dsh-sidecard-ask 2.1.4 → 2.1.5

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 2.1.5
+
+**主题：修完「技术方案评审团」在 0.2.1-rc.3（桌面 Electron 44.7.0 / 网页端同源）上复核出的 8 条缺陷。**
+四套脚本全绿（57 / 1454 / 100 / 279 = 1890），新增 10 条回归断言。
+
+### 修复
+
+- **R1（中）原生栏把卡迁回浮层时没展开，卡在两端同时不可见**。`surfaces.native.open()` 只把
+  被挤出的卡 `surface` 改回 `'flow'`，但浮层只挂载 `surface === 'flow' && open` 的卡
+  （`FloatingLayer`），于是那张卡既不在栏里、也不在屏幕上，流式输出还继续往它里面写。
+  现在迁移时一并置 `open: true`。
+- **R2（中）关 A 卡片会关掉 B 的 tab**。`close()` 认领 tab 的判据是"`contentId` 为空就算我的"，
+  而单地址模型下栏里那条 tab 可能正显示另一张卡；`this.cardId` 已被清空时（页面重载后）
+  就会误关别人的 tab，连带把别人的正文一起关掉。现在要求 `contentId === 本卡 id`，或
+  宿主没报 `contentId` 且适配器仍持有本卡地址。
+- **R3（中）删历史 / 删卡片不释放原生栏的 tab**。tab 是宿主自己的状态，不随 `store.cards`
+  变化；删掉卡片后页面里留着一张渲染"已不存在卡片"的空壳，直到用户手动关。新增
+  `releaseNativeTab(id)`，`deleteHistoryCard` / `deleteCard` / `clearHistory`（仅历史态卡）都会调用。
+- **R4（中）设置页把只读开关标成"只读（推荐）"，而 0.2.1-rc.3 上它根本不生效**。
+  宿主的 `SubagentCapabilities` 没有 `toolFilter`，`readOnlyToolFilter()` 返回的白名单会被丢弃，
+  侧边作答实际继承会话全部工具——卡片上的 `toolFilter: 'unsupported'` 是对的，但设置页的
+  "推荐"是假的。标签改为「只读（需宿主支持，0.2.1 无效）」。
+- **R5（低）`setSideToolsHint` 谎称"只读靠探针自动拒写"**。代码里没有任何"拒写探针"，
+  真实机制是 `toolFilter`（宿主不支持即失效）或 `agentPreset`（0.2.1-rc.3 支持）。文案改为
+  指向 preset，并写明版本前提。
+- **R6（中）`/cancel` 不校验归属**。`runs` 是进程级全局表，任何已认证页面拿到（或猜到）一个
+  run id 就能打断别的会话的追问。run 记录现在带 `sessionId`，`cancel(id, sessionId)` 在双方
+  都已知且不一致时按"没找到"处理；不带 `sessionId` 的老客户端保持可用。
+- **R8（低）写盘失败的报错只有 errno 原文**。`toWireError()` 现按 `EACCES` / `EPERM` / `EROFS` /
+  `ENOSPC` / `EBUSY` / `ENOENT` 追加中文处置提示，`error.code` 不变（程序分支仍按码判断）。
+
+### 评估后不改
+
+- **R7 `/state` 回配置文件的绝对路径**：该接口要求宿主登录（页面外是 `401 unauthorized`），
+  且这个字段是设置页"到底读的哪个文件"的唯一依据。已写进 README §隐私与安全第 16 条，
+  说明暴露面边界与转发时的处置办法。
+
 ## 2.1.4
 
 **主题：把「技术方案评审团」查出的 11 条缺陷一次修完。四套脚本全绿，新增 21 条回归断言。**

package/README.md

@@ -1088,4 +1088,12 @@ npm deprecate "<旧包名>@*" "Renamed to <新包名> - <原因>"       # 旧名
 15. **部署前缀不带尾斜杠时（2.1.0）**：`API` 基址会先按 `document.baseURI` 猜一次，若得到 404
     则回退到根绝对路径重试一次。这是唯一安全的判别方式（401/403 都不能用来改基址），
     代价是每次页面加载最多多一次 404 往返——正常部署下不会触发。
+16. **`/state` 会回配置文件的绝对路径（`provenance.persistedPath`，2.1.5 复核后保留）**：这是设置页
+    用来说明"到底读的是哪个文件"的诊断字段，且该接口要求宿主登录（页面外拿到的是
+    `401 unauthorized`）。它**不是**无鉴权暴露面；如果你把 `/state` 的响应转发到别处，请自行删掉
+    这个字段。同一响应里的 `persistedError` 会带上 errno 的中文提示（`EACCES` / `EPERM` /
+    `ENOSPC` / `EBUSY` 等），原始错误码仍保留在 `error.code` 上供程序分支。
+17. **`/cancel` 校验归属（2.1.5）**：请求体带 `sessionId` 且与 run 的发起会话不一致时，按"没找到"
+    返回 `cancelled: false`（不回 403，避免把别的会话的 run id 是否存在当成探测面）。不带
+    `sessionId` 的老客户端仍然可以取消——向后兼容优先于收紧。
 

package/client.js

@@ -117,7 +117,7 @@ window.__ModuleLoader__.load({
      * the Host and the module's `api.version` both read it, so a report can
      * never claim a generation the browser is not actually running.
      */
-    const CLIENT_VERSION = '2.1.4'
+    const CLIENT_VERSION = '2.1.5'
 
     /**
      * Tab kind served by the DSH native right rail (also its implementation id).
@@ -707,9 +707,9 @@ window.__ModuleLoader__.load({
         setMinChars: '最小触发字符数',
         setConcurrency: '并发作答上限',
         setSideTools: '侧边作答工具权限',
-        setSideToolsReadonly: '只读（推荐）',
+        setSideToolsReadonly: '只读（需宿主支持，0.2.1 无效）',
         setSideToolsInherit: '继承当前会话',
-        setSideToolsHint: '在 0.2.1 上，只读靠探针自动拒写，不依赖此开关；要彻底收窄工具，请填写下面的 preset',
+        setSideToolsHint: '这个开关只在宿主支持工具白名单时才生效；0.2.1-rc.3 不支持，侧边作答会继承当前会话的全部工具。要真正收窄，请填写下面的 preset（0.2.1-rc.3 已支持）。',
         setSideAgentPreset: '只读 preset（可选）',
         setSideAgentPresetPlaceholder: '留空则不启用',
         setSideAgentPresetHint: '子代理以该 agent preset 启动，工具集由 preset 决定（0.2.1 唯一可靠的收窄通道）；留空时退回探针拒写',
@@ -982,9 +982,9 @@ window.__ModuleLoader__.load({
         setMinChars: 'Minimum selection length',
         setConcurrency: 'Max concurrent answers',
         setSideTools: 'Side answerer tool access',
-        setSideToolsReadonly: 'Read-only (recommended)',
+        setSideToolsReadonly: 'Read-only (needs host support; no-op on 0.2.1)',
         setSideToolsInherit: 'Inherit from the session',
-        setSideToolsHint: 'On 0.2.1 read-only is enforced by the write-refusing probe, not by this switch; set a preset below to narrow the tool set itself',
+        setSideToolsHint: 'This switch only works when the host supports a tool allow-list; 0.2.1-rc.3 does not, so the side answerer inherits every tool of the session. To really narrow it, set the preset below (supported on 0.2.1-rc.3).',
         setSideAgentPreset: 'Read-only preset (optional)',
         setSideAgentPresetPlaceholder: 'Leave empty to disable',
         setSideAgentPresetHint: 'Starts the subagent with this agent preset, so the preset decides the tool set — the only reliable narrowing channel on 0.2.1; when empty the write-refusing probe is the fallback',
@@ -2322,7 +2322,11 @@ window.__ModuleLoader__.load({
           // 继续往一张看不见的卡片里写。
           for (const other of store.state.cards) {
             if (other.id !== card.id && other.surface === 'native-rightbar') {
-              patchCard(other.id, { surface: 'flow' })
+              // `open: true` is load-bearing: the floating layer only mounts a
+              // card whose `surface === 'flow'` AND `open` is true, so migrating
+              // a card back to the flow while leaving it folded hid it on BOTH
+              // surfaces — not in the rail, not on screen, still streaming.
+              patchCard(other.id, { surface: 'flow', open: true })
             }
           }
           this.cardId = card.id
@@ -2356,12 +2360,15 @@ window.__ModuleLoader__.load({
           const row = Array.isArray(rows)
             ? rows.find(entry => entry?.kind === CARD_KIND
               && typeof entry?.tabId === 'string' && entry.tabId !== ''
-              // 单地址模型下这里只该有一行；万一宿主保留了多行，必须关"属于这张
-              // 卡片"的那一行（openTab 把 cardId 写进 params → contentId），
-              // 否则会替另一张卡片关掉它的 tab。
-              && (typeof entry?.contentId !== 'string'
-                || entry.contentId === ''
-                || entry.contentId === card.id)
+              // Ownership, not just kind. The tab belongs to this card when the
+              // host echoes the id it was opened with (`openTab` carries it in
+              // `params.cardId`, which the rail publishes as `contentId`), or
+              // when the host reported no id at all AND this adapter still holds
+              // that card's address. Claiming a tab merely because `contentId`
+              // was empty made "close A" close B's tab — and with it B's body.
+              && (entry.contentId === card.id
+                || ((entry.contentId === undefined || entry.contentId === null || entry.contentId === '')
+                  && this.cardId === card.id))
               && (typeof entry?.sessionId !== 'string'
                 || store.state.sessionId === null
                 || entry.sessionId === store.state.sessionId))
@@ -6129,6 +6136,26 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             : [],
         })
 
+        /**
+         * Close the right-rail tab when it is showing this card.
+         *
+         * The rail's tab is not derived from `store.cards`: deleting a card (or
+         * a history entry) only removed it from the stores, so a card that lived
+         * in the native rail left its tab behind — a body rendering an id that
+         * no longer exists, until the user closed it by hand. Only the tab this
+         * adapter actually opened is touched; `close` re-checks ownership.
+         * @param {string} id - the card id that is going away.
+         */
+        function releaseNativeTab(id) {
+          const native = surfaces.native
+          if (native === null || native === undefined) return
+          if (native.controller === null || native.controller === undefined) return
+          if (native.cardId !== id) return
+          try {
+            native.close({ id })
+          } catch { /* the rail owns its tab's lifetime */ }
+        }
+
         const actions = {
           openPopover(candidate) {
             // P2-2: the composer must be remembered BEFORE the popover's
@@ -6167,6 +6194,9 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             const next = store.state.history
               .filter(item => item.id !== id)
               .slice(0, historyCap())
+            // A deleted entry must not keep a right-rail tab alive: the tab is
+            // not part of the store, so nothing else would ever close it.
+            releaseNativeTab(id)
             writePersisted(next)
             store.set({
               history: next,
@@ -6194,7 +6224,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
             const controller = controllers.get(id)
             if (controller !== undefined) {
               controller.abort()
-              void postJson('cancel', { id }).catch(() => {})
+              void postJson('cancel', { id, sessionId: store.state.sessionId }).catch(() => {})
             }
             controllers.delete(id)
             pendingDeltas.delete(id)
@@ -6211,6 +6241,10 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
                 surfaces.native.close(card)
               } catch { /* the right rail owns its lifecycle */ }
             }
+            // A card restored from durable history has no live `surface`, so the
+            // branch above cannot see its tab; this checks the adapter's own
+            // address instead and is a no-op when nothing is on the rail.
+            releaseNativeTab(id)
             const next = store.state.history
               .filter(item => item.id !== id)
               .slice(0, historyCap())
@@ -6237,6 +6271,15 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
            * by definition: it is the one action allowed to drop the old keys.
            */
           clearHistory() {
+            // A history-only card that happens to sit on the rail loses its
+            // durable entry here; leaving the tab up would show a body for an
+            // entry the manager no longer has. A card that is still live keeps
+            // its tab — this action does not touch running cards.
+            const railCard = surfaces.native?.cardId
+            if (typeof railCard === 'string' && railCard !== ''
+              && !store.state.cards.some(card => card.id === railCard)) {
+              releaseNativeTab(railCard)
+            }
             try {
               for (const key of [PERSIST_KEY, PERSIST_V2_KEY, PERSIST_LEGACY_KEY]) {
                 window.localStorage?.removeItem(key)
@@ -6542,7 +6585,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               // so POST /cancel too. Fire-and-forget on purpose — the card is
               // already stopped locally, and a dead host must not turn the
               // Stop button into a failure.
-              void postJson('cancel', { id: card.id }).catch(() => {})
+              void postJson('cancel', { id: card.id, sessionId: store.state.sessionId }).catch(() => {})
             }
             patchCard(card.id, { status: 'stopped' })
           },
@@ -6591,7 +6634,7 @@ body[data-ds-dark-theme] .dsa-seg button[data-on="true"]:hover{
               controller.abort()
               // Same host-side release as the Stop button: closing a card
               // mid-stream must not leave the child running server-side.
-              void postJson('cancel', { id: card.id }).catch(() => {})
+              void postJson('cancel', { id: card.id, sessionId: store.state.sessionId }).catch(() => {})
             }
             controllers.delete(card.id)
             // A closed card's buffered-but-unflushed deltas belong to nobody:

package/index.js

@@ -45,7 +45,7 @@ export const name = 'dsh-sidecard-ask'
 export const inject = ['webServer']
 
 /** Version of this plugin (kept in step with package.json by test/verify.mjs). */
-export const PLUGIN_VERSION = '2.1.4'
+export const PLUGIN_VERSION = '2.1.5'
 
 /** Route prefix of the plugin's own API. */
 export const ROUTE_PREFIX = '/sidecard-ask/api'
@@ -1248,6 +1248,21 @@ export async function sendSmtpMessage(endpoint, mail, { timeoutMs = 20_000, now
   }
 }
 
+/**
+ * Plain-language hints for the filesystem errnos that actually reach a save on
+ * Windows/macOS/Linux. The raw `EACCES: permission denied, open '…'` line is
+ * accurate but tells a user nothing about what to do; the code stays on the
+ * wire (clients branch on it) and the hint is appended to the message.
+ */
+const ERRNO_HINTS = {
+  EACCES: '（没有写权限：检查文件是否被其它程序占用，或改用可写目录）',
+  EPERM: '（系统拒绝写入：文件可能被占用或只读）',
+  EROFS: '（所在磁盘是只读的）',
+  ENOSPC: '（磁盘空间不足，设置未保存）',
+  EBUSY: '（文件正被其它进程占用，请稍后重试）',
+  ENOENT: '（目标目录不存在）',
+}
+
 /**
  * Reduce any thrown value to a wire error the Client can present.
  * @param {unknown} error - the thrown value.
@@ -1258,7 +1273,15 @@ export function toWireError(error, fallbackCode = 'internal') {
   if (error !== null && typeof error === 'object') {
     const code = typeof error.code === 'string' && error.code !== '' ? error.code : undefined
     const message = typeof error.message === 'string' && error.message !== '' ? error.message : undefined
-    if (message !== undefined) return { code: code ?? fallbackCode, message }
+    if (message !== undefined) {
+      const hint = code !== undefined && Object.prototype.hasOwnProperty.call(ERRNO_HINTS, code)
+        ? ERRNO_HINTS[code]
+        : undefined
+      return {
+        code: code ?? fallbackCode,
+        message: hint === undefined || message.includes(hint) ? message : `${message}${hint}`,
+      }
+    }
   }
   return { code: fallbackCode, message: String(error) }
 }
@@ -1901,7 +1924,16 @@ function createSideEngine(ctx, configOf) {
 
     /** Detach this run's stream listener (frames are per attempt). */
     let detach = () => {}
-    const runRecord = { abort: () => controller.abort(), dispose: undefined }
+    const runRecord = {
+      abort: () => controller.abort(),
+      dispose: undefined,
+      // Which session asked. `runs` is process-global, so `/cancel` needs an
+      // owner to check against: without it any trusted page could abort any
+      // other session's run by guessing (or sniffing) a run id.
+      sessionId: typeof request.sessionId === 'string' && request.sessionId !== ''
+        ? request.sessionId
+        : null,
+    }
     runs.set(id, runRecord)
 
     try {
@@ -2123,10 +2155,28 @@ function createSideEngine(ctx, configOf) {
     }
   }
 
-  /** Abort one in-flight run. */
-  function cancel(id) {
+  /**
+   * Abort one in-flight run.
+   *
+   * `runs` is process-global: every session shares it. When both sides know the
+   * owning session and they differ, this is a cross-session cancel and is
+   * refused (it reports `false`, exactly like an unknown id, so it does not
+   * confirm that the id exists elsewhere). A request that cannot name its
+   * session is still honoured — older clients and scripted calls must keep
+   * working.
+   * @param {string} id - the run id.
+   * @param {string|null} [sessionId] - the session asking for the cancel.
+   * @returns {boolean} whether a run was aborted.
+   */
+  function cancel(id, sessionId = null) {
     const record = runs.get(id)
     if (record === undefined) return false
+    const owner = record.sessionId
+    if (typeof owner === 'string' && owner !== ''
+      && typeof sessionId === 'string' && sessionId !== ''
+      && owner !== sessionId) {
+      return false
+    }
     record.abort()
     return true
   }
@@ -2603,7 +2653,12 @@ export function apply(ctx, patchConfig) {
     // 只回本次取消的结果：`runs` 是跨会话的全局表，把它的 id 列表回给
     // 任意可信页面等于泄露别的会话正在追问的卡片 id（而 cancel 本身也不
     // 校验归属），Client 侧也没有任何地方消费这个字段。
-    writeOk(res, { cancelled: engine.cancel(id) })
+    // 归属校验：请求方必须带上自己的 sessionId，与 run 记录不一致时按"没
+    // 找到"处理（不回 403，避免把别的会话的 id 是否存在当成探测面）。
+    const sessionId = typeof body?.sessionId === 'string' && body.sessionId !== ''
+      ? body.sessionId
+      : null
+    writeOk(res, { cancelled: engine.cancel(id, sessionId) })
   }
 
   /** `/config` — merge a partial config into the user layer and persist it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-sidecard-ask",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "DSH 划词追问（侧边卡片作答）：在聊天区与任务区选中文本就地追问，答案由独立子代理在侧边卡片里流式呈现，也可选择落回主对话。",
   "type": "module",
   "main": "index.js",