dsh-workspace-plus 0.6.1 → 0.7.1

package/README.md

@@ -3,11 +3,11 @@
 [![npm version](https://img.shields.io/npm/v/dsh-workspace-plus.svg)](https://www.npmjs.com/package/dsh-workspace-plus)
 [![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/sen70s/dsh-workspace-plus)
 [![license](https://img.shields.io/npm/l/dsh-workspace-plus.svg)](https://github.com/Sen70s/dsh-workspace-plus/blob/main/LICENSE)
-
-**当前版本 `v0.6.1`** · 要求 DSH `>=0.1.7-rc.2`
-
+**当前版本 `v0.7.1`** · 要求 DSH `>=0.1.7-rc.2`
 DeepSeek Harness（DSH）的插件。一个插件，两个子功能，插件页里各占一行、可单独启停。
 
+DeepSeek Harness（DSH）的插件。一个插件，三个子功能，插件页里各占一行、可单独启停。
+
 | 子功能 | 说明 |
 | --- | --- |
 | **workspace+** | 一个工作区登记多个目录，每个目录一个标签。标签表注入每次请求，输入框打 `@` 也能直接引用 |
@@ -58,6 +58,8 @@ agent 直接去 D:\proj\backend，不会因为旁边有个 backend-legacy 而改
 
 装好即用。请求权限、询问用户、任务完成、中断、出错都会弹 toast，点一下就打开对应的对话。
 
+正常情况下，点通知不会再先闪一个终端窗口。首次注册 `dsh-notice:` 协议时（插件加载后就会发生），宿主会用系统自带的 `csc.exe` 把一个小助手（约 10 KB 的 `click-host.exe`）编译到 `~/.dsh/notice/` 并缓存；之后点击由这个助手在无窗口的情况下完成，窗口被别的程序挡住、最小化甚至收进托盘，它都能恢复并切到前台（最大化状态保持不变）。编译不可用时自动退化为无窗口 PowerShell（改由 Harness 自己把窗口切到前台），再不行就退化为普通 PowerShell 兼容模式（可能有窗口闪烁）；当前用的是哪一种，设置 → 通知 的状态区会直接写明。
+
 设置 → 通知 里可以选通知类型、声音、时长、注册协议、发一条测试通知。这里还有一个「启用桌面通知」开关，不动插件页也能静音。
 
 设置存在 `~/.dsh/notice/`，协议 scheme 是 `dsh-notice:` —— 从独立 dsh-notice 插件升级过来时，已有设置与协议注册自动生效。
@@ -70,12 +72,13 @@ agent 直接去 D:\proj\backend，不会因为旁边有个 backend-legacy 而改
 node tools/verify.mjs
 ```
 
-479 项断言，覆盖 manifest、patch 层、宿主半、浏览器半、工作区行按钮、`@` 候选源与弹窗形状。
+521 项断言，覆盖 manifest、patch 层、宿主半（含 `/workspaceplus/api` 在认证服务缺失时的拒绝）、浏览器半、工作区行按钮、`@` 候选源、弹窗形状，以及通知点击启动器的编译与回退（含真实 `csc.exe` 编译一次并自检）。
 
 ## 其它
 
-- `lib/` 是手写源码，**不需要任何构建步骤**。从 npm、GitHub、本地目录三种方式装到的都是可直接加载的代码。
+- `lib/` 是手写源码，**不需要打包步骤**（没有 bundler）：从 npm、GitHub、本地目录三种方式装到的都是可直接加载的代码。唯一的例外是通知点击助手 —— 它由宿主在首次注册协议跳转时（插件加载后就会发生）用系统自带的 `csc.exe` 从 `lib/notice/click-host.cs` 现编到 `~/.dsh/notice/` 并缓存；编译不可用时自动退化为 PowerShell 启动器，插件其余部分不受影响。
 - workspace+ 的状态文件在 `~/.dsh/workspaceplus/directories.json`，可以直接手改，改完刷新页面即可。
+- workspace+ 的浏览器接口 `/workspaceplus/api` 每次请求都要过宿主的 `connection.admit` 认证。认证服务缺失、`admit` 不存在或报错时一律 **503**，读写都不放行——这个接口写下的目录备注会进入模型上下文，不能让未认证的调用方有机会修改它。
 - [LICENSE](./LICENSE) · MIT
 
 ## Star History

package/cordis.patch.yml

@@ -26,7 +26,7 @@
 #                  regardless and degrades silently when this row is off.
 #
 # Turning one row off removes exactly that half from the host while the bundle
-# and the other sub-feature keep working. The 通知 settings page also carries a
+# and the other sub-features keep working. The 通知 settings page also carries a
 # runtime "启用桌面通知" switch, so notifications can be silenced without
 # touching the row at all.
 - insert:

package/lib/client.js

@@ -388,8 +388,36 @@ window.__ModuleLoader__.load({
         } AUMID 发言：${toast.appId ?? '(未知)'}`
       })()
 
+      // How a click is actually delivered, as the host reports it after
+      // registering the protocol. The host prefers a compiled windowless
+      // helper and falls back to windowless PowerShell, then to plain
+      // PowerShell, so the status line names the mode instead of promising the
+      // best case. The helper restores and focuses the window itself, but only
+      // when `focusOnClick` is on — with the switch off the host registers the
+      // same helper without that step — so the sentence must not claim a
+      // foreground window in that state. A host that predates `launcher` has no
+      // value here, and then this returns '' so the sentence reads exactly as
+      // it did before.
+      const launcherNote = (() => {
+        const focus = settings.focusOnClick === true
+        if (protocol.launcher === 'helper') {
+          return focus ? '点击助手会在无窗口的情况下把 Harness 切到前台' : '由无窗口的点击助手处理，不改变窗口的前后顺序'
+        }
+        if (protocol.launcher === 'windowless-powershell') {
+          return focus
+            ? '使用无窗口 PowerShell 助手，由 Harness 负责切到前台；首次点击可能稍慢'
+            : '使用无窗口 PowerShell 助手；首次点击可能稍慢'
+        }
+        if (protocol.launcher === 'powershell') return '兼容模式：由 PowerShell 启动，可能有窗口闪烁'
+        return ''
+      })()
+
       const protocolLine = (() => {
-        if (protocol.registered === true) return `点击通知可打开对应对话（已注册 ${protocol.scheme}:）。`
+        if (protocol.registered === true) {
+          return launcherNote
+            ? `点击通知可打开对应对话（已注册 ${protocol.scheme}:，${launcherNote}）。`
+            : `点击通知可打开对应对话（已注册 ${protocol.scheme}:）。`
+        }
         if (settings.registerProtocol === false) return '已关闭协议注册：点击通知只会把 Harness 窗口切到前台。'
         return `尚未注册 ${protocol.scheme ?? 'dsh-notice'}:，点击通知只会把 Harness 窗口切到前台。`
       })()
@@ -434,7 +462,7 @@ window.__ModuleLoader__.load({
           }),
           React.createElement(NoticeSwitchRow, {
             title: '点击时把 Harness 窗口切到前台',
-            description: '关闭后只切换对话，不改变窗口的前后顺序。',
+            description: '开启后点击通知会尽量把窗口从最小化、被遮挡或收进托盘的状态恢复并切到前台；关闭则只切换对话，不改变窗口的前后顺序。',
             checked: settings.focusOnClick === true,
             disabled,
             onChange: (next) => void send({ op: 'patch', patch: { focusOnClick: next } }),
@@ -827,6 +855,7 @@ window.__ModuleLoader__.load({
       document.head.appendChild(tag)
     }
 
+
     ensureStyles()
 
     // The notice page's stylesheet follows the same one-tag rule; calling it in
@@ -1871,11 +1900,16 @@ window.__ModuleLoader__.load({
       const bodyBlocks = (() => {
         if (state.status === 'error') {
           const unauthorized = state.message.includes('401')
+          const unavailable = state.message.includes('503')
           const unrouted = state.message.includes('404')
           /**
-           * The three failures need different advice:
+           * The four failures need different advice:
            * - 401: this document never completed the token exchange, so the
            *   connection layer has no authority to admit the request.
+           * - 503: the Host has no usable authentication service, so the route
+           *   refused the request instead of accepting an unauthenticated
+           *   change. Restarting is the ordinary fix; the route stays shut until
+           *   the connection service is mounted.
            * - 404: the request reached the Host and nothing claimed the path.
            *   The browser half hot-reloads from the served bundle, the host half
            *   does not, so a stale Host process is the ordinary cause.
@@ -1883,14 +1917,16 @@ window.__ModuleLoader__.load({
            */
           const diagnosis = unauthorized
             ? '这个页面没有带授权的会话凭据。请用 `dsh` 启动时打印的带 token 的地址重新打开 GUI（它会写入 cookie，然后跳转到干净地址）。'
-            : unrouted
-              ? '请求到达了 DSH 宿主进程，但宿主里没有注册 ' +
-                API_PATH +
-                ' 这条路由——通常意味着宿主进程还在跑旧版插件代码。浏览器半会随 bundle 热更新，宿主半不会：重启 dsh 即可。' +
-                '重启后终端会出现 [dsh-workspace-plus] host half loaded 一行；若没有，请到 设置 → 插件 查看该插件行的状态。'
-              : '这个面板通过 ' +
-                API_PATH +
-                ' 与宿主进程通信，而当前页面没有可用的 HTTP 通道（例如页面不是 dsh 提供的、或宿主进程还没起来）。'
+            : unavailable
+              ? '宿主进程没有可用的认证服务，接口按安全默认拒绝了这次请求（503）。重启 dsh 通常即可恢复；如果一直出现，说明这个宿主没有挂载 connection 认证服务，这个接口在它上面不会放行任何读写。'
+              : unrouted
+                ? '请求到达了 DSH 宿主进程，但宿主里没有注册 ' +
+                  API_PATH +
+                  ' 这条路由——通常意味着宿主进程还在跑旧版插件代码。浏览器半会随 bundle 热更新，宿主半不会：重启 dsh 即可。' +
+                  '重启后终端会出现 [dsh-workspace-plus] host half loaded 一行；若没有，请到 设置 → 插件 查看该插件行的状态。'
+                : '这个面板通过 ' +
+                  API_PATH +
+                  ' 与宿主进程通信，而当前页面没有可用的 HTTP 通道（例如页面不是 dsh 提供的、或宿主进程还没起来）。'
           return [
             noticeBlock(
               'error',

package/lib/index.js

@@ -12,7 +12,9 @@
  *      agent sees the mapping without spending a tool call
  *   3. a `workspace_dirs` Tool the agent uses to inspect or edit the mapping
  *      when the user asks in natural language
- *   4. a small JSON HTTP route the browser half uses to manage the same store
+ *   4. a small JSON HTTP route the browser half uses to manage the same store —
+ *      every request must pass the Host's `connection.admit` check, and the
+ *      route refuses (503) when that service is unavailable
  *
  * The whole point is routing by label instead of by guesswork: the injected
  * table gives absolute paths, so a similar-looking directory name elsewhere on
@@ -362,6 +364,55 @@ export function validateLabel(label) {
   return { ok: true, label: text }
 }
 
+/**
+ * Run the Host's browser trust check for one plugin request.
+ *
+ * `connection.admit(req)` is the only authority a plugin route has: the Host
+ * fence plus the GUI session cookie. This route both publishes the mapping and
+ * lets the caller rewrite it, and whatever it stores is rendered into every
+ * request's model context — so it fails closed when that authority is absent
+ * instead of falling through to "admitted":
+ *
+ * - no `connection` service mounted, or a service without `admit` — the host
+ *   composition has no auth layer (or its API drifted): refuse with 503;
+ * - `admit` throwing, rejecting, or failing to answer: the decision is
+ *   unavailable, so refuse with 503;
+ * - a rejection from `admit`: pass its 401 through, everything else is 403.
+ *
+ * The result is awaited, so a synchronous or an asynchronous `admit` is honored
+ * the same way — but only an answer that actually carries no rejection counts
+ * as an admission.
+ *
+ * The notice sub-feature deliberately grants a loopback exemption. This route
+ * does not: an unauthenticated writer could otherwise plant arbitrary text in
+ * the agent's prompt through a directory note.
+ *
+ * @param connection - the resolved `connection` service, or undefined.
+ * @param req - incoming request.
+ * @returns a promise of `{ ok: true }` or `{ ok: false, status, message }`.
+ */
+export async function checkAdmission(connection, req) {
+  const unavailable = (message) => ({ ok: false, status: 503, message })
+  if (connection === undefined || connection === null) {
+    return unavailable('host authentication service is not mounted; refusing to answer')
+  }
+  if (typeof connection.admit !== 'function') {
+    return unavailable('host authentication service has no admit(); refusing to answer')
+  }
+  let admission
+  try {
+    admission = await connection.admit(req)
+  } catch (error) {
+    return unavailable(`host authentication service failed: ${String(error?.message ?? error)}`)
+  }
+  const rejection = admission !== null && typeof admission === 'object' ? admission.rejection : undefined
+  if (rejection !== undefined) {
+    const status = rejection === 401 ? 401 : 403
+    return { ok: false, status, message: status === 401 ? 'unauthorized' : 'forbidden' }
+  }
+  return { ok: true }
+}
+
 /**
  * Apply one store operation. Every branch validates first and returns a
  * discriminated result, so both the Tool and the HTTP route share one behavior
@@ -709,11 +760,17 @@ export function apply(ctx) {
           kind: 'exact',
           path: API_PATH,
           handler: async (req, res) => {
-            const connection = ctx.get('connection')
-            const admission = connection?.admit?.(req)
-            if (admission !== undefined && 'rejection' in admission) {
-              res.writeHead(admission.rejection)
-              res.end(admission.rejection === 401 ? 'unauthorized' : 'forbidden')
+            // Fail closed. A request that cannot be admitted by the Host's
+            // connection service gets no answer at all, read or write: the
+            // mapping this route returns — and the notes it stores — become
+            // model context, so an unauthenticated caller must never reach it.
+            const admission = await checkAdmission(ctx.get('connection'), req)
+            if (!admission.ok) {
+              res.writeHead(admission.status, {
+                'content-type': 'application/json; charset=utf-8',
+                'cache-control': 'no-store',
+              })
+              res.end(JSON.stringify({ ok: false, message: admission.message }))
               return
             }
             const send = (status, payload) => {