dsh-session-messaging 0.1.2 → 0.2.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-10-18
+
+### Changed
+
+- **Cross-directory peers are allowed by default.** `session_peers` and
+  `session_send` now accept sessions whose working directory differs from the
+  sender's. Set `sameDirectoryOnly: true` in the plugin configuration to
+  restore the previous path restriction.
+- The change is a minor release because it changes default delivery behavior:
+  review the peer-content trust boundary before enabling it in shared hosts.
+
+### Tests
+
+- Integration coverage now exercises default cross-directory discovery and
+  delivery, plus an explicit `sameDirectoryOnly: true` policy test.
+
 ## [0.1.2] - 2026-10-18
 
 ### Fixed

package/README.md

@@ -3,11 +3,12 @@
 Cross-session messaging for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh): let **user-launched sessions in the same workspace message each other** to coordinate tasks, declared file-write scopes, and conflicts — without turning them into parent/child subagents.
 
 [![CI](https://github.com/XBXyftx/dsh-session-messaging/actions/workflows/ci.yml/badge.svg)](https://github.com/XBXyftx/dsh-session-messaging/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/dsh-session-messaging.svg)](https://www.npmjs.com/package/dsh-session-messaging)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 **English** | [简体中文](README.zh-CN.md)
 
-> Status: early preview (`0.1.0`). Targets dsh `0.2.1-rc.2`. dsh plugin APIs are pre-stable, so expect breaking changes on upstream upgrades.
+> Status: early preview (`0.2.0`). Targets dsh `0.2.1-rc.2`. dsh plugin APIs are pre-stable, so expect breaking changes on upstream upgrades.
 
 ## Why
 
@@ -48,7 +49,7 @@ See [CHANGELOG.md](CHANGELOG.md) for the `0.1.2` entry.
 - Advisory **write-scope conflict detection**: if a peer declared an overlapping path, the receipt and the message envelope carry a `conflict-warning`.
 - No new Session event types and no `SESSION_FORMAT_VERSION` change: the relay is a durable `user/message` with a declared `session-message` source.
 - Bilingual plugin-card metadata and icons (English / 简体中文) for the dsh plugin manager.
-- Bounded: message size, per-sender→target rate limit, same-directory scope, top-level-only, live-only, self-send rejected.
+- Bounded: message size, per-sender→target rate limit, top-level-only, live-only, self-send rejected. Cross-directory peers are allowed by default; `sameDirectoryOnly: true` restricts to one working directory.
 
 ## How it works
 
@@ -73,13 +74,21 @@ The envelope always states that the message comes from another session, not the
 
 ## Install
 
+### From npm (recommended)
+
+```sh
+dsh plugin --profile <profile> add dsh-session-messaging
+```
+
+The package is published as [`dsh-session-messaging`](https://www.npmjs.com/package/dsh-session-messaging) (latest `0.2.0`). For library use: `npm install dsh-session-messaging`.
+
 ### From GitHub
 
 ```sh
 dsh plugin --profile <profile> add github:XBXyftx/dsh-session-messaging
 ```
 
-The repository ships the built `lib/` output, so installing from git does **not** run a build. If you prefer a registry, `npm publish` from this repository produces the same package (`dsh-session-messaging`).
+The repository ships the built `lib/` output, so a git install does not run a build.
 
 ### From a local checkout
 
@@ -130,7 +139,7 @@ The bundle row accepts validated configuration; every field has a default:
     maxMessageChars: 4000
     maxMessagesPerMinute: 12
     requireTargetOptIn: false   # sessions are open to peers by default
-    sameDirectoryOnly: true
+    sameDirectoryOnly: false
     allowSelfSend: false
 ```
 
@@ -141,7 +150,7 @@ The bundle row accepts validated configuration; every field has a default:
 - **Same process only.** Discovery uses `ctx.agents`; a session that is not live cannot receive a message in this version. Cold-session delivery and cross-process/cross-host messaging are not implemented.
 - **Advisory scopes, not locks.** dsh has optimistic filesystem version guards (`FS_STALE_VERSION`) but no file locking. `writeScopes` and `conflict-warning` are coordination aids; Bash, formatters, and code generators bypass them.
 - **In-memory state.** Reception pauses and declared scopes live for the plugin's lifetime and reset on reload/restart.
-- **Same working directory by default.** Set `sameDirectoryOnly: false` only if you understand cross-project implications.
+- **Cross-directory by default.** Sessions in different working directories can message each other. Set `sameDirectoryOnly: true` to restore a path boundary; peer content remains untrusted either way.
 - **No GUI extension.** Messages render as ordinary user messages; a dedicated title/icon for the `session-message` source would require a client plugin or an upstream `ui-chat` change.
 
 ## Development

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 
 [English](README.md) | **简体中文**
 
-> 状态：早期预览（`0.1.0`），适配 dsh `0.2.1-rc.2`。dsh 插件 API 仍为 pre-stable，上游升级可能带来破坏性变更。
+> 状态：早期预览（`0.2.0`），适配 dsh `0.2.1-rc.2`。dsh 插件 API 仍为 pre-stable，上游升级可能带来破坏性变更。
 
 ## 为什么需要
 
@@ -45,7 +45,7 @@ macOS 桌面客户端（`0.2.1-rc.2`）真实运行：另一个用户启动的
 - 建议性**写范围冲突检测**：与 peer 声明重叠时，回执与消息信封带 `conflict-warning`。
 - 不新增 Session 事件类型、不改 `SESSION_FORMAT_VERSION`：消息就是带 `session-message` source 的 `user/message`。
 - 插件管理卡片提供中英双语标题、简介与图标（English / 简体中文）。
-- 有边界：长度上限、每 sender→target 限频、同目录、仅顶层、仅 live、拒绝自发送。
+- 有边界：长度上限、每 sender→target 限频、仅顶层、仅 live、拒绝自发送。默认允许跨目录对等会话；`sameDirectoryOnly: true` 可收紧为同工作目录。
 
 ## 工作原理
 
@@ -70,13 +70,21 @@ macOS 桌面客户端（`0.2.1-rc.2`）真实运行：另一个用户启动的
 
 ## 安装
 
+### 从 npm 安装（推荐）
+
+```sh
+dsh plugin --profile <profile> add dsh-session-messaging
+```
+
+包已发布为 [`dsh-session-messaging`](https://www.npmjs.com/package/dsh-session-messaging)（最新 `0.2.0`）。库用法：`npm install dsh-session-messaging`。
+
 ### 从 GitHub 安装
 
 ```sh
 dsh plugin --profile <profile> add github:XBXyftx/dsh-session-messaging
 ```
 
-仓库包含构建好的 `lib/`，从 git 安装**不需要**额外构建。发布到 npm 后也可用包名 `dsh-session-messaging` 安装。
+仓库包含构建好的 `lib/`，从 git 安装不需要额外构建。
 
 ### 本地目录安装
 
@@ -125,7 +133,7 @@ dsh plugin --profile <profile> add /absolute/path/to/dsh-session-messaging
     maxMessageChars: 4000
     maxMessagesPerMinute: 12
     requireTargetOptIn: false   # 默认对 peer 开放
-    sameDirectoryOnly: true
+    sameDirectoryOnly: false
     allowSelfSend: false
 ```
 
@@ -136,7 +144,7 @@ dsh plugin --profile <profile> add /absolute/path/to/dsh-session-messaging
 - **仅同进程**：发现依赖 `ctx.agents`，非 live 会话本版无法接收；冷会话投递与跨进程/跨机器通信未实现。
 - **写范围只是建议，不是锁**：dsh 只有乐观版本守卫（`FS_STALE_VERSION`），没有文件锁；Bash、格式化器、代码生成器会绕过写范围提示。
 - **状态在内存**：暂停接收与写范围声明随插件生命周期存在，重载/重启后重置。
-- **默认同目录**：除非理解跨项目影响，否则不要关闭 `sameDirectoryOnly`。
+- **默认允许跨目录**：不同工作目录的会话也可以互发消息。设置 `sameDirectoryOnly: true` 可恢复路径边界；无论是否限制，peer 内容都不可信。
 - **无 GUI 扩展**：消息按普通 user 消息显示；`session-message` 的专属标题/图标需要 client 插件或上游 `ui-chat` 改动。
 
 ## 开发

package/lib/config.d.ts

@@ -13,7 +13,7 @@ export interface SessionMessagingConfig {
     readonly maxMessagesPerMinute: number;
     /** Require the target session to opt in before it can receive peer messages. Off by default: sessions are mutually visible and can message each other unless they pause reception. */
     readonly requireTargetOptIn: boolean;
-    /** Only allow peers whose working directory equals the sender's. */
+    /** Restrict peers to the sender's working directory. Off by default: cross-directory peers are allowed. */
     readonly sameDirectoryOnly: boolean;
     /** Allow a session to relay to itself (diagnostics only; off by default). */
     readonly allowSelfSend: boolean;

package/lib/config.js

@@ -11,6 +11,6 @@ export const Config = Schema.object({
     maxMessageChars: Schema.number().min(1).default(DEFAULT_MAX_MESSAGE_CHARS),
     maxMessagesPerMinute: Schema.number().min(1).default(DEFAULT_MAX_MESSAGES_PER_MINUTE),
     requireTargetOptIn: Schema.boolean().default(false),
-    sameDirectoryOnly: Schema.boolean().default(true),
+    sameDirectoryOnly: Schema.boolean().default(false),
     allowSelfSend: Schema.boolean().default(false),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-session-messaging",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Peer messaging between user-launched sessions in one workspace: discover peers, relay coordination messages, pause reception, and get advisory write-scope conflict warnings.",
   "license": "MIT",
   "type": "module",
@@ -77,7 +77,7 @@
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --test tests/protocol.test.ts",
-    "test:integration": "node --experimental-strip-types tests/integration-smoke.ts",
+    "test:integration": "node --experimental-strip-types tests/integration-smoke.ts && node --experimental-strip-types tests/directory-policy-smoke.ts",
     "test:model-e2e": "node --experimental-strip-types tests/model-e2e-smoke.ts"
   },
   "dsh": {