dsh-sidecard-ask 2.1.7 → 2.1.9

package/index.js

@@ -45,7 +45,7 @@ export const name = 'dsh-sidecard-ask'
 export const inject = ['webServer']
 
 /** Version of this plugin (kept in step with package.json by test/verify.mjs). */
-export const PLUGIN_VERSION = '2.1.7'
+export const PLUGIN_VERSION = '2.1.9'
 
 /** Route prefix of the plugin's own API. */
 export const ROUTE_PREFIX = '/sidecard-ask/api'
@@ -127,6 +127,9 @@ export const DEFAULT_CONFIG = {
    * floating layer is used either way.
    */
   dockRail: true,
+  // 2.1.9: expand the floating layer when an answer settles, so the answer is
+  // visible in the side card instead of hiding behind the capsule pill.
+  autoExpandOnDone: true,
   /**
    * One-click quick actions rendered beside the selection trigger.
    *
@@ -534,7 +537,7 @@ export function sanitizeLayer(raw, problems = []) {
     if (value !== null && (value === '' || looksLikeEmail(value))) out.feedbackSmtpFrom = value
     else problems.push('feedbackSmtpFrom: 必须是合法邮箱或空字符串，已忽略')
   }
-  for (const boolKey of ['showInUnclassified', 'notifyOnDone', 'contextMenu', 'followUpSuggestions', 'dockRail']) {
+  for (const boolKey of ['showInUnclassified', 'notifyOnDone', 'contextMenu', 'followUpSuggestions', 'dockRail', 'autoExpandOnDone']) {
     if (raw[boolKey] === undefined) continue
     if (typeof raw[boolKey] === 'boolean') out[boolKey] = raw[boolKey]
     else problems.push(`${boolKey}: 必须是布尔值，已忽略`)
@@ -1346,7 +1349,12 @@ export function readOnlyToolFilter(ctx) {
   if (!Array.isArray(known)) return undefined
   const names = new Set(known.map(schema => schema?.name).filter(name => typeof name === 'string'))
   const allow = READONLY_TOOL_NAMES.filter(name => names.has(name))
-  return allow.length === 0 ? undefined : { allow }
+  // A registry that answered but names NONE of our read-only tools cannot
+  // honour the guard. Returning `undefined` here made the child inherit every
+  // parent tool (fail-open) while the card only said "unsupported" — the guard
+  // disappeared exactly when a host upgrade renamed things.
+  if (allow.length === 0) return { blocked: 'no-readonly-guard' }
+  return { allow }
 }
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -1762,6 +1770,7 @@ function createSideEngine(ctx, configOf) {
     ]
     const seen = new Set()
     let fallback
+    let live
     for (const agent of listed) {
       const id = agentSessionId(agent)
       if (id === undefined || seen.has(id)) continue
@@ -1769,11 +1778,16 @@ function createSideEngine(ctx, configOf) {
       const isArchived = archived.has(id)
       candidates.push({ id, archived: isArchived })
       if (fallback === undefined) fallback = { agent, id, archived: isArchived }
-      if (!isArchived) return { agent, id, archived: false, candidates }
-    }
-    return fallback === undefined
+      if (live === undefined && !isArchived) live = { agent, id, archived: false }
+    }
+    // A caller that NAMED a session which is not live is answered by another
+    // one (the host's historical fallback — older clients depend on it), but the
+    // start frame now says WHICH session answered so the card can show it
+    // instead of silently publishing into an unfamiliar conversation.
+    const chosen = live ?? fallback
+    return chosen === undefined
       ? { agent: undefined, id: undefined, archived: false, candidates }
-      : { ...fallback, candidates }
+      : { ...chosen, candidates }
   }
 
   /**
@@ -1967,6 +1981,20 @@ function createSideEngine(ctx, configOf) {
       const preset = typeof config.sideAgentPreset === 'string' ? config.sideAgentPreset.trim() : ''
       const presetSupported = caps?.agentPreset === true
       const presetInForce = config.sideTools === 'readonly' && preset !== '' && presetSupported
+      // 2.1.9: the read-only guard must fail CLOSED. Without a preset there is
+      // no other real narrowing channel on this host, so a guard we cannot
+      // build is a refusal, not an inheritance.
+      if (config.sideTools === 'readonly' && !presetInForce
+        && toolFilter !== undefined && toolFilter.blocked === 'no-readonly-guard') {
+        sink.send('error', {
+          id,
+          code: 'no-readonly-guard',
+          message: '这台宿主的工具注册表里认不出任何只读工具，无法保证侧边作答只读，已拒绝本次作答',
+          retryable: false,
+          fallback: 'main',
+        })
+        return
+      }
       // Style and the user's own extra instruction ride the SAME persona
       // string, so the "persona vs prompt" gate above covers all three of
       // them with one branch — there is no second injection point.
@@ -1979,7 +2007,7 @@ function createSideEngine(ctx, configOf) {
         signal: controller.signal,
         ...(personaSupported ? { persona: personaText } : {}),
         ...(presetInForce ? { agentPreset: preset } : {}),
-        ...(toolFilter === undefined || !toolFilterSupported ? {} : { toolFilter }),
+        ...(toolFilter === undefined || toolFilter.allow === undefined || !toolFilterSupported ? {} : { toolFilter }),
       })
       runRecord.dispose = run.dispose
 
@@ -2005,12 +2033,20 @@ function createSideEngine(ctx, configOf) {
           ? 'inherit'
           : (presetInForce
             ? 'preset'
-            : (toolFilter === undefined
-              ? 'unsupported'
-              : (toolFilterSupported ? 'applied' : 'unsupported'))),
+            : (toolFilter !== undefined && toolFilter.blocked !== undefined
+              ? 'blocked'
+              : (toolFilter === undefined
+                ? 'unsupported'
+                : (toolFilterSupported ? 'applied' : 'unsupported')))),
         agentPreset: presetInForce ? preset : null,
         persona: personaSupported ? 'section' : 'prompt',
         parentArchived: parent.archived === true,
+        // The session that actually owns this child. A mismatch with the
+        // requested session is shown on the card, never silently absorbed.
+        parentSessionId: parent.id ?? null,
+        requestedSessionId: typeof request.sessionId === 'string' && request.sessionId !== ''
+          ? request.sessionId
+          : null,
       })
 
       const childId = run.id
@@ -2698,6 +2734,25 @@ export function apply(ctx, patchConfig) {
       writeError(res, 400, 'invalid-config', problems.join('；'))
       return
     }
+    // 2.1.9: changing WHERE mail is sent (host/port/tls/user) invalidates the
+    // stored authorization code. Keeping it made "host:" a one-field takeover:
+    // point the host at an attacker and the next /feedback hands them the
+    // password in cleartext AUTH PLAIN. Losing the password is recoverable;
+    // leaking it is not.
+    const endpointChanged = ['feedbackSmtpHost', 'feedbackSmtpPort', 'feedbackSmtpSecure', 'feedbackSmtpUser']
+      .some(key => accepted[key] !== undefined && String(accepted[key]) !== String(state.config[key] ?? ''))
+    if (endpointChanged && accepted.feedbackSmtpPass === undefined) {
+      delete userLayer.feedbackSmtpPass
+      problems.push('SMTP 目标已变更，已保存的授权码随之作废，请重新填写')
+    }
+    // The side answerer inheriting the whole tool set is the one irreversible
+    // kind of change here (a page-level script can ask the host to run with the
+    // session's tools). A written confirmation does not stop same-origin code,
+    // but it stops the accident and makes the intent auditable.
+    if (accepted.sideTools === 'inherit' && body.confirmInheritTools !== true) {
+      writeError(res, 400, 'privileged-key', 'sideTools=inherit 需要显式确认（confirmInheritTools: true）')
+      return
+    }
     userLayer = { ...userLayer, ...accepted }
     const saved = writePersistedConfig(userLayer, ctx.logger)
     if (!saved.ok) {

package/locale/en.json

@@ -41,5 +41,7 @@
   "versionViewing": "Viewing an older version (read-only)",
   "suggestionsLabel": "Suggested follow-ups",
   "setFollowUps": "Suggest follow-ups at the end",
-  "setFollowUpsHint": "The model ends each answer with a <followups> block of 2–3 next questions, rendered as clickable chips (no extra request)"
+  "setFollowUpsHint": "The model ends each answer with a <followups> block of 2–3 next questions, rendered as clickable chips (no extra request)",
+  "setAutoExpandOnDone": "Expand the card when the answer finishes",
+  "setAutoExpandOnDoneHint": "On: the answer appears in the card the moment it settles. Off: the one-line capsule stays until you click it"
 }

package/locale/zh.json

@@ -41,5 +41,7 @@
   "versionViewing": "正在查看历史版本（只读）",
   "suggestionsLabel": "建议追问",
   "setFollowUps": "答案末尾给出建议追问",
-  "setFollowUpsHint": "开启后模型会用 <followups> 块在答案末尾给出 2–3 个可点的下一步问题，点一下即追问（不额外发请求）"
+  "setFollowUpsHint": "开启后模型会用 <followups> 块在答案末尾给出 2–3 个可点的下一步问题，点一下即追问（不额外发请求）",
+  "setAutoExpandOnDone": "答完自动展开卡片",
+  "setAutoExpandOnDoneHint": "开启后，回答一结束就展开成卡片显示正文；关闭后保持一行胶囊，点一下才展开"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-sidecard-ask",
-  "version": "2.1.7",
+  "version": "2.1.9",
   "description": "DSH 划词追问（侧边卡片作答）：在聊天区与任务区选中文本就地追问，答案由独立子代理在侧边卡片里流式呈现，也可选择落回主对话。",
   "type": "module",
   "main": "index.js",
@@ -21,7 +21,8 @@
     "icon.svg",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "NODE-HOST-CONTRACT.md"
   ],
   "engines": {
     "node": ">=20",