dsh-sidecard-ask 2.0.2 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## 2.1.0
+
+**主题：跨端核查后的性能与可观测性收口——流式热路径从「每次 delta 全树重渲染」改成「只重渲染变化的卡」，
+新增加载预算与活动卡上限，补上一个不免鉴权的探活口，并修掉部署前缀缺少尾斜杠时的基址丢失。**
+
+排查依据见 `CROSS-END-AUDIT-2.0.2.md`（网页端 dsh 0.2.1-rc.2 × 桌面端 dsh-desktop 0.2.0-rc.2 /
+Electron 43.3.0）。本版不含破坏性变更，配置项与接口签名不变。
+
+### 性能
+
+- **流式热路径只重渲染变化的卡片**。`useStoreState()` 订阅整个 store，而 `FloatingLayer` 每次渲染都给
+  `AnswerCard` 新建 16 个箭头函数，于是任何一次 `store.set` 都会让所有卡片的 props 全部不等——
+  `React.memo` 无从下手。现在：
+  - `AnswerCard` 经 `React.memo` 包装（对没有 `memo` 的 React 自动退化为原组件）；
+  - 新增 `useCardHandlers(actions)`：每个卡片 id 只建一次回调包，回调通过 ref 读当时的卡片
+    （否则"复制"会复制到两个 delta 之前的文本），因此未变化的卡片 props 引用稳定、整棵子树跳过。
+- **一次 flush 只提交一次状态**。`flushStreamBuffers` 原来对正文和思考各调用一次
+  `appendCardText`/`appendCardReasoning`，每次都是一次 `store.set`；3 路并发时理论上 120 次全树渲染/秒。
+  现在两个缓冲合并成一个 `cards` 补丁、一次提交（两个旧 helper 随之删除）。
+- **流式节奏按文本长度自适应**：答案超过 32 K 字符时刷新间隔 50 ms → 100 ms
+  （实测 64 K 答案的 `renderRichText` 为 1.2–2.0 ms/帧，翻倍间隔即减半工作量，肉眼无差）。
+- **右栏观察器不再被 class/style 吵醒**。面板测量的 `MutationObserver` 原来把 `class`、`style`
+  放进 `attributeFilter`，聊天区的 hover/滚动/徽标切换每次都会触发一次 rAF 内的
+  `getBoundingClientRect`（强制布局）；现在只监听 `data-sidebar-right-open` 与
+  `data-dockkit-pane-active` 两个真正表示"右栏几何变了"的属性。
+- **活动卡片上限 20**。此前 `store.state.cards` 无上限，长会话会把每条答案的 React 子树一直挂着。
+  超过上限时最旧的**已完成**卡片隐藏为 `open:false`（数据保留、正文卸载、历史可恢复），
+  正在流式的卡片永不隐藏。
+- **冷启动回放预算 200 K 字符**。回放原来把所有历史卡片以 `open:true` 恢复，仅受卡数（默认 10）
+  与单字段 64 K 限制，最坏要挂 64 万字符的 markdown；现在最新一张必定展开，其余按累计字符预算展开，
+  超预算的以折叠态回来。
+
+### 修复
+
+- **部署前缀不带尾斜杠时基址丢失**。`new URL('.', 'https://host/dsh')` 会把 `dsh` 当文件名，
+  于是 `API` 退化成 `/sidecard-ask/api`，前缀部署下全部 404。现在首次 404 会回退到根绝对路径重试一次
+  （401/403 都**不**改基址：那是鉴权/围栏的答案，不是"路径不对"）。正常部署（文档根或带尾斜杠）
+  取值与旧值完全相同，不产生额外请求。
+
+### 可观测性
+
+- **新增 `GET /sidecard-ask/api/ping`**：唯一免宿主会话的接口，只回 `{version, at}`。
+  2.0.2 的会话门把脚本/CI 的探活路径全挡住了（连 README 里的 `Invoke-WebRequest` 都变成 401），
+  这条补回"插件是否加载"的判别能力，同时不重新打开"无 cookie 就能 spawn 子代理"的口子。
+  它仍受 loopback/Origin 围栏保护，且**不咨询** `connection` 服务——会话服务坏掉时探活照常工作。
+- 路由分发顺序随之调整：路径解析提前到会话门之前（`ping` 在此之前应答），未知路径仍然对所有动词
+  回同一个 404。
+
+### 文档
+
+- README §10.1 的自测配方改为"先 `/ping` 判存活，其余接口需会话"（旧配方在 2.0.2 之后恒 401）。
+- 新增 README §5.4：2026-10-22 桌面端复核（宿主版本落差、Chromium 150、scheme 特权、请求转发、
+  权限、AUMID、加速键、产物缓存）。
+- README §14 补 12–15 四条限制（`/ping` 的边界、活动卡上限、回放预算、前缀重试）。
+- 更正 2.0.2 的一处结论：「桌面端在本机冷启动即崩」**2026-10-22 未能复现**（冷启动成功、宿主在 19387
+  正常服务），改为"与安装包/启动方式相关，需按版本复验"。
+
+### 测试
+
+- `verify` 57、`contract` **1408**（原 1377）、`float-placement` **83**（原 82）、`smoke` **271**（原 262），
+  合计 **1819 通过，0 失败**。
+- 新增覆盖：`apiBaseAfter` 的四种状态码（404 改基址、401/403 不改、根绝对不循环）、
+  `capLiveCards` 的隐藏规则（只藏最旧、跳过流式卡片、已隐藏不占配额、不改入参）、
+  `replayCardOpen` 的预算边界、`React.memo` 与稳定回调包的接线、一次 flush 只有一次 `store.set`、
+  `attributeFilter` 不再含 `class`、`/ping` 免鉴权与 405、`/ping` 不咨询 `connection`、
+  其余接口仍 fail-closed、未知路径仍 404。
+
 ## 2.0.2
 
 **主题：跨端（网页端 / 桌面端）排查后的六个修复 —— 插件 API 补上宿主会话鉴权、诊断上报不再互相覆盖、prompt 预算真正守住 60k、SMTP 密码状态自洽、未知接口状态码对称、用户层配置按 profile 分文件。**

package/README.md

@@ -486,6 +486,25 @@ dsh-better-sidebar 为此专门带了一条防御（`html[data-platform] body>[d
 `Alt+Q` 是否会撞上桌面 App 的菜单加速键（Electron 的菜单加速键由菜单先处理，页面的 keydown 可能收不到；
 若冲突，在设置页改成 `Ctrl+Alt+Q` 之类即可）；Electron 下 `navigator.clipboard` 的写入权限（已有"选中文本"降级兜底）。
 
+### 5.4 2026-10-22 复核（v2.1.0 / 桌面 0.2.0-rc.2）
+
+上一轮之后桌面端与网页端的形态都变过，本轮把能静态取证的部分重新核了一遍，**完整报告见
+[`CROSS-END-AUDIT-2.0.2.md`](CROSS-END-AUDIT-2.0.2.md)**（含实测数字与未验证清单）。要点：
+
+| 维度 | 事实 | 对插件意味着什么 |
+|---|---|---|
+| 宿主版本落差 | 桌面 `dsh-desktop 0.2.0-rc.2`（包内 `dsh` 同版本）；网页 **`0.2.1-rc.2`** | 适配矩阵要按两端分别列，不能写成"DSH 0.2.x" |
+| 渲染内核 | Electron **43.3.0 = Chromium 150.0.7871.212**（`~/.dsh/electron/version` 亦为 43.3.0）；网页端取决于访问者浏览器（本机对照 Edge/Chromium 155） | `renderRichText` 在 150 与 155 上实测同量级（8 k 0.2–0.3 ms，64 k 1.2–2.0 ms） |
+| 自定义 scheme | `dsh-app://app/` 特权：`standard/secure/supportFetchAPI/corsEnabled/stream/codeCache` | `fetch` + 流式读取可用，不需要 EventSource |
+| 请求转发 | `forwardWebRequest`：只放行 `origin=dsh-app://app`，删 `host/origin/cookie/sec-fetch-site` 后注入宿主 cookie，`duplex:"half"` | 2.0.2 起的会话门在桌面端靠这条链路通过；插件侧 `origin` 缺失时被判为可信（`isTrustedRequest`） |
+| 权限 | 主窗口 `setPermissionRequestHandler`：非 `media` 一律放行；登录窗/侧栏 webview 一律拒绝并拦下载 | 剪贴板与通知**有**权限；导出下载走主窗口，不受拦截 |
+| 通知 | 全包 **无 `setAppUserModelId`** | Windows toast 可能不弹；`notifyOnDone` 默认关，打开后仍以卡片状态为兜底 |
+| 菜单加速键 | 全包 `Alt+Q` **0 命中** | 外壳不抢默认快捷键（输入法/其它程序仍可能抢） |
+| 插件产物缓存 | `/plugins/*` 被壳改写为 `cache-control: no-store` | 每次加载重新拉 349 KB（localhost，传输≈0，代价在解析） |
+
+> 另：2.0.2 CHANGELOG 里"桌面端在本机冷启动即崩"的结论，2026-10-22 **未能复现**——本次冷启动成功、
+> 宿主在 19387 正常服务。该条已按"与安装包/启动方式相关，需按版本复验"处理，不再当作既定事实。
+
 ---
 
 ## 六、未知 DSH API：占位接口与替换方式
@@ -816,11 +835,21 @@ node tools/compat-probe.mjs 0.1.7-rc.2            # 也可只探某个版本
 
 ### 10.1 对已安装实例做真实联调（本机实测通过）
 
+> **2.1.0 起除 `/ping` 外的每个接口都走宿主会话门。** 不带浏览器登录 cookie 的脚本调用会拿到
+> `401 {"error":{"code":"unauthorized"}}`，这表示"没登录"，**不表示插件没起来**——先用第 0 步区分。
+> 页面内自检（设置 → 侧边卡片追问 → 运行自检）读的是同一份 `/state`，不需要任何脚本。
+
 ```powershell
-# 1) 宿主接口与能力（archived 父会话检测也在这里）
-(Invoke-WebRequest http://127.0.0.1:8080/sidecard-ask/api/state -UseBasicParsing).Content
+# 0) 探活：唯一免鉴权的接口，只回插件版本与宿主时钟
+(Invoke-WebRequest http://127.0.0.1:8080/sidecard-ask/api/ping -UseBasicParsing).Content
+# → {"ok":true,"value":{"version":"2.1.0","at":1792...}}    200 = 插件宿主半已加载
+
+# 1) 宿主接口与能力（archived 父会话检测也在这里）——需要会话
+#    在本机浏览器已登录的前提下复用会话：先 -WebSession 登录，或把浏览器的 Cookie 头带进来
+(Invoke-WebRequest http://127.0.0.1:8080/sidecard-ask/api/state `
+   -Headers @{ Cookie = $cookie } -UseBasicParsing).Content
 
-# 2) 端到端流式作答：把 sessionId 换成当前会话 id（$env:DSH_SESSION_ID）
+# 2) 端到端流式作答：把 sessionId 换成当前会话 id（$env:DSH_SESSION_ID）；同样需要会话
 #    期望事件序列：start → reasoning*/delta* → status → done（done.text 是真实答案）
 $body = @{ id='probe'; question='用一句话说明这句话在说什么。';
            selection='槽位出口会带上 data-slot 标记。'; zone='chat';
@@ -828,11 +857,13 @@ $body = @{ id='probe'; question='用一句话说明这句话在说什么。';
 $tmp = Join-Path $env:TEMP 'probe.json'
 [System.IO.File]::WriteAllText($tmp, $body, (New-Object System.Text.UTF8Encoding($false)))
 (Invoke-WebRequest http://127.0.0.1:8080/sidecard-ask/api/ask -Method POST `
+   -Headers @{ Cookie = $cookie } `
    -ContentType 'application/json; charset=utf-8' -InFile $tmp -TimeoutSec 240 -UseBasicParsing).Content
 
 # 3) 客户端半的真实状态（浏览器跑的那份代码/槽位落点/两个适配器）
 #    页面加载后 GET /state，看 value.client —— 这是唯一能从页面外读到客户端状态的通道
-((Invoke-WebRequest http://127.0.0.1:8080/sidecard-ask/api/state -UseBasicParsing).Content | ConvertFrom-Json).value.client
+((Invoke-WebRequest http://127.0.0.1:8080/sidecard-ask/api/state `
+    -Headers @{ Cookie = $cookie } -UseBasicParsing).Content | ConvertFrom-Json).value.client
 ```
 
 **客户端状态样例**（1.3.0 起）：
@@ -986,4 +1017,14 @@ npm deprecate "<旧包名>@*" "Renamed to <新包名> - <原因>"       # 旧名
     自己的数据）；**唯一的例外是「清空全部历史」**——显式清空会同时删除 v3/v2/v1 三代键（1.8.1）。
     这条例外是必需的：只删当前键会让 `readPersisted()` 的 v3→v2→v1 回落把刚清掉的历史从旧键读回来，
     刷新一次就复活（1.8.1 复现并修复）。
+12. **接口鉴权（2.0.2 起，2.1.0 补 `/ping`）**：除 `/ping` 外的每个接口都要宿主会话；从页面外读
+    `/state` 会得到 `401 unauthorized`。`/ping` 是唯一免鉴权的探活口，只回 `{version, at}`——
+    不要往里加字段，它存在的理由是"能给监控用"，不是"能省登录"。
+13. **活动卡片上限 20（2.1.0）**：超过后最旧的**已完成**卡片自动隐藏（`open:false`，数据仍在，
+    历史里可恢复），正在流式的卡片永不隐藏。这不是删除，但会"少一张卡片在浮层里"。
+14. **冷启动回放预算 200 K 字符（2.1.0）**：最新一张必定展开，其余按累计字符预算展开；
+    超预算的旧卡片以折叠态回来，点开才解析。改 `historyMaxCards` 不改变这个预算。
+15. **部署前缀不带尾斜杠时（2.1.0）**：`API` 基址会先按 `document.baseURI` 猜一次，若得到 404
+    则回退到根绝对路径重试一次。这是唯一安全的判别方式（401/403 都不能用来改基址），
+    代价是每次页面加载最多多一次 404 往返——正常部署下不会触发。
 

package/client.js

@@ -62,6 +62,50 @@ window.__ModuleLoader__.load({
         return '/sidecard-ask/api'
       }
     })()
+
+    /** Root-absolute base — the retry target when the prefix guess misses. */
+    const API_ROOT = '/sidecard-ask/api'
+
+    /**
+     * The base actually used from now on.
+     *
+     * `new URL('.', base)` treats the last path segment as a FILE name, so a
+     * deployment whose public URL has no trailing slash (`https://host/dsh`)
+     * resolves to the document root and loses the prefix. There is no way to
+     * tell `/dsh` (directory) from `/dsh` (file) without asking the server, so
+     * the first `404` retries once against the root-absolute base: 404 is the
+     * only unambiguous signal here — auth answers `401`, a foreign origin
+     * `403`, and `404` means the route is not mounted at this path at all.
+     */
+    let apiBase = API
+
+    /**
+     * The base to use after one response.
+     * @param {number} status - HTTP status of the attempt.
+     * @param {string} current - the base that produced it.
+     * @returns {string} the base for the next attempt (unchanged unless 404).
+     */
+    function apiBaseAfter(status, current) {
+      return status === 404 && current !== API_ROOT ? API_ROOT : current
+    }
+
+    /**
+     * `fetch` against the plugin API, retrying once on a 404 with the other
+     * base. A 404 body is never consumed here: the caller's own error path
+     * reads it (or ignores it), exactly as before.
+     * @param {string} path - `/state` or `/ask`, appended to the base.
+     * @param {RequestInit} [init] - fetch options (body must be replayable).
+     * @returns {Promise<Response>} the response of whichever attempt answered.
+     */
+    async function fetchApi(path, init) {
+      const attempted = apiBase
+      let response = await fetch(`${attempted}${path}`, init)
+      if (response.status === 404 && attempted !== API_ROOT) {
+        apiBase = apiBaseAfter(response.status, attempted)
+        response = await fetch(`${apiBase}${path}`, init)
+      }
+      return response
+    }
     /** Slot ids contributed by this plugin (also the overlay entry ids). */
     const IDS = {
       overlay: 'sidecard-ask',
@@ -73,7 +117,7 @@ window.__ModuleLoader__.load({
      * the Host and the module's `api.version` both read it, so a report can
      * never claim a generation the browser is not actually running.
      */
-    const CLIENT_VERSION = '2.0.2'
+    const CLIENT_VERSION = '2.1.0'
 
     /**
      * Tab kind served by the DSH native right rail (also its implementation id).
@@ -109,6 +153,35 @@ window.__ModuleLoader__.load({
     const HISTORY_TURN_Q_CHARS = 500
     const HISTORY_TURN_A_CHARS = 4000
 
+    /**
+     * Streaming flush cadence.
+     *
+     * 50 ms is the cadence that reads as "live"; a 32 k+ answer costs 1.2–2.0 ms
+     * of markdown parsing per frame (measured, both Chromium 150 and 155), so
+     * past that length the cadence doubles — the eye cannot tell, and the work
+     * halves.
+     */
+    const STREAM_FLUSH_MS = 50
+    const STREAM_FLUSH_SLOW_MS = 100
+    const STREAM_SLOW_CHARS = 32_000
+
+    /**
+     * How many cards may stay mounted at once. Past this the oldest finished
+     * card is hidden (not deleted): its body unmounts, its data stays, and the
+     * durable history still restores it.
+     */
+    const MAX_LIVE_CARDS = 20
+
+    /**
+     * How many characters of history a page load may re-render unfolded.
+     *
+     * Replay used to restore every saved card `open:true`, bounded only by the
+     * card count (default 10) and a 64 k per-field limit — a worst case of
+     * ~640 k characters of markdown parsed and mounted before the page is
+     * usable. Past this budget the older cards come back collapsed.
+     */
+    const REPLAY_OPEN_BUDGET_CHARS = 200_000
+
     /**
      * Client-side mirror of the Host `DEFAULT_CONFIG`. The client needs values
      * before `/state` answers (first paint) and when the Host is unreachable;
@@ -1121,7 +1194,7 @@ window.__ModuleLoader__.load({
     async function postJson(method, payload) {
       let response
       try {
-        response = await fetch(`${API}/${method}`, {
+        response = await fetchApi(`/${method}`, {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify(payload ?? {}),
@@ -1145,7 +1218,7 @@ window.__ModuleLoader__.load({
     async function getState() {
       let response
       try {
-        response = await fetch(`${API}/state`, { method: 'GET' })
+        response = await fetchApi('/state', { method: 'GET' })
       } catch (error) {
         throw Object.assign(new Error(String(error?.message ?? error)), { code: 'unreachable' })
       }
@@ -1173,7 +1246,7 @@ window.__ModuleLoader__.load({
     async function streamAsk(payload, handlers) {
       let response
       try {
-        response = await fetch(`${API}/ask`, {
+        response = await fetchApi('/ask', {
           method: 'POST',
           headers: { 'content-type': 'application/json', accept: 'text/event-stream' },
           body: JSON.stringify(payload),
@@ -1323,6 +1396,57 @@ window.__ModuleLoader__.load({
       return store.state
     }
 
+    /**
+     * Per-card handler bundle with a STABLE identity.
+     *
+     * `store.set` bumps a revision on every streamed delta, and the floating
+     * layer re-renders on each one. Handing `AnswerCard` a fresh arrow per
+     * render makes every prop compare unequal, so `React.memo` could never bail
+     * out. The bundle is therefore created once per card id and reads the card
+     * through a ref at call time — a closure must never capture a stale card,
+     * or "copy" would copy the text from two deltas ago.
+     * @param {object} actions - the plugin's action table (stable for the
+     *   lifetime of `apply`).
+     * @returns {(card: object) => object} handler bundle for one card.
+     */
+    function useCardHandlers(actions) {
+      const latest = React.useRef(new Map())
+      const cache = React.useRef(new Map())
+      return React.useCallback((card) => {
+        if (card === null || card === undefined) return null
+        latest.current.set(card.id, card)
+        let bundle = cache.current.get(card.id)
+        if (bundle === undefined) {
+          // The maps are keyed by card id and live for the whole session, so a
+          // long session would keep one tiny bundle per card ever shown. Past a
+          // generous ceiling both are dropped: the live cards simply get a
+          // fresh (still stable) bundle and re-render once.
+          if (cache.current.size > 64) {
+            cache.current.clear()
+            latest.current.clear()
+          }
+          const current = () => latest.current.get(card.id) ?? card
+          bundle = {
+            onCopy: element => actions.copy(current(), element),
+            onFollowUp: text => actions.followUp(current(), text),
+            onRetry: () => actions.retry(current()),
+            onRetryEdit: text => actions.retryEdit(current(), text),
+            onCancel: () => actions.cancel(current()),
+            onSendToMain: () => { void actions.sendToMain(current()) },
+            onClose: () => actions.close(current()),
+            onLocate: target => actions.locateCard(target ?? current()),
+            onExport: target => actions.exportCard(target ?? current()),
+            onInsert: target => actions.insertAnswer(target ?? current()),
+            onReplace: target => actions.insertAnswer(target ?? current(), { replace: true }),
+            onViewVersion: index => actions.viewVersion(current(), index),
+            onDelete: () => actions.deleteCard(current()),
+          }
+          cache.current.set(card.id, bundle)
+        }
+        return bundle
+      }, [actions])
+    }
+
     // ─────────────────────────────────────────────────────────────────────
     // §4.5 family singleton
     //
@@ -1430,20 +1554,63 @@ window.__ModuleLoader__.load({
       return cards.find(card => card.id === id)
     }
 
-    /** Append text to one card's streaming answer. */
-    function appendCardText(id, delta) {
-      const cards = store.state.cards.map(card => (
-        card.id === id ? { ...card, text: card.text + delta } : card
-      ))
-      store.set({ cards })
+    /**
+     * Hide the oldest finished cards once a stack exceeds its cap.
+     *
+     * Pure so the rule can be asserted without a renderer: the newest card and
+     * anything still streaming are never hidden, `open:false` cards are skipped
+     * (already hidden), and the input array is not mutated.
+     * @param {object[]} cards - newest first.
+     * @param {number} [cap] - how many may stay visible.
+     * @param {string|null} [keptId] - id that must survive this pass.
+     * @returns {object[]} the same list, with overflow entries closed.
+     */
+    function capLiveCards(cards, cap = MAX_LIVE_CARDS, keptId = null) {
+      if (!Array.isArray(cards) || cards.length <= cap) return cards
+      const next = [...cards]
+      let excess = next.length - cap
+      for (let index = next.length - 1; index >= 0 && excess > 0; index -= 1) {
+        const item = next[index]
+        if (item === null || item === undefined) continue
+        if (item.id === keptId || item.open === false) continue
+        if (item.status === 'pending' || item.status === 'streaming') continue
+        next[index] = { ...item, open: false }
+        excess -= 1
+      }
+      return next
     }
 
-    /** Append reasoning text to one card. */
-    function appendCardReasoning(id, delta) {
-      const cards = store.state.cards.map(card => (
-        card.id === id ? { ...card, reasoning: card.reasoning + delta } : card
-      ))
-      store.set({ cards })
+    /**
+     * Whether replayed card `index` comes back unfolded.
+     *
+     * The newest replay always does — a page load that hides everything would
+     * look like data loss — and the rest only while the running total stays
+     * inside the budget.
+     * @param {number} index - 0 = newest.
+     * @param {number} replayedChars - characters replayed so far, inclusive.
+     * @returns {boolean} true when the card should mount unfolded.
+     */
+    function replayCardOpen(index, replayedChars) {
+      return index === 0 || replayedChars <= REPLAY_OPEN_BUDGET_CHARS
+    }
+
+    /**
+     * Prepend one card, hiding the oldest FINISHED card once the stack grows
+     * past the live cap.
+     *
+     * Cards used to accumulate for the whole session: nothing capped
+     * `store.state.cards`, so a long session kept every answer mounted (each
+     * one a full React subtree). Past the cap the oldest finished card is
+     * hidden — `open:false` keeps its data, unmounts its body, and the durable
+     * history still offers it back. A card that is still streaming is never
+     * hidden: that would orphan its stream.
+     * @param {object} card - the card to put on top.
+     * @param {object} [extra] - additional store fields to commit in the same
+     *   update (the carrier's surface label, for instance).
+     */
+    function pushCard(card, extra = null) {
+      const cards = capLiveCards([card, ...store.state.cards], MAX_LIVE_CARDS, card.id)
+      store.set(extra === null ? { cards } : { ...extra, cards })
     }
 
     /** Show a transient toast line. */
@@ -4431,6 +4598,19 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           : null)
     }
 
+    /**
+     * Memoised {@link AnswerCard}.
+     *
+     * Only the card that actually changed gets a new `card` object
+     * (`patchCard` / the stream flush keep every other card by reference), and
+     * the handler bundle from {@link useCardHandlers} is stable per id — so a
+     * delta on card A no longer re-renders cards B..N. `React.memo` is probed
+     * because the test double (and any trimmed-down React a host might hand a
+     * plugin) does not have to implement it; without it this is the same
+     * component, just un-memoised.
+     */
+    const MemoAnswerCard = typeof React.memo === 'function' ? React.memo(AnswerCard) : AnswerCard
+
     /**
      * The flow surface, i.e. the floating layer (A).
      *
@@ -4450,6 +4630,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
       const containerRef = React.useRef(null)
       const dockRef = React.useRef(null)
       const state = useStoreState()
+      const handlersFor = useCardHandlers(actions)
       const [dock, setDock] = React.useState(null)
       const visible = cards.filter(card => card.surface === 'flow' && card.open)
       const total = visible.length
@@ -4563,16 +4744,20 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
         }
         if (typeof window.addEventListener === 'function') window.addEventListener('resize', schedule)
         // Opening/closing the rail changes no size this effect already watches,
-        // so the DOM itself has to be the trigger. Attributes only (no
-        // childList): streaming tokens rewrite text nodes continuously and must
-        // not wake the layer on every frame.
+        // so the DOM itself has to be the trigger. The two data attributes are
+        // the only signals that MEAN "the rail geometry changed". `class` and
+        // `style` used to be in this list too, and a chat pane rewrites both
+        // constantly (hover, scroll state, streaming badges) — every one of
+        // those woke this observer and forced a layout read on the next frame.
+        // Streaming tokens rewrite text nodes, which `childList`-free observing
+        // already ignores.
         if (typeof window.MutationObserver === 'function' && document.body !== null && document.body !== undefined) {
           try {
             mutation = new window.MutationObserver(schedule)
             mutation.observe(document.body, {
               attributes: true,
               subtree: true,
-              attributeFilter: ['data-sidebar-right-open', 'data-dockkit-pane-active', 'style', 'class'],
+              attributeFilter: ['data-sidebar-right-open', 'data-dockkit-pane-active'],
             })
           } catch { mutation = null }
         }
@@ -4625,24 +4810,14 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           : null),
       }, children)
 
-      const cardNodes = visible.map(card => h(AnswerCard, {
+      const cardNodes = visible.map(card => h(MemoAnswerCard, {
         key: card.id,
         card,
         surfaceLabel: null,
-        onCopy: element => actions.copy(card, element),
-        onFollowUp: text => actions.followUp(card, text),
-        onRetry: () => actions.retry(card),
-        onRetryEdit: text => actions.retryEdit(card, text),
-        onCancel: () => actions.cancel(card),
-        onSendToMain: () => actions.sendToMain(card),
-        onClose: () => actions.close(card),
-        onLocate: target => actions.locateCard(target ?? card),
-        onExport: target => actions.exportCard(target ?? card),
-        onInsert: target => actions.insertAnswer(target ?? card),
-        onReplace: target => actions.insertAnswer(target ?? card, { replace: true }),
-        onViewVersion: index => actions.viewVersion(card, index),
         onFloatMode: setFloatMode,
-        onDelete: () => actions.deleteCard(card),
+        // Stable per card id (see useCardHandlers), which is what lets
+        // React.memo skip every card that did not change in this tick.
+        ...handlersFor(card),
       }))
 
       if (mode === 'capsule') {
@@ -5646,37 +5821,47 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           if (cap > 0 && (currentRaw === null || currentRaw === undefined)) {
             writePersisted(saved)
           }
-          const replayed = saved.map(entry => ({
-            id: entry.id,
-            question: entry.question,
-            selected: String(entry.selected ?? ''),
-            selection: String(entry.selection ?? ''),
-            text: String(entry.text ?? ''),
-            reasoning: String(entry.reasoning ?? ''),
-            status: entry.status === 'stopped' ? 'stopped' : 'done',
-            carrier: 'side',
-            zone: entry.zone,
-            truncated: entry.truncated === true,
-            droppedChars: Number(entry.droppedChars ?? 0),
-            streaming: null,
-            error: null,
-            provider: typeof entry.provider === 'string' && entry.provider !== '' ? entry.provider : null,
-            elapsedMs: Number.isFinite(entry.elapsedMs) ? entry.elapsedMs : null,
-            createdAt: Number.isFinite(entry.createdAt) ? entry.createdAt : 0,
-            // P2-5b: replayed versions stay switchable after a reload.
-            versions: replayVersions(entry.versions),
-            viewingVersion: null,
-            actionId: typeof entry.actionId === 'string' && entry.actionId !== '' ? entry.actionId : null,
-            // A native/better tab cannot survive a reload, so history always
-            // comes back on the flow stack where it is visible immediately.
-            surface: 'flow',
-            open: true,
-            history: Array.isArray(entry.history)
-              ? entry.history
-                  .filter(turn => turn !== null && typeof turn === 'object')
-                  .map(turn => ({ question: String(turn.question ?? ''), answer: String(turn.answer ?? '') }))
-              : [],
-          }))
+          // Replay budget: the newest card always comes back unfolded, and the
+          // rest stay unfolded only while the running total of replayed
+          // characters stays under the budget. A page load used to mount up to
+          // 10 × 64 k characters of markdown before it was usable; past the
+          // budget the older cards come back collapsed and are parsed when the
+          // user opens them.
+          let replayedChars = 0
+          const replayed = saved.map((entry, index) => {
+            replayedChars += String(entry.text ?? '').length + String(entry.reasoning ?? '').length
+            return {
+              id: entry.id,
+              question: entry.question,
+              selected: String(entry.selected ?? ''),
+              selection: String(entry.selection ?? ''),
+              text: String(entry.text ?? ''),
+              reasoning: String(entry.reasoning ?? ''),
+              status: entry.status === 'stopped' ? 'stopped' : 'done',
+              carrier: 'side',
+              zone: entry.zone,
+              truncated: entry.truncated === true,
+              droppedChars: Number(entry.droppedChars ?? 0),
+              streaming: null,
+              error: null,
+              provider: typeof entry.provider === 'string' && entry.provider !== '' ? entry.provider : null,
+              elapsedMs: Number.isFinite(entry.elapsedMs) ? entry.elapsedMs : null,
+              createdAt: Number.isFinite(entry.createdAt) ? entry.createdAt : 0,
+              // P2-5b: replayed versions stay switchable after a reload.
+              versions: replayVersions(entry.versions),
+              viewingVersion: null,
+              actionId: typeof entry.actionId === 'string' && entry.actionId !== '' ? entry.actionId : null,
+              // A native/better tab cannot survive a reload, so history always
+              // comes back on the flow stack where it is visible immediately.
+              surface: 'flow',
+              open: replayCardOpen(index, replayedChars),
+              history: Array.isArray(entry.history)
+                ? entry.history
+                    .filter(turn => turn !== null && typeof turn === 'object')
+                    .map(turn => ({ question: String(turn.question ?? ''), answer: String(turn.answer ?? '') }))
+                : [],
+            }
+          })
           store.set({ cards: [...replayed, ...store.state.cards] })
         }
 
@@ -5750,7 +5935,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             if (store.state.cards.some(card => card.id === id)) {
               patchCard(id, { surface: 'flow', open: true })
             } else {
-              store.set({ cards: [historyEntryToCard(entry), ...store.state.cards] })
+              pushCard(historyEntryToCard(entry))
             }
             // A collapsed (capsule) layer would swallow the restored card;
             // this is a session-only override, exactly like clicking expand.
@@ -5879,7 +6064,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               actionId: payload?.actionId ?? null,
             }
             if (payload.carrier === 'main') {
-              store.set({ cards: [card, ...store.state.cards] })
+              pushCard(card)
               try {
                 const result = await askInMainConversation({
                   ctx,
@@ -5905,7 +6090,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             }
             const { adapter, fellBack } = pickSurface(config.sideSurface)
             card.surface = adapter.kind
-            store.set({ cards: [card, ...store.state.cards], surface: adapter.kind })
+            pushCard(card, { surface: adapter.kind })
             if (fellBack) {
               store.set({ surfaceNote: t('surfaceFellBack', { name: adapter.label() }) })
               toast(t('surfaceUnavailable'))
@@ -6241,31 +6426,65 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
         const pendingReasonings = new Map()
         let deltaFlushTimer = null
 
+        /**
+         * Commit every buffered chunk for this tick as ONE store update.
+         *
+         * The previous shape published text and reasoning separately, so a
+         * single 50 ms tick could bump the store twice per streaming card —
+         * and every bump re-renders the whole overlay. With the concurrency
+         * cap at 3 that is up to 120 tree renders per second for two string
+         * appends. Cards that saw no chunk keep their identity, so a memoised
+         * card is not touched at all.
+         */
         const flushStreamBuffers = () => {
           if (deltaFlushTimer !== null) {
             clearTimeout(deltaFlushTimer)
             deltaFlushTimer = null
           }
-          if (pendingDeltas.size > 0) {
-            for (const [cardId, chunk] of [...pendingDeltas.entries()]) appendCardText(cardId, chunk)
-            pendingDeltas.clear()
-          }
-          if (pendingReasonings.size > 0) {
-            for (const [cardId, chunk] of [...pendingReasonings.entries()]) appendCardReasoning(cardId, chunk)
-            pendingReasonings.clear()
+          if (pendingDeltas.size === 0 && pendingReasonings.size === 0) return
+          const cards = store.state.cards.map((card) => {
+            const text = pendingDeltas.get(card.id)
+            const reasoning = pendingReasonings.get(card.id)
+            if (text === undefined && reasoning === undefined) return card
+            const next = { ...card }
+            if (text !== undefined) next.text = `${card.text}${text}`
+            if (reasoning !== undefined) next.reasoning = `${card.reasoning}${reasoning}`
+            return next
+          })
+          pendingDeltas.clear()
+          pendingReasonings.clear()
+          store.set({ cards })
+        }
+
+        /**
+         * Milliseconds to wait before the next flush.
+         *
+         * 50 ms is the "feels live" cadence, but the cost of one frame grows
+         * with the answer: `renderRichText` measured 0.2–0.3 ms at 8 k
+         * characters and 1.2–2.0 ms at 64 k. Past 32 k a 100 ms cadence is
+         * indistinguishable to the eye and halves the work.
+         * @returns {number} the delay for the next flush tick.
+         */
+        const streamFlushDelay = () => {
+          let longest = 0
+          for (const card of store.state.cards) {
+            if (card.status === 'streaming' && typeof card.text === 'string' && card.text.length > longest) {
+              longest = card.text.length
+            }
           }
+          return longest > STREAM_SLOW_CHARS ? STREAM_FLUSH_SLOW_MS : STREAM_FLUSH_MS
         }
 
         const bufferStreamDelta = (cardId, chunk) => {
           if (chunk === '') return
           pendingDeltas.set(cardId, (pendingDeltas.get(cardId) ?? '') + chunk)
-          if (deltaFlushTimer === null) deltaFlushTimer = setTimeout(flushStreamBuffers, 50)
+          if (deltaFlushTimer === null) deltaFlushTimer = setTimeout(flushStreamBuffers, streamFlushDelay())
         }
 
         const bufferStreamReasoning = (cardId, chunk) => {
           if (chunk === '') return
           pendingReasonings.set(cardId, (pendingReasonings.get(cardId) ?? '') + chunk)
-          if (deltaFlushTimer === null) deltaFlushTimer = setTimeout(flushStreamBuffers, 50)
+          if (deltaFlushTimer === null) deltaFlushTimer = setTimeout(flushStreamBuffers, streamFlushDelay())
         }
 
         /** Stream one side answer into its card. */
@@ -6868,7 +7087,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           }
           return h('div', { className: 'dsa-settings', 'data-dsa-root': '', 'data-dsa-rail-host': '', style: { padding: '10px' } },
             h(Styles, null),
-            h(AnswerCard, {
+            h(MemoAnswerCard, {
               card,
               surfaceLabel: state.surface === 'better-sidebar' ? t('surfaceBetter') : t('surfaceNative'),
               onCopy: element => actions.copy(card, element),
@@ -7043,6 +7262,15 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
           CARD_KIND,
           CARD_KIND_BETTER,
           HISTORY_TURNS,
+          API_ROOT,
+          apiBaseAfter,
+          MAX_LIVE_CARDS,
+          REPLAY_OPEN_BUDGET_CHARS,
+          STREAM_FLUSH_MS,
+          STREAM_FLUSH_SLOW_MS,
+          STREAM_SLOW_CHARS,
+          capLiveCards,
+          replayCardOpen,
           estimateLabelWidth,
           parseSseBlock,
           truncateSelection,

package/index.js

@@ -45,7 +45,7 @@ export const name = 'dsh-sidecard-ask'
 export const inject = ['webServer']
 
 /** Version of this plugin (kept in step with package.json by test/verify.mjs). */
-export const PLUGIN_VERSION = '2.0.2'
+export const PLUGIN_VERSION = '2.1.0'
 
 /** Route prefix of the plugin's own API. */
 export const ROUTE_PREFIX = '/sidecard-ask/api'
@@ -2591,8 +2591,13 @@ export function apply(ctx, patchConfig) {
   /**
    * The HTTP methods the plugin serves; kept in one place because the route
    * registration has two shapes (see below).
+   *
+   * `ping` is the one method that answers WITHOUT the browser session: it is
+   * the only way a script, a CI job or a monitor can tell "the plugin is up"
+   * apart from "the Host is up" once the session gate is in front of
+   * everything else. It exposes nothing but the version and the Host clock.
    */
-  const API_METHODS = ['state', 'ask', 'cancel', 'config', 'reset', 'diagnose', 'feedback']
+  const API_METHODS = ['ping', 'state', 'ask', 'cancel', 'config', 'reset', 'diagnose', 'feedback']
 
   /**
    * The Host's own browser-session gate, borrowed for the plugin's routes.
@@ -2643,16 +2648,11 @@ export function apply(ctx, patchConfig) {
       writeError(res, 403, 'forbidden', 'forbidden')
       return
     }
-    const unauthorized = authRejection(req)
-    if (unauthorized !== undefined) {
-      writeError(
-        res,
-        unauthorized,
-        unauthorized === 401 ? 'unauthorized' : 'forbidden',
-        unauthorized === 401 ? '需要先通过 DSH 登录（宿主会话未认证）' : '请求来源不受信任',
-      )
-      return
-    }
+    // Path parsing runs BEFORE the session gate now, because `ping` must be
+    // answerable without a browser session. The order is deliberate: the fence
+    // still rejects a foreign origin first, the method name is validated
+    // before anything is dispatched, and `ping` is the ONLY verb that skips the
+    // gate — everything else falls through to it immediately below.
     const pathname = new URL(req.url ?? '/', 'http://dsh.internal').pathname
     const method = pathname.startsWith(`${ROUTE_PREFIX}/`)
       ? pathname.slice(ROUTE_PREFIX.length + 1)
@@ -2663,6 +2663,24 @@ export function apply(ctx, patchConfig) {
       writeError(res, 404, 'not-found', `未知接口 "${method}"`)
       return
     }
+    if (method === 'ping') {
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        writeError(res, 405, 'method-error', 'method not allowed')
+        return
+      }
+      writeOk(res, { version: PLUGIN_VERSION, at: Date.now() })
+      return
+    }
+    const unauthorized = authRejection(req)
+    if (unauthorized !== undefined) {
+      writeError(
+        res,
+        unauthorized,
+        unauthorized === 401 ? 'unauthorized' : 'forbidden',
+        unauthorized === 401 ? '需要先通过 DSH 登录（宿主会话未认证）' : '请求来源不受信任',
+      )
+      return
+    }
     // Everything that can throw runs inside ONE try: `/state` assembles the
     // whole diagnostic surface (capabilities, SMTP resolution, provenance), and
     // it used to sit outside this block, so a single bad config value answered

package/package.json

@@ -1,69 +1,69 @@
-{
-  "name": "dsh-sidecard-ask",
-  "version": "2.0.2",
-  "description": "DSH 划词追问（侧边卡片作答）：在聊天区与任务区选中文本就地追问，答案由独立子代理在侧边卡片里流式呈现，也可选择落回主对话。",
-  "type": "module",
-  "main": "index.js",
-  "scripts": {
-    "test": "node test/verify.mjs && node test/contract-test.mjs && node test/float-placement.mjs && node test/smoke-test.mjs"
-  },
-  "exports": {
-    ".": "./index.js",
-    "./client": "./client.js",
-    "./package.json": "./package.json",
-    "./locale/*.json": "./locale/*.json"
-  },
-  "files": [
-    "index.js",
-    "client.js",
-    "cordis.patch.yml",
-    "locale/*.json",
-    "icon.svg",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "license": "MIT",
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "selection",
-    "划词",
-    "选中追问",
-    "ask",
-    "side-card",
-    "侧边卡片"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/HERO476/dsh-sidecard-ask.git"
-  },
-  "homepage": "https://github.com/HERO476/dsh-sidecard-ask#readme",
-  "bugs": {
-    "url": "https://github.com/HERO476/dsh-sidecard-ask/issues"
-  },
-  "icon": "./icon.svg",
-  "meta": {
-    "title": "侧边卡片追问",
-    "description": "选中聊天或任务里的文本就地追问；答案由独立子代理在侧边卡片里流式呈现（也可落回主对话）。"
-  },
-  "dsh": {
-    "manifestVersion": 1,
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "immediately": true,
-      "inject": [
-        "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-ui-slots",
-        "@deepseek-ai/dsh-client-ui-conversation"
-      ]
-    }
-  }
-}
+{
+  "name": "dsh-sidecard-ask",
+  "version": "2.1.0",
+  "description": "DSH 划词追问（侧边卡片作答）：在聊天区与任务区选中文本就地追问，答案由独立子代理在侧边卡片里流式呈现，也可选择落回主对话。",
+  "type": "module",
+  "main": "index.js",
+  "scripts": {
+    "test": "node test/verify.mjs && node test/contract-test.mjs && node test/float-placement.mjs && node test/smoke-test.mjs"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "selection",
+    "划词",
+    "选中追问",
+    "ask",
+    "side-card",
+    "侧边卡片"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HERO476/dsh-sidecard-ask.git"
+  },
+  "homepage": "https://github.com/HERO476/dsh-sidecard-ask#readme",
+  "bugs": {
+    "url": "https://github.com/HERO476/dsh-sidecard-ask/issues"
+  },
+  "icon": "./icon.svg",
+  "meta": {
+    "title": "侧边卡片追问",
+    "description": "选中聊天或任务里的文本就地追问；答案由独立子代理在侧边卡片里流式呈现（也可落回主对话）。"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ]
+    }
+  }
+}