dsh-zhihu-search 1.2.7 → 1.3.0

package/README.md

@@ -2,6 +2,10 @@
   <h1 align="center">dsh-zhihu-search</h1>
 </p>
 
+<p align="center">
+  <img src="assets/cover.svg" alt="dsh-zhihu-search：给 DSH 装上知乎搜索" width="600">
+</p>
+
 <div align="center">
   <p><strong>赋予 DeepSeek Harness 检索知乎社区的能力</strong></p>
   <p><em>Empowering DeepSeek Harness with Zhihu Insights</em></p>
@@ -9,14 +13,13 @@
   <p>
     <a href="https://developer.zhihu.com/"><img src="https://img.shields.io/badge/Zhihu%20Open%20Platform-Official%20API-0084FF?style=flat&logo=zhihu&logoColor=white" alt="知乎开放平台官方 API"></a>
     <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/DeepSeek%20Harness-Plugin-4176E6?style=flat" alt="DeepSeek Harness Plugin"></a>
-    <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/dsh--plugin-Auto%20Discovered-orange?style=flat" alt="dsh-plugin"></a>
   </p>
 
   <p>
     <a href="https://github.com/zlZayn/dsh-zhihu-search/actions/workflows/ci.yml"><img src="https://github.com/zlZayn/dsh-zhihu-search/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
     <a href="https://www.npmjs.com/package/dsh-zhihu-search"><img src="https://img.shields.io/npm/v/dsh-zhihu-search.svg" alt="npm"></a>
     <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT 许可证"></a>
-    <a href="https://slsa.dev/"><img src="https://img.shields.io/badge/SLSA-Provenance-green?logo=slsa" alt="SLSA Provenance"></a>
+    <a href="https://www.npmjs.com/package/dsh-zhihu-search"><img src="https://img.shields.io/badge/SLSA-Build%20L2-green?logo=slsa" alt="SLSA Build L2"></a>
   </p>
 
   <p>
@@ -136,6 +139,14 @@ Access Secret 在[知乎开放平台个人中心](https://developer.zhihu.com/pr
 
 不想把密钥存在设置里时，改用环境变量 `ZHIHU_ACCESS_SECRET`；或在卡片的「凭据引用名」里填别的名字，指向另一个环境变量或凭据记录。
 
+### 只用知乎检索
+
+卡片里的「隐藏原生网页搜索（web_search / web_fetch）」开关默认关闭 —— 插件不擅自削宿主能力。打开并保存后，模型看不到 DSH 原生的 `web_search` 与 `web_fetch`，只用知乎的三个工具。
+
+- 从**下一次模型请求**起生效，无需重启、无需新窗口。
+- 该 agent 派生的子 agent 一并遵守同一套规则。
+- 只控制模型可见性：tool-web 插件本身照常加载，关掉开关即恢复。
+
 ## 安全与边界
 
 - Access Secret 只在设置界面、凭据域与环境变量之间流转：不写日志、不以明文进入缓存键、不进仓库。

package/README_en.md

@@ -2,6 +2,10 @@
   <h1 align="center">dsh-zhihu-search</h1>
 </p>
 
+<p align="center">
+  <img src="assets/cover.svg" alt="dsh-zhihu-search: Equipping DSH with Zhihu search" width="600">
+</p>
+
 <div align="center">
   <p><strong>Empowering DeepSeek Harness with Zhihu Insights</strong></p>
   <p><em>赋予 DeepSeek Harness 检索知乎社区的能力</em></p>
@@ -9,14 +13,13 @@
   <p>
     <a href="https://developer.zhihu.com/"><img src="https://img.shields.io/badge/Zhihu%20Open%20Platform-Official%20API-0084FF?style=flat&logo=zhihu&logoColor=white" alt="Zhihu Open Platform Official API"></a>
     <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/DeepSeek%20Harness-Plugin-4176E6?style=flat" alt="DeepSeek Harness Plugin"></a>
-    <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/dsh--plugin-Auto%20Discovered-orange?style=flat" alt="dsh-plugin"></a>
   </p>
 
   <p>
     <a href="https://github.com/zlZayn/dsh-zhihu-search/actions/workflows/ci.yml"><img src="https://github.com/zlZayn/dsh-zhihu-search/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
     <a href="https://www.npmjs.com/package/dsh-zhihu-search"><img src="https://img.shields.io/npm/v/dsh-zhihu-search.svg" alt="npm"></a>
     <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT License"></a>
-    <a href="https://slsa.dev/"><img src="https://img.shields.io/badge/SLSA-Provenance-green?logo=slsa" alt="SLSA Provenance"></a>
+    <a href="https://www.npmjs.com/package/dsh-zhihu-search"><img src="https://img.shields.io/badge/SLSA-Build%20L2-green?logo=slsa" alt="SLSA Build L2"></a>
   </p>
 
   <p>
@@ -136,6 +139,14 @@ Get the Access Secret from the [Zhihu Open Platform profile](https://developer.z
 
 If you would rather not keep the secret in settings, use the `ZHIHU_ACCESS_SECRET` environment variable. Or put a different name in the card's "Credential reference" to point at another environment variable or credential record.
 
+### Zhihu results only
+
+The card's "Hide native web search (web_search / web_fetch)" switch is off by default — the plugin does not quietly remove host capabilities. Turn it on and save, and the model no longer sees DSH's native `web_search` and `web_fetch`, leaving only the three Zhihu tools.
+
+- Applies from the **next model request**: no restart, no new window.
+- Agents derived from that one follow the same rule.
+- Visibility only: the tool-web plugin still loads, and switching it back off restores the tools.
+
 ## Security and boundaries
 
 - The Access Secret only travels between the settings UI, the credential scope and the environment: never logged, never in a cache key in clear text, never committed.

package/lib/client.js

@@ -50,6 +50,8 @@ var zh = {
   refOverridden: "\u5DF2\u8986\u76D6",
   reset: "\u91CD\u7F6E",
   refHint: "\u73AF\u5883\u53D8\u91CF\u6216\u51ED\u636E\u8BB0\u5F55\u7684\u540D\u5B57\uFF1B\u7559\u7A7A\u5E76\u4FDD\u5B58\u4F1A\u6E05\u6389\u8986\u76D6\uFF0C\u56DE\u843D\u5230\u9ED8\u8BA4\u7684 ZHIHU_ACCESS_SECRET\u3002",
+  hideNativeWebLabel: "\u9690\u85CF\u539F\u751F\u7F51\u9875\u641C\u7D22\uFF08web_search / web_fetch\uFF09",
+  hideNativeWebHint: "\u4EC5\u63A7\u5236\u6A21\u578B\u53EF\u89C1\u6027\uFF0C\u4E0D\u5F71\u54CD tool-web \u63D2\u4EF6\u672C\u8EAB\u72B6\u6001\u3002\u4FDD\u5B58\u540E\u4ECE\u4E0B\u4E00\u6B21\u6A21\u578B\u8BF7\u6C42\u8D77\u751F\u6548\uFF0C\u65E0\u9700\u91CD\u542F\u3002",
   discard: "\u653E\u5F03",
   save: "\u4FDD\u5B58",
   saving: "\u4FDD\u5B58\u4E2D\u2026"
@@ -69,6 +71,8 @@ var en = {
   refOverridden: "Overridden",
   reset: "Reset",
   refHint: "Name of an environment variable or credential record. Saving it blank clears the override and falls back to ZHIHU_ACCESS_SECRET.",
+  hideNativeWebLabel: "Hide native web search (web_search / web_fetch)",
+  hideNativeWebHint: "Controls model visibility only \u2014 the tool-web plugin itself stays untouched. Applies from the next model request after saving; no restart needed.",
   discard: "Discard",
   save: "Save",
   saving: "Saving\u2026"
@@ -81,6 +85,7 @@ var inject = ["slots", "settingsScope", "locale"];
 var NAMESPACE = "zhihu-search";
 var SECRET_FIELD = "accessSecret";
 var REF_FIELD = "accessSecretRef";
+var HIDE_FIELD = "disableNativeWebSearch";
 var PROFILE_URL = "https://developer.zhihu.com/profile";
 function asRecord(value) {
   return typeof value === "object" && value !== null ? value : void 0;
@@ -158,6 +163,18 @@ var S = {
     width: "100%"
   },
   hint: { margin: 0, fontSize: 12, lineHeight: 1.5, color: "var(--dsw-alias-label-tertiary)" },
+  // 开关行：逐条对齐官方 SubagentModelSelectionCard.module.css 的 .toggleRow / .toggleLabel，
+  // 右侧放原生 `Switch`（同一个 ui-primitives 包），因此外观与官方卡片一致。
+  toggleRow: {
+    display: "flex",
+    alignItems: "flex-start",
+    justifyContent: "space-between",
+    gap: 16,
+    fontSize: 13,
+    lineHeight: 1.5,
+    color: "var(--dsw-alias-label-primary)"
+  },
+  toggleLabel: { flex: 1, minWidth: 0, fontSize: 13, lineHeight: 1.5 },
   // 说明句里的外链：只用卡片既有的语义令牌，颜色取自 ui-theme 的 --dsw-alias-link。
   // 卡片是纯内联样式、无法写 :hover，所以常驻下划线作为静态可点提示。
   link: {
@@ -214,6 +231,7 @@ function ZhihuCard({ scope, mirror, t }) {
   const [open, setOpen] = (0, import_react.useState)(false);
   const [secret, setSecret] = (0, import_react.useState)("");
   const [refDraft, setRefDraft] = (0, import_react.useState)(void 0);
+  const [hideDraft, setHideDraft] = (0, import_react.useState)(void 0);
   const [saving, setSaving] = (0, import_react.useState)(false);
   const [failed, setFailed] = (0, import_react.useState)("");
   const writable = snapshot.writable && snapshot.status === "ready";
@@ -222,11 +240,15 @@ function ZhihuCard({ scope, mirror, t }) {
   const refText = refDraft ?? effectiveRef;
   const refOverridden = asRecord(snapshot.user)?.[REF_FIELD] !== void 0;
   const refDirty = refText !== effectiveRef;
-  const dirty = secret !== "" || refDirty;
+  const hideEffective = snapshot.value?.[HIDE_FIELD] === true;
+  const hideText = hideDraft ?? hideEffective;
+  const hideDirty = hideDraft !== void 0 && hideDraft !== hideEffective;
+  const dirty = secret !== "" || refDirty || hideDirty;
   const blocked = !dirty || disabled;
   const discard = () => {
     setSecret("");
     setRefDraft(void 0);
+    setHideDraft(void 0);
     setFailed("");
   };
   const save = async () => {
@@ -238,8 +260,10 @@ function ZhihuCard({ scope, mirror, t }) {
         if (refText === "") await scope.unset(REF_FIELD);
         else await scope.set(REF_FIELD, refText);
       }
+      if (hideDirty) await scope.set(HIDE_FIELD, hideText);
       setSecret("");
       setRefDraft(void 0);
+      setHideDraft(void 0);
       setOpen(false);
     } catch (error) {
       setFailed(error instanceof Error ? error.message : String(error));
@@ -338,6 +362,23 @@ function ZhihuCard({ scope, mirror, t }) {
         ),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: S.hint, children: t("refHint") })
       ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: S.fieldDivider, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: S.toggleRow, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: S.toggleLabel, children: t("hideNativeWebLabel") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            import_dsh_client_ui_primitives.Switch,
+            {
+              checked: hideText,
+              label: t("hideNativeWebLabel"),
+              disabled,
+              onChange: (next) => {
+                setHideDraft(next);
+              }
+            }
+          )
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: S.hint, children: t("hideNativeWebHint") })
+      ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: S.footer, children: [
         failed !== "" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: S.failed, role: "status", children: failed }) : null,
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: dimStyle(S.discard, !dirty || saving), disabled: !dirty || saving, onClick: discard, children: t("discard") }),

package/lib/index.d.ts

@@ -53,6 +53,13 @@ export interface Config {
     enableGlobalSearch?: boolean;
     /** 是否注册直答工具。 */
     enableZhida?: boolean;
+    /**
+     * 是否对模型隐藏 DSH 原生的 `web_search` / `web_fetch`。
+     *
+     * 默认 `false`：插件不擅自削宿主能力。打开后按 agent 生效，
+     * 且作用于该 agent 派生的子 agent（restriction 沿 scope 链继承）。
+     */
+    disableNativeWebSearch?: boolean;
 }
 /** 配置的运行时校验 schema；默认值同时是文档。 */
 export declare const Config: z<Schemastery.ObjectS<{
@@ -67,6 +74,7 @@ export declare const Config: z<Schemastery.ObjectS<{
     enableSearch: z<boolean, boolean>;
     enableGlobalSearch: z<boolean, boolean>;
     enableZhida: z<boolean, boolean>;
+    disableNativeWebSearch: z<boolean, boolean>;
 }>, Schemastery.ObjectT<{
     accessSecret: z<string, string>;
     accessSecretRef: z<string, string>;
@@ -79,6 +87,7 @@ export declare const Config: z<Schemastery.ObjectS<{
     enableSearch: z<boolean, boolean>;
     enableGlobalSearch: z<boolean, boolean>;
     enableZhida: z<boolean, boolean>;
+    disableNativeWebSearch: z<boolean, boolean>;
 }>>;
 /**
  * 注册插件：创建状态与客户端，注册设置命名空间，并按配置注册各工具。

package/lib/index.js

@@ -30,6 +30,13 @@ export const inject = ['tools'];
 export const ZHIHU_SETTINGS_NAMESPACE = 'zhihu-search';
 /** 凭据引用的默认名，按 DSH 约定取环境变量名。 */
 export const DEFAULT_ACCESS_SECRET_REF = 'ZHIHU_ACCESS_SECRET';
+/**
+ * DSH 原生网页工具名（由 `@deepseek-ai/dsh-tool-web` 注册）。
+ *
+ * `tools.restrict()` 会按名字校验并**抛错**，而 `agent/created` 监听器里的同步异常
+ * 会否决 agent 创建（DSH `core/agent` 的注册表语义），所以使用前必须按真实注册表过滤。
+ */
+const NATIVE_WEB_TOOLS = ['web_search', 'web_fetch'];
 /** 配置的运行时校验 schema；默认值同时是文档。 */
 export const Config = z.object({
     // 与官方 web 搜索提供者同构：secret 角色负责「掩码显示 + 不下发明文」，
@@ -45,6 +52,7 @@ export const Config = z.object({
     enableSearch: z.boolean().default(true),
     enableGlobalSearch: z.boolean().default(true),
     enableZhida: z.boolean().default(true),
+    disableNativeWebSearch: z.boolean().default(false),
 });
 /**
  * 断言配置项是正整数。
@@ -110,11 +118,84 @@ export function apply(ctx, config) {
             return literal;
         return `ref:${section.accessSecretRef ?? DEFAULT_ACCESS_SECRET_REF}`;
     };
+    /** 一条告警通道；宿主 logger 缺失时静默 —— 诊断本身不该成为故障源。 */
+    const logger = ctx.logger;
+    const warn = (message) => {
+        logger?.warn?.(message);
+    };
     if ((config.accessSecret ?? '').trim() === '') {
         // 只告警不阻断：profile 必须能正常启动。
-        const logger = ctx.logger;
-        logger?.warn?.('[zhihu-search] 未配置 accessSecret，工具会注册但调用时返回鉴权错误。可在 DSH 设置 → 插件 → 知乎搜索 中填写。');
+        warn('[zhihu-search] 未配置 accessSecret，工具会注册但调用时返回鉴权错误。可在 DSH 设置 → 插件 → 知乎搜索 中填写。');
     }
+    // ── 隐藏 DSH 原生网页工具 ──────────────────────────────────────────────
+    // restriction 挂在**agent 的 scope** 上，`tools.restrict()` 返回的正是撤销它自己
+    // 那一个；想撤销就必须持有它，所以这张表省不掉。restriction 本身随 agent scope
+    // 自动撤销，这里只是我们这一侧的账，用于「拨回开关」与「插件卸载」两个时机。
+    const restrictions = new Map();
+    /** 本刻真实存在、可被 deny 的原生工具名 —— 名字不存在时 deny 会让 restrict 抛错。 */
+    const restrictableNativeTools = () => NATIVE_WEB_TOOLS.filter((toolName) => ctx.tools.get(toolName) !== undefined);
+    /**
+     * 给一个 agent 装上 restriction（已装或不需要装时是空操作）。
+     *
+     * 刻意吞掉异常：`agent/created` 监听器同步抛错会**否决 agent 创建并回滚**，
+     * 一个可选的界面开关不该有这种权力。
+     */
+    const installOn = (agent) => {
+        if (current().disableNativeWebSearch !== true || restrictions.has(agent.id))
+            return;
+        const deny = restrictableNativeTools();
+        if (deny.length === 0)
+            return;
+        try {
+            restrictions.set(agent.id, agent.ctx.tools.restrict({ deny }));
+        }
+        catch (error) {
+            warn(`[zhihu-search] 隐藏原生网页工具失败（不影响其他功能）：${String(error)}`);
+        }
+    };
+    /** 摘掉一个 agent 上的 restriction。 */
+    const liftFrom = (agentId) => {
+        const dispose = restrictions.get(agentId);
+        if (dispose === undefined)
+            return;
+        restrictions.delete(agentId);
+        try {
+            dispose();
+        }
+        catch {
+            // 撤销失败不该波及别处：账已经销了，scope 销毁时也会兜底清理。
+        }
+    };
+    /**
+     * 幂等对账：让每个 live agent 的 restriction 与当前配置一致。
+     *
+     * 三个时机共用它 —— agent 服务就绪、设置写入、以及新 agent 出现。
+     * 幂等是硬要求：保存 Access Secret 同样会触发 `onChange`。
+     */
+    const syncNativeWebTools = () => {
+        const registry = ctx.get('agents');
+        if (registry === undefined)
+            return;
+        const wanted = current().disableNativeWebSearch === true;
+        for (const agent of registry.list()) {
+            if (wanted)
+                installOn(agent);
+            else
+                liftFrom(agent.id);
+        }
+    };
+    // 新 agent 补装；销毁时销账（它的 scope 已随之撤销）。
+    ctx.on('agent/created', ({ agent }) => {
+        installOn(agent);
+    });
+    ctx.on('agent/disposed', ({ agent }) => {
+        restrictions.delete(agent.id);
+    });
+    // agent 服务就绪时补一次对账：正常启动顺序下 agent 晚于插件出现，
+    // HMR 换装时则可能已经有 live agent。
+    ctx.inject(['agents'], () => {
+        syncNativeWebTools();
+    });
     // 设置命名空间：让 Host 把这个 section 暴露给浏览器端的描述镜像，
     // 否则自带的「插件」设置页不会分派我们的卡片。
     ctx.inject(['settings'], (settingsCtx) => {
@@ -122,9 +203,26 @@ export function apply(ctx, config) {
             setSource: (source) => {
                 current = source;
             },
-            onChange: () => { },
+            // 写入后就地生效：可见集在**每次模型请求**时重算，因此下一次请求即采用新集合，
+            // 不需要新窗口。DSH 在 section attach/detach 时也会调它，所以这里必须幂等。
+            onChange: () => {
+                syncNativeWebTools();
+            },
         });
     });
+    // 插件卸载（含 HMR 换装）：撤掉我们装过的 restriction ——
+    // 它们挂在 agent 的 scope 上，不会随本插件卸载自动消失。
+    ctx.effect(() => () => {
+        for (const dispose of restrictions.values()) {
+            try {
+                dispose();
+            }
+            catch {
+                // 同上：卸载路径不因单个撤销失败而中断。
+            }
+        }
+        restrictions.clear();
+    }, 'zhihu-search: native web tool restrictions');
     ctx.effect(() => {
         // 全部可变状态在此创建，随 effect 一起销毁。
         const state = createState({

package/lib/types/client/locales.d.ts

@@ -18,7 +18,7 @@ import type { LocaleNamespaceMap } from '@deepseek-ai/dsh-client-ui-slots';
  */
 export declare const LOCALE_NS = "zhihu-search";
 /** 本卡片全部文案的 key。 */
-export type ZhihuLocaleKey = 'title' | 'description' | 'unsaved' | 'readOnly' | 'secretLabel' | 'secretConfigured' | 'secretMissing' | 'secretHintBefore' | 'secretHintLink' | 'secretHintAfter' | 'refLabel' | 'refOverridden' | 'reset' | 'refHint' | 'discard' | 'save' | 'saving';
+export type ZhihuLocaleKey = 'title' | 'description' | 'unsaved' | 'readOnly' | 'secretLabel' | 'secretConfigured' | 'secretMissing' | 'secretHintBefore' | 'secretHintLink' | 'secretHintAfter' | 'refLabel' | 'refOverridden' | 'reset' | 'refHint' | 'hideNativeWebLabel' | 'hideNativeWebHint' | 'discard' | 'save' | 'saving';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         'zhihu-search': ZhihuLocaleKey;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-zhihu-search",
-  "version": "1.2.7",
+  "version": "1.3.0",
   "description": "DSH plugin: Zhihu in-site search, global web search, and Zhida over the official Zhihu Open Platform API — with a native settings card and source-cited results.",
   "keywords": [
     "dsh",