dsh-msg9-kit 0.2.0 → 0.2.1

package/README.md

@@ -137,10 +137,16 @@ The panel resolves the same workspace from the current session's `cwd` (the
 
 ## Install
 
+```bash
+dsh plugin --profile web add dsh-msg9-kit
+# then restart dsh web and refresh the browser
+```
+
+From source (for development):
+
 ```bash
 npm install && npm run build          # builds lib/index.js + lib/client.js
 bash scripts/install-personal.sh      # dsh plugin --profile web add <this dir>
-# then restart dsh web and refresh the browser
 ```
 
 The plugin is one Loader entry; its `dsh.client` manifest makes the browser load
@@ -200,6 +206,12 @@ State (`~/.dsh/msg9-kit/state.json`, 0600, written atomically):
 A state file that fails to parse is never silently discarded: it is copied to
 `state.json.corrupt-*` and reported, because it holds irreplaceable inbox keys.
 
+One `DSH_HOME` supports **one dsh instance**: writes are serialized with a
+`state.json.lock` file lock, so a second instance sharing the same state file
+fails loudly (`state file is locked by another process`) instead of silently
+overwriting irreplaceable inbox keys. Run each instance with its own
+`DSH_HOME` / `MSG9_STATE_FILE`.
+
 ## Typical use
 
 ```
@@ -219,8 +231,10 @@ what it sent, and the address book it messages most.
 
 ## HTTP bridge
 
-The panel talks to these same-origin routes (loopback / same-origin only, never
-a key in the response):
+The panel talks to these same-origin routes (never a key in the response).
+Requests are accepted only when the connection itself comes from loopback
+(`remoteAddress`), plus a same-origin `Origin` check for browsers — a forged
+`Host` header from another local process does not pass:
 
 | Route | Purpose |
 |---|---|

package/README.zh-CN.md

@@ -102,10 +102,16 @@ dsh-<slug>-<hash4>@msg9.io
 
 ## 安装
 
+```bash
+dsh plugin --profile web add dsh-msg9-kit
+# 然后重启 dsh web 并刷新浏览器
+```
+
+从源码改装（开发时）：
+
 ```bash
 npm install && npm run build          # 产出 lib/index.js + lib/client.js
 bash scripts/install-personal.sh      # 等价于 dsh plugin --profile web add <本目录>
-# 然后重启 dsh web 并刷新浏览器
 ```
 
 插件只有一个 Loader entry，包内的 `dsh.client` 声明让浏览器从同一个包加载 `./client` 面，因此图标和面板无需额外配置。
@@ -155,6 +161,8 @@ bash scripts/install-personal.sh      # 等价于 dsh plugin --profile web add <
 
 状态文件解析失败时**不会**被静默清空：它会先被复制为 `state.json.corrupt-*` 再报错——因为里面存着不可再生的收件箱 key。
 
+一个 `DSH_HOME` 只支持**一个 dsh 实例**：写入前会对 `state.json.lock` 加文件锁，第二个共享同一状态文件的实例会响亮报错（`state file is locked by another process`），而不是互相覆盖不可再生的收件箱 key。多实例请各用各的 `DSH_HOME` / `MSG9_STATE_FILE`。
+
 ## 典型用法
 
 ```
@@ -173,7 +181,7 @@ msg9_send({ to: "dsh-alpha-a1b2@msg9.io", text: "schema 已更新", correlation_
 
 ## HTTP 桥
 
-面板调用的同源接口（只接受本机 / 同源请求，响应里永不含 key）：
+面板调用的同源接口（响应里永不含 key）。只接受连接来源本身是本机 loopback（`remoteAddress`）的请求，浏览器另有 `Origin` 同源校验——本机其他进程伪造 `Host` 头不再放行：
 
 | 路由 | 用途 |
 |---|---|