+          status: "unavailable",
+          writable: false,
+          saveError: code,
+          justSaved: false,
+        });
+      };
+
       const callRpc = async (endpoint, payload) => {
-        if (!isLoopback) {
-          publish({ status: "unavailable", saveError: null });
-          return undefined;
-        }
         try {
           const result = await rpc.call(RPC_CHANNEL, endpoint, payload);
-          return result && result.ok === true ? result.value : undefined;
-        } catch {
-          return undefined;
+          if (result && result.ok === true) return { value: result.value };
+          const code = result && result.error && result.error.code;
+          return { error: code === "forbidden" ? "forbidden" : "rejected" };
+        } catch (error) {
+          const message = String((error && error.message) || error || "");
+          return { error: /403|forbidden/i.test(message) ? "forbidden" : "unreachable" };
         }
       };
 
@@ -258,11 +268,12 @@ window.__ModuleLoader__.load({
           return () => listeners.delete(listener);
         },
         async refresh() {
-          const value = await callRpc("get", {});
-          if (value === undefined) {
-            if (isLoopback) publish({ status: "ready", saveError: "load" });
+          const result = await callRpc("get", {});
+          if (result.error !== undefined) {
+            fail(result.error === "forbidden" ? "forbidden" : "load");
             return;
           }
+          const value = result.value;
           publish({
             status: "ready",
             settings: normalizeSettings(value.settings),
@@ -272,6 +283,7 @@ window.__ModuleLoader__.load({
           });
         },
         patch(field) {
+          if (!snapshot.writable) return Promise.resolve();
           const next = normalizeSettings({ ...snapshot.settings, ...field });
           publish({
             status: "ready",
@@ -280,14 +292,15 @@ window.__ModuleLoader__.load({
             justSaved: false,
           });
           return enqueue(async () => {
-            const value = await callRpc("save", {
+            const result = await callRpc("save", {
               settings: next,
               expectedRevision: snapshot.revision,
             });
-            if (value === undefined) {
-              publish({ saveError: "save", justSaved: false });
+            if (result.error !== undefined) {
+              fail(result.error === "forbidden" ? "forbidden" : "save");
               return;
             }
+            const value = result.value;
             publish({
               settings: normalizeSettings(value.settings),
               revision: value.revision,
@@ -299,13 +312,14 @@ window.__ModuleLoader__.load({
           });
         },
         async reset() {
-          if (!isLoopback) return;
+          if (!snapshot.writable) return;
           publish({ saveError: null, justSaved: false });
-          const value = await callRpc("reset", { expectedRevision: snapshot.revision });
-          if (value === undefined) {
-            publish({ saveError: "save", justSaved: false });
+          const result = await callRpc("reset", { expectedRevision: snapshot.revision });
+          if (result.error !== undefined) {
+            fail(result.error === "forbidden" ? "forbidden" : "save");
             return;
           }
+          const value = result.value;
           publish({
             settings: normalizeSettings(value.settings),
             revision: value.revision,
@@ -332,7 +346,9 @@ window.__ModuleLoader__.load({
       }, [settings.customPrompt]);
 
       const statusText = state.saveError
-        ? t("status.error")
+        ? state.saveError === "forbidden"
+          ? t("status.forbidden")
+          : t("status.error")
         : state.status === "loading"
           ? t("status.loading")
           : !state.writable
@@ -466,7 +482,7 @@ window.__ModuleLoader__.load({
         "dsh-kaomoji: dictionaries",
       );
       const connection = ctx.get("connection");
-      const controller = createSettingsStore(connection.rpc, connection.isLoopback);
+      const controller = createSettingsStore(connection.rpc);
       void controller.refresh();
 
       ctx.effect(() => {

package/lib/index.js

@@ -30,6 +30,8 @@ export const SETTINGS_FILE_SCHEMA_VERSION = 1;
 
 export const MODES = ["off", "auto", "frequent"];
 export const PLACEMENTS = ["inline", "end"];
+/** 设置 RPC 的信任范围：trusted-host = 本机 + 服务端声明的受信主机（如 Tailscale）。 */
+export const SETTINGS_AUTHORITIES = ["trusted-host", "loopback"];
 
 export const DEFAULT_CONFIG = Object.freeze({
   /** off=关闭；auto=智能（确实有助于表达才用）；frequent=高频（每条对话回复都带）。 */
@@ -144,8 +146,9 @@ export function buildGuidance(config) {
 
   const modeLines = {
     auto: [
-      "Use a Japanese kaomoji only when it genuinely improves a friendly, empathetic, playful, or warm reply.",
-      "One per reply is usually enough; never force one, and never replace real content with it.",
+      "Most conversational replies should include one fitting kaomoji — greetings, casual chat, empathy, everyday recommendations or shopping advice, and practical how-to answers.",
+      "Skip it only when the reply is purely code, a formal/technical deliverable, or serious/high-stakes content.",
+      "One per reply is usually enough; never replace real content with it.",
     ],
     frequent: [
       "In every conversational reply — except code-only output, formal/technical deliverables, or tool calls — include one fitting kaomoji.",
@@ -203,6 +206,11 @@ function cloneSettings(settings) {
   return { ...settings, customPrompt: settings.customPrompt };
 }
 
+/** 设置 RPC 的信任范围；未显式配置时用 trusted-host（本机 + 服务端声明的受信主机）。 */
+function resolveAuthority(config) {
+  return config?.settingsAuthority === "loopback" ? "loopback" : "trusted-host";
+}
+
 function defaultSettingsFile(config) {
   if (typeof config?.settingsFile === "string" && config.settingsFile.trim() !== "") {
     return resolve(config.settingsFile);
@@ -362,6 +370,7 @@ function createSettingsRpcHandler(ctx, settingsFile, getState, commit) {
 export function apply(ctx, config = {}) {
   const baseSettings = normalizeConfig(config);
   const settingsFile = defaultSettingsFile(config);
+  const authority = resolveAuthority(config);
   const stored = loadSettingsDocument(settingsFile);
 
   // currentSettings = 用户层（~/.dsh/dsh-kaomoji.json）覆盖部署默认值后的实时设置。
@@ -406,14 +415,14 @@ export function apply(ctx, config = {}) {
     connectionCtx.effect(
       () =>
         connectionCtx.connection.rpc.handle(SETTINGS_RPC_CHANNEL, handler, {
-          authority: "loopback",
+          authority,
         }),
       "dsh-kaomoji: settings rpc",
     );
   });
 
   ctx.logger?.info?.(
-    `[dsh-kaomoji] 已挂载（mode=${currentSettings.mode}, placement=${currentSettings.placement}, settingsFile=${settingsFile}）`,
+    `[dsh-kaomoji] 已挂载（mode=${currentSettings.mode}, placement=${currentSettings.placement}, authority=${authority}, settingsFile=${settingsFile}）`,
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-kaomoji",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Add mood-aware Japanese kaomoji to DeepSeek Harness (dsh) replies; prompt-injection plugin with a curated library from kaomojiya.org.",
   "type": "module",
   "main": "lib/index.js",