dsh-openwrite 0.2.20 → 0.2.22

package/README.md

@@ -29,12 +29,12 @@
 
 ## 快速安装
 
-**0.2.20 标准插件包**兼容精确 dsh 版本 **0.1.2-rc.1 / 0.1.5-alpha.1 / 0.2.0-rc.2**。三个版本均已完成 Web 工作台渲染与 DoG 数据读取验证，Windows Electron 桌面端启动/恢复链路尚未实机复测。可下载版本、各平台验收结果和 SHA-256 以 [GitHub Release](https://github.com/LiPu-jpg/Openwrite/releases/latest) 附件为准；验收方法见 [发布验收](docs/RELEASE_ACCEPTANCE.md)。默认使用 npm `latest` 渠道；商城所需的精确预览版兼容性、验证范围和安装限制见 [DSH STORE 接入](docs/DSH_STORE.md)。
+**0.2.21 标准插件包**兼容精确 dsh 版本 **0.1.2-rc.1 / 0.1.5-alpha.1 / 0.2.0-rc.2**。三个版本均已完成 Web 工作台渲染与 DoG 数据读取验证，Windows Electron 桌面端启动/恢复链路尚未实机复测。可下载版本、各平台验收结果和 SHA-256 以 [GitHub Release](https://github.com/LiPu-jpg/Openwrite/releases/latest) 附件为准；验收方法见 [发布验收](docs/RELEASE_ACCEPTANCE.md)。默认使用 npm `latest` 渠道；商城所需的精确预览版兼容性、验证范围和安装限制见 [DSH STORE 接入](docs/DSH_STORE.md)。
 
 npm 包和对应 GitHub Release 使用同一份验收产物。也可安装精确版本的 Release 包：
 
 ```sh
-dsh plugin --profile web add -w https://github.com/LiPu-jpg/Openwrite/releases/download/v0.2.20/dsh-openwrite-0.2.20.tgz
+dsh plugin --profile web add -w https://github.com/LiPu-jpg/Openwrite/releases/download/v0.2.21/dsh-openwrite-0.2.21.tgz
 dsh web
 ```
 
@@ -64,6 +64,8 @@ dsh web
 
 ### dsh 0.2 桌面端升级
 
+`0.2.21` 修复 [#79](https://github.com/LiPu-jpg/Openwrite/issues/79) 的 Windows Desktop 目录选择：宿主接口失败后使用桌面提供的系统文件夹对话框，覆盖侧栏进入与工作台内目录选择。Core 保持 5.8.10。排查与手填路径方式见 [安装指南](docs/INSTALL.md#windows-desktop-目录选择)。
+
 `0.2.20` 捆绑 Core 5.8.10，修复 [#76](https://github.com/LiPu-jpg/Openwrite/issues/76) 的草稿恢复、任务状态、编辑和审稿契约，并补充 [#65](https://github.com/LiPu-jpg/Openwrite/issues/65) 的英文使用支持。行为与范围见 [修复说明](docs/ISSUE_76_REPAIRS.md)。正式可下载版本以 npm `latest` 和 GitHub Release 为准。
 
 `0.2.19` 候选包修复两个加载/工具问题：部分安装下「OpenWrite 创作」预设从列表消失、DoG 工具不可用（dsh-dog 宿主包解析失败，[#74](https://github.com/LiPu-jpg/Openwrite/issues/74)），以及 `novel_*` 工具的对象/数组参数在模型输出 JSON 字符串时预览失败、`data` 字段丢失（[#75](https://github.com/LiPu-jpg/Openwrite/issues/75)）。正式可下载版本以 npm `latest` 和 GitHub Release 为准。升级后需停止并重新启动 dsh，再刷新浏览器页面。
@@ -84,7 +86,7 @@ dsh web
 
 `0.2.11` 修复 [#45](https://github.com/LiPu-jpg/Openwrite/issues/45)，适配精确宿主版本 `0.2.0-rc.2`：工作台兼容新的 turn-tail list 槽位，DoG 调试面板使用新的 `sessionStatus`；根包和所有子包的兼容声明同步更新。已验证 0.2.0-rc.2 的 Web 客户端启动、OpenWrite 入口、DoG 面板及其他插件共存；Windows Electron 桌面端恢复链路尚未实机复测。
 
-**`dsh-openwrite@0.2.10` 不包含这项修复，请升级到 `0.2.13` 的 GitHub Release 包。** 不要通过给旧子包授权来代替升级：`dsh-openwrite` 的版本豁免不会覆盖 `@dsh-novel/studio-panel@<ver>` 和 `@dsh-external/dsh-dog@<ver>`，而旧客户端在 0.2.0-rc.2 上激活失败可能触发桌面端的 profile 恢复。
+**`dsh-openwrite@0.2.10` 不包含这项修复，请升级到 `0.2.21` 的 GitHub Release 包。** 不要通过给旧子包授权来代替升级：`dsh-openwrite` 的版本豁免不会覆盖 `@dsh-novel/studio-panel@<ver>` 和 `@dsh-external/dsh-dog@<ver>`，而旧客户端在 0.2.0-rc.2 上激活失败可能触发桌面端的 profile 恢复。
 
 若已发生恢复，先关闭桌面端并备份当前 profile，再从自己的 `cordis.patch.yml.bak-*` 备份恢复 patch，同时恢复原 `package.json` 的 `dsh.profile.bundles` 列表。安装包和作品目录通常仍在；不要用出厂模板覆盖其他插件配置。详细排查见 [安装指南](docs/INSTALL.md#dsh-02-客户端兼容排查)。
 

package/cordis.patch.yml

@@ -1,12 +1,3 @@
-# 0.2's carrier-neutral Connection does not require webServer itself, but its
-# custom RPC channel registrar reads that service from its declaring context.
-# OpenWrite targets Web/Desktop, where the carrier is present; declare it here
-# so authenticated DoG RPC channels can register without changing transport.
-- id: connection
-  inject:
-    - webRuntime
-    - webServer
-
 - insert:
     - id: openwrite-bundle
       name: dsh-openwrite

package/docs/INSTALL.md

@@ -2,6 +2,12 @@
 
 安装已发布的版本；可下载产物、SHA-256 和实际平台结果以 [GitHub Release](https://github.com/LiPu-jpg/Openwrite/releases/latest) 附件为准。验收方法见 [验收报告](RELEASE_ACCEPTANCE.md)。
 
+## Windows Desktop 目录选择
+
+若留空作品目录并点击“选择目录并进入”时出现 `directoryPicker.pick needs the native capability; the composed picker serves "browse"`，这是桌面宿主组合的目录选择能力与其接口要求不一致。OpenWrite 0.2.21 在宿主接口失败后调用桌面公开的 `__DSH_DESKTOP_PICK_DIRECTORY__`，覆盖侧栏进入、作品绑定、新建与恢复目录选择。取消目录对话框不会创建作品或会话；手填绝对路径仍可直接进入。
+
+没有桌面选择通道的宿主会保留原始错误。此时可在同一个输入框填写作品的完整绝对路径，例如 `A:\AI\我的小说`，点击“进入作品”。升级插件后需要关闭并重新打开 DSH Desktop，使客户端重新加载。
+
 ## 标准安装
 
 本次锁定 dsh `0.1.2-rc.1`，Node 24 为完整验收基线；Node 22.19 / 26 做兼容检查。安装不自动升级 dsh。先执行 `dsh --version` 核对宿主。

package/docs/RELEASE_ACCEPTANCE.md

@@ -6,6 +6,29 @@
 
 新建作品的验收请求最多等待 60 秒（原为 15 秒），保留成功耗时和失败诊断；不重试写请求，超时仍失败。此调整容纳慢速运行器，不代表初始化耗时问题已被修复。
 
+## 0.2.21
+
+[GitHub Release](https://github.com/LiPu-jpg/Openwrite/releases/tag/v0.2.21) 与 npm `dsh-openwrite@0.2.21` 已发布，npm `latest` 已更新到 0.2.21。使用[主分支完整 CI](https://github.com/LiPu-jpg/Openwrite/actions/runs/38444848871) 验收的原始产物，来源提交 `4e5f88aac8b14c2402c509b2282810cc85840129`，npm 包 SHA-256 为 `b53e3638308185b5890207bc01806641a966620915b99102f5cb35c462b1daee`。8 份安装报告与 3 份宿主客户端报告全部通过；GitHub 四份附件逐一与 CI 原文件比对一致，官方 npm registry 无认证下载包的字节与 SHA-256 也一致。
+
+修复 [#79](https://github.com/LiPu-jpg/Openwrite/issues/79)，合并来源 [PR #80](https://github.com/LiPu-jpg/Openwrite/pull/80)。Windows Desktop 宿主目录接口失败后，插件使用桌面公开的系统目录选择通道；侧栏进入和工作台内所有目录选择共用入口。宿主取消不触发第二个对话框，桌面取消不创建作品/会话，手填路径跳过选择器，没有桌面能力时保留原始错误。Core 保持 5.8.10，wheel 与 requirements.lock 未变。
+
+`npm run check:plugin` 全部通过（298 项组件测试）。新增回归直接对正式 0.2.20 客户端复现同一错误，修复后的客户端通过；从本版主分支 CI 包提取客户端执行相同回归也通过。正式发布构建在打包前执行该回归。回归覆盖宿主优先、两种取消、首次进入、共享入口、缺失/无效桌面能力、桌面对话框失败和手填路径。
+
+本版原生 Windows 安装与浏览器检查运行在 Web profile；Windows Electron 系统文件夹对话框的实机复测未计为通过。目录通道的名称与返回契约已对照桌面上游源码，安装指南补充排查及手填路径方式。升级后需关闭并重新打开 DSH Desktop，重新加载客户端。真实模型调用为 0。
+
+## 0.2.20
+
+[GitHub Release](https://github.com/LiPu-jpg/Openwrite/releases/tag/v0.2.20) 与 npm `dsh-openwrite@0.2.20` 已发布，npm `latest` 已更新到 0.2.20。使用[主分支完整 CI](https://github.com/LiPu-jpg/Openwrite/actions/runs/38296670387) 验收的同一份原始产物，来源提交 `4d54f3c619f853a4243cd60e67ef6c8ba8d336af`，npm 包 SHA-256 为 `486c20fbd36909e32cc6cac1fd1e734872abec53da749c0860f8e5e1d4cf6cda`。六组原生平台/Node、源码安装与 alpha 兼容共 8 份运行报告、三代宿主客户端 3 份报告全部通过；GitHub 四份附件逐一与 CI 原文件比对一致，从官方 npm registry 无认证重新下载后，包字节及 SHA-256 也一致。
+
+修复 [#76](https://github.com/LiPu-jpg/Openwrite/issues/76) 与 [#65](https://github.com/LiPu-jpg/Openwrite/issues/65)，合并来源为引擎 [PR #77](https://github.com/LiPu-jpg/Openwrite/pull/77) 和插件 [PR #78](https://github.com/LiPu-jpg/Openwrite/pull/78)。捆绑 Core 5.8.10，wheel 来源提交 `18a500015f5d5da00f2f4d5ccd2325b084fed24b` 已包含在合并后的 native-core 分支；wheel SHA-256 为 `f121410300c7e7c55d594d0b8d7f4da41f8a17f0dfb5dc3b195e447b618bfd4d`。
+
+- 生成后提交失败保留正文与恢复句柄；恢复提交复用已有草稿。写章返回持久化 task_id，忙碌延后、取消请求与终态分离，传输错误可追踪。
+- 统一字数目标，补齐验收恢复、批量与字段级编辑、精确文本/换行保护、完整审稿覆盖与硬检查、正文结构及推理污染检查、审稿历史。
+- persona 和所有技能入口跟随作者语言；运行环境与任务状态提供英文，Studio 错误附带英文说明和错误码。
+- Core 全套 pytest 1397 passed / 32 skipped，专项回归 21 passed。本地 macOS arm64 真实候选包安装、生命周期及浏览器验收通过；正式包以以上主分支 CI 报告为准。真实模型写作未实测，不计为通过。
+
+恢复步骤与明确的范围见 [修复说明](ISSUE_76_REPAIRS.md)。跨章聚合与逾期伏笔硬阻断按 issue 允许的方案声明职责范围，本版未新增这些功能。
+
 ## 0.2.19
 
 [GitHub Release](https://github.com/LiPu-jpg/Openwrite/releases/tag/v0.2.19) 已发布，直接使用[完整 CI](https://github.com/LiPu-jpg/Openwrite/actions/runs/38167325137) 验收的同一份包。来源提交 `e0c1ab7`，npm 包 SHA-256 为 `97f89586e4c43071ebca67abd5af1df1ae42b637cf6637d4fc26ca31c133d784`。六组原生平台/Node、源码安装与 alpha 兼容共 8 份运行报告、三代宿主客户端 3 份报告全部通过；Release 四份附件的校验值已与 CI `validated-release` 产物逐一核对。npm `dsh-openwrite@0.2.19` 已发布到官方 registry（registry.npmjs.org），`latest` 已更新到 0.2.19；从官方 registry 无认证重新下载后，SHA-256 与上述 CI 包一致。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-openwrite",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "OpenWrite 长篇小说领域后端接入 DeepSeek Harness：统一创作 Agent 预设 + 原生创作工作台",
   "type": "module",
   "scripts": {

package/packages/openwrite-bridge/lib/managed-runtime.d.ts

@@ -104,6 +104,23 @@ export declare class ManagedRuntime {
     private queueRestart;
     private recover;
     private download;
+    /**
+     * Restricted networks throttle single connections to GitHub releases to a
+     * few dozen KB/s, so a fixed total timeout can never finish a 23 MB runtime
+     * archive (OpenWrite issue #82). Try the origin first, then optional mirror
+     * prefixes; every candidate is verified against the manifest checksum, so a
+     * mirror cannot substitute content. OPENWRITE_DOWNLOAD_MIRRORS overrides the
+     * prefix list (empty disables mirrors); the slow-start window uses
+     * OPENWRITE_DOWNLOAD_SLOW_MS / OPENWRITE_DOWNLOAD_SLOW_BYTES.
+     */
+    private downloadInto;
+    /**
+     * One download attempt against a single source. A source that stays below
+     * the byte threshold through the grace window is abandoned for the next
+     * candidate, and a transfer that stops progressing is cut by an idle
+     * timeout — there is deliberately no total-duration cap.
+     */
+    private downloadFrom;
     private extract;
     private command;
     private lock;

package/packages/openwrite-bridge/lib/managed-runtime.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { createReadStream } from 'node:fs';
-import { chmod, mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, open, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
 import { spawn } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
@@ -12,6 +12,8 @@ export const DEFAULT_RESTART_LIMIT = 5;
 export const DEFAULT_BACKOFF_MS = [1_000, 2_000, 4_000, 8_000, 16_000];
 /** Budget for the per-request liveness probe of a previously-ready backend. */
 const HEALTH_PROBE_TIMEOUT_MS = 1_500;
+/** A download with no progress for this long is cut and retried on the next source. */
+const DOWNLOAD_IDLE_TIMEOUT_MS = 30_000;
 /** The backend stderr log on disk keeps only the newest chunk. */
 const STDERR_LOG_LIMIT = 64 * 1024;
 /**
@@ -63,6 +65,13 @@ const ALLOWED_ENV = new Set([
     'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'LANGUAGE', 'TZ',
     'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY', 'http_proxy', 'https_proxy', 'no_proxy', 'all_proxy',
     'SSL_CERT_FILE', 'SSL_CERT_DIR', 'REQUESTS_CA_BUNDLE', 'CURL_CA_BUNDLE',
+    // Package-index overrides let authors on restricted networks point the
+    // installer at a mirror (OpenWrite issue #82). uv reads UV_* variables only;
+    // PIP_* covers pip itself. UV_NO_CONFIG stays set so stray config files
+    // cannot change the locked dependency set — environment variables still
+    // apply, which is exactly the supported escape hatch.
+    'UV_DEFAULT_INDEX', 'UV_INDEX_URL', 'UV_INDEX', 'UV_HTTP_TIMEOUT',
+    'PIP_INDEX_URL', 'PIP_EXTRA_INDEX_URL', 'PIP_TRUSTED_HOST', 'PIP_DEFAULT_TIMEOUT',
 ]);
 export async function sha256(file) {
     const hash = createHash('sha256');
@@ -364,19 +373,86 @@ export class ManagedRuntime {
         const destination = join(cache, item.sha256);
         if (await sha256(destination).catch(() => '') === item.sha256)
             return destination;
+        // A host killed mid-download leaves .partial fragments that are never
+        // resumed (observed in OpenWrite issue #82); clear them before starting.
+        for (const entry of await readdir(cache))
+            if (entry.endsWith('.partial'))
+                await rm(join(cache, entry), { force: true });
         const partial = destination + '.' + randomUUID() + '.partial';
         this.update('downloading', 'Downloading and verifying the writing environment');
         try {
-            const response = await fetch(item.url, { signal: AbortSignal.any([signal, AbortSignal.timeout(600_000)]) });
+            await this.downloadInto(item, partial, signal);
+            await rename(partial, destination);
+            return destination;
+        }
+        finally {
+            await rm(partial, { force: true });
+        }
+    }
+    /**
+     * Restricted networks throttle single connections to GitHub releases to a
+     * few dozen KB/s, so a fixed total timeout can never finish a 23 MB runtime
+     * archive (OpenWrite issue #82). Try the origin first, then optional mirror
+     * prefixes; every candidate is verified against the manifest checksum, so a
+     * mirror cannot substitute content. OPENWRITE_DOWNLOAD_MIRRORS overrides the
+     * prefix list (empty disables mirrors); the slow-start window uses
+     * OPENWRITE_DOWNLOAD_SLOW_MS / OPENWRITE_DOWNLOAD_SLOW_BYTES.
+     */
+    async downloadInto(item, partial, signal) {
+        const grace = Number(process.env['OPENWRITE_DOWNLOAD_SLOW_MS'] ?? 12_000);
+        const threshold = Number(process.env['OPENWRITE_DOWNLOAD_SLOW_BYTES'] ?? 524_288);
+        const prefixes = (process.env['OPENWRITE_DOWNLOAD_MIRRORS'] ?? 'https://gh-proxy.com/')
+            .split(',').map(prefix => prefix.trim()).filter(Boolean);
+        const candidates = [item.url, ...prefixes.map(prefix => prefix + item.url)];
+        const failures = [];
+        for (const candidate of candidates) {
+            signal.throwIfAborted();
+            try {
+                await this.downloadFrom(candidate, partial, signal, grace, threshold);
+                if (await sha256(partial) !== item.sha256)
+                    throw new Error('checksum mismatch');
+                return;
+            }
+            catch (error) {
+                signal.throwIfAborted();
+                let host = candidate;
+                try {
+                    host = new URL(candidate).host;
+                }
+                catch { /* keep the raw candidate */ }
+                failures.push(`${host}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        throw new Error(`Download failed (${failures.join('; ')}); retry`);
+    }
+    /**
+     * One download attempt against a single source. A source that stays below
+     * the byte threshold through the grace window is abandoned for the next
+     * candidate, and a transfer that stops progressing is cut by an idle
+     * timeout — there is deliberately no total-duration cap.
+     */
+    async downloadFrom(url, partial, signal, grace, threshold) {
+        const controller = new AbortController();
+        const started = Date.now();
+        let received = 0;
+        let lastChunkAt = started;
+        const watchdog = setInterval(() => {
+            if (Date.now() - lastChunkAt > DOWNLOAD_IDLE_TIMEOUT_MS)
+                controller.abort(new Error(`stalled (no data for ${DOWNLOAD_IDLE_TIMEOUT_MS}ms)`));
+            else if (received < threshold && Date.now() - started > grace)
+                controller.abort(new Error(`too slow (${received} of ${threshold} bytes within ${grace}ms)`));
+        }, 250);
+        try {
+            const response = await fetch(url, { signal: AbortSignal.any([signal, controller.signal]) });
             if (!response.ok || !response.body)
-                throw new Error(`Download failed: HTTP ${response.status}`);
+                throw new Error(`HTTP ${response.status}`);
             const size = Number(response.headers.get('content-length')) || undefined;
-            const file = await open(partial, 'wx', 0o600);
-            let received = 0;
+            const file = await open(partial, 'w', 0o600);
             try {
                 for await (const chunk of response.body) {
                     signal.throwIfAborted();
                     received += chunk.length;
+                    lastChunkAt = Date.now();
                     if (received > 1024 ** 3)
                         throw new Error('Download exceeds the allowed size');
                     await file.write(chunk);
@@ -386,13 +462,9 @@ export class ManagedRuntime {
             finally {
                 await file.close();
             }
-            if (await sha256(partial) !== item.sha256)
-                throw new Error('Download checksum failed; retry');
-            await rename(partial, destination);
-            return destination;
         }
         finally {
-            await rm(partial, { force: true });
+            clearInterval(watchdog);
         }
     }
     async extract(item, signal) {