dsh-remote-bridge 2.4.0 → 2.4.2

package/README.en.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.0-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.2-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -77,10 +77,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # 2. tarball from the GitHub release
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.2/dsh-remote-bridge-v2.4.2.tgz
 
 # 3. tarball from the Gitee release (faster from mainland China)
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.2/dsh-remote-bridge-v2.4.2.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -97,7 +97,7 @@ Restart DSH after installation, then open settings — The section is titled **
 To install a downloaded release archive:
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.4.0.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.4.2.tgz
 ```
 
 ## First connection
@@ -329,13 +329,13 @@ pnpm pack
 
 `pnpm check` covers type-checking, documentation consistency, and tests. It currently passes **30 test files / 226 cases**, plus **4 browser-layer cases** (Playwright measuring real computed styles).
 
-`npm pack` produces roughly a **0.29 MB** archive: 2.2.0 dropped the standalone page and its editor dependencies and turned source maps off, down from 1.72 MB.
+`npm pack` produces roughly a **0.53 MB** archive (v2.4.2 measured 558,704 bytes, SHA-256 `0260fe57…e3067f`): 2.2.0 dropped the standalone page and its editor dependencies and turned source maps off, down from 1.72 MB; it has since grown slightly with projection passthrough and the permission BFF.
 
-v2.4.0 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
+v2.4.2 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
 
 ## Project
 
-- Version: `v2.4.0`
+- Version: `v2.4.2`
 - Author: upstream [Hakunm](https://github.com/Hakunm); this fork maintained by [westanke](https://github.com/westanke)
 - Repository: [GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm: [`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge) ([mainland-China mirror](https://registry.npmmirror.com/dsh-remote-bridge))

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.0-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.2-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -76,10 +76,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # ② GitHub Release 的 tarball
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.2/dsh-remote-bridge-v2.4.2.tgz
 
 # ③ Gitee Release 的 tarball（国内访问更快）
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.2/dsh-remote-bridge-v2.4.2.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -95,7 +95,7 @@ npx @deepseek-ai/dsh web
 从 GitHub Release 下载离线安装包时，可直接安装 tarball：
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.4.0.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.4.2.tgz
 ```
 
 ## 第一次使用
@@ -323,13 +323,13 @@ pnpm pack
 
 `pnpm check` 覆盖类型检查、文档一致性与测试；当前 **30 个测试文件 / 226 个用例**，外加 **4 个浏览器层用例**（Playwright 实测量出的计算样式），全部通过。
 
-`npm pack` 的产物约 **0.29 MB**：2.2.0 删除独立页及其编辑器依赖、并关闭 source map 之后，从 1.72 MB 降下来。
+`npm pack` 的产物约 **0.53 MB**（v2.4.2 实测 558,704 字节，SHA-256 `0260fe57…e3067f`）：2.2.0 删除独立页及其编辑器依赖、并关闭 source map 之后从 1.72 MB 降下来，之后随投影透传与权限 BFF 小幅增长。
 
-v2.4.0 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
+v2.4.2 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
 
 ## 项目信息
 
-- 当前版本：`v2.4.0`
+- 当前版本：`v2.4.2`
 - 作者：上游 [Hakunm](https://github.com/Hakunm)，本 fork 维护 [westanke](https://github.com/westanke)
 - 仓库：[GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm：[`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge)（[国内镜像](https://registry.npmmirror.com/dsh-remote-bridge)）

package/docs/api/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.0.0
 info:
   title: DeepSeek Harness Mobile Events
-  version: 2.4.0
+  version: 2.4.2
   description: |
     Live file and authorized DSH chat events. Reconnect clients must refresh
     REST state; unbounded replay is not provided.
@@ -143,6 +143,37 @@ components:
             code: { type: string }
             stopped: { type: boolean, const: true }
 
+    ChatTurnEnd:
+      type: object
+      description: |
+        A turn ended. Emitted for every `turn/end` the host reports, including the
+        ordinary `reason.kind === 'ok'` case. When the host stops a turn at its
+        output-token cap (`reason.kind === 'max-tokens'`) the reply is **truncated,
+        not failed** — this frame is the only place a client can learn that, because
+        no separate failure frame is emitted for it. Clients that ignore `reason`
+        keep working unchanged (the field is additive).
+      required: [sessionId, eventType]
+      properties:
+        sessionId: { type: string }
+        eventType: { type: string, const: turn/end }
+        seq: { type: integer }
+        reason:
+          type: object
+          description: |
+            Forwarded **verbatim** from the host; this repository does not interpret
+            it. Known `kind` values (kernel `turn-error.js` / `turn-max-tokens.js` /
+            `retry.js`): `ok` (normal), `error` (terminal failure — also delivered as
+            `chat.turn.failed`), `max-tokens` (output-token cap: reply truncated,
+            earlier output preserved — render as a **warning**, not an error),
+            `aborted` (cancelled by the user or a hook, e.g. signing out).
+            Unknown kinds must be ignored rather than treated as failure.
+          properties:
+            kind: { type: string }
+            error:
+              type: object
+              properties:
+                message: { type: string }
+                code: { type: string }
     ChatDeliverablesPresented:
       type: object
       description: |

package/docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepSeek Harness Mobile API
-  version: 2.4.0
+  version: 2.4.2
   description: Versioned file and chat BFF for mobile and third-party DSH clients. HTTP and HTTPS are both supported.
 servers:
   - url: http://127.0.0.1:3090/api/v1
@@ -24,7 +24,7 @@ paths:
                 properties:
                   ok: { type: boolean, const: true }
                   version: { type: string, const: v1 }
-                  pluginVersion: { type: string, const: 2.4.0 }
+                  pluginVersion: { type: string, const: 2.4.2 }
   /pairings/exchange:
     post:
       security: []
@@ -307,6 +307,28 @@ paths:
                   items:
                     type: array
                     items: { $ref: '#/components/schemas/AgentPreset' }
+  /chat/permission-presets:
+    get:
+      operationId: listPermissionPresets
+      description: >-
+        Lists the permission presets a session can switch between (the catalog behind
+        DSH WebUI's access-mode selector). Session projections only carry the *current*
+        value, so clients cannot enumerate the choices without this endpoint.
+      responses:
+        '200':
+          description: Permission preset choices and the deployment default.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [options, defaultPreset]
+                properties:
+                  options:
+                    type: array
+                    items: { $ref: '#/components/schemas/PermissionOption' }
+                  defaultPreset:
+                    type: string
+        '403': { $ref: '#/components/responses/Error' }
   /settings/providers:
     get:
       operationId: listProviderSettings

package/kotlin-sdk/build.gradle.kts

@@ -4,7 +4,7 @@ plugins {
 }
 
 group = "ai.deepseek.dsh"
-version = "2.4.0"
+version = "2.4.2"
 
 repositories { mavenCentral() }
 

package/kotlin-sdk/src/main/kotlin/ai/deepseek/dsh/workspace/DshWorkspaceClient.kt

@@ -116,6 +116,30 @@ data class AgentPreset(
 @Serializable
 data class ModelSelection(val provider: String, val model: String, val reasoningEffort: String? = null)
 
+/**
+ * 一个可选的权限档位。
+ *
+ * [name] 是**非空**的：服务端 `normalizePermissionCatalog` 保证名字缺失时用 `value` 顶上，
+ * 空名字会在严格反序列化器上失败，或在 UI 上留下一行没有文字的选项。
+ */
+@Serializable
+data class PermissionOption(
+    val value: String,
+    val name: String,
+    val description: String? = null,
+)
+
+/**
+ * 权限档位清单（`GET /chat/permission-presets`）。
+ *
+ * [defaultPreset] 是部署默认，**不等于**某个会话的当前档位 —— 当前值只认会话投影。
+ */
+@Serializable
+data class PermissionCatalog(
+    val options: List<PermissionOption> = emptyList(),
+    val defaultPreset: String = "",
+)
+
 @Serializable
 data class ModelReasoningEffort(val id: String, val name: String, val description: String? = null)
 
@@ -343,6 +367,19 @@ class DshWorkspaceClient(
         AgentPresetList.serializer(),
     ).items
 
+    /**
+     * 权限档位候选清单。
+     *
+     * 必须单开一条：会话投影里那条 `permissions` 视图**只给 currentValue**，
+     * 候选项在内核的独立远程服务上，所以客户端列不出档位菜单。
+     */
+    fun listPermissionPresets(): PermissionCatalog = executeJson(
+        "chat/permission-presets",
+        "GET",
+        null,
+        PermissionCatalog.serializer(),
+    )
+
     fun selectSessionAgentPreset(sessionId: String, agentPreset: String): String {
         val body = json.encodeToString(AgentPresetSelection.serializer(), AgentPresetSelection(agentPreset))
         return executeJson(

package/lib/index.d.ts

@@ -655,6 +655,22 @@ interface AgentPresetsLike {
   resolveAgent?: never;
   select(agent: unknown, agentPreset: string): Promise<string>;
 }
+/**
+ * 内核 `dsh-permission-presets`（cordis 服务名 `permissionPresets`）。
+ *
+ * @patch
+ * id: permission-presets-catalog-bff
+ * for: 内核把「权限预设清单」放在**独立的远程服务**上（`@Remote('catalog')`），
+ *      而会话投影里那条同名 wire 视图只给 `currentValue`（`wire.view: state => ({ currentValue })`），
+ *      两者没有任何交叉引用。客户端要列候选档位就只能自己编。
+ * why: 没有正规写法可用 —— 内核的 Host FaceModel 里没有「把 catalog 并进投影」这个方法；
+ *      插件唯一的入口就是那个远程服务。
+ * until: 内核把候选项并进投影，或提供一条已含 options 的查询。
+ * test: tests/permission-presets.spec.ts
+ */
+interface PermissionPresetsLike {
+  catalog(): Promise<unknown>;
+}
 interface LlmLike {
   /** Live routes, as `{ id, name }` rows. */
   listProviders(): readonly {
@@ -694,6 +710,7 @@ interface Dsh02HostServices {
   settingsController: SettingsControllerLike;
   credentialsController: CredentialsControllerLike;
   agentPresets: AgentPresetsLike;
+  permissionPresets: PermissionPresetsLike;
   llm: LlmLike;
   /**
    * 内核附件存储（`ctx.attachments`）；会话历史里的图片要经它取字节。
@@ -1006,6 +1023,18 @@ interface DshApiProxy {
       agentPreset: string;
     }>>;
   };
+  /**
+   * 权限档位目录（内核 `ctx.permissionPresets`）。
+   *
+   * 单开命名空间的理由与 userQuestions 相同：它由**另一个内核服务**提供
+   * （`@deepseek-ai/dsh-permission-presets`），在没装它的 profile 上是可选能力。
+   */
+  permissionPresets: {
+    catalog(request: {
+      rpcId: string;
+      payload: Record<string, never>;
+    }): Promise<RpcResponse<unknown>>;
+  };
   /**
    * 用户问题（内核 `ctx.userQuestions`，即 ask_user_question 工具）。
    *
@@ -1114,7 +1143,14 @@ interface CommandExecutionView {
 }
 interface DshCommandRuntime {
   list(agent: unknown): readonly CommandDescriptorView[];
-  execute(agent: unknown, line: string, signal: AbortSignal): Promise<CommandExecutionView | undefined>;
+  /**
+   * 内核签名是 **四个**参数：`execute(agent, line, submittedAttachments, signal)`。
+   *
+   * 少传一个（把 signal 传到第三个位）会让内核读到 `undefined.aborted`，
+   * 表现为**所有**斜杠命令都报 `Cannot read properties of undefined (reading 'aborted')`。
+   * 实测 2026-10-19 踩过：手机端因此切不了会话权限档位。
+   */
+  execute(agent: unknown, line: string, submittedAttachments: readonly unknown[], signal: AbortSignal): Promise<CommandExecutionView | undefined>;
 }
 interface DshAgentRegistry {
   get(sessionId: string): unknown | undefined;
@@ -1263,6 +1299,16 @@ interface AgentPresetView {
   isDefault: boolean;
   available: boolean;
 }
+/**
+ * 一个可选的权限档位。字段名刻意与内核 `optionOf()` 的产出一致
+ * （`{ value, name, description? }`），中间不再改名 —— 客户端的
+ * kotlinx.serialization 严格解码器对字段名敏感。
+ */
+interface PermissionOptionView {
+  value: string;
+  name: string;
+  description?: string;
+}
 declare class DshChatAdapter {
   private readonly api;
   private readonly database;
@@ -1293,6 +1339,16 @@ declare class DshChatAdapter {
   renameWorkspace(principal: Principal, workspaceId: string, title: string): Promise<ChatWorkspaceView>;
   deleteWorkspace(principal: Principal, workspaceId: string): Promise<void>;
   listAgentPresets(): Promise<AgentPresetView[]>;
+  /**
+   * 权限档位候选清单。
+   *
+   * 为什么这条必须在插件侧：BFF 要把内核的进程级 catalog 透出来。会话投影里那条
+   * wire 视图只带 `currentValue`，没有候选项 —— 客户端拿不到候选就列不出档位菜单。
+   */
+  listPermissionPresets(): Promise<{
+    options: PermissionOptionView[];
+    defaultPreset: string;
+  }>;
   selectAgentPreset(principal: Principal, sessionId: string, agentPreset: string): Promise<string>;
   createSessionInWorkspace(principal: Principal, workspaceId: string, options: {
     sessionId?: string;