dsh-zen-remote 1.1.13 → 1.1.14

package/lib/types/share-export.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Share-image transcript route (issue #7): fold one session's raw event log
+ * into the flat user/assistant transcript the phone rasterizes into shareable
+ * PNG cards.
+ *
+ * Why a host route at all: the Chat view is a paged window over a surface the
+ * compactor rewrites, so the browser DOM never holds the whole conversation
+ * and cloning it cannot work. The whole-log source of truth is the host-side
+ * `sessionQuery` service (standard dsh-base composition), which no browser
+ * half can reach.
+ *
+ * Why the RAW log (`readSession`) and not the observed surface: the surface
+ * deliberately shadows replaced ranges, so once a replacement lands it shows
+ * LESS than the user already saw — wrong source for a human transcript (the
+ * official trap note on `isAppendSurfaceEvent`: append-origin events are the
+ * transcript's durable source material). The raw log additionally carries the
+ * `agent/inbox/spliced` bookkeeping the steering classification below folds —
+ * it never exists on the surface. The fold keeps every append-origin message
+ * in log order and never applies the shadows, so a steered or compacted
+ * session still exports everything the user saw.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Context } from '@deepseek-ai/cordis';
+/** Exact route the browser GETs a session's share transcript from. */
+export declare const SHARE_EXPORT_ROUTE = "/_dsh/mobile-nav/share-export";
+/** Upper bound on `turns` for `range=last` (PLAN §4). 500 exchanges is
+ * already more wall of text than any share card wants, and the cap keeps a
+ * careless `turns=99999999` from quietly meaning "the whole log". */
+export declare const MAX_SHARE_TURNS = 500;
+/** One exportable content block of a transcript row. */
+export type ShareBlock = {
+    kind: 'text';
+    text: string;
+} | {
+    kind: 'image';
+};
+/** One transcript row. `seq` is the source event's log position — stable
+ * across re-renders and usable as a React key; a range=last body keeps whole
+ * turns, so its seqs always arrive turn-contiguous. */
+export interface ShareTurn {
+    role: 'user' | 'assistant';
+    seq: number;
+    blocks: ShareBlock[];
+}
+/** Response body of a successful export (PLAN §4 contract). */
+export interface ShareExportBody {
+    ok: true;
+    /** Session creation time (Unix epoch ms) from the observed header. */
+    createdAt: number;
+    turns: ShareTurn[];
+    /** Constant false while the server never truncates; the client's slice
+     * budget is the only truncation that exists. */
+    truncated: false;
+}
+/**
+ * Handle one `GET {@link SHARE_EXPORT_ROUTE}?session=<id>&range=all|last&turns=N`
+ * request.
+ *
+ * Exported so an integration test can drive it with a plain node:http server
+ * and a fake sessionQuery service instead of booting a harness.
+ * @param ctx - host context carrying the sessionQuery service and logger.
+ * @param req - inbound request; no body is read.
+ * @param res - the response this call owns end to end.
+ */
+export declare function handleShareExport(ctx: Context, req: IncomingMessage, res: ServerResponse): Promise<void>;
+//# sourceMappingURL=share-export.d.ts.map

package/lib/types/share-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-export.d.ts","sourceRoot":"","sources":["../../src/share-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAWlD,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,kCAAkC,CAAA;AAEjE;;qEAEqE;AACrE,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB;;uDAEuD;AACvD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,UAAU,EAAE,CAAA;CACrB;AAaD,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAA;IACR,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB;oDACgD;IAChD,SAAS,EAAE,KAAK,CAAA;CACjB;AAoTD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC9G"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-zen-remote",
-  "version": "1.1.13",
+  "version": "1.1.14",
   "description": "把 DeepSeek Harness 变成手机 App：移动端界面重排（两级页面栈、会话列表主屏、composer 重排、手势、附件上传）+ 配对码认证网关 + PWA 安装 + 真 Web Push。Complete mobile plugin for DeepSeek Harness (DSH): app-shell mobile UI, pairing-code gateway for public-internet access behind your own reverse proxy, installable PWA, offline service worker, and real Web Push agent-done notifications.",
   "license": "MIT",
   "type": "module",
@@ -88,6 +88,7 @@
     "@deepseek-ai/dsh-host-webserver": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.0 <0.2.0-0 || >=0.1.2-rc.0 <0.2.0-0",
     "@deepseek-ai/dsh-session": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.0 <0.2.0-0 || >=0.1.2-rc.0 <0.2.0-0",
     "@deepseek-ai/dsh-session-log-export": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.0 <0.2.0-0 || >=0.1.2-rc.0 <0.2.0-0",
+    "@deepseek-ai/dsh-session-query": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.0 <0.2.0-0 || >=0.1.2-rc.0 <0.2.0-0",
     "react": "^18.2.0",
     "@deepseek-ai/dsh-tools": ">=0.0.1-rc.1 <0.1.0 || >=0.1.0-rc.1 <0.2.0-0 || >=0.1.2-rc.0 <0.2.0-0",
     "@deepseek-ai/dsh-workspace": ">=0.1.1-rc.0 <0.2.0-0 || >=0.1.2-rc.0 <0.2.0-0"
@@ -99,6 +100,9 @@
     "@deepseek-ai/dsh-session": {
       "optional": true
     },
+    "@deepseek-ai/dsh-session-query": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-tools": {
       "optional": true
     },
@@ -128,6 +132,7 @@
     "@deepseek-ai/dsh-scope": "0.1.2-rc.1",
     "@deepseek-ai/dsh-session": "0.1.2-rc.1",
     "@deepseek-ai/dsh-session-log-export": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-query": "0.1.2-rc.1",
     "@deepseek-ai/dsh-session-stats": "0.1.2-rc.1",
     "@deepseek-ai/dsh-subagent": "0.1.2-rc.1",
     "@deepseek-ai/dsh-timeout": "0.1.2-rc.1",
@@ -146,7 +151,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs",
     "verify": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "test": "node --test \"test/*.test.cjs\" && node scripts/check-sunk-viewport.mjs && node scripts/check-keyboard-avoid.mjs && node scripts/check-attach-upload.mjs && node scripts/check-upload-endpoint.mjs && node scripts/check-host-shadow.mjs && node scripts/check-compat-store.mjs && node scripts/check-client-externals.mjs && node scripts/check-info-sheet-stacking.mjs && node scripts/sync-doc-version.mjs --check",
+    "test": "node --test \"test/*.test.cjs\" && node scripts/check-sunk-viewport.mjs && node scripts/check-keyboard-avoid.mjs && node scripts/check-attach-upload.mjs && node scripts/check-share-image.mjs && node scripts/check-upload-endpoint.mjs && node scripts/check-host-shadow.mjs && node scripts/check-compat-store.mjs && node scripts/check-client-externals.mjs && node scripts/check-info-sheet-stacking.mjs && node scripts/sync-doc-version.mjs --check",
     "version": "node scripts/sync-doc-version.mjs && git add README.md README.zh-CN.md"
   }
 }

package/scripts/check-host-shadow.mjs

@@ -8,12 +8,13 @@
 // means the host half silently loads whatever version this plugin last
 // installed — "it links and starts" proves nothing.
 //
-// Instead of hand-maintaining a package list, the three files the host half
-// actually loads (dsh-push.mjs, lan-gate.mjs, lib/index.js) are scanned for
-// @deepseek-ai specifiers — static import, dynamic import() and require() —
-// so a new import added there gets watched automatically. src/index.ts is
-// type-only imports (erased at runtime) and the gateway subprocess uses only
-// stdlib + web-push, so this scan is the whole runtime story.
+// Instead of hand-maintaining a package list, the files the host half
+// actually loads (dsh-push.mjs, lan-gate.mjs, lib/index.js and the modules
+// it statically pulls in) are scanned for @deepseek-ai specifiers — static
+// import, dynamic import() and require() — so a new import added there gets
+// watched automatically. src/index.ts is type-only imports (erased at
+// runtime) and the gateway subprocess uses only stdlib + web-push, so this
+// scan is the whole runtime story.
 //
 // Run: node scripts/check-host-shadow.mjs
 import assert from 'node:assert/strict'
@@ -47,15 +48,46 @@ const require = createRequire(import.meta.url)
 //   first, or temporarily accept the drift).
 // - npm-published tarballs contain no node_modules, so this shadow only
 //   exists on dev machines where the plugin is link-installed.
-const SHADOW_ALLOWED = ['@deepseek-ai/dsh-tools']
+//
+// @deepseek-ai/dsh-session:
+// - Why allowed at all: src/share-export.ts (the share-image transcript
+//   route) statically imports the two pure fold helpers
+//   (isAppendSurfaceEvent, deriveEventMessage) from the browser-safe
+//   `@deepseek-ai/dsh-session/surface` subpath. They are THE canonical
+//   per-node projection rule per their own doc; reimplementing them locally
+//   would be a second fold that silently drifts, and no host service exposes
+//   them, so a module import is the only way to reuse them.
+// - Why 0.1.2-rc.1: same release line as every other devDep; the package is
+//   also needed in node_modules for pnpm verify's type check regardless. The
+//   shadow only bites the two pure functions — both take plain event records
+//   and touch no class identity, and their signatures are identical on the
+//   0.1.2 and 0.1.5 lines — so a version-skewed copy cannot diverge the fold
+//   the way a service-class mismatch could.
+//   The fact BEHIND that "signatures identical" conclusion, verified against
+//   both closures (2026-09-10): the SURFACE_EVENT_TYPES set differs across
+//   the lines — 0.1.2-rc.1 admits user/message, assistant/message,
+//   tool/result, while 0.1.5-rc.2 also admits system/message (and its
+//   deriveEventMessage projects it to a system-role message). The fold in
+//   src/share-export.ts neutralizes the difference: its role filter keeps
+//   only 'user'/'assistant' rows, so a system/message is dropped on 0.1.5 by
+//   the filter and on 0.1.2 by isAppendSurfaceEvent itself — the exported
+//   transcript is byte-identical either way. A future DSH that adds another
+//   role-bearing surface type must re-run this equivalence, not assume it.
+// - WHEN TO ACT: a future DSH that renames the surface subpath or changes
+//   event shapes will break this import loudly at plugin load; re-pin the
+//   devDep then.
+// - npm-published tarballs contain no node_modules, so this shadow only
+//   exists on dev machines where the plugin is link-installed.
+const SHADOW_ALLOWED = ['@deepseek-ai/dsh-tools', '@deepseek-ai/dsh-session']
 
 // Packages that must never exist in this plugin's node_modules at all: DSH
 // 0.1.2 dropped them, and a stale copy would let the type check quietly pass
 // against outdated declarations. NOT exemptible via SHADOW_ALLOWED.
 const BANNED_PACKAGES = ['@deepseek-ai/dsh-client-runtime', '@deepseek-ai/dsh-host-apiproxy']
 
-// The three files the host half actually loads.
-const HOST_ENTRY_FILES = ['dsh-push.mjs', 'lan-gate.mjs', 'lib/index.js']
+// The files the host half actually loads. lib/share-export.js is statically
+// imported by lib/index.js, so it is part of the same runtime graph.
+const HOST_ENTRY_FILES = ['dsh-push.mjs', 'lan-gate.mjs', 'lib/index.js', 'lib/share-export.js']
 
 // Matches the specifier of real module statements only — `... from 'pkg'`,
 // `import 'pkg'`, `import('pkg')`, `require('pkg')` — so @deepseek-ai names

package/scripts/check-keyboard-avoid.mjs

@@ -1,12 +1,14 @@
 // Self-check for the composer keyboard-avoid lift (S10, issue #1 方案 2).
 // The failing environment (小米 + 微信输入法) cannot be reproduced off-device,
 // so the boundary cases of the pure geometry are asserted numerically.
-// Run: node scripts/check-keyboard-avoid.mjs   (needs Node >= 23.6 type stripping)
+// Run: node scripts/check-keyboard-avoid.mjs   (needs Node >= 23.6 type stripping;
+// clamped comes from lib/index.js — the host source is multi-file since the
+// share-export route, so strip-only cannot load src/index.ts. Build first.)
 import assert from 'node:assert/strict'
 import { readFileSync } from 'node:fs'
 import { composerLift, estimatedLift, keyboardLift as lift, safetyPad } from '../src/client/effects/keyboard-avoid.ts'
 import { KEYBOARD_DEFAULTS, parseClientConfig } from '../src/client/client-config.ts'
-import { clamped } from '../src/index.ts'
+import { clamped } from '../lib/index.js'
 
 // The reported class of bug: keyboard shrinks the visual viewport, browser
 // does not pan it — the whole shrink is an occluded band at the bottom.