dsh-kaomoji 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/lang/zh-CN/
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-09-25
+
+### Fixed
+
+- 设置通道从 `connection.rpc` 改为插件自有的 `webServer` 路由
+  （`POST /dsh-kaomoji-settings`）。部分部署里 `connection` 服务不会进入插件
+  作用域，通道永远注册不上，浏览器侧只看到 `HTTP 405`，设置卡片因此无法保存。
+
+## [0.1.4] - 2026-09-25
+
+### Changed
+
+- 设置卡片在保存失败时直接显示 Host 返回的真实原因（例如文件不可写、来源不受信任），
+  不再只显示通用的“保存失败”，便于定位服务器端问题。
+
 ## [0.1.3] - 2026-09-13
 
 ### Fixed

package/README.en.md

@@ -44,7 +44,7 @@ largest Japanese kaomoji sites.
 3. The model emits one of the listed kaomoji where it fits. Because kaomoji
    are plain text, no custom rendering is needed in the chat UI.
 
-Settings use a dedicated loopback RPC channel (`/dsh-kaomoji-settings`):
+Settings use a same-origin route registered on the web server (`POST /dsh-kaomoji-settings`):
 
 1. The Settings → General card reads/writes `~/.dsh/dsh-kaomoji.json`.
 2. The Host updates the prompt section and emits `system-prompt/change`
@@ -107,19 +107,16 @@ Example `cordis.patch.yml`:
 | `maxPerTurn` | `number` (1–5) | `1` | Max kaomoji per reply; `frequent` distributes that many across different sentences (fewer in very short replies) |
 | `customPrompt` | `string` | `''` | Extra style/scene guidance; cannot change mode, whitelist or limits |
 | `settingsFile` | `string` | `~/.dsh/dsh-kaomoji.json` | (advanced) user-settings file path |
-| `settingsAuthority` | `'trusted-host' \| 'loopback'` | `'trusted-host'` | Settings RPC trust scope: by default the local Host plus declared trusted hosts (Tailscale/LAN) may write; set `loopback` to restrict to the local machine |
-
 Card edits take effect immediately; deployment-default edits in
 `cordis.patch.yml` require a dsh restart.
 
 ### Remote access (Tailscale / LAN)
 
-- If the dsh page is reachable remotely, the Host already trusts that origin;
-  with the default `settingsAuthority: trusted-host` the General card can save
-  settings from the remote session.
-- If the card reports that the origin is not trusted, add the host to the
-  server’s `trustedHosts` (dsh-client-connection) or temporarily switch to
-  `settingsAuthority: loopback` and edit on the server itself.
+- The settings route is same-origin with the page (`POST /dsh-kaomoji-settings`),
+  so pages opened over Tailscale, LAN or an SSH tunnel can all save settings —
+  no `trustedHosts` configuration needed.
+- The only requirement is that the page can reach that Host's HTTP port; any
+  failure now shows the server's original error in the card (0.1.4+).
 
 ## Kaomoji library & attribution
 

package/README.md

@@ -31,7 +31,7 @@
    - 用户附加的 `customPrompt`（可选）。
 3. 模型生成时在合适位置直接输出列表内的颜文字——因为它只是普通文本，聊天界面无需任何自定义渲染即可显示。
 
-设置部分走独立的 loopback RPC（`/dsh-kaomoji-settings`）：
+设置部分由插件在 webServer 上注册同源路由 `POST /dsh-kaomoji-settings`：
 
 1. 「设置 → 通用设置」的卡片读取/写入 `~/.dsh/dsh-kaomoji.json`；
 2. Host 收到写入后立刻更新提示词段并发出 `system-prompt/change`，**下一次回复就生效**，不需要重启。
@@ -123,14 +123,12 @@ pnpm add file:C:\path\to\dsh-kaomoji
 | `maxPerTurn` | `number`（1–5） | `1` | 每条回复的颜文字数量上限；`frequent` 会按这个数量分散放在不同句子后，回复太短时自动减少 |
 | `customPrompt` | `string` | `''` | 附加风格/场景说明；不能改变模式、白名单或数量上限 |
 | `settingsFile` | `string` | `~/.dsh/dsh-kaomoji.json` | （进阶）用户设置持久化文件路径 |
-| `settingsAuthority` | `'trusted-host' \| 'loopback'` | `'trusted-host'` | 设置 RPC 信任范围：默认允许本机与 Host 声明的受信主机（Tailscale/局域网）保存设置；改成 `loopback` 则仅本机可改 |
-
 卡片里的修改即时写入用户层并热生效；修改 `cordis.patch.yml` 的部署默认值后需重启 dsh。
 
 ### 远程访问（Tailscale / 局域网）
 
-- 只要能正常远程打开 dsh 页面，说明 Host 已信任该来源；默认 `settingsAuthority: trusted-host` 下，通用设置卡片可以直接修改并保存。
-- 如果卡片提示「当前来源不在 Host 的信任列表里」，说明服务端 `@deepseek-ai/dsh-client-connection` 没有把该域名/IP 加进 `trustedHosts`；先在服务端配置受信主机，或临时改用 `settingsAuthority: loopback` 并到服务器本机编辑。
+- 设置路由和页面同源（`POST /dsh-kaomoji-settings`），所以 Tailscale、局域网或 SSH 端口转发打开的页面都能直接改设置，不需要配置 `trustedHosts`。
+- 唯一要求是页面能访问该 Host 的 HTTP 端口；如果卡片报错，看提示里的具体原因（0.1.4+ 会显示服务端原始错误）。
 
 ## 词库来源与许可
 

package/lib/client.js

@@ -213,7 +213,8 @@ window.__ModuleLoader__.load({
      * 轻量快照 store（getSnapshot/subscribe），slot runtime 会把它包装成
      * useKaomoji(selector) hook。所有写操作都串行经过 loopback RPC。
      */
-    function createSettingsStore(rpc) {
+    function createSettingsStore(fetchImpl) {
+      const doFetch = typeof fetchImpl === "function" ? fetchImpl : (...args) => fetch(...args);
       let snapshot = {
         status: "loading",
         settings: cloneSettings(DEFAULT_SETTINGS),
@@ -230,7 +231,9 @@ window.__ModuleLoader__.load({
       };
 
       const publish = (patch) => {
-        snapshot = { ...snapshot, ...patch };
+        snapshot = patch.saveError === null
+          ? { ...snapshot, ...patch, saveErrorMessage: null }
+          : { ...snapshot, ...patch };
         emit();
       };
 
@@ -240,24 +243,45 @@ window.__ModuleLoader__.load({
         return task;
       };
 
-      const fail = (code) => {
+      const fail = (code, message) => {
         publish({
           status: "unavailable",
           writable: false,
           saveError: code,
+          saveErrorMessage: message || null,
           justSaved: false,
         });
       };
 
       const callRpc = async (endpoint, payload) => {
         try {
-          const result = await rpc.call(RPC_CHANNEL, endpoint, payload);
+          const response = await doFetch(RPC_CHANNEL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ endpoint, payload }),
+          });
+          const status = Number((response && response.status) || 0);
+          let result;
+          try {
+            result = await response.json();
+          } catch {
+            result = undefined;
+          }
           if (result && result.ok === true) return { value: result.value };
-          const code = result && result.error && result.error.code;
-          return { error: code === "forbidden" ? "forbidden" : "rejected" };
+          const error = (result && result.error) || {};
+          if (status === 403 || error.code === "forbidden") {
+            return { error: "forbidden", message: error.message || "forbidden" };
+          }
+          return {
+            error: "rejected",
+            message: typeof error.message === "string" ? error.message : `HTTP ${String(status)}`,
+          };
         } catch (error) {
           const message = String((error && error.message) || error || "");
-          return { error: /403|forbidden/i.test(message) ? "forbidden" : "unreachable" };
+          return {
+            error: /403|forbidden/i.test(message) ? "forbidden" : "unreachable",
+            message,
+          };
         }
       };
 
@@ -270,7 +294,7 @@ window.__ModuleLoader__.load({
         async refresh() {
           const result = await callRpc("get", {});
           if (result.error !== undefined) {
-            fail(result.error === "forbidden" ? "forbidden" : "load");
+            fail(result.error === "forbidden" ? "forbidden" : "load", result.message);
             return;
           }
           const value = result.value;
@@ -297,7 +321,7 @@ window.__ModuleLoader__.load({
               expectedRevision: snapshot.revision,
             });
             if (result.error !== undefined) {
-              fail(result.error === "forbidden" ? "forbidden" : "save");
+              fail(result.error === "forbidden" ? "forbidden" : "save", result.message);
               return;
             }
             const value = result.value;
@@ -316,7 +340,7 @@ window.__ModuleLoader__.load({
           publish({ saveError: null, justSaved: false });
           const result = await callRpc("reset", { expectedRevision: snapshot.revision });
           if (result.error !== undefined) {
-            fail(result.error === "forbidden" ? "forbidden" : "save");
+            fail(result.error === "forbidden" ? "forbidden" : "save", result.message);
             return;
           }
           const value = result.value;
@@ -348,7 +372,9 @@ window.__ModuleLoader__.load({
       const statusText = state.saveError
         ? state.saveError === "forbidden"
           ? t("status.forbidden")
-          : t("status.error")
+          : state.saveErrorMessage
+            ? `${t("status.error")} ${state.saveErrorMessage}`
+            : t("status.error")
         : state.status === "loading"
           ? t("status.loading")
           : !state.writable
@@ -474,15 +500,14 @@ window.__ModuleLoader__.load({
       );
     }
 
-    const inject = ["slots", "locale", "connection"];
+    const inject = ["slots", "locale"];
 
     function apply(ctx) {
       ctx.effect(
         () => ctx.locale.register(NS, { zh, en }),
         "dsh-kaomoji: dictionaries",
       );
-      const connection = ctx.get("connection");
-      const controller = createSettingsStore(connection.rpc);
+      const controller = createSettingsStore();
       void controller.refresh();
 
       ctx.effect(() => {

package/lib/index.js

@@ -30,8 +30,6 @@ export const SETTINGS_FILE_SCHEMA_VERSION = 1;
 
 export const MODES = ["off", "auto", "frequent"];
 export const PLACEMENTS = ["inline", "end"];
-/** 设置 RPC 的信任范围：trusted-host = 本机 + 服务端声明的受信主机（如 Tailscale）。 */
-export const SETTINGS_AUTHORITIES = ["trusted-host", "loopback"];
 
 export const DEFAULT_CONFIG = Object.freeze({
   /** off=关闭；auto=智能（确实有助于表达才用）；frequent=高频（每条对话回复都带）。 */
@@ -219,11 +217,6 @@ function cloneSettings(settings) {
   return { ...settings, customPrompt: settings.customPrompt };
 }
 
-/** 设置 RPC 的信任范围；未显式配置时用 trusted-host（本机 + 服务端声明的受信主机）。 */
-function resolveAuthority(config) {
-  return config?.settingsAuthority === "loopback" ? "loopback" : "trusted-host";
-}
-
 function defaultSettingsFile(config) {
   if (typeof config?.settingsFile === "string" && config.settingsFile.trim() !== "") {
     return resolve(config.settingsFile);
@@ -372,10 +365,9 @@ function createSettingsRpcHandler(ctx, settingsFile, getState, commit) {
         return rpcError("bad-request", `Unknown dsh-kaomoji settings operation: ${endpoint}`);
       });
     } catch (error) {
-      ctx.logger?.warn?.(
-        `[dsh-kaomoji] settings rpc failed: ${error instanceof Error ? error.message : String(error)}`,
-      );
-      return rpcError("settings-rejected", "The Host rejected the kaomoji settings.");
+      const reason = error instanceof Error ? error.message : String(error);
+      console.warn(`[dsh-kaomoji] settings rpc failed: ${reason}`);
+      return rpcError("settings-rejected", `The Host rejected the kaomoji settings: ${reason}`);
     }
   };
 }
@@ -383,7 +375,6 @@ function createSettingsRpcHandler(ctx, settingsFile, getState, commit) {
 export function apply(ctx, config = {}) {
   const baseSettings = normalizeConfig(config);
   const settingsFile = defaultSettingsFile(config);
-  const authority = resolveAuthority(config);
   const stored = loadSettingsDocument(settingsFile);
 
   // currentSettings = 用户层（~/.dsh/dsh-kaomoji.json）覆盖部署默认值后的实时设置。
@@ -421,21 +412,59 @@ export function apply(ctx, config = {}) {
     "dsh-kaomoji: guidance",
   );
 
-  // 设置卡片通过 loopback RPC 读写 ~/.dsh/dsh-kaomoji.json；写入后立即
-  // 更新提示词段（emit system-prompt/change），无需重启。
-  ctx.inject(["connection"], (connectionCtx) => {
-    const handler = createSettingsRpcHandler(ctx, settingsFile, getState, adoptSettings);
-    connectionCtx.effect(
+  // 设置读写走 webServer 直连路由，不用 connection.rpc：后者在部分部署里
+  // connection 服务不进入插件作用域，通道永远注册不上（浏览器侧表现为 405）。
+  const settingsHandler = createSettingsRpcHandler(ctx, settingsFile, getState, adoptSettings);
+  const attachSettingsRoute = (scope) => {
+    scope.effect(
       () =>
-        connectionCtx.connection.rpc.handle(SETTINGS_RPC_CHANNEL, handler, {
-          authority,
+        scope.webServer.register({
+          kind: "exact",
+          path: SETTINGS_RPC_CHANNEL,
+          handler: async (request, response) => {
+            const reply = (status, value) => {
+              response.writeHead(status, {
+                "Content-Type": "application/json; charset=utf-8",
+                "Cache-Control": "no-store",
+              });
+              response.end(JSON.stringify(value));
+            };
+            if (request.method !== "POST") {
+              reply(405, rpcError("bad-request", "POST required"));
+              return;
+            }
+            let raw = "";
+            try {
+              for await (const chunk of request) raw += chunk;
+            } catch {
+              // 客户端中断：按空 body 处理，下面的解析会返回 400。
+            }
+            let endpoint = "";
+            let payload;
+            try {
+              const parsed = JSON.parse(raw === "" ? "{}" : raw);
+              endpoint = typeof parsed.endpoint === "string" ? parsed.endpoint : "";
+              payload = parsed.payload;
+            } catch {
+              reply(400, rpcError("bad-request", "invalid JSON body"));
+              return;
+            }
+            reply(200, await settingsHandler(endpoint, payload));
+          },
         }),
-      "dsh-kaomoji: settings rpc",
+      "dsh-kaomoji: settings route",
     );
-  });
+    console.log(`[dsh-kaomoji] settings route 已注册（path=${SETTINGS_RPC_CHANNEL}）`);
+  };
+  const webServer = typeof ctx.get === "function" ? ctx.get("webServer") : undefined;
+  if (webServer !== undefined) {
+    attachSettingsRoute(ctx);
+  } else {
+    ctx.inject(["webServer"], attachSettingsRoute);
+  }
 
-  ctx.logger?.info?.(
-    `[dsh-kaomoji] 已挂载（mode=${currentSettings.mode}, placement=${currentSettings.placement}, authority=${authority}, settingsFile=${settingsFile}）`,
+  console.log(
+    `[dsh-kaomoji] 已挂载（mode=${currentSettings.mode}, placement=${currentSettings.placement}, settingsFile=${settingsFile}）`,
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-kaomoji",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Add mood-aware Japanese kaomoji to DeepSeek Harness (dsh) replies; prompt-injection plugin with a curated library from kaomojiya.org.",
   "type": "module",
   "main": "lib/index.js",