dsh-plugin-marketplace 0.3.0 → 0.3.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Scorp1o117
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Scorp1o117
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -56,6 +56,13 @@ therefore require DSH `0.1.0-rc.7` or newer. DSH `0.1.0-rc.6` users must pin
 `dsh-plugin-marketplace@0.2.6`, the last release carrying the legacy
 settings-allowlist compatibility patch.
 
+DSH `0.1.2-rc.1` removed the client-side `connection.api` (the legacy settings
+RPC face); version 0.3.1 therefore writes through the bound `settingsScope`'s
+own `mutate` (hosts older than `0.1.2-rc.1` still use the legacy channel).
+Note: when dsh web is opened from a non-loopback origin (a LAN IP, say), DSH
+keeps settings writes process-local, so install / AI-explain requests never
+reach the host.
+
 ## How it works
 
 | Layer | File | Role |

package/README.zh.md

@@ -46,6 +46,11 @@ DSH `0.1.0-rc.7` 起会公开全部已注册的 settings 命名空间，插件
 请锁定 `dsh-plugin-marketplace@0.2.6`；这是最后一个包含旧 settings 白名单兼容
 补丁的版本。
 
+DSH `0.1.2-rc.1` 移除了客户端的 `connection.api`（旧 settings RPC 入口），
+`0.3.1` 起改用 `settingsScope` 自带的 `mutate` 写入（`0.1.2-rc.1` 之前的主机仍走
+旧通道）。注意：非本机回环（如局域网 IP）访问 dsh web 时，DSH 的设置写入是
+进程本地的，安装 / AI 解释请求不会到达宿主。
+
 ## 实现方式
 
 | 层 | 文件 | 作用 |

package/client.js

@@ -82,7 +82,7 @@ window.__ModuleLoader__.load({
       aiExplain: "🤖 AI 解释",
       aiExplaining: "AI 解释中，请稍候…",
       aiExplainErr: "AI 解释失败：{msg}",
-      notExposed: "当前 DSH 版本没有公开插件市场的设置通道；请升级到 DSH 0.1.0-rc.7 或更高版本并重启 dsh web。"
+      notExposed: "无法写入插件市场的设置通道：DSH 版本过旧（需 0.1.0-rc.7+）、宿主半端未挂载，或当前页面不是本机回环访问；请通过 127.0.0.1 打开 dsh web 后重试。"
     };
     var en = {
       nav: "Plugin Marketplace",
@@ -113,7 +113,7 @@ window.__ModuleLoader__.load({
       aiExplain: "🤖 AI Explain",
       aiExplaining: "AI is explaining…",
       aiExplainErr: "AI explain failed: {msg}",
-      notExposed: "This DSH version does not expose the plugin-marketplace settings channel. Upgrade to DSH 0.1.0-rc.7 or newer and restart dsh web."
+      notExposed: "The plugin-marketplace settings channel is not writable here: the DSH version is too old (0.1.0-rc.7+ required), the host half is not mounted, or this page is not a loopback connection. Open dsh web via 127.0.0.1 and try again."
     };
 
     // ── GitHub API ────────────────────────────────────────────────────────
@@ -184,6 +184,38 @@ window.__ModuleLoader__.load({
       return promise;
     }
 
+    // ── settings write channel ────────────────────────────────────────────
+    /**
+     * Write one namespace field through whichever settings channel this host
+     * exposes. dsh 0.1.2-rc.1 dropped `connection.api` (the old raw settings
+     * RPC); there the bound scope's own `mutate` (the remote.settings RPC) is
+     * the only write path. Older hosts (0.1.0-rc.7 / 0.1.1.x) have no public
+     * scope mutate but keep `connection.api`, whose structured error responses
+     * the UI can show verbatim. Always resolves `{ok, error?}` — refused or
+     * failed writes surface as a result, never as a rejection.
+     */
+    function writeField(scope, api, field, value) {
+      if (scope && typeof scope.mutate === "function") {
+        return scope.mutate([{ op: "set", path: [field], value: value }]).then(function () {
+          // A refused write leaves the namespace view absent (the scope folds
+          // the outcome into its snapshot before the promise settles).
+          var snap = scope.getSnapshot();
+          if (!snap || snap.status !== "ready") return { ok: false, error: { code: "settings-not-exposed" } };
+          return { ok: true };
+        }, function (e) {
+          return { ok: false, error: { message: String(e && e.message || e) } };
+        });
+      }
+      return api.settings.mutate({
+        ns: "plugin-marketplace",
+        ops: [{ op: "set", path: [field], value: value }]
+      }).then(function (response) {
+        return (response && response.result) ? response.result : { ok: false, error: { message: "malformed settings response" } };
+      }, function (e) {
+        return { ok: false, error: { message: String(e && e.message || e) } };
+      });
+    }
+
     // ── components ────────────────────────────────────────────────────────
     function PluginCard(props) {
       return h("li", null,
@@ -305,33 +337,21 @@ window.__ModuleLoader__.load({
       };
       var onInstall = react.useCallback(function (pkg) {
         set(function (prev) { return Object.assign({}, prev, { installError: null }); });
-        api.settings.mutate({
-          ns: "plugin-marketplace",
-          ops: [{ op: "set", path: ["install"], value: { pkg: pkg, ts: Date.now() } }]
-        }).then(function (response) {
-          if (!response.result.ok) {
-            var detail = response.result.error || {};
-            set(function (prev) { return Object.assign({}, prev, { installError: mutateError(detail, "unknown") }); });
+        writeField(scope, api, "install", { pkg: pkg, ts: Date.now() }).then(function (result) {
+          if (!result.ok) {
+            set(function (prev) { return Object.assign({}, prev, { installError: mutateError(result.error, "unknown") }); });
           }
-        }).catch(function (e) {
-          set(function (prev) { return Object.assign({}, prev, { installError: String(e && e.message || e) }); });
         });
-      }, [api, t]);
+      }, [scope, api, t]);
       // AI-explain request: the host answers over the same settings channel.
       var onExplain = react.useCallback(function (repo, desc, readme) {
         set(function (prev) { return Object.assign({}, prev, { explainError: null }); });
-        api.settings.mutate({
-          ns: "plugin-marketplace",
-          ops: [{ op: "set", path: ["aiExplain"], value: { repo: repo, desc: desc, readme: readme, ts: Date.now() } }]
-        }).then(function (response) {
-          if (!response.result.ok) {
-            var detail = response.result.error || {};
-            set(function (prev) { return Object.assign({}, prev, { explainError: mutateError(detail, "unknown") }); });
+        writeField(scope, api, "aiExplain", { repo: repo, desc: desc, readme: readme, ts: Date.now() }).then(function (result) {
+          if (!result.ok) {
+            set(function (prev) { return Object.assign({}, prev, { explainError: mutateError(result.error, "unknown") }); });
           }
-        }).catch(function (e) {
-          set(function (prev) { return Object.assign({}, prev, { explainError: String(e && e.message || e) }); });
         });
-      }, [api, t]);
+      }, [scope, api, t]);
       var load = react.useCallback(function (q, sort, page, append) {
         set(function (prev) { return Object.assign({}, prev, { loading: true, error: null }); });
         fetchPage(q, sort, page).then(function (out) {
@@ -414,7 +434,9 @@ window.__ModuleLoader__.load({
       var t = ctx.locale.bind(NS);
       ctx.effect(function () { return ctx.locale.register(NS, { zh: zh, en: en }); }, "dsh-plugin-marketplace: dictionaries");
       var scope = ctx.settingsScope.bind({ namespace: "plugin-marketplace" });
-      var api = ctx.connection.api;
+      // dsh 0.1.2-rc.1 dropped connection.api; only older hosts still carry
+      // the raw settings face there. writeField picks whichever exists.
+      var api = (ctx.connection && ctx.connection.api) ? ctx.connection.api : null;
       ctx.slots.inject("settings.section", function () {
         return ctx.slots.register({
           name: "settings.section",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "dsh-plugin-marketplace",
-    "version": "0.3.0",
+    "version": "0.3.1",
     "description": "DeepSeek Harness Web UI 内置插件市场：在设置页直接浏览 github.com/topics/dsh-plugin，支持搜索、按 Star 排序、查看安装方式。",
     "type": "module",
     "main": "index.js",