dsh-remote 0.8.17 → 0.8.18

package/README.md

@@ -8,7 +8,7 @@
 [![license](https://img.shields.io/github/license/flymysql/dsh-remote)](LICENSE)
 [![dsh-plugin](https://img.shields.io/badge/topic-dsh--plugin-7a3ef3)](https://github.com/topics/dsh-plugin)
 
-![dsh-remote workspace picker](docs/cover.png)
+![dsh-remote — make any SSH machine a real DSH workspace](docs/cover.png)
 
 **Remote-work assistant for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).**
 
@@ -74,10 +74,8 @@ core or require a listening Web server:
   `sidebar.right.pane.tab` seat. It reuses the existing explorer/editor and
   gives remote files their own session-scoped resource addresses, rather than
   sending remote paths to the local Files viewer.
-- When the core Web-server row is explicitly disabled (the official Desktop
-  composition), the bundled `dsh-better-sidebar` row stays disabled. Web hosts
-  retain the existing `/dsh-remote/*` routes and sidebar composition, including
-  the standalone-sidebar deduplication guard.
+- `dsh-better-sidebar` is not bundled. Web hosts may install it separately;
+  official Desktop uses the native right-sidebar integration instead.
 
 Validation so far covers Host startup, Desktop IPC JSON requests, read-only
 SSH connection/list/read, and opening the settings/import UI. Native file-tab
@@ -99,48 +97,29 @@ build allowlist or automatically approve dependency scripts.
 dsh plugin add dsh-remote            # add the bundle
 ```
 
-One command installs everything: since **v0.7.2** the sidebar
-([dsh-better-sidebar](https://www.npmjs.com/package/dsh-better-sidebar)) is a
-hard dependency and is mounted automatically — the 🌐 remote-file explorer and
-remote file viewer show up in the sidebar with no extra step. If you already
-have the sidebar installed on its own, the embedded copy backs off (no double
-mount) — regardless of whether the standalone bundle is listed **before or
-after** `dsh-remote` in `dsh.profile.bundles` (order-independent guard since
-0.8.7; earlier versions crashed boot with `duplicate prefix route
-"/sidebar/api"` when the standalone bundle came after `dsh-remote`).
-
-> **Upgrading from ≤0.8.6 with a standalone sidebar?** You may keep the
-> standalone `dsh-better-sidebar` bundle (any order) — 0.8.7+ no longer
-> crashes. Or remove it from `bundles` and let dsh-remote mount the embedded
-> copy (version ^0.18.1 since 0.8.15 — earlier releases pinned 0.14.x, whose
-> `import { settingsNamespace } from "@deepseek-ai/dsh-settings"` broke once
-> dsh-settings 0.1.2-alpha.2 made that symbol private; issue #29).
-
-> **Harness requirement of the embedded sidebar (0.8.15+): `dsh ≥ 0.1.2-rc.1`.**
-> `dsh-better-sidebar` 0.18.x imports `SessionLogOffset` from
-> `@deepseek-ai/dsh-session`, which only exists from 0.1.2-rc.1 on. On an older
-> harness (0.1.0-rc.x) that import fails and the loader aborts the whole plugin
-> tree, so dsh does not start at all. Verified: 0.8.14 + sidebar 0.14.0 boots on
-> 0.1.0-rc.8, while 0.8.15 + sidebar 0.18.1 does not; both boot on 0.1.2-rc.1.
-> On an older harness either stay on **0.8.14**, or keep the host half by
-> disabling the embedded sidebar row in your profile's `cordis.patch.yml`
-> (verified working on 0.1.0-rc.8 — the `rw_*` tools keep working, the sidebar
-> UI is what you give up):
->
-> ```yaml
-> - id: dsh-remote-sidebar
->   disabled: true
-> ```
->
-> (and do not list a standalone `dsh-better-sidebar` bundle either).
-
-> **Requires the profile's pnpm linker to be `hoisted`** (the DSH profile
-> default, `nodeLinker: hoisted` in `pnpm-workspace.yaml`). The loader resolves
-> plugin packages from the profile root, so the sidebar must be reachable in
-> the top-level `node_modules`. If your `pnpm-workspace.yaml` was rewritten
-> without `nodeLinker: hoisted`, add it back (`nodeLinker: hoisted`) and run
-> `pnpm install` once — otherwise the embedded sidebar row fails with
-> `Cannot find package 'dsh-better-sidebar'`.
+Since **v0.8.18**, `dsh-remote` installs and mounts only itself. The Web sidebar
+([dsh-better-sidebar](https://www.npmjs.com/package/dsh-better-sidebar)) is
+optional and is no longer a dependency or an automatically mounted row. This
+keeps the SSH tools and settings UI independent from a particular sidebar
+implementation.
+
+To add the optional Web remote-file explorer/editor, install both bundles:
+
+```bash
+dsh plugin add dsh-remote
+dsh plugin add dsh-better-sidebar
+```
+
+When the standalone sidebar service is present, `dsh-remote` discovers it
+dynamically and registers its remote explorer/editor tabs. Without it, all
+`rw_*` tools, the settings UI, sync, audit log, and port forwarding continue to
+work. Official Desktop uses its native right-sidebar seats and does not need
+`dsh-better-sidebar`.
+
+> **Upgrading from 0.7.2–0.8.17:** upgrading to 0.8.18 removes the embedded
+> sidebar dependency and mount. Install `dsh-better-sidebar` separately only if
+> you still want that Web UI. Any old profile override for
+> `id: dsh-remote-sidebar` can be removed because that row no longer exists.
 
 (or `npm install dsh-remote` + add `- id: dsh-remote / name: dsh-remote` in `cordis.patch.yml`).
 

package/README.zh.md

@@ -13,8 +13,8 @@
   `dsh-app:` 通道承载请求，鉴权仍由宿主负责，不启动 Web Server。
 - 通过 `sidebarRightTabs` 和 `sidebar.right.pane.tab` 提供原生“远程文件”入口，
   复用原来的文件树与编辑器，不把远端路径传给本地文件预览器。
-- 官方 Desktop 显式禁用 Web Server 时，不挂载内置 `dsh-better-sidebar`；
-  Web 版仍保留原路由、侧栏及独立安装时的去重逻辑。
+- `dsh-better-sidebar` 不再内置；Web 版可以单独安装，官方 Desktop 则使用
+  原生右侧栏集成。
 
 已验证 Host 启动、IPC 请求、真实 SSH 的只读连接/目录列表/文本读取，以及设置页和
 测试 SSH 配置的导入。文件标签的完整 UI 操作、编辑/同步、多机器并行会话，以及旧 Web
@@ -28,7 +28,7 @@ Desktop 安装器还可能要求明确配置 `ssh2` / `cpu-features` 可选构
 [![license](https://img.shields.io/github/license/flymysql/dsh-remote)](LICENSE)
 [![dsh-plugin](https://img.shields.io/badge/topic-dsh--plugin-7a)](https://github.com/topics/dsh-plugin)
 
-![dsh-remote 工作区选择](docs/cover.png)
+![dsh-remote —— 把任意 SSH 机器变成真正的 DSH 工作区](docs/cover.png)
 
 **为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）打造的远程工作助手。**
 
@@ -76,38 +76,25 @@ DSH 的 Web 界面刻意只监听 `127.0.0.1`（CLI 为安全拒绝 `--host 0.0.
 dsh plugin add dsh-remote            # 添加 bundle
 ```
 
-一条命令装齐：从 **v0.7.2** 起，侧边栏
-（[dsh-better-sidebar](https://www.npmjs.com/package/dsh-better-sidebar)）是
-**硬依赖并自动挂载** —— 装完 dsh-remote 后，侧边栏里的「🌐 远程文件」目录树和
-远程文件查看器即可直接用，无需额外步骤。如果你已单独安装过该侧边栏，内嵌副本
-会自动退避（不会重复挂载）。
-
-> **内嵌侧边栏版本**：0.8.15 起依赖范围为 `^0.18.1`。0.8.14 及更早锁在 `^0.14.0`，
-> 而 0.14.0~0.17.1 仍然 `import { settingsNamespace } from "@deepseek-ai/dsh-settings"`，
-> 该导出自 dsh-settings 0.1.2-alpha.2 起被移除，静态导入失败会让整个插件树加载失败
-> （issue #29）。
-
-> **⚠ 内嵌侧边栏对 harness 的要求（0.8.15+）：`dsh ≥ 0.1.2-rc.1`**。
-> `dsh-better-sidebar` 0.18.x 会 `import { SessionLogOffset } from "@deepseek-ai/dsh-session"`，
-> 该导出从 0.1.2-rc.1 才有。在更老的 harness（0.1.0-rc.x）上这个静态导入会失败，
-> loader 因此判定整个插件树加载失败 —— **dsh 直接起不来**。实测：`0.8.14 + 侧边栏 0.14.0`
-> 在 0.1.0-rc.8 上可以正常启动，`0.8.15 + 侧边栏 0.18.1` 不行；两者在 0.1.2-rc.1 上都正常。
-> 老 harness 上要么**留在 0.8.14**，要么在 profile 的 `cordis.patch.yml` 里关掉内嵌侧边栏行
-> 以保住 host 半（已在 0.1.0-rc.8 实测可启动，`rw_*` 工具照常可用，放弃的只是侧边栏 UI）：
->
-> ```yaml
-> - id: dsh-remote-sidebar
->   disabled: true
-> ```
->
-> （同时不要再单独列出 `dsh-better-sidebar` bundle。）
-
-> **要求 profile 的 pnpm linker 为 `hoisted`**（DSH profile 默认，
-> `pnpm-workspace.yaml` 里 `nodeLinker: hoisted`）。loader 从 profile 根解析
-> 插件包，侧边栏必须能在顶层 `node_modules` 被解析到。如果你的
-> `pnpm-workspace.yaml` 被重写丢掉了 `nodeLinker: hoisted`，请补回并执行一次
-> `pnpm install` —— 否则内嵌侧边栏行会报
-> `Cannot find package 'dsh-better-sidebar'`。
+从 **v0.8.18** 起，`dsh-remote` 只安装并挂载自身。Web 侧边栏
+（[dsh-better-sidebar](https://www.npmjs.com/package/dsh-better-sidebar)）
+改为可选，不再是依赖，也不会被自动挂载。这样 SSH 工具和设置页不再被某个侧边栏
+实现的版本/API 变化拖垮。
+
+如需 Web 版远程文件浏览/编辑，请显式安装两个 bundle：
+
+```bash
+dsh plugin add dsh-remote
+dsh plugin add dsh-better-sidebar
+```
+
+独立侧边栏 service 存在时，`dsh-remote` 会动态发现它并注册远程文件 tab；
+不安装时，`rw_*` 工具、设置页、同步、审计日志和端口转发均照常工作。
+官方 Desktop 使用原生右侧栏，不需要安装 `dsh-better-sidebar`。
+
+> **从 0.7.2–0.8.17 升级：** 升到 0.8.18 后，内嵌侧边栏依赖和挂载会消失。
+> 只有仍需要 Web 侧边栏 UI 时才单独安装 `dsh-better-sidebar`。旧 profile 里针对
+> `id: dsh-remote-sidebar` 的覆盖可以删除，因为这行已不存在。
 
 （或 `npm install dsh-remote`，再在 `cordis.patch.yml` 加 `- id: dsh-remote / name: dsh-remote`。）
 

package/cordis.patch.yml

@@ -1,59 +1,9 @@
-# dsh-remote bundle patch: inserts this plugin into a profile's layer stack.
-# Applied when a profile lists this bundle; rows reference the package by name so
-# Node resolution finds the installed code.
+# dsh-remote bundle patch: inserts only this plugin into a profile's layer stack.
 #
-# Since v0.7.2 dsh-remote ships dsh-better-sidebar as a hard dependency and
-# mounts it here, so `dsh plugin add dsh-remote` brings up the sidebar with
-# zero extra steps on Web. Official Desktop explicitly disables the Web server
-# row and uses the native right-sidebar seats instead. The sidebar
-# row uses a DEDICATED id (`dsh-remote-sidebar`)
-# and a guard so it backs off when another row mounts `dsh-better-sidebar`
-# (e.g. the user installed the sidebar bundle on its own, or an aggregate
-# bundle owns it) — two enabled mounts would both register /sidebar/api and
-# fail the whole plugin tree at boot.
-#
-# Order-independence (issue #12): the guard must NOT depend on
-# `ctx.loader.entries()` creation order. The loader creates entries in bundle
-# order and each row's disabled expression is evaluated at creation time, when
-# only rows created BEFORE it are visible — so with
-# `bundles: [..., "dsh-remote", "dsh-better-sidebar", ...]` (standalone sidebar
-# installed after dsh-remote, the normal `dsh plugin add` append order) both
-# rows saw no other sidebar mount and BOTH started, crashing boot with
-# `duplicate prefix route "/sidebar/api"`.
-#
-# Instead we scan the COMPOSED PATCH STACK — the include entry's
-# `config.patches` (every bundle layer in `dsh.profile.bundles` order, then the
-# profile/home/overlay layers) — for any OTHER row that mounts
-# `dsh-better-sidebar`. That data is fully materialized before any row guard
-# evaluates, so the outcome is identical no matter where the standalone bundle
-# sits in the bundle list. It is also pure data: it never reads another row's
-# `disabled` (reading another row's disabled expression would recursively
-# re-enter the loader — dsh-better-sidebar's own row carries one too, so the
-# two would ping-pong), so no recursion is possible. The old entries()-based
-# check is kept as a belt-and-suspenders fallback for rows not visible in the
-# patch stack (e.g. an entry injected at runtime by HMR or another plugin).
+# dsh-better-sidebar is deliberately not mounted here and is not a dependency.
+# Users who want that optional Web UI can install its bundle separately;
+# lib/client.js discovers the betterSidebar service dynamically and adds the
+# remote explorer/editor tabs when it is present.
 - insert:
     - id: dsh-remote
       name: 'dsh-remote'
-    - id: dsh-remote-sidebar
-      name: 'dsh-better-sidebar'
-      disabled: !!js >-
-        (function () {
-          // Inspect the core row's explicit disabled flag, not service presence:
-          // a Web server that simply has not started yet must still be awaited.
-          // Do not evaluate another sidebar's disabled guard (issue #12).
-          if ([...ctx.loader.entries()].some((e) => e.options.name === '@deepseek-ai/dsh-host-webserver' && e.options.disabled === true)) return true
-          try {
-            const inc = ctx.loader && ctx.loader.resolve && ctx.loader.resolve('include')
-            const patches = inc && inc.subtree && inc.subtree.config && inc.subtree.config.patches
-            if (Array.isArray(patches)) {
-              for (const p of patches) {
-                if (!p || !Array.isArray(p.insert)) continue
-                for (const row of p.insert) {
-                  if (row && row.name === 'dsh-better-sidebar' && row.id !== 'dsh-remote-sidebar') return true
-                }
-              }
-            }
-          } catch (e) {}
-          return [...ctx.loader.entries()].some((e) => e.options.name === 'dsh-better-sidebar' && e.options.id !== 'dsh-remote-sidebar')
-        })()

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.17",
-  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 21 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, port forwarding, side-bar remote file editing, audit log, keychain passwords.",
+  "version": "0.8.18",
+  "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 21 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",
   "homepage": "https://github.com/flymysql/dsh-remote",
@@ -66,7 +66,6 @@
   "dependencies": {
     "ssh2": "^1.16.0",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "dsh-better-sidebar": "^0.18.1",
     "iconv-lite": "^0.6.3"
   },
   "devDependencies": {