dsh-plugin-guide 0.3.42 → 0.4.1

package/references/official-docs/docs/user/guide/index.md

@@ -1,31 +0,0 @@
-# Use the Web UI
-
-English | [中文](index.zh.md)
-
-Start the Web UI through the [root README](../../../README.md#run); the command prints its URL. This guide begins after that server is running. The `dsh` process uses its invoking directory as the default filesystem location, but a fresh Web UI has no selected workspace until you add one.
-
-## Configure a model
-
-Open **Settings → Models**, enter a [DeepSeek API key](https://platform.deepseek.com/), and save it. The model route becomes usable immediately without restarting the server.
-
-The [model configuration guide](./providers.md) covers other providers and custom OpenAI-compatible endpoints.
-
-## Choose a workspace
-
-Click **Choose workspace**, add the project directory where you started `dsh`, and select it. The session composer remains unavailable until a workspace is selected.
-
-## Run a task
-
-Start a session and send:
-
-> Summarize this repository and identify its main packages.
-
-The agent can read and edit workspace files, run commands, delegate work, and maintain a plan. The Web UI asks before operations that require approval under the active permission policy.
-
-## Continue
-
-- [Configure models](./providers.md)
-- [Use the Python SDK](./python-sdk.md)
-- [Publish the Web UI behind a reverse proxy](./public-deployments.md)
-- [Use other CLI modes](../../../apps/cli/README.md)
-- [Develop a plugin](../develop/basic/index.md)

package/references/official-docs/docs/user/guide/index.zh.md

@@ -1,31 +0,0 @@
-# 使用 Web UI
-
-[English](index.md) | 中文
-
-请先按照[根目录 README](../../../README.zh.md#run) 中的说明启动 Web UI；命令会打印其访问地址。本指南从服务器已经运行的状态开始。`dsh` 进程会把启动时所在的目录作为默认文件系统位置；全新的 Web UI 则不会选中任何工作区，你需要添加一个工作区。
-
-## 配置模型
-
-打开**设置 → 模型**，输入 [DeepSeek API 密钥](https://platform.deepseek.com/)并保存。模型路由会立即可用，不需要重启服务器。
-
-[模型配置指南](./providers.zh.md)介绍其他提供方和自定义 OpenAI 兼容端点。
-
-## 选择工作区
-
-点击**选择工作区**，添加启动 `dsh` 时所在的项目目录，然后选中它。选中工作区前，会话输入框不可用。
-
-## 运行任务
-
-启动一个会话并发送：
-
-> Summarize this repository and identify its main packages.
-
-Agent（智能体）可以读取和编辑工作区文件、运行命令、委派工作并维护计划。如果根据当前权限策略，某项操作需要审批，Web UI 会先询问你。
-
-## 继续使用
-
-- [配置模型](./providers.zh.md)
-- [使用 Python SDK](./python-sdk.zh.md)
-- [在反向代理之后发布 Web UI](./public-deployments.zh.md)
-- [使用其他 CLI 模式](../../../apps/cli/README.zh.md)
-- [开发插件](../develop/basic/index.zh.md)

package/references/official-docs/docs/user/guide/mcp-memory.i18n.yaml

@@ -1,37 +0,0 @@
-# Bilingual-pair consistency record for mcp-memory.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write docs/user/guide/mcp-memory.md
-/connect-a-third-party-memory-mcp-server:
-  en: afc73e9b4fb4108f
-  zh: c8a5a903adf8bcc5
-/connect-a-third-party-memory-mcp-server/what-dsh-does:
-  en: ea9b47af91d7c6d2
-  zh: 7a592ba5461625e3
-/connect-a-third-party-memory-mcp-server/choose-one:
-  en: 257a536ce62bc959
-  zh: 600ed7ccf29085e4
-/connect-a-third-party-memory-mcp-server/enable-one:
-  en: 4655ee4df53b3682
-  zh: 344948464e64dc83
-/connect-a-third-party-memory-mcp-server/provider-setup:
-  en: ea88b3912a142edc
-  zh: aaccbb2fb9a851a4
-/connect-a-third-party-memory-mcp-server/provider-setup/memorix:
-  en: 59991df2616ac49c
-  zh: f1f99103e19b21a3
-/connect-a-third-party-memory-mcp-server/provider-setup/mcp-reference-memory:
-  en: 74653857786286ea
-  zh: 00df52de24d231a8
-/connect-a-third-party-memory-mcp-server/provider-setup/engram:
-  en: f45eb35678140a98
-  zh: 192c7887fb6462e4
-/connect-a-third-party-memory-mcp-server/optional-shared-model-instruction:
-  en: 9ab6aa5481f8dc72
-  zh: e1e196bf2704c259
-/connect-a-third-party-memory-mcp-server/verify-write-fresh-session-recall-and-use:
-  en: e869c2a95eff307a
-  zh: bfb26f6719c61c62
-/connect-a-third-party-memory-mcp-server/bring-another-mcp-server:
-  en: a64eb09726e63a83
-  zh: 83838d5f27f51d22

package/references/official-docs/docs/user/guide/mcp-memory.md

@@ -1,101 +0,0 @@
-# Connect a third-party memory MCP server
-
-English | [中文](mcp-memory.zh.md)
-
-These three **default-off reference configurations** connect one memory system to DSH through [`@deepseek-ai/dsh-mcp-client`](../../../packages/mcp/mcp-client/README.md). Pick one, or copy the same generic MCP row for another server.
-
-These third-party configurations are provided as interoperability examples only. Their inclusion does not imply endorsement, recommendation, partnership, or ongoing support by DeepSeek.
-
-## What DSH does
-
-DSH parses the selected Cordis overlay, starts a configured stdio command or connects to a configured Streamable HTTP URL, discovers MCP tools, and exposes them as `mcp__<serverName>__<tool>`. DSH does **not** download the server, initialize its database, choose its model or embedding provider, create a cloud account, migrate vendor data, or supervise a separate HTTP service. For stdio, the generic client launches and stops the child with the DSH plugin lifecycle; for HTTP, the upstream service must already be running.
-
-The stdio bridge deliberately removes ambient variables whose names usually identify credentials and all `DSH_*` variables before launching a child; other ambient variables remain inherited. Each example adds only the baseline override it needs. If an optional upstream feature needs another secret, add that variable to the row's `config.env` instead of putting the secret directly in YAML.
-
-## Choose one
-
-| System | Tested pin | Transport | Upstream prerequisite |
-|---|---:|---|---|
-| [Memorix](https://github.com/AVIDS2/memorix) | `memorix@1.3.0` (`500792cad3144142293bfbb20acb4841c9f7fcfa`) | stdio | Node 22.18+ and `npm install --global memorix@1.3.0` |
-| [MCP Reference Memory](https://github.com/modelcontextprotocol/servers/tree/main/src/memory) | `@modelcontextprotocol/server-memory@2026.7.4` (`6dd0a683e198783e30feabf7abaf42f925bd18b1`) | stdio | `npm install --global @modelcontextprotocol/server-memory@2026.7.4` |
-| [Engram](https://github.com/Gentleman-Programming/engram) | `v1.20.0` (`ba9e46ced152c37a7cb9e576153c41995873e2fc`) | stdio | Go 1.25.10+ and `go install github.com/Gentleman-Programming/engram/cmd/engram@v1.20.0`, or the matching release binary |
-
-## Enable one
-
-Pass one overlay to DSH:
-
-```sh
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/memorix.cordis.yml"
-```
-
-Replace the filename with `mcp-reference-memory.cordis.yml` or `engram.cordis.yml`. The path may point to a copied file anywhere on disk. No memory server is present in the shipped composition, so omitting `--patch` keeps all three disabled.
-
-To keep the selection across runs, merge the chosen file's single `insert` patch into a user patch layer — `$DSH_HOME/profiles/<name>/cordis.patch.yml` for one profile, or `$DSH_HOME/cordis.patch.yml` for every profile on the machine. Do not copy over an existing file: it may already contain unrelated user patches.
-
-## Provider setup
-
-### Memorix
-
-```sh
-npm install --global memorix@1.3.0
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/memorix.cordis.yml"
-```
-
-Memorix works in local heuristic mode without an LLM or embedding service. Configure optional providers in Memorix's own `~/.memorix/config.toml` or project `memorix.toml`. The example keeps Memorix's Git-project identity from the DSH working directory and uses Memorix's own `~/.memorix/data` default. Set `MEMORIX_DATA_DIR` before starting DSH to override it.
-
-### MCP Reference Memory
-
-```sh
-npm install --global @modelcontextprotocol/server-memory@2026.7.4
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/mcp-reference-memory.cordis.yml"
-```
-
-This reference server stores a local knowledge graph and exposes entity, relation, observation, read, search, and open tools. It needs no model or embedding service. The example stores its JSONL at `$HOME/.dsh-mcp-reference-memory.jsonl` instead of the installed npm package directory. Set `MEMORY_FILE_PATH` before starting DSH to override it.
-
-Search is case-insensitive substring matching over entity names, types, and observations, not semantic retrieval. The server does not add embeddings, automatic summarization, conflict resolution, or a forgetting policy.
-
-### Engram
-
-```sh
-go install github.com/Gentleman-Programming/engram/cmd/engram@v1.20.0
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/engram.cordis.yml"
-```
-
-Engram owns storage and project selection: it uses `~/.engram` by default, detects the Git project from the DSH working directory, and accepts `ENGRAM_DATA_DIR` or `ENGRAM_PROJECT` as ambient overrides.
-
-## Optional shared model instruction
-
-Add this short, vendor-neutral instruction to your existing model instructions if the server's tool descriptions do not trigger memory use reliably:
-
-> When the user asks you to remember something, call a memory write tool. When historical information may be relevant, search memory and use relevant results.
-
-This is additive guidance only. The examples do not replace DSH's system-prompt persona.
-
-## Verify write, fresh-session recall, and use
-
-Use one unique value and keep the provider's storage scope unchanged throughout:
-
-1. In DSH session A, ask: `Remember that my validation drink is lapsang-<unique suffix>.` Confirm the model called the provider's write tool and the tool returned success.
-2. Create DSH session B in the same running Host. Do not copy session A's conversation. Ask: `What is my validation drink? Check memory.` Confirm the model called the provider's search or recall tool and returned the value.
-3. Still in session B, ask: `Use that preference to suggest one drink for the meeting.` Confirm the answer uses the recalled value.
-
-A new DSH session is required; a Host restart is not. A crashed MCP child triggers automatic reconnection with backoff and a tool re-sync; tools stay listed and calls fail only during the outage, and after the reconnect budget is exhausted the tools are unregistered and reconnection stops until a reload or restart. Initial discovery is asynchronous, so wait for the provider's `mcp__...` tools before sending the first validation prompt.
-
-## Bring another MCP server
-
-Copy the same entry fields and use a unique `id` and `serverName`:
-
-```yaml
-- insert:
-    - id: memory-my-server
-      name: '@deepseek-ai/dsh-mcp-client'
-      config:
-        serverName: my-memory
-        transport: stdio
-        command: my-memory-mcp
-        args: []
-        env: {}
-        cwd: !!js process.cwd()
-```
-
-For a remote server, use `transport: streamable-http`, `url`, and `headers` instead. Provider-specific installation, identity, authentication, models, embeddings, persistence, and licensing remain the provider's responsibility.

package/references/official-docs/docs/user/guide/mcp-memory.zh.md

@@ -1,101 +0,0 @@
-# 连接第三方记忆 MCP 服务
-
-[English](mcp-memory.md) | 中文
-
-这三份**默认关闭的参考配置**通过 [`@deepseek-ai/dsh-mcp-client`](../../../packages/mcp/mcp-client/README.zh.md) 将一个记忆系统连接到 DSH。请选择其中一份，或复制相同的通用 MCP 配置项来连接其他服务器。
-
-这些第三方配置仅作为互操作参考；收录不代表 DeepSeek 的认可、推荐、合作关系或持续支持承诺。
-
-## DSH 负责什么
-
-DSH 解析选中的 Cordis overlay，启动已配置的 stdio 命令或连接已配置的 Streamable HTTP URL，发现 MCP 工具，并以 `mcp__<serverName>__<tool>` 的形式公开这些工具。DSH **不负责** 下载服务器、初始化其数据库、选择模型或 embedding 提供方、创建云端账户、迁移提供方数据，也不监管独立的 HTTP 服务。对于 stdio，通用客户端会随 DSH 插件生命周期启动和停止子进程；对于 HTTP，上游服务必须已经运行。
-
-stdio 桥接器在启动子进程前会主动移除环境中名称通常表示凭据的变量和所有 `DSH_*` 变量；其余环境变量仍会继承。每份示例仅添加其基线所需的覆盖项。如果某个可选的上游功能还需要其他密钥，请将该变量添加到配置项的 `config.env`，不要把密钥直接写进 YAML。
-
-## 选择一个
-
-| 系统 | 已测试版本 | 传输方式 | 上游前置条件 |
-|---|---:|---|---|
-| [Memorix](https://github.com/AVIDS2/memorix) | `memorix@1.3.0`（`500792cad3144142293bfbb20acb4841c9f7fcfa`） | stdio | Node 22.18+，并执行 `npm install --global memorix@1.3.0` |
-| [MCP Reference Memory](https://github.com/modelcontextprotocol/servers/tree/main/src/memory) | `@modelcontextprotocol/server-memory@2026.7.4`（`6dd0a683e198783e30feabf7abaf42f925bd18b1`） | stdio | `npm install --global @modelcontextprotocol/server-memory@2026.7.4` |
-| [Engram](https://github.com/Gentleman-Programming/engram) | `v1.20.0`（`ba9e46ced152c37a7cb9e576153c41995873e2fc`） | stdio | Go 1.25.10+，并执行 `go install github.com/Gentleman-Programming/engram/cmd/engram@v1.20.0`，或安装匹配的发布版二进制文件 |
-
-## 启用一个
-
-将一份 overlay 传给 DSH：
-
-```sh
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/memorix.cordis.yml"
-```
-
-请将文件名替换为 `mcp-reference-memory.cordis.yml` 或 `engram.cordis.yml`。该路径可以指向磁盘任意位置的一份复制文件。交付组合不包含任何记忆服务器，因此不传 `--patch` 就会让这三项全部保持关闭。
-
-如果要跨次运行保留所选配置，请将对应文件中的单个 `insert` patch 合并到用户 patch 层：只对一个 profile 生效则写入 `$DSH_HOME/profiles/<name>/cordis.patch.yml`，对本机所有 profile 生效则写入 `$DSH_HOME/cordis.patch.yml`。不要覆盖已有文件，其中可能已经包含无关的用户 patch。
-
-## 提供方设置
-
-### Memorix
-
-```sh
-npm install --global memorix@1.3.0
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/memorix.cordis.yml"
-```
-
-Memorix 无需 LLM（大语言模型）或 embedding 服务，即可在本地启发式模式下运行。请在 Memorix 自己的 `~/.memorix/config.toml` 或项目 `memorix.toml` 中配置可选提供方。该示例沿用 DSH 工作目录中的 Git 项目标识，并使用 Memorix 自身的默认目录 `~/.memorix/data`。若要覆盖该目录，请在启动 DSH 前设置 `MEMORIX_DATA_DIR`。
-
-### MCP Reference Memory
-
-```sh
-npm install --global @modelcontextprotocol/server-memory@2026.7.4
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/mcp-reference-memory.cordis.yml"
-```
-
-该参考服务器存储本地知识图谱，并公开实体、关系、观察、读取、搜索和打开工具。它不需要模型或 embedding 服务。该示例将 JSONL 存储在 `$HOME/.dsh-mcp-reference-memory.jsonl`，而不是已安装的 npm 包目录中。若要覆盖该路径，请在启动 DSH 前设置 `MEMORY_FILE_PATH`。
-
-搜索只对实体名称、类型和观察进行不区分大小写的子字符串匹配，不是语义检索。该服务器不提供 embedding、自动摘要、冲突消解或遗忘策略。
-
-### Engram
-
-```sh
-go install github.com/Gentleman-Programming/engram/cmd/engram@v1.20.0
-dsh web --patch "$PWD/apps/cli/config/examples/mcp-memory/engram.cordis.yml"
-```
-
-Engram 负责存储和项目选择：它默认使用 `~/.engram`，从 DSH 工作目录检测 Git 项目，并接受 `ENGRAM_DATA_DIR` 或 `ENGRAM_PROJECT` 作为环境覆盖项。
-
-## 可选的共用模型指令
-
-如果服务器的工具描述无法可靠触发记忆使用，请将以下简短、与提供方无关的指令添加到你现有的模型指令中：
-
-> 用户要求记住某事时调用记忆写入工具；历史信息可能相关时，检索记忆并使用相关结果。
-
-这只是附加指导。示例不会替换 DSH 系统提示词中的 persona。
-
-## 验证写入、新会话召回和使用
-
-请在整个过程中使用一个唯一值，并保持提供方的存储范围不变：
-
-1. 在 DSH 会话 A 中提出：`Remember that my validation drink is lapsang-<unique suffix>.`。确认模型调用了提供方的写入工具，并且工具返回成功。
-2. 在同一个仍在运行的 Host 中创建 DSH 会话 B。不要复制会话 A 的对话。提出：`What is my validation drink? Check memory.`。确认模型调用了提供方的搜索或召回工具，并返回该值。
-3. 继续在会话 B 中提出：`Use that preference to suggest one drink for the meeting.`。确认回答使用了召回的值。
-
-必须新建 DSH 会话，但不需要重启 Host。MCP 子进程崩溃后会触发带退避的自动重连与工具重新同步；停机期间工具仍保持列出，调用只在停机期间失败；重连预算耗尽后工具会被注销，重连停止，直到重新加载或重启。初始发现过程是异步的，因此发送第一条验证提示词前，请等待提供方的 `mcp__...` 工具出现。
-
-## 接入其他 MCP 服务器
-
-复制相同的条目字段，并使用唯一的 `id` 和 `serverName`：
-
-```yaml
-- insert:
-    - id: memory-my-server
-      name: '@deepseek-ai/dsh-mcp-client'
-      config:
-        serverName: my-memory
-        transport: stdio
-        command: my-memory-mcp
-        args: []
-        env: {}
-        cwd: !!js process.cwd()
-```
-
-对于远程服务器，请改用 `transport: streamable-http`、`url` 和 `headers`。提供方专属的安装、身份、认证、模型、embedding、持久化和许可仍由提供方负责。

package/references/official-docs/docs/user/guide/network-proxy.i18n.yaml

@@ -1,25 +0,0 @@
-# Bilingual-pair consistency record for network-proxy.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write docs/user/guide/network-proxy.md
-/run-dsh-behind-a-network-proxy:
-  en: 7659888fbb3e2e0d
-  zh: 96c019583f5bf7ab
-/run-dsh-behind-a-network-proxy/export-the-variables:
-  en: 6c92d33cc57ced2a
-  zh: 653b6ffeb4d102b0
-/run-dsh-behind-a-network-proxy/why-your-browser-is-proxied-but-your-terminal-is-not:
-  en: d565b202923482a1
-  zh: 7eb5a36a3d7504d7
-/run-dsh-behind-a-network-proxy/choose-what-stays-direct:
-  en: 307f5b01e6e09661
-  zh: 39eccb0287afc128
-/run-dsh-behind-a-network-proxy/limits-worth-knowing:
-  en: d0defd7e52100d1f
-  zh: 50f38176e16f55e4
-/run-dsh-behind-a-network-proxy/what-stays-direct:
-  en: 34b04f98af3e09ae
-  zh: 4c530b755b552942
-/run-dsh-behind-a-network-proxy/check-that-it-worked:
-  en: d7455972489f79a8
-  zh: 1e7295e10a211769

package/references/official-docs/docs/user/guide/network-proxy.md

@@ -1,85 +0,0 @@
-# Run DSH behind a network proxy
-
-English | [中文](network-proxy.zh.md)
-
-DSH routes its outbound requests — model calls, web search, page fetches, and MCP servers over HTTP — through the proxy named by the standard proxy environment variables. It reads them at launch; nothing else needs configuring. A few paths stay direct by design or by runtime limit, listed under "What stays direct" below.
-
-## Export the variables
-
-```sh
-export HTTPS_PROXY=http://127.0.0.1:7890
-export HTTP_PROXY=http://127.0.0.1:7890
-```
-
-Put both lines in your shell profile so every `dsh` invocation inherits them, or in `$DSH_HOME/.env` (`~/.dsh/.env` by default) next to your API key; an exported variable always wins over that file. A project's own `.env` cannot set them: it arrives with `git clone`, and DSH refuses to start rather than let a repository decide where your traffic goes.
-
-A proxy that needs credentials takes them in the URL: `http://user:password@proxy.example:8080`. DSH never prints the URL back: a diagnostic names the variable it rejected, so neither the username nor the password appears anywhere.
-
-## Why your browser is proxied but your terminal is not
-
-This is the most common surprise, and it is not specific to DSH. There is no single "system proxy" that all software obeys — there are three unrelated mechanisms:
-
-| Mechanism | Who follows it |
-|---|---|
-| The operating system's proxy settings | Safari, most native macOS apps, Chrome and Edge |
-| The `HTTP_PROXY` / `HTTPS_PROXY` environment variables | `curl`, `git`, `npm`, `pip`, and DSH |
-| TUN mode (a virtual network interface) | Everything, transparently |
-
-The "system proxy" switch in a proxy application such as Clash writes only the first one. Browsers pick it up; command-line tools never see it. That is why exporting the variables is a separate step, and why turning on TUN mode makes both work without any variables at all.
-
-DSH does not read the operating system's proxy settings. Export the variables, or use TUN mode.
-
-## Choose what stays direct
-
-`NO_PROXY` lists hosts to reach directly:
-
-```sh
-export NO_PROXY=internal.example.com,.corp.example.com,registry.local
-```
-
-An entry names a host and matches it together with every subdomain under it: `NO_PROXY=example.com` also sends `api.example.com` direct. A leading `.` or `*.` is accepted and means the same thing. An entry may carry a `:port`, and `*` bypasses everything.
-
-**CIDR ranges do not work.** An operating system bypass list often contains entries like `10.0.0.0/8` or `192.168.0.0/16`; copying those into `NO_PROXY` has no effect. Use host names or domain suffixes instead.
-
-You do not need to list `localhost` or `127.0.0.1`. DSH always bypasses loopback, because its own Web UI and local servers would otherwise route through the proxy and loop.
-
-## Limits worth knowing
-
-**SOCKS proxies are not supported.** A `socks5://` value is reported at startup and skipped, and DSH connects directly for the scheme that named it — setting `HTTPS_PROXY=socks5://…` alongside a usable `HTTP_PROXY` leaves `https:` direct rather than borrowing the HTTP proxy. Point the variables at your proxy application's HTTP port instead — most expose both, and the HTTP one is usually a neighbouring port number.
-
-**`ALL_PROXY` alone is enough.** DSH falls back to it for both schemes, even though Node and curl differ on this. Setting `HTTPS_PROXY` explicitly is still clearer.
-
-**A TLS-intercepting corporate proxy needs its certificate.** If requests fail with a certificate error once the proxy is reachable, point Node at your organisation's CA bundle before launching:
-
-```sh
-export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem
-```
-
-Node reads that variable only at process start, so export it before running `dsh`.
-
-**Tools DSH runs for you follow the same proxy.** Commands in the bash tool, `git`, `gh`, and MCP servers started as child processes all inherit these variables. A child that is itself a Node program honors them only on Node 22.21 or later; an older Node connects directly. If one of your proxy variables holds a value DSH rejected — a SOCKS URL, say — Node-based tools also connect directly rather than fail to start, while `curl` and `git` still read that value.
-
-**A password in the proxy URL reaches those tools too.** `HTTPS_PROXY=http://alice:s3cret@proxy.example:8080` is a normal environment variable, so every command DSH runs — including the ones the model writes — can read it, and a command that prints its environment puts the password in output that is kept. This is how the variable already behaves for everything else in your shell. If that matters, give the proxy a credential-free entry point, or authenticate it some other way than in the URL.
-
-## What stays direct
-
-Not every request DSH makes goes through the proxy:
-
-- **Anything on this machine.** Loopback is always direct: `localhost`, the whole `127.0.0.0/8` range, `::1`, and `0.0.0.0`. A proxy cannot usefully reach a service that only listens locally.
-- **Code the model writes.** Workflow workers and Node ptc-runtime processes receive no proxy settings, so model-authored scripts cannot read a proxy URL that may carry a password. Direct requests must configure any required proxy themselves and remain subject to the execution sandbox.
-- **Usage telemetry.** The OTLP exporter uses Node's own HTTP client rather than the one a proxy configures, so telemetry connects directly and simply fails where direct egress is blocked. Nothing you do in DSH depends on it. Set `DSH_TELEMETRY_MODE=DISABLED` to turn it off entirely.
-- **`web_fetch` to a literal private address.** A URL naming an address like `http://10.0.0.5/` is refused rather than handed to the proxy, the same refusal it gets with no proxy configured.
-
-## Check that it worked
-
-Ask the agent to fetch a page and watch your proxy application's connection log:
-
-```sh
-dsh --profile headless "fetch https://example.com and tell me the page title"
-```
-
-If the request does not appear there, confirm the variables survive into DSH's own environment:
-
-```sh
-env | grep -i proxy
-```

package/references/official-docs/docs/user/guide/network-proxy.zh.md

@@ -1,85 +0,0 @@
-# 在网络代理后面运行 DSH
-
-[English](network-proxy.md) | 中文
-
-DSH 会把自身的出站请求——模型调用、web 搜索、页面抓取、走 HTTP 的 MCP 服务器——都经由标准代理环境变量所指定的代理发出。它在启动时读取这些变量，不需要其他配置。有几条路径出于设计或运行时限制保持直连，下文"哪些保持直连"一节列出了它们。
-
-## 导出环境变量
-
-```sh
-export HTTPS_PROXY=http://127.0.0.1:7890
-export HTTP_PROXY=http://127.0.0.1:7890
-```
-
-把这两行写进 shell 配置，这样每次调用 `dsh` 都会继承它们；也可以写进 `$DSH_HOME/.env`（默认 `~/.dsh/.env`），和 API key 放在一起；导出的环境变量始终优先于该文件。项目自己的 `.env` 不能设置它们：它随 `git clone` 一起到来，DSH 宁可拒绝启动，也不让一个仓库决定你的流量去向。
-
-需要凭据的代理把凭据写在 URL 里：`http://user:password@proxy.example:8080`。DSH 绝不会回显这个 URL：诊断只点名被拒绝的变量，因此用户名和密码都不会出现在任何地方。
-
-## 为什么浏览器走代理、终端却不走
-
-这是最常见的意外，而且并非 DSH 特有。**根本不存在一个所有软件都遵循的"系统代理"**——实际上有三套互不相干的机制：
-
-| 机制 | 谁会遵循 |
-|---|---|
-| 操作系统的代理设置 | Safari、绝大多数 macOS 原生应用、Chrome 与 Edge |
-| `HTTP_PROXY` / `HTTPS_PROXY` 环境变量 | `curl`、`git`、`npm`、`pip` 以及 DSH |
-| TUN 模式（虚拟网卡） | 所有程序，且对应用透明 |
-
-Clash 这类代理软件里的"系统代理"开关只写第一套。浏览器会读到它，命令行工具则永远看不到。这就是为什么导出环境变量是一个独立步骤，也是为什么打开 TUN 模式后两者都能工作、且完全不需要变量。
-
-DSH 不读取操作系统的代理设置。请导出环境变量，或使用 TUN 模式。
-
-## 指定哪些目标保持直连
-
-`NO_PROXY` 列出需要直连的主机：
-
-```sh
-export NO_PROXY=internal.example.com,.corp.example.com,registry.local
-```
-
-一个条目写的是主机名，它连同其下所有子域名一起匹配：`NO_PROXY=example.com` 也会让 `api.example.com` 直连。前缀 `.` 或 `*.` 可以写，含义相同。条目可带 `:port`，`*` 则放行全部。
-
-**CIDR 网段不生效。** 操作系统的绕过列表常含 `10.0.0.0/8` 或 `192.168.0.0/16` 这类条目；把它们复制进 `NO_PROXY` 不会有任何效果。请改用主机名或域名后缀。
-
-不需要列出 `localhost` 或 `127.0.0.1`。DSH 始终绕过 loopback，否则它自己的 Web UI 与本地服务器都会经由代理并形成回环。
-
-## 值得知道的限制
-
-**不支持 SOCKS 代理。** `socks5://` 形式的值会在启动时被报告并跳过，指定它的那个 scheme 转为直连——把 `HTTPS_PROXY=socks5://…` 与一个可用的 `HTTP_PROXY` 一起设置时，`https:` 会保持直连，而不会去借用 HTTP 代理。请把变量指向代理软件的 HTTP 端口——多数软件两者都提供，且 HTTP 端口通常就在相邻的端口号上。
-
-**只设 `ALL_PROXY` 也够用。** DSH 会用它为两种协议兜底，尽管 Node 与 curl 在这一点上并不一致。显式设置 `HTTPS_PROXY` 仍然更清楚。
-
-**做 TLS 拦截的企业代理需要它的证书。** 如果代理已经可达但请求仍报证书错误，请在启动前把 Node 指向你所在组织的 CA 包：
-
-```sh
-export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem
-```
-
-Node 只在进程启动时读取该变量，所以要在运行 `dsh` 之前导出。
-
-**DSH 替你运行的工具遵循同一个代理。** bash 工具里的命令、`git`、`gh`，以及作为子进程启动的 MCP 服务器都会继承这些变量。子进程若本身是 Node 程序，则需 Node 22.21 或更高版本才会遵循；更旧的 Node 会直连。如果你的某个代理变量是 DSH 拒绝的值——比如 SOCKS URL——基于 Node 的工具同样直连而不是起不来，`curl` 与 `git` 则仍会读取那个值。
-
-**代理 URL 里的密码同样会到达这些工具。** `HTTPS_PROXY=http://alice:s3cret@proxy.example:8080` 就是一个普通环境变量，因此 DSH 运行的每一条命令——包括模型编写的那些——都能读到它，而打印环境的命令会把密码写进被保留的输出。这与该变量在你 shell 里对其他一切程序的行为一致。若这一点重要，请为代理提供一个无需凭据的入口，或改用 URL 之外的方式认证。
-
-## 哪些保持直连
-
-并非 DSH 发出的每个请求都会走代理：
-
-- **本机上的一切。** loopback 始终直连：`localhost`、整个 `127.0.0.0/8` 段、`::1` 与 `0.0.0.0`。代理无法有意义地访问一个只在本地监听的服务。
-- **模型编写的代码。** Workflow worker 与 Node ptc-runtime 进程不接收代理配置，因此模型脚本读不到可能携带密码的代理 URL。直接请求必须自行配置所需代理，并继续受到执行沙箱的约束。
-- **使用情况遥测。** OTLP 导出器用的是 Node 自带的 HTTP 客户端，而不是代理所配置的那个，因此遥测直连；在禁止直连出网的环境里它只会失败。DSH 的任何功能都不依赖它。设 `DSH_TELEMETRY_MODE=DISABLED` 可完全关闭。
-- **`web_fetch` 访问字面量私网地址。** 形如 `http://10.0.0.5/` 的 URL 会被拒绝而非交给代理，与未配置代理时得到的拒绝相同。
-
-## 验证是否生效
-
-让 agent 抓取一个页面，同时观察代理软件的连接日志：
-
-```sh
-dsh --profile headless "fetch https://example.com and tell me the page title"
-```
-
-如果请求没有出现在那里，确认变量确实进入了 DSH 自己的环境：
-
-```sh
-env | grep -i proxy
-```

package/references/official-docs/docs/user/guide/plugin-market.i18n.yaml

@@ -1,34 +0,0 @@
-# Bilingual-pair consistency record for plugin-market.md (docs/i18n/README.md): per heading
-# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
-# After editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write docs/user/guide/plugin-market.md
-/plugin-markets:
-  en: 09b2a6328dcae63c
-  zh: ac7bce767e4f5011
-/plugin-markets/summary:
-  en: 2716b194b8a12aa7
-  zh: b90773d095851969
-/plugin-markets/table-of-contents:
-  en: a8d1e6785c3c3c30
-  zh: 7ea1eaa8204a5a1e
-/plugin-markets/turn-on-discover:
-  en: 96b2fd994f8f3e7e
-  zh: 203e8460ec6aed7a
-/plugin-markets/browse-and-install:
-  en: cf616bba26958533
-  zh: 1e32df16a6f4bba7
-/plugin-markets/publish-an-index:
-  en: b85b82b22c1e14b8
-  zh: 920c0d6f20956c07
-/plugin-markets/generate-an-index-with-the-reference-generator:
-  en: 57a48912c00e1c85
-  zh: 69f2934eed0fbadf
-/plugin-markets/index-format-reference:
-  en: d058d12c27433f64
-  zh: f43b85e4934817f3
-/plugin-markets/further-exploration:
-  en: 3c0a90e8bf73c89b
-  zh: 95608eb4f6278cb4
-/plugin-markets/dev-note:
-  en: b75c8458928b72b9
-  zh: 003ba4e17b4b5269