dsh-sidebar-browser-agent 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.2.7
+
+- Redrew the plugin icon in the official plugin style: a transparent 36x36
+  gradient glyph (browser window, sidebar list, agent cursor) using the same
+  palette and stroke language as the built-in plugin icons.
+- Declared `icon` in `package.json`, the field the Plugin Manager reads for a
+  plugin row, and added a GitHub-hosted 180px raster for storefront tiles.
+
+## 0.2.6
+
+- Publishing is now token-free: the publish workflow authenticates to npm with
+  **Trusted Publishing (GitHub OIDC)**, publishes with provenance, and no
+  longer needs the `NPM_TOKEN` secret (long-lived/bypass-2FA tokens are being
+  deprecated by npm).
+
 ## 0.2.5
 
 - Resilience: every awaited guest operation (page script, screenshot, native

package/README.md

@@ -123,10 +123,15 @@ github:Hesitate-P/dsh-sidebar-browser-agent#v0.2.2
 也可以直接填 GitHub 仓库 URL。安装完成后 profile 依赖会记录为 `github:...#v0.2.0`，bundle 自动选中并启用。
 `engines.dsh` 声明兼容 `>=0.2.2-rc.1 <0.3.0`，Git 规格在安装后由 DSH 校验版本要求。
 
-### 从 npm 安装（发布后，可一键更新）
+### 从 npm 安装（推荐，可一键更新）
 
-包名 `dsh-sidebar-browser-agent`。发布后在 Plugin Manager 中以 `dsh-sidebar-browser-agent@<version>` 安装，
-此后详情页会出现 **Update**（DSH 的版本列表与 Update 只对 registry 安装的第三方包生效）。
+包名 `dsh-sidebar-browser-agent`（已发布，最新 `0.2.5`）。在 Plugin Manager 中以
+`dsh-sidebar-browser-agent@<version>` 安装（或直接点 Update 升级），此后详情页会持续提供 **Update**
+（DSH 的版本列表与 Update 只对 registry 安装的第三方包生效）：
+
+```text
+plugin_manager install_bundle(target: "dsh-sidebar-browser-agent@0.2.5")
+```
 
 ### 开发安装（link）
 
@@ -153,18 +158,24 @@ GitHub 安装（`github:...` 规格）不会出现 Update。对应更新方式
 Plugin Manager 重装新版本后解析到新的模块 URL，Host 半会加载新代码而**无需重启** Harness；
 若仍看到「page half / Host half 版本不一致」告警，重启一次 Harness 即可。
 
-如果希望 GitHub 安装也具备一键更新：把包发布到 npm（仓库自带 `.github/workflows/publish.yml`，
-在 GitHub 配置 `NPM_TOKEN` secret 后推送 `v*` 标签即自动测试并发布），然后把 profile 的安装来源切换到
-registry spec（`dsh-sidebar-browser-agent@<version>`）一次即可。
+如果希望 GitHub 安装也具备一键更新：把 profile 的安装来源切换到 registry spec
+（`dsh-sidebar-browser-agent@<version>`）一次即可；本仓库自 `0.2.5` 起已发布到 npm。
 
 ## 发布流程
 
+发布认证使用 **npm Trusted Publishing（GitHub OIDC）**，不使用长期 token：npm 包设置里把发布者绑定到
+本仓库的 `publish.yml`，workflow 以 `id-token: write` 换取短期发布权限（`npm publish --provenance`）。
+这样没有需要轮换的 `NPM_TOKEN`，也不受 bypass-2FA token 弃用政策影响。
+
+首次发布前在 npm 包设置（Settings → Trusted Publisher）绑定：owner `Hesitate-P`、repository
+`dsh-sidebar-browser-agent`、workflow `publish.yml`。
+
 ```bash
-node scripts/set-version.mjs 0.2.1   # 同步 package.json 与 index.js/client.js 的 PLUGIN_VERSION
-npm test                             # 回归测试同时校验三处版本一致性
+node scripts/set-version.mjs 0.2.1   # 同步 package.json、index.js/client.js 的 PLUGIN_VERSION，并生成新的 lib/entry-<version>.js
+npm test                             # 回归测试同时校验版本一致性、版本化 Host 入口
 git commit -am "release v0.2.1"
 git tag v0.2.1
-git push --follow-tags               # CI 跑测试；配置了 NPM_TOKEN 时 publish workflow 发布 npm
+git push --follow-tags               # CI 跑测试；publish workflow 通过 OIDC 自动发布 npm
 ```
 
 ### 本地打包

package/icon.svg

@@ -1,8 +1,17 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Sidebar browser agent">
-  <rect x="2" y="2" width="60" height="60" rx="14" fill="#1f6feb"/>
-  <circle cx="31" cy="29" r="15" fill="none" stroke="#ffffff" stroke-width="2.4"/>
-  <ellipse cx="31" cy="29" rx="6.5" ry="15" fill="none" stroke="#ffffff" stroke-width="2.4"/>
-  <path d="M16 29h30" stroke="#ffffff" stroke-width="2.4" stroke-linecap="round"/>
-  <circle cx="47" cy="47" r="9.5" fill="#0b2a4a" stroke="#7ee787" stroke-width="2"/>
-  <path d="M42.5 47h9M47 42.5v9" stroke="#7ee787" stroke-width="2" stroke-linecap="round"/>
+<svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <linearGradient id="sidebar-browser-page" x1="8" y1="9" x2="29" y2="27" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#67C7FE" />
+      <stop offset="1" stop-color="#3F77D8" />
+    </linearGradient>
+    <linearGradient id="sidebar-browser-side" x1="10" y1="11" x2="15" y2="25" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#6AECB6" />
+      <stop offset="1" stop-color="#37A6B1" />
+    </linearGradient>
+  </defs>
+  <rect x="7.7" y="8.7" width="20.6" height="18.6" rx="3.4" stroke="url(#sidebar-browser-page)" stroke-width="2.4" />
+  <rect x="10.4" y="12.2" width="3.6" height="1.8" rx="0.9" fill="url(#sidebar-browser-side)" />
+  <rect x="10.4" y="15.7" width="2.8" height="1.8" rx="0.9" fill="url(#sidebar-browser-side)" fill-opacity="0.65" />
+  <rect x="10.4" y="19.2" width="3.2" height="1.8" rx="0.9" fill="url(#sidebar-browser-side)" fill-opacity="0.45" />
+  <path d="M17.4 15.4L17.4 24.9L19.9 22.5L21.8 26.1L24.1 25.1L22.2 21.5L25.4 21.4Z" fill="url(#sidebar-browser-page)" stroke="#FFFFFF" stroke-width="0.7" stroke-linejoin="round" />
 </svg>

package/lib/client.js

@@ -28,7 +28,7 @@ window.__ModuleLoader__.load({
     const BASE_BACKOFF_MS = 400
     const MAX_EVAL_CHARS = 100_000
     /** Plugin version reported by diagnostics; keep in sync with package.json. */
-    const PLUGIN_VERSION = '0.2.5'
+    const PLUGIN_VERSION = '0.2.7'
     const MAX_SCREENSHOT_WIDTH = 1_400
     const MAX_SCREENSHOT_BASE64 = 12_000_000
     /**

package/lib/{entry-0.2.5.js → entry-0.2.7.js}

@@ -20,7 +20,7 @@ import z from '../vendor/schemastery/index.mjs'
 export const name = 'dsh-sidebar-browser-agent'
 
 /** Plugin version reported by diagnostics; keep in sync with package.json. */
-export const PLUGIN_VERSION = '0.2.5'
+export const PLUGIN_VERSION = '0.2.7'
 
 /** Services that must exist before this plugin mounts. */
 export const inject = ['webServer', 'connection', 'tools']

package/lib/index.js

@@ -20,7 +20,7 @@ import z from '../vendor/schemastery/index.mjs'
 export const name = 'dsh-sidebar-browser-agent'
 
 /** Plugin version reported by diagnostics; keep in sync with package.json. */
-export const PLUGIN_VERSION = '0.2.5'
+export const PLUGIN_VERSION = '0.2.7'
 
 /** Services that must exist before this plugin mounts. */
 export const inject = ['webServer', 'connection', 'tools']

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "dsh-sidebar-browser-agent",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "type": "module",
+  "icon": "./icon.svg",
   "description": "Native agent control for the DSH right-sidebar browser: manage tabs, and read, click, type, scroll, run JavaScript in and screenshot the real page through its Electron guest.",
   "license": "MIT",
   "repository": {
@@ -19,7 +20,7 @@
     "electron-webview"
   ],
   "exports": {
-    ".": "./lib/entry-0.2.5.js",
+    ".": "./lib/entry-0.2.7.js",
     "./client": "./lib/client.js",
     "./locale/*.json": "./locale/*.json",
     "./icon": "./icon.svg"

package/test/host-harness.mjs

@@ -370,6 +370,14 @@ async function main() {
   // --- version consistency and the versioned Host entry ---
   check('package version matches host constant', packageJson.version === PLUGIN_VERSION, `${packageJson.version} vs ${PLUGIN_VERSION}`)
   check('client version matches package', clientSource.includes(`PLUGIN_VERSION = '${packageJson.version}'`), packageJson.version)
+  const iconReference = packageJson.icon
+  check('package declares a relative icon', typeof iconReference === 'string' && iconReference.startsWith('./') && !iconReference.includes('..'), iconReference)
+  const iconFile = typeof iconReference === 'string' ? path.resolve(here, '..', iconReference) : ''
+  check('declared icon exists', iconFile !== '' && fs.existsSync(iconFile), iconFile)
+  const iconSource = iconFile !== '' && fs.existsSync(iconFile) ? fs.readFileSync(iconFile, 'utf8') : ''
+  check('declared icon is a 36x36 svg', iconSource.startsWith('<svg') && iconSource.includes('viewBox="0 0 36 36"'), iconSource.slice(0, 60))
+  check('declared icon ships with the package', Array.isArray(packageJson.files) && packageJson.files.includes('icon.svg'), JSON.stringify(packageJson.files))
+
   const expectedEntry = `./lib/entry-${packageJson.version}.js`
   check('package entry is versioned', packageJson.exports?.['.'] === expectedEntry, packageJson.exports?.['.'])
   const entryFile = path.join(here, '..', 'lib', `entry-${packageJson.version}.js`)