dsh-loadout 0.12.4 → 0.12.6

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 「装备栏」是一个 DeepSeek Harness 插件：给每个对话选一套工具（套装），只把用得上的工具投给模型。
 
-## 0.12.4（本地测试版，未发布）
+## 0.12.6
+
+- **发布流水线失败的那次补上**：0.12.5 的 `npm publish --provenance` 在 sigstore 里报了 `TLOG_CREATE_ENTRY_ERROR (409) an equivalent entry already exists in the transparency log`——包本身没进 registry（`latest` 仍是 0.12.4），是可信日志去重把这一版挡了下来。`publish.yml` 现在多两层兜底：先看这个版本是不是其实已经到 registry 了（到了就算成功），否则去掉 `--provenance` 再发一次，并留下 warning；正常路径仍然带 provenance。
+- 这一版内容与 0.12.5 相同（只是版本号 + 上面这条流水线兜底）。
+
+## 0.12.5
+
+- **把开发期探针从发布包里清掉**：`scripts/*-probe.mjs` 六个脚本（agent-probe / agent-lookup-probe / attribution-probe / cmd-probe / dock-probe / slots-probe）都是当时读 `app.asar` 用的一次性工具，里面硬编码了本机绝对路径，却因为 `files: scripts/*.mjs` 一直被塞进 npm 包。现在它们从仓库和包里一起消失，包里只剩三套自检。
+- 市场条目的注释指向 `docs/RELEASING.md`（原来指向已删除的 `RELEASE.md`）。
+- `publish.yml` 的说明改成事实：npm 已不发经典 token，需要 granular token + Bypass 2FA。
+- `index.js` 里那个用来让 `restrict()` 报错的哨兵工具名从 `__dsh_plugin_kits_probe__` 改成 `__dsh_loadout_probe__`（旧包名残留，纯内部字符串，无行为变化）。
+- README 补一句 `scripts/install.ps1` 的定位：没有 `dsh` CLI 时的链接安装，等价于 `install_bundle`。
+## 0.12.4
 
 - **重名当场说清楚**：新建/编辑套装时，输入框下方直接给出原因——「「仅聊天」是预置套装（标识 chat），不能用这个名字」，或是「已经有叫「我的套」的套装了」。占用时保存按钮置灰，不用等提交后才失败。
 - 说明重名判定：名字先 trim + NFKC + 转小写，然后同时比对**自建套装的 name 与 title**、**预置套装的 name（稳定标识）与 title（界面显示）**、以及保留字（全部 / 仅内置 / all / default…）。所以预置显示「仅聊天」时，chat 依然被占用——chat 是它的标识。

package/README.en.md

@@ -43,6 +43,8 @@ Letting Harness install it is the same as the third form:
 plugin_manager action=install_bundle target=<absolute path to this directory>
 ```
 
+Without the dsh CLI you can use `scripts/install.ps1`: it creates the junction link and writes the profile manifest, the same thing `install_bundle` does. Its `-Copy` switch goes back to a copied install — avoid it unless you know why you want one.
+
 Restart the app afterwards: host plugins have no hot reload, and the UI needs at least a refresh.
 
 ### Why not copy the files
@@ -63,7 +65,7 @@ node scripts/client-smoke.mjs # browser bundle: menu and settings panel render
 - **Settings → Loadout**: manage kits, edit notes, choose the new-conversation default.
 - `/kit <name>`: switch from the message box.
 
-Settings has no conversation of its own, so it only decides *where new conversations start* — use the header button to change the current one. In the default list, `All` / `Built-in only` and kits are the same kind of card: each can copy its switch command or be set as default. **My kits** starts collapsed and shows only the current default; open it to see the rest. A saved kit can be **edited** on its card: the form opens under that card, and you either overwrite it (conversations already using it switch immediately) or save as a new kit.
+Settings has no conversation of its own, so it only decides *where new conversations start* — use the header button to change the current one. In the default list, `All` / `Built-in only` and kits are the same kind of card: each can copy its switch command or be set as default. **My kits** starts collapsed and shows only the current default, with the same ＋ New kit action right under it; open it to see the rest. A saved kit can be **edited** on its card: the form opens under that card, and you either overwrite it (conversations already using it switch immediately) or save as a new kit.
 
 ### Shipped presets (five, read-only)
 Five read-only presets. Editing one forks it into one of your kits.
@@ -85,7 +87,7 @@ Five read-only presets. Editing one forks it into one of your kits.
 ## Upgrading
 
 - 0.11.x → 0.12.x: same package name; install over it. The store migrates to `schema: 2` once, with a `loadout.json.v1.bak-<ts>` backup, and every existing conversation is pinned to 全部 so a default change cannot reach back into it.
-- 0.4.x → 0.11.x: the package was renamed from `dsh-plugin-kits`; remove the old one first:
+- 0.4.x → 0.12.x: the package was renamed from `dsh-plugin-kits`; remove the old one first:
 
   ```text
   plugin_manager action=remove_bundle target=dsh-plugin-kits

package/README.md

@@ -44,6 +44,8 @@ dsh plugin --profile desktop add link:<本目录绝对路径>
 plugin_manager action=install_bundle target=<本目录绝对路径>
 ```
 
+没有 dsh CLI 的机器上，可以用 `scripts/install.ps1`：它建 junction 链接并写 profile manifest，等价于 `install_bundle`；`-Copy` 会退回拷贝安装，除非你清楚后果，否则别用。
+
 装完重启应用：宿主插件没有热重载，界面至少刷新一次。
 
 ### 为什么不能复制文件
@@ -64,7 +66,7 @@ node scripts/client-smoke.mjs # 浏览器 bundle：菜单与设置页渲染
 - 设置 → 装备栏：管理套装、改备注、选新对话默认套装。
 - `/kit <名字>`：在对话里直接切换。
 
-设置页没有自己的对话，所以它只管「新对话从哪套开始」，不切换当前对话——当前对话请在标题栏里切。默认列表里「全部 / 仅内置」和套装是同一种卡片：都能「复制切换命令」或「设为默认」；「我的套装」默认折叠，只显示当前默认的那一个，点开才列出全部。已经保存的套装可以在卡片上「编辑」：改动就在那张卡片下面展开，「覆盖保存」（正在用它的对话立刻按新工具集走）或「另存为新套装」。
+设置页没有自己的对话，所以它只管「新对话从哪套开始」，不切换当前对话——当前对话请在标题栏里切。默认列表里「全部 / 仅内置」和套装是同一种卡片：都能「复制切换命令」或「设为默认」；「我的套装」默认折叠，只显示当前默认的那一个（这一行下面始终留着「＋ 新建套装」），点开才列出全部。已经保存的套装可以在卡片上「编辑」：改动就在那张卡片下面展开，「覆盖保存」（正在用它的对话立刻按新工具集走）或「另存为新套装」。
 
 ### 预置套装（五套，只读）
 
@@ -101,8 +103,8 @@ node scripts/client-smoke.mjs # 浏览器 bundle：菜单与设置页渲染
 
 ## 升级
 
-- 0.5.x → 0.9.x：包名没变（`dsh-loadout`），直接 `plugin_manager install_bundle` 覆盖即可；套装数据在 `~/.dsh/loadout.json`，不动。
-- 0.4.x → 0.9.x：包名从 `dsh-plugin-kits` 改成 `dsh-loadout`，先卸旧的再装新的：
+- 0.5.x → 0.12.x：包名没变（`dsh-loadout`），直接 `plugin_manager install_bundle` 覆盖即可；套装数据在 `~/.dsh/loadout.json`，第一次启动会迁移到 `schema: 2`（旧文件备份为 `.v1.bak-<时间戳>`）。
+- 0.4.x → 0.12.x：包名从 `dsh-plugin-kits` 改成 `dsh-loadout`，先卸旧的再装新的：
 
   ```text
   plugin_manager action=remove_bundle target=dsh-plugin-kits

package/index.js

@@ -1238,7 +1238,7 @@ export function apply(ctx, config = {}) {
     }
     try {
       // A rejected restriction names every global tool it knows about.
-      tools.restrict({ deny: ['__dsh_plugin_kits_probe__'] })
+      tools.restrict({ deny: ['__dsh_loadout_probe__'] })
     } catch (error) {
       const message = String(error instanceof Error ? error.message : error)
       const match = /known global tools: ([^;]+)/u.exec(message)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-loadout",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "Loadout for DeepSeek Harness: group tools into kits, keep only the current kit's tools visible in each conversation, and manage everything from a settings panel.",
   "type": "module",
   "main": "./index.js",

package/scripts/agent-lookup-probe.mjs

@@ -1,24 +0,0 @@
-/**
- * Is there a host service that maps a session id to its live agent?
- */
-import { readFileSync, readdirSync } from 'node:fs'
-
-const BASE = 'C:/Users/JungleYXu/AppData/Local/Programs/DeepSeek Harness/resources/app.asar/dsh/node_modules/@deepseek-ai'
-const packages = readdirSync(BASE)
-const pattern = /agentFor|bySession|sessionAgent|agentOf|resolveAgent/g
-
-for (const name of packages) {
-  if (!name.startsWith('dsh-')) continue
-  let text
-  try {
-    text = readFileSync(`${BASE}/${name}/lib/index.js`, 'utf8')
-  } catch {
-    continue
-  }
-  const hits = [...new Set([...text.matchAll(pattern)].map((m) => m[0]))]
-  if (hits.length === 0) continue
-  const index = text.search(pattern)
-  console.log(`\n### ${name} :: ${hits.join(', ')}`)
-  console.log(text.slice(Math.max(0, index - 200), index + 260).replace(/\s+/g, ' '))
-}
-

package/scripts/agent-probe.mjs

@@ -1,25 +0,0 @@
-/**
- * How does host code get a session id from an agent object?
- */
-import { readFileSync } from 'node:fs'
-
-const BASE = 'C:/Users/JungleYXu/AppData/Local/Programs/DeepSeek Harness/resources/app.asar/dsh/node_modules/@deepseek-ai'
-const files = [
-  'dsh-tools/lib/index.js',
-  'dsh-agent/lib/index.js',
-  'dsh-session/lib/index.js',
-  'dsh-subagent/lib/index.js',
-]
-
-for (const rel of files) {
-  let text
-  try {
-    text = readFileSync(`${BASE}/${rel}`, 'utf8')
-  } catch (error) {
-    console.log(`skip ${rel}: ${error.code}`)
-    continue
-  }
-  const hits = [...text.matchAll(/agent\.session[A-Za-z]*/g)].map((m) => m[0])
-  const unique = [...new Set(hits)]
-  console.log(`${rel} -> ${unique.join(', ') || '(none)'}`)
-}

package/scripts/attribution-probe.mjs

@@ -1,91 +0,0 @@
-/**
- * Offline probe: does the package-name heuristic actually recover the plugins
- * that own the host-registered tools? Prints the derived index and the mapping
- * for a list of real tool names, so the heuristic can be checked before the app
- * is restarted.
- *
- *   ELECTRON_RUN_AS_NODE=1 "DeepSeek Harness.exe" scripts/attribution-probe.mjs
- */
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-const BUILTIN_PREFIXES = new Set([
-  'todo', 'web', 'kit', 'agent', 'work', 'read', 'write', 'edit', 'glob', 'grep',
-  'ask', 'present', 'skill', 'workflow', 'subagent', 'send', 'list', 'interrupt',
-  'job', 'schedule', 'create', 'get', 'update', 'exit', 'compress', 'decompress',
-  'search', 'load', 'working',
-])
-
-const NAME_NOISE = new Set([
-  'core', 'tools', 'tool', 'client', 'server', 'shared', 'common', 'plugin', 'plugins',
-  'dsh', 'ui', 'web', 'harness', 'extension', 'preset', 'settings', 'sidebar', 'runtime',
-])
-
-const SELF = 'dsh-loadout'
-
-const REAL_GLOBAL_TOOLS = [
-  'kit_list', 'kit_apply', 'kit_create', 'kit_set_tools', 'kit_set_default', 'kit_delete',
-  'modlens_read_image',
-  'weknora_list_knowledge_bases', 'weknora_search', 'weknora_read_document', 'weknora_ask',
-  'hindsight_sync_status', 'hindsight_diagnose', 'hindsight_search_knowledge_pages',
-  'hindsight_list_knowledge_pages', 'hindsight_read_knowledge_page', 'hindsight_reflect',
-  'hindsight_capture_initiative', 'hindsight_ingest_document',
-  'working_directory',
-  'vision_describe', 'vision_bootstrap', 'vision_materialize', 'vision_ground', 'vision_detect',
-  'vision_crop', 'vision_present', 'vision_pixel_diff', 'vision_colors', 'vision_ocr',
-  'vision_long_screenshot_ocr', 'vision_trace', 'vision_extract_foreground', 'vision_html_screenshot',
-  'list_mcp_resources', 'list_mcp_resource_templates', 'read_mcp_resource',
-  'compress', 'decompress', 'search_context',
-  'acp_status', 'acp_cache', 'acp_read_original_image',
-  'load_workspace_dependencies',
-]
-
-function profilePackages() {
-  const root = join(homedir(), '.dsh', 'profiles')
-  const names = new Set()
-  for (const entry of readdirSync(root)) {
-    const file = join(root, entry, 'package.json')
-    if (!existsSync(file)) continue
-    const parsed = JSON.parse(readFileSync(file, 'utf8'))
-    for (const name of Object.keys(parsed.dependencies ?? {})) names.add(name)
-    for (const bundle of parsed?.dsh?.profile?.bundles ?? []) if (typeof bundle === 'string') names.add(bundle)
-  }
-  return [...names]
-}
-
-function buildIndex(packages) {
-  const index = new Map()
-  for (const packageName of packages) {
-    const base = packageName.replace(/^@[^/]+\//, '')
-    if (base === SELF) continue
-    const stripped = base.replace(/^dsh-/, '').replace(/^plugin-/, '')
-    const tokens = [stripped, ...stripped.split('-')]
-      .map((token) => token.toLowerCase())
-      .filter((token) => token.length >= 3 && !NAME_NOISE.has(token) && !BUILTIN_PREFIXES.has(token))
-    for (const token of tokens) if (!index.has(token)) index.set(token, { id: token, title: stripped, packageName: base })
-  }
-  return index
-}
-
-const packages = profilePackages()
-const index = buildIndex(packages)
-console.log(`profile packages: ${packages.length}`)
-console.log(`tokens: ${[...index.keys()].sort().join(', ')}`)
-console.log('')
-const grouped = new Map()
-const orphan = []
-for (const toolName of REAL_GLOBAL_TOOLS) {
-  const cut = toolName.indexOf('_')
-  const prefix = cut > 0 ? toolName.slice(0, cut).toLowerCase() : ''
-  const owner = prefix === '' || BUILTIN_PREFIXES.has(prefix) ? undefined : index.get(prefix)
-  if (owner === undefined) { orphan.push(toolName); continue }
-  if (!grouped.has(owner.title)) grouped.set(owner.title, [])
-  grouped.get(owner.title).push(toolName)
-}
-for (const [title, tools] of [...grouped.entries()].sort()) {
-  console.log(`${title}  (${tools.length})`)
-  console.log(`   ${tools.join(', ')}`)
-}
-console.log('')
-console.log(`built-in / unattributed (${orphan.length}): ${orphan.join(', ')}`)

package/scripts/cmd-probe.mjs

@@ -1,30 +0,0 @@
-/**
- * What can a client plugin do with the command system, and how is a session id
- * exposed to a session-scoped slot?
- */
-import { readFileSync } from 'node:fs'
-
-const BASE = 'C:/Users/JungleYXu/AppData/Local/Programs/DeepSeek Harness/resources/app.asar/dsh/node_modules/@deepseek-ai'
-
-function show(rel, pattern, width = 260, limit = 6) {
-  let text
-  try {
-    text = readFileSync(`${BASE}/${rel}`, 'utf8')
-  } catch (error) {
-    console.log(`skip ${rel}: ${error.code}`)
-    return
-  }
-  console.log(`\n##### ${rel}`)
-  let index = text.search(pattern)
-  let shown = 0
-  while (index !== -1 && shown < limit) {
-    console.log('...' + text.slice(Math.max(0, index - 80), index + width).replace(/\s+/g, ' '))
-    index = text.slice(index + 1).search(pattern)
-    if (index !== -1) index += 1
-    shown += 1
-  }
-}
-
-show('dsh-client-ui-commands/lib/client.js', /submitCommand|runCommand|executeCommand/)
-show('dsh-client-commands/lib/index.js', /^\s*(run|execute|dispatch|submit)\(|exports\.(run|execute|dispatch|submit)/, 200, 8)
-show('dsh-client-ui-conversation/lib/client.js', /inject: \(sessionId\) =>/, 700, 2)

package/scripts/dock-probe.mjs

@@ -1,53 +0,0 @@
-/**
- * Look at how the shipped bundles use the composer-area slots, so the kit bar
- * can plug into a real surface with real props.
- */
-import { readFileSync, readdirSync } from 'node:fs'
-
-const BASE = 'C:/Users/JungleYXu/AppData/Local/Programs/DeepSeek Harness/resources/app.asar/dsh/node_modules/@deepseek-ai'
-
-function files(pkg) {
-  const out = []
-  const walk = (dir, depth) => {
-    if (depth > 3) return
-    let names = []
-    try {
-      names = readdirSync(dir)
-    } catch {
-      return
-    }
-    for (const name of names) {
-      if (name === 'node_modules') continue
-      const full = `${dir}/${name}`
-      if (name.endsWith('.js') || name.endsWith('.d.ts')) out.push(full)
-      else if (!name.includes('.')) walk(full, depth + 1)
-    }
-  }
-  walk(`${BASE}/${pkg}`, 0)
-  return out
-}
-
-const targets = ['composer.dock', 'conversation.composer', 'session.header.utilities', 'shell.overlay']
-const pkgs = readdirSync(BASE).filter((n) => n.startsWith('dsh-client-ui'))
-
-for (const pkg of pkgs) {
-  for (const file of files(pkg)) {
-    let text
-    try {
-      text = readFileSync(file, 'utf8')
-    } catch {
-      continue
-    }
-    for (const target of targets) {
-      let index = text.indexOf(target)
-      let shown = 0
-      while (index !== -1 && shown < 2) {
-        const start = Math.max(0, index - 320)
-        console.log(`\n=== ${pkg}/${file.split('/').slice(-2).join('/')} :: ${target}`)
-        console.log(text.slice(start, index + 320).replace(/\s+/g, ' '))
-        index = text.indexOf(target, index + 1)
-        shown += 1
-      }
-    }
-  }
-}

package/scripts/slots-probe.mjs

@@ -1,59 +0,0 @@
-/**
- * Find real slot names in the shipped client bundles.
- * Electron's fs is asar-aware, so archive-internal paths start with '/'.
- */
-import { readFileSync, readdirSync, statSync } from 'node:fs'
-
-const ROOT = '/dsh/node_modules/@deepseek-ai'
-const found = new Map()
-
-function safeReaddir(dir) {
-  try {
-    return readdirSync(dir, { withFileTypes: false })
-  } catch {
-    try {
-      return readdirSync(dir)
-    } catch {
-      return []
-    }
-  }
-}
-
-const packages = safeReaddir(ROOT).filter((name) => name.startsWith('dsh-client-ui') || name.startsWith('dsh-client-'))
-console.log(`packages: ${packages.length}`)
-
-const pattern = /["']((?:shell|conversation|settings|sidebar|composer|workspace|agent|home|chat|message|session)\.[a-zA-Z.]+)["']/g
-
-function scan(dir, depth) {
-  if (depth > 3) return
-  for (const entry of safeReaddir(dir)) {
-    const full = `${dir}/${entry}`
-    let isDir = false
-    try {
-      isDir = statSync(full).isDirectory()
-    } catch {
-      continue
-    }
-    if (isDir) {
-      if (entry === 'node_modules') continue
-      scan(full, depth + 1)
-      continue
-    }
-    if (!entry.endsWith('.js')) continue
-    let text
-    try {
-      text = readFileSync(full, 'utf8')
-    } catch {
-      continue
-    }
-    for (const match of text.matchAll(pattern)) {
-      const slot = match[1]
-      if (slot.split('.').length < 2) continue
-      found.set(slot, (found.get(slot) ?? 0) + 1)
-    }
-  }
-}
-
-for (const name of packages) scan(`${ROOT}/${name}`, 0)
-
-for (const [slot, count] of [...found.entries()].sort()) console.log(`${slot}\t${count}`)