dsh-obsidian-notes 0.0.0-stage → 0.5.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 revive123456
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,286 @@
-# Temporary Holding Version
+# Obsidian Notes for DeepSeek Harness
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**A local Obsidian-style notes pane for the [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) web UI.** Point it at a folder of Markdown files, then read, edit, search and cite them next to the conversation — without opening Obsidian, without importing anything, and without your notes leaving the machine.
+
+![The notes pane in action: open the vault tree, read a callout note, select a passage, ask about it — the composed prompt lands in the DSH composer, gets sent, and the answer comes back in the chat](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/hero.gif?v=2)
+
+[![CI](https://github.com/revive123456/dsh-obsidian-notes/actions/workflows/ci.yml/badge.svg)](https://github.com/revive123456/dsh-obsidian-notes/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/revive123456/dsh-obsidian-notes/blob/main/LICENSE)
+![DSH 0.2.1+](https://img.shields.io/badge/DSH-0.2.1%2B-blueviolet)
+
+English | [中文](https://github.com/revive123456/dsh-obsidian-notes/blob/main/README.zh.md)
+
+---
+
+## Why this one
+
+There is already an Obsidian-ish plugin in the DSH ecosystem
+([DedsecLemon/dsh-obsidian](https://github.com/DedsecLemon/dsh-obsidian)), and it
+is a good fit if you want an outline pane, backlinks and `==highlight==`. This
+plugin bet on a different set of things — the three that matter if you write next
+to a chat:
+
+1. **Rendering fidelity is the feature.** The preview is line-numbered and keeps
+   the Obsidian details other viewers flatten: all 13 callout types plus 15
+   aliases, table alignment, fenced code with info strings, task lists, setext
+   headings, and frontmatter that round-trips byte-for-byte on save.
+2. **Pasted screenshots stay attached.** Paste an image while editing and the
+   host writes an Obsidian-native `![[Pasted image …]]` embed. Move the
+   attachment folder later and every embed in the vault is rewritten to match.
+3. **The note can talk to the chat.** Cite a whole note as an `@path` mention, or
+   select a passage and ask about it — the prompt carries the absolute path, the
+   line range and the quoted text.
+
+> **What it does not do:** no backlinks, no outline pane, no graph view, and no
+> math/mermaid/transclusion rendering. If those are your priority, use a real
+> Obsidian vault (or the plugin above) instead. The [comparison](#comparison) is
+> spelled out below.
+
+## Screenshots
+
+| Notes tree + docked preview | Callouts, line numbers, badges |
+| --- | --- |
+| ![Sidebar notes tree with the preview dock open](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-sidebar.png) | ![Coloured Obsidian callouts with one source line per rendered line](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-callouts.png) |
+
+| Real tables and fenced code | Edit with a line-numbered source view |
+| --- | --- |
+| ![Table with column alignment and a TypeScript code fence](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-markdown.png) | ![Editor with line numbers and Save button](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-editing.png) |
+
+![Select a passage and ask about it: path, line numbers and quote are sent with the question](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-ask.png)
+
+## Install
+
+**Requirements:** DeepSeek Harness **0.2.1 or newer** (web UI or desktop app).
+The CLI install also needs **pnpm** (`npm i -g pnpm`, or `corepack enable`) and a
+Node.js **`^22.19 || >=24`** runtime for DSH.
+
+A plugin that ships a bundle layer is only composed at startup, so **restart the
+DSH host after installing** (desktop: quit and reopen). Refreshing the page is
+not enough.
+
+### 1. Desktop app (after the npm release)
+
+1. Open **Settings → Plugins**.
+2. Search for **`dsh-obsidian-notes`** and install it.
+3. Restart DeepSeek Harness.
+
+> This path requires the package to be published on npm (target release 0.5.0).
+> If search shows nothing, use one of the two paths below.
+
+### 2. CLI (after the npm release)
+
+```bash
+npm i -g pnpm                                   # `dsh plugin` forwards to pnpm
+dsh plugin --profile web add dsh-obsidian-notes
+# restart the host, then start it again
+dsh web
+```
+
+### 3. From source (works before the npm release)
+
+```bash
+git clone https://github.com/revive123456/dsh-obsidian-notes.git
+cd dsh-obsidian-notes
+npm i                     # runs build.mjs via prepare → lib/client.js
+dsh plugin --profile web add "$(pwd)"            # PowerShell: "$PWD"
+# restart `dsh web`
+```
+
+`dsh plugin add` records the package as a bundle in
+`$DSH_HOME/profiles/web/package.json`; the profile patch is applied on the next
+boot.
+
+> Avoid installing this repository with a bare `github:` spec: pnpm ≥ 10 blocks
+> lifecycle (`prepare`) scripts by default, so the build step that produces
+> `lib/client.js` would be skipped. Clone + `npm i` + install the local path
+> instead.
+
+**Uninstall:** `dsh plugin --profile web remove dsh-obsidian-notes`, then restart.
+If you installed it the old way (manual `cordis.patch.yml` row), see
+[docs/legacy-install.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/docs/legacy-install.md).
+
+### First run
+
+Open the **📚 Notes** row at the bottom of the sidebar. If no vault is
+configured, choose one:
+
+- **📂** opens a directory picker;
+- **📋** accepts a pasted absolute path.
+
+The default vault is `$DSH_WORKSPACE/obsidian_vault`, falling back to
+`./obsidian_vault` under the directory you started `dsh web` from.
+
+## Features
+
+- **Vault sidebar** — lazy directory tree; open a note with one click, create,
+  rename or delete notes and folders, and search titles **and** file contents.
+  Shows a live note count.
+- **Line-numbered Obsidian preview** — every source line keeps its line number.
+  Real tables with alignment, fenced code with language labels, nested lists and
+  task lists, all heading levels, setext headings, horizontal rules, and
+  clickable `[[wikilinks]]` (aliases and `#sections` included).
+- **Callouts** — `> [!type] title` blocks render with type colours, icons and
+  badges. 13 canonical types (`note`, `abstract`, `info`, `todo`, `tip`,
+  `success`, `question`, `warning`, `failure`, `danger`, `bug`, `example`,
+  `quote`) plus 15 Obsidian aliases (`summary`, `tldr`, `hint`, `important`,
+  `check`, `done`, `help`, `faq`, `caution`, `attention`, `fail`, `missing`,
+  `error`, `cite`, `none`).
+- **Edit and save** — line-numbered source editor, save with the button or
+  <kbd>Ctrl/Cmd+S</kbd>. The YAML frontmatter is never shown in the editor and is
+  stitched back untouched on save; external edits to the YAML are preserved.
+- **Screenshot paste** — <kbd>Ctrl/Cmd+V</kbd> in the editor uploads the image to
+  the configured attachment folder and inserts the Obsidian-native
+  `![[Pasted image <timestamp>.png]]` embed (20 MB per image). Files written this
+  way keep working in real Obsidian.
+- **Attachment folder management** — four location modes (Vault root, fixed
+  folder, same folder as the note, subfolder under the note), image-only folders
+  hidden from the tree, and optional orphan cleanup. Changing the folder moves
+  existing screenshots and rewrites the embeds in every note.
+- **Cite and ask** — `⤴ Cite to chat` inserts `@/abs/path/to/note.md` into the
+  composer (falling back to the clipboard if the composer cannot be reached).
+  Select text in the preview or editor to get the **💬 Ask / ⚡ Explain** bar: the
+  prompt contains the absolute path, the line range, the quoted passage (up to
+  1500 characters) and your question.
+- **Session and workspace housekeeping** — rename, archive or permanently delete
+  sessions from the sidebar; batch-select sessions (archive/delete) or
+  workspaces (delete registration and their session logs); rows whose logs are
+  already gone are hidden instead of resurrected. Running sessions are refused,
+  and deleting a workspace never touches its directory or files.
+- **Docked panel** — the preview panel can be dragged around and resized; the
+  width you pick is remembered. The preview polls the file's mtime and refreshes
+  when the file changes on disk.
+
+The UI is bilingual (English / Chinese) and uses DSH theme tokens, so it follows
+the app's light and dark themes.
+
+## Comparison
+
+| | This plugin | [DedsecLemon/dsh-obsidian](https://github.com/DedsecLemon/dsh-obsidian) |
+| --- | --- | --- |
+| Vault tree, search | ✅ tree, title + body search | ✅ tree, whole-vault matching-line search |
+| Obsidian callouts | ✅ 13 types + 15 aliases, line-numbered spine | ✅ rendered, fold state kept |
+| Tables, fenced code, setext headings | ✅ | ✅ |
+| Frontmatter | ✅ preserved on save | ✅ shown as properties |
+| Paste screenshots + attachment folder moves | ✅ | — |
+| Cite a note / ask about a selection | ✅ | — |
+| Session & workspace housekeeping | ✅ | — |
+| Backlinks | ❌ | ✅ |
+| Outline pane | ❌ | ✅ |
+| `==highlight==` | ❌ | ✅ |
+
+The point is not "more features" — it is a different trade-off. If you need
+outline and backlinks, use the other plugin (or Obsidian itself); if you want a
+faithful Obsidian reading/editing experience with a clean hand-off into the chat,
+this one is built for that.
+
+## Configuration
+
+Everything lives inside the notes pane; there is no YAML to edit.
+
+### Vault root
+
+`📂` (pick a directory) or `📋` (paste an absolute path) in the notes toolbar.
+The picker and the pasted path are validated: the vault must exist and be a
+directory. Switching the vault clears the currently open note.
+
+### Attachments
+
+The `📎 Attachment location` row in the tree controls where pasted images go:
+
+| Mode | Behaviour |
+| --- | --- |
+| Vault root | The image lands in the vault root. |
+| Fixed folder | The image lands in the configured folder (default `attachments`). |
+| Same folder as note | The image lands next to the note it was pasted into. |
+| Subfolder under note | The image lands in `<note dir>/<subfolder>`. |
+
+Defaults: fixed folder `attachments`, image-only folders hidden from the tree,
+automatic orphan deletion **off** (files are never deleted implicitly). When
+automatic cleanup is enabled, saving a note deletes an attachment only if the
+embed was removed **and** no other note references the file.
+
+Settings are persisted in `$DSH_HOME/dsh-obsidian-vault.json`
+(`$DSH_HOME` defaults to `~/.dsh`).
+
+### Keyboard
+
+- <kbd>Ctrl/Cmd+S</kbd> — save the note being edited.
+- <kbd>Esc</kbd> — close the search box or the ask popup.
+
+## Security and privacy
+
+- **Local only, no telemetry.** The plugin serves everything from the DSH host's
+  own `/obsidian/*` routes. It makes no outbound network requests and contains
+  no analytics. (Links you click in a note are ordinary links; the plugin does
+  not fetch them.)
+- **Behind the DSH auth fence.** The routes are mounted on the DSH web server, so
+  they require the same authenticated session/token as the app. On top of that,
+  every non-image request must carry the plugin's `x-dsh-obsidian: 1` header;
+  image requests are exempt only because `<img>` tags cannot set headers (they
+  are still behind the app's auth).
+- **Vault containment.** Every path that crosses the route boundary is
+  normalized first (absolute paths, `..`, backslashes and drive letters are
+  rejected) and then re-checked with `realpath` against the resolved vault root,
+  so symlinks cannot escape either. Setting the attachment folder outside the
+  vault is rejected with `403`.
+- **Explicit limits.** A single note is capped at 1 MB, a pasted image at
+  20 MB, and a search at 4000 scanned files / 100 results.
+- **Destructive actions are scoped.**
+  - Deleting a note or folder requires confirmation and deletes only the vault
+    entry (folders recursively).
+  - Deleting sessions removes only that session's log directory under
+    `$DSH_HOME/sessions` and its projection cache under `$DSH_HOME/storages`;
+    running sessions (including running subagents) are refused, and symlinked
+    directories are skipped. Archiving is one-way: the log stays on disk.
+  - Deleting a workspace removes its registration and its session logs — the
+    directory and files are kept.
+- **No hidden writes.** The only write paths are: a note save, the attachment
+  upload, attachment folder migration, orphan cleanup (opt-in), and session-log
+  deletion you initiated.
+
+## Compatibility
+
+- **DSH:** verified against **0.2.1-rc.5** (web UI, desktop app shell). The
+  composer integration targets DSH 0.2's Lexical input and falls back to the
+  0.1.x textarea path where possible.
+- **Node.js:** `^22.19 || >=24` (needed only when running the host from source).
+- **OS:** paths are handled with the platform separator; session paths use
+  `$DSH_HOME`. The screenshots above were captured on macOS.
+- **Not rendered** (kept as source text): math, mermaid, footnotes, strikethrough
+  and highlight, tags, raw HTML, note transclusion, audio/PDF embeds, block refs
+  (`^id`), callout folding/unknown types/nested callouts, and some inline
+  emphasis edge cases (`***bold italic***`, nested emphasis, `_` next to text).
+
+## Development
+
+```bash
+npm i             # installs dev deps and builds lib/client.js via prepare
+npm test          # node --test test/*.mjs — offline, no network, no API keys
+npm run build     # rebuild lib/client.js from src/
+npm run check:bundle   # bundle manifest consistency (patch file, module id, files)
+```
+
+Repository layout:
+
+| Path | Purpose |
+| --- | --- |
+| `src/index.js` | Host half: `/obsidian/*` routes, path containment, attachment migration |
+| `src/client.js` | Browser half: sidebar, notes tree, preview dock, session/workspace UI |
+| `src/markdown.js` | Zero-dependency line-numbered Markdown renderer |
+| `src/vault-store.js` | Vault + attachment settings persistence |
+| `src/session-store.js` | Session log discovery and deletion |
+| `lib/client.js` | Build artifact (gitignored; produced by `npm run build`) |
+| `cordis.patch.yml` | The bundle layer inserted by `dsh plugin add` |
+| `tools/demo/` | Isolated demo environment + headless-Chrome asset pipeline (see [tools/demo/README.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/tools/demo/README.md)) |
+| `docs/assets/` | The screenshots and GIF used above |
+
+The plugin never modifies the DSH installation: it only contributes a bundle
+layer plus host/client plugin modules.
+
+Contributions are welcome through pull requests — `main` is protected and only
+the maintainer can push to it. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](https://github.com/revive123456/dsh-obsidian-notes/blob/main/LICENSE). See [README.zh.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/README.zh.md) for the Chinese version and
+[docs/troubleshooting.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/docs/troubleshooting.md) for troubleshooting.

package/README.zh.md

@@ -0,0 +1,201 @@
+# Obsidian Notes for DeepSeek Harness
+
+**DeepSeek Harness Web 的本地 Obsidian 风格笔记面板。** 指向一个 Markdown 文件夹，就能在对话旁边浏览、编辑、搜索、引用笔记 —— 不用装 Obsidian、不用导入，笔记也不会离开这台机器。
+
+![笔记面板演示：打开目录树、阅读 callout 笔记、选中一段文字提问 —— 组合好的 prompt 进入 DSH 输入框、发送后回答出现在对话里](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/hero.gif?v=2)
+
+[![CI](https://github.com/revive123456/dsh-obsidian-notes/actions/workflows/ci.yml/badge.svg)](https://github.com/revive123456/dsh-obsidian-notes/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/revive123456/dsh-obsidian-notes/blob/main/LICENSE)
+![DSH 0.2.1+](https://img.shields.io/badge/DSH-0.2.1%2B-blueviolet)
+
+[English](https://github.com/revive123456/dsh-obsidian-notes/blob/main/README.md) | 中文
+
+---
+
+## 为什么是这一个
+
+DSH 生态里已经有一个 Obsidian 方向的插件
+（[DedsecLemon/dsh-obsidian](https://github.com/DedsecLemon/dsh-obsidian)），
+它适合需要大纲、反链和高亮的人。本插件押的是另外三件事 —— 如果你习惯「一边写笔记、一边和模型讨论」，这三件更重要：
+
+1. **渲染细节本身就是功能。** 预览带行号，并保留 Obsidian 的渲染细节：13 种 callout 类型 + 15 个别名、表格对齐、带语言标签的围栏代码、任务列表、setext 标题；frontmatter 不进编辑器，保存时按原文拼回。
+2. **粘贴的截图不会丢。** 编辑时粘贴图片，host 落盘为 Obsidian 原生引用 `![[Pasted image …]]`；以后迁移附件目录，全库笔记里的引用会一并改写。
+3. **笔记能接进对话。** 整篇引用为 `@绝对路径`；选中一段再提问，注入的内容带文件路径、行号区间和原文。
+
+> **它不做什么：** 没有反链、没有大纲面板、没有关系图，也不渲染数学公式 / mermaid / transclusion。这些是你的刚需就用真 Obsidian（或上面那个插件）。对比在[下方](#对比)写清楚。
+
+## 截图
+
+| 侧边栏笔记树 + 右侧预览 | Callout、行号、类型徽标 |
+| --- | --- |
+| ![侧边栏笔记树与右侧预览](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-sidebar.png) | ![彩色 Obsidian callout，一行源码对应一行渲染](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-callouts.png) |
+
+| 真表格与围栏代码 | 带行号的源码编辑视图 |
+| --- | --- |
+| ![带列对齐的表格与 TypeScript 代码块](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-markdown.png) | ![带行号的编辑器与保存按钮](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-editing.png) |
+
+![选中一段文字提问：路径、行号与原文会随问题一起注入](https://raw.githubusercontent.com/revive123456/dsh-obsidian-notes/main/docs/assets/screenshot-ask.png)
+
+## 安装
+
+**前置要求：** DeepSeek Harness **0.2.1 或更新**（Web UI / 桌面版）。CLI 安装还需要 **pnpm**（`npm i -g pnpm` 或 `corepack enable`）；从源码跑需要 Node.js **`^22.19 || >=24`**。
+
+带 bundle 的插件只在启动时装配，所以**安装后必须重启 DSH host**（桌面版：退出再打开）。只刷新页面不够。
+
+### 1. 桌面版（npm 发布后）
+
+1. 打开 **Settings → Plugins**；
+2. 搜索 **`dsh-obsidian-notes`** 并安装；
+3. 重启 DeepSeek Harness。
+
+> 这条路径要求 npm 上已有该包（目标版本 0.5.0）。搜不到时用下面两种方式。
+
+### 2. CLI（npm 发布后）
+
+```bash
+npm i -g pnpm                                   # `dsh plugin` 会转发给 pnpm
+dsh plugin --profile web add dsh-obsidian-notes
+# 重启 host 后再启动
+dsh web
+```
+
+### 3. 从源码安装（npm 发布前也能用）
+
+```bash
+git clone https://github.com/revive123456/dsh-obsidian-notes.git
+cd dsh-obsidian-notes
+npm i                     # 通过 prepare 跑 build.mjs → 生成 lib/client.js
+dsh plugin --profile web add "$(pwd)"            # PowerShell 用 "$PWD"
+# 重启 `dsh web`
+```
+
+`dsh plugin add` 会把这个包记为 profile 的 bundle，写进
+`$DSH_HOME/profiles/web/package.json`，下次启动时生效。
+
+> 不建议直接用 `github:` 形式安装本仓库：pnpm ≥ 10 默认拦截生命周期
+> (`prepare`) 脚本，生成 `lib/client.js` 的构建步骤会被跳过。请用
+> clone + `npm i` + 安装本地路径。
+
+**卸载：** `dsh plugin --profile web remove dsh-obsidian-notes`，然后重启。若当年是手工改
+`cordis.patch.yml` 装的，见 [docs/legacy-install.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/docs/legacy-install.md)。
+
+### 首次使用
+
+点侧边栏底部的 **📚 笔记**。没有配置 Vault 时先选目录：
+
+- **📂** 打开目录选择器；
+- **📋** 接受一个粘贴的绝对路径。
+
+默认 Vault 为 `$DSH_WORKSPACE/obsidian_vault`，缺省回落到启动 `dsh web` 目录下的
+`./obsidian_vault`。
+
+## 功能
+
+- **Vault 侧边栏**：按需加载的目录树；单击打开笔记，新建 / 重命名 / 删除笔记与文件夹，按标题**和正文**搜索，显示笔记数徽标。
+- **带行号的 Obsidian 预览**：一行源码对应一行渲染并带行号。真表格（支持 `:---` / `:---:` / `---:` 对齐）、带语言标签的围栏代码、嵌套列表与任务列表、`#`～`######` 标题、setext 标题、分隔线、可点击的 `[[双链]]`（含别名与 `#章节`）。
+- **Callout**：`> [!type] 标题` 按类型渲染颜色、图标与徽标。13 种规范类型（`note`、`abstract`、`info`、`todo`、`tip`、`success`、`question`、`warning`、`failure`、`danger`、`bug`、`example`、`quote`）+ 15 个 Obsidian 别名（`summary`、`tldr`、`hint`、`important`、`check`、`done`、`help`、`faq`、`caution`、`attention`、`fail`、`missing`、`error`、`cite`、`none`）。
+- **编辑与保存**：带行号的源码编辑器，点 `保存` 或按 <kbd>Ctrl/Cmd+S</kbd>。YAML frontmatter 不进编辑器，保存时原样拼回；外部对 YAML 的改动不会被覆盖。
+- **粘贴截图**：编辑时 <kbd>Ctrl/Cmd+V</kbd> 把剪贴板图片写入附件目录，并在光标处插入 Obsidian 原生写法 `![[Pasted image <时间戳>.png]]`（单张上限 20 MB），写进 `.md` 的内容可被真实 Obsidian 识别。
+- **附件目录管理**：四种位置模式（Vault 根 / 固定目录 / 与笔记同目录 / 笔记目录下子目录）、目录树隐藏纯图片目录、可选孤儿附件清理。修改目录会移动已有截图并改写全库笔记引用。
+- **引用与提问**：`⤴ 引用到对话` 把 `@绝对路径` 注入输入框（注入不了时复制到剪贴板）；在预览或编辑器中选中文字会出现 **💬 提问 / ⚡ 解释** 浮动条，注入内容包含绝对路径、行号区间、原文（≤1500 字符）和你的问题。
+- **会话与工作区整理**：重命名 / 归档 / 彻底删除会话；批量勾选会话（归档、彻底删除）或工作区（删除注册项及其会话日志）；日志已不存在的行会被隐藏而不是复活。运行中的会话拒绝删除；删除工作区不碰目录和文件。
+- **可停靠面板**：预览面板可拖动、可调宽，宽度会被记住；预览每 3 秒探测文件 mtime，磁盘上的改动会自动刷新。
+
+界面中英双语，使用 DSH 主题变量，跟随应用的浅色 / 深色主题。
+
+## 对比
+
+| | 本插件 | [DedsecLemon/dsh-obsidian](https://github.com/DedsecLemon/dsh-obsidian) |
+| --- | --- | --- |
+| Vault 目录树、搜索 | ✅ 目录树 + 标题/正文搜索 | ✅ 目录树 + 全库命中行搜索 |
+| Obsidian callout | ✅ 13 种类型 + 15 别名，逐行渲染 | ✅ 渲染，保留折叠状态 |
+| 表格、围栏代码、setext 标题 | ✅ | ✅ |
+| frontmatter | ✅ 保存时原样拼回 | ✅ 以属性区展示 |
+| 粘贴截图 + 附件目录迁移 | ✅ | — |
+| 整篇引用 / 选中片段提问 | ✅ | — |
+| 会话与工作区整理 | ✅ | — |
+| 反链 | ❌ | ✅ |
+| 大纲面板 | ❌ | ✅ |
+| `==高亮==` | ❌ | ✅ |
+
+比的不是「功能多少」，而是取舍：需要大纲和反链，用另一个插件（或真 Obsidian）；想要忠实的 Obsidian 阅读/编辑体验、并顺手把笔记递进对话，这个插件就是为此写的。
+
+## 配置
+
+所有配置都在笔记面板里完成，不用手改 YAML。
+
+### Vault 根目录
+
+笔记工具栏的 `📂`（选目录）或 `📋`（粘贴绝对路径）。目录必须存在且是目录；切换 Vault 会清空当前打开的笔记。
+
+### 附件
+
+目录树里的 `📎 Attachment location` 行控制粘贴图片的落盘位置：
+
+| 模式 | 行为 |
+| --- | --- |
+| Vault 根 | 图片落在 Vault 根目录。 |
+| 固定目录 | 图片落在配置的目录（默认 `attachments`）。 |
+| 与笔记同目录 | 图片落在被粘贴笔记所在目录。 |
+| 笔记目录下子目录 | 图片落在 `<笔记目录>/<子目录>`。 |
+
+默认值：固定目录 `attachments`、目录树隐藏纯图片目录、自动清理孤儿附件**关闭**（不会隐式删文件）。打开自动清理后，只有「这次保存移除了引用」且「没有其它笔记引用」的附件才会被删。
+
+设置持久化在 `$DSH_HOME/dsh-obsidian-vault.json`（`$DSH_HOME` 缺省 `~/.dsh`）。
+
+### 快捷键
+
+- <kbd>Ctrl/Cmd+S</kbd>：保存正在编辑的笔记。
+- <kbd>Esc</kbd>：关闭搜索框或提问浮层。
+
+## 安全与隐私
+
+- **纯本地、无遥测。** 所有能力都由 DSH host 自己的 `/obsidian/*` 路由提供；插件不发起任何外网请求，也不含统计埋点。（笔记里点链接是普通链接；插件不会去抓取。）
+- **在 DSH 鉴权之后。** 路由挂在 DSH web server 上，需要和应用相同的已认证会话/token。除此之外，所有非图片请求还必须带插件自己的 `x-dsh-obsidian: 1` 头；图片请求豁免只因为 `<img>` 无法带自定义头（它同样在应用鉴权之后）。
+- **Vault 包含性校验。** 跨越路由边界的每个路径先做词法规范化（绝对路径、`..`、反斜杠、盘符一律拒绝），再用 `realpath` 对真实 Vault 根做一次包含性校验，符号链接也逃不出去。把附件目录设到 Vault 之外会被 `403` 拒绝。
+- **明确的限额。** 单篇笔记上限 1 MB，粘贴图片上限 20 MB，搜索最多扫描 4000 个文件、返回 100 条。
+- **破坏性操作有边界。**
+  - 删除笔记/文件夹需确认，且只删 Vault 内的条目（文件夹递归）。
+  - 删除会话只删该会话在 `$DSH_HOME/sessions` 下的日志目录与 `$DSH_HOME/storages` 下的投影缓存；运行中的会话（含运行中子代理）拒绝删除，符号链接目录一律跳过。归档是单向的：日志保留在磁盘。
+  - 删除工作区 = 删注册项 + 该工作区的会话日志，目录和文件保留。
+- **没有隐式写入。** 唯一的写路径是：保存笔记、上传附件、附件目录迁移、孤儿清理（需显式开启）、以及你主动发起的会话日志删除。
+
+## 兼容性
+
+- **DSH：** 已对照 **0.2.1-rc.5** 验证（Web UI、桌面版外壳）。composer 集成面向 DSH 0.2 的 Lexical 输入框，并保留 0.1.x textarea 的降级路径。
+- **Node.js：** `^22.19 || >=24`（仅从源码运行 host 时需要）。
+- **系统：** 路径按平台分隔符处理，会话路径基于 `$DSH_HOME`。上面的截图在 macOS 上录制。
+- **不渲染（保持原文显示）**：数学公式、mermaid、脚注、删除线/高亮、标签、裸 HTML、笔记 transclusion、音频/PDF 嵌入、块引用 `^id`、callout 折叠/未知类型/嵌套，以及部分行内强调边界（`***粗斜体***`、嵌套强调、`_` 相邻文本）。
+
+## 开发
+
+```bash
+npm i             # 安装 dev 依赖，并通过 prepare 构建 lib/client.js
+npm test          # node --test test/*.mjs —— 离线、不联网、不需要 API Key
+npm run build     # 从 src/ 重新构建 lib/client.js
+npm run check:bundle   # bundle 清单一致性（patch 文件、module id、files）
+```
+
+仓库结构：
+
+| 路径 | 作用 |
+| --- | --- |
+| `src/index.js` | host 半边：`/obsidian/*` 路由、路径包含性、附件迁移 |
+| `src/client.js` | 浏览器半边：侧边栏、笔记树、预览 Dock、会话/工作区 UI |
+| `src/markdown.js` | 零依赖、带行号的 Markdown 渲染器 |
+| `src/vault-store.js` | Vault 与附件设置的持久化 |
+| `src/session-store.js` | 会话日志发现与删除 |
+| `lib/client.js` | 构建产物（gitignore；由 `npm run build` 生成） |
+| `cordis.patch.yml` | `dsh plugin add` 安装后生效的 bundle 层 |
+| `tools/demo/` | 隔离 demo 环境 + 无头 Chrome 资产生成流程（见 [tools/demo/README.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/tools/demo/README.md)） |
+| `docs/assets/` | 上面用到的截图与 GIF |
+
+插件不修改 DSH 安装本身：只贡献一个 bundle 层和 host/client 插件模块。
+
+欢迎通过 PR 贡献 —— `main` 已开启分支保护，只有维护者能直接 push。见
+[CONTRIBUTING.md](CONTRIBUTING.md)。
+
+## 许可
+
+[MIT](https://github.com/revive123456/dsh-obsidian-notes/blob/main/LICENSE)。英文版见 [README.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/README.md)，排障见
+[docs/troubleshooting.zh.md](https://github.com/revive123456/dsh-obsidian-notes/blob/main/docs/troubleshooting.zh.md)。

package/cordis.patch.yml

@@ -0,0 +1,11 @@
+# dsh-obsidian-notes 的组合层（bundle layer）。
+#
+# profile 的 package.json 在 dsh.profile.bundles 里列出本包名后，启动器按顺序
+# 叠加各 bundle 的 patch 文件；本文件把插件行插入组合树。行字段含义：
+#   - id：组合内唯一的行 id，profile/用户的 patch 层用它覆盖本行；
+#   - name：Node 模块标识符，即 npm 包名，启动器据此解析到本包的 host 入口。
+# id 与 name 都写包名：一旦 npm 包名迁移，这里和 build.mjs 的 client module id
+# 必须一起改（test/bundle-manifest.mjs 会离线断言三者一致）。
+- insert:
+    - id: dsh-obsidian-notes
+      name: dsh-obsidian-notes