Skip to content

v1.3.0

Choose a tag to compare

View all tags
@Him666233 Him666233 released this 07 Nov 21:13
· 3 commits to main since this release
v1.3.0
0ced872
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.3.0 · 内联差异插件（2026-11-08）

发布日期：2026-11-08（Asia/Shanghai）
上一个公开版本：v1.2.6（2026-11-07）

DSH Inline Diff 为 DeepSeek Harness 的对话流提供逐次文件修改的内联差异卡片：每一次 edit / write 都会就地显示修改前后对照，并提供左右对照、行内字符级高亮、移动块与被动行号说明、Read 行范围，以及可独立配置的「展开风格」工具行。

本版本是一个功能版本（minor）：新增中英双语界面与设置页语言切换、完整英文文档与双语截图、设置页/文档原创声明，同时完成一轮安全加固、详细中文注释与多级回退梳理；首次把插件发布到 npm（@him666233/dsh-inline-diff），安装方式在原有本地目录 / link / Release 基础上增加 dsh plugin add 一键安装。没有破坏性变更；旧安装方式继续可用。

新增

中英双语界面与语言切换

  • 插件设置页新增「界面语言 / Language」：中文（默认） / English / 跟随 DSH，切换立即生效、无需刷新；不会修改 DSH 全局语言，也不影响其它插件。
  • 全部插件界面文案（卡片、放大弹窗、命令/工具行、Read 范围、设置、aria-label/title、空状态与错误文案）统一走双语字典；字典缺失时按「选中语言 → 中文 → key」回退，绝不因缺词抛错。
  • 设置页与设置弹窗顶部新增醒目的原创声明：本项目完全原创，与 JanEickholt/dsh-inline-diff 及任何其他同名插件/仓库无关，功能相似纯属巧合，实现与代码效果完全不同，不是衍生或复刻作品。

英文文档与双语截图

  • 新增 README.en.md、plugin/README.en.md、docs/display-behavior.en.md；三份文档顶部提供中/英切换，中文为默认主文档。
  • 新增 docs/en/ 英文界面截图 12 张（与中文截图同名一一对应）；中文设置页、放大弹窗截图按 1.3.0 新界面重拍。截图流程：关闭第三方主题 → 官方原版外观（深色为主，另附浅色外观）→ 分中英文各截一套 → 恢复原主题/外观。

维护者文档与安装方式

  • 新增维护者本地 GitHub 上传说明（放在工作区根目录，不进入仓库、不随发行包发布）：哪些文件该传、哪些不该传，Release 附件怎么发。
  • docs/publish.md 增加发布节奏（先 GitHub 源码 + Release，再 npm 发布）与 npm 首发口径。
  • 安装方式更新为：npm（主推，自 1.3.0 起）→ 本地目录/离线安装 → 手动 link → GitHub Release 安装，并补充升级、卸载、按 profile 安装说明。

安全加固

安全审计结论：无 CRITICAL 级漏洞；修复 2 项 HIGH、3 项 MEDIUM，另有若干 LOW/INFO。

  • Host 只读 API 的浏览器信任边界（HIGH）：前缀路由 /dsh-inline-diff/api/* 在读取 body 前先做准入——优先复用 DSH connection.admit(req)（Host / Origin / 跨站围栏 + HttpOnly、SameSite=Strict 会话 Cookie）；无 connection 的嵌入式 profile 回退本地围栏（Host 必须 loopback / 监听器绑定地址、Origin 同 authority、拒绝 sec-fetch-site: cross-site）；任何异常都不 fail-open。修复 DNS rebinding 与未认证远程读取风险。
  • 快照内存总预算（HIGH）：在「最多 240 条 / 每侧 4MB」之外新增 64MB 总字节预算与字节记账 LRU，避免异常输入把 Host 内存放大到 OOM。
  • 路由与输入加固（MEDIUM）：仅接受 application/json（415）、action 预检（404）、请求体 1MB + 流式上限 + 10 秒超时（413/408）、/read 15 秒读超时与 8 并发（429/504）、统一安全响应头（nosniff / no-store / referrer-policy / CORP）、错误改为语义状态码与固定文案（不回显绝对路径 / errno / 堆栈）。
  • 客户端物化预算（MEDIUM）：20 万行 / 单行 100 万字符预算在拆分逐行对象之前生效，超限降级为「文件过大」提示，避免 4MB 级输入冻结或撑爆渲染进程；locateOnce 与移动块候选对增加复杂度护栏。
  • 其它：read-range-dom 在 document.body 缺失 / 观察异常时安全回退；CI 增加最小权限 permissions: contents: read；npm audit（含 devDependencies）0 漏洞；客户端无 innerHTML / dangerouslySetInnerHTML / eval；高亮 HTML 只解析为纯文本 token。

改进

  • 代码结构与注释：按「一个文件只做一类事」梳理客户端模块（i18n 独立成模块）；关键路径补充详细中文注释（职责、输入输出、边界、回退链）；核心逻辑抽为纯函数便于测试。
  • 多级回退与容错：修改前全文（快照 → 文件读取 → 工具元数据差异块 → 明确说明）、全文对照、超大输入、语法高亮、界面语言（设置 → 中文 → key）、设置存储（localStorage → 内存默认值）、Host API 准入（connection → 本地围栏 → 403 降级）等均明确回退层级，最终给出可读原因说明而不是静默失败。
  • 测试：新增 tests/locales.test.mjs（30 项）与 tests/security.test.mjs（31 项）；npm test 共 124 项。
  • 版本卫生：package-lock.json 与版本号同步；plugin/package.json 的 files 增加 README.en.md；build.mjs 保持包名单一来源（client.js 模块 id 与 cordis.patch.yml 自动生成）。

安装与升级

# 新安装（推荐，自 1.3.0 起发布到 npm）
dsh plugin add @him666233/dsh-inline-diff

# 或在 DSH Web UI 的「插件 → 添加插件」中输入包名
# 升级（npm 安装的版本）
dsh plugin add @him666233/dsh-inline-diff@<版本>

原有安装方式继续可用：本地目录 / 离线包（把 plugin/ 目录交给「添加插件」）、手动 pnpm add link:、GitHub Release 中的 dsh-inline-diff-<版本>-plugin.zip。桌面端与 Web UI 若使用不同 profile，需分别安装；同一 profile 不要同时保留 link 版与 npm 版。

截图与文档

  • 中文文档：README.md、docs/display-behavior.md、中文截图 docs/；英文文档：README.en.md、docs/display-behavior.en.md、英文截图 docs/en/。
  • 发布前检查：node build.mjs（重建 plugin/client.js 与 plugin/cordis.patch.yml）→ node build.mjs --check → npm test（124 项）→ cd plugin && npm pack --dry-run（10 个文件）。
  • 发行包由 node scripts/build-release.mjs 生成：两个 zip + SHA256SUMS.txt，同时做版本/包名/bundle patch/构建产物一致性校验。

校验

  • 安装包 SHA-256 见同目录 SHA256SUMS.txt；Windows 可用 certutil -hashfile <文件> SHA256 核对。
  • 本版本在 DeepSeek Harness 0.2.2-rc.1（desktop profile）实测通过；engines.dsh 仍为 >=0.2.2-rc.1 <0.3.0。

v1.3.0 · Inline Diff Plugin (2026-11-08)

Release date: 2026-11-08 (Asia/Shanghai)
Previous public release: v1.2.6 (2026-11-07)

DSH Inline Diff renders per-edit inline diff cards directly in the DeepSeek Harness conversation: every edit / write call shows a before/after comparison in place, with side-by-side viewing, character-level inline highlighting, moved-block and passive line-number notes, Read range chips, and an independently configurable "expanded style" for command and tool rows.

This is a feature (minor) release: bilingual UI with an in-settings language switch, complete English documentation and dual-language screenshots, a prominent originality notice in settings and docs, a security-hardening pass, detailed Chinese code comments and multi-level fallbacks, and the first npm release (@him666233/dsh-inline-diff) enabling one-command installation via dsh plugin add. There are no breaking changes; all previous installation methods keep working.

Added

Bilingual UI and language switch

  • A new "Language" setting in the plugin settings page: Chinese (default) / English / Follow DSH. The switch applies immediately without reloading; it does not change the DSH global language or other plugins.
  • Every plugin-facing string (cards, expanded dialog, command/tool rows, Read range, settings, aria-labels/titles, empty and error states) goes through the bilingual dictionary. Missing entries fall back "selected language → Chinese → key" and never throw.
  • A prominent originality notice at the top of both settings surfaces: this project is fully original, has no relationship to JanEickholt/dsh-inline-diff or any other same-name plugin/repository, functional similarity is coincidental, implementation and code behavior are entirely different, and it is neither a derivative nor a replica.

English documentation and dual-language screenshots

  • New README.en.md, plugin/README.en.md, and docs/display-behavior.en.md, each with a Chinese/English switch at the top; Chinese remains the default primary documentation.
  • New 12 English screenshots under docs/en/ (same filenames as the Chinese set); the Chinese settings and viewer screenshots were retaken for the 1.3.0 UI. Screenshot process: disable any third-party theme → official appearance (dark, plus one light-appearance sample) → capture both languages → restore the original theme/appearance.

Maintainer docs and installation

  • New maintainer-local GitHub upload notes (kept at the workspace root, outside the repository and release packages): what to upload to GitHub and what to keep out of the source tree.
  • docs/publish.md now documents the release rhythm (GitHub source + Release first, npm publish afterwards) and the first npm release target.
  • Installation now covers: npm (recommended, available since 1.3.0) → local directory / offline archive → manual link → GitHub Release, plus upgrade, uninstall, and per-profile notes.

Security hardening

Audit result: no CRITICAL issues; 2 HIGH and 3 MEDIUM issues were fixed, along with several LOW/INFO findings.

  • Browser trust boundary for the Host read-only API (HIGH): the /dsh-inline-diff/api/* prefix routes now perform admission before reading any body — preferring DSH connection.admit(req) (Host / Origin / cross-site fencing plus HttpOnly, SameSite=Strict session cookies), falling back to a local fence on profiles without connection (Host must be loopback or the bound listener address, Origin must match the authority, sec-fetch-site: cross-site is rejected). Failures never fail open. This closes DNS-rebinding and unauthenticated remote-read paths.
  • Snapshot memory budget (HIGH): besides "at most 240 entries / 4MB per side", a 64MB total byte budget with byte accounting now evicts the oldest entries, preventing abnormal input from pushing Host memory to OOM.
  • Route and input hardening (MEDIUM): JSON-only bodies (415), action pre-checks (404), 1MB body + streaming cap + 10s timeout (413/408), /read 15s timeout and 8 concurrent reads (429/504), unified security headers (nosniff / no-store / referrer-policy / CORP), and semantic status codes with fixed messages (no absolute paths, errno, or stack traces).
  • Client-side materialization budget (MEDIUM): a 200k-line / 1M-character-per-line budget is measured before rows are materialized; oversized input degrades to a "file too large" notice instead of freezing or crashing the renderer. locateOnce and moved-block candidate pairs gained complexity guards.
  • Other: read-range-dom falls back safely when document.body is missing or observation fails; CI gained least-privilege permissions: contents: read; npm audit (including devDependencies) reports 0 vulnerabilities; the client uses no innerHTML / dangerouslySetInnerHTML / eval, and highlighted HTML is parsed back into plain-text tokens only.

Improvements

  • Code structure and comments: client modules were reorganized around "one file, one responsibility" (i18n is now its own module); critical paths carry detailed Chinese comments (responsibility, inputs/outputs, boundaries, fallbacks); core logic was extracted into pure functions for testability.
  • Multi-level fallbacks: before-text (snapshot → current-file read → tool-metadata hunks → readable notice), whole-file comparison, oversized input, syntax highlighting, UI language (setting → Chinese → key), settings storage (localStorage → in-memory defaults), and Host API admission (connection → local fence → 403 degradation) all define explicit fallback layers and end in a readable explanation rather than a silent failure.
  • Tests: new tests/locales.test.mjs (30 tests) and tests/security.test.mjs (31 tests); npm test now runs 124 tests.
  • Version hygiene: package-lock.json is in sync; plugin/package.json's files includes README.en.md; build.mjs keeps the package name as a single source of truth (client module id and cordis.patch.yml are generated from it).

Install and upgrade

# Fresh install (recommended; published to npm since 1.3.0)
dsh plugin add @him666233/dsh-inline-diff

# or type the package name in DSH Web UI: Plugins → Add plugin
# Upgrade (npm installs)
dsh plugin add @him666233/dsh-inline-diff@<version>

All previous installation methods remain supported: local directory / offline archive (point "Add plugin" at the plugin/ directory), manual pnpm add link:, and the dsh-inline-diff-<version>-plugin.zip from GitHub Releases. Install once per profile when the desktop app and Web UI use different profiles; do not keep both a link install and an npm install in the same profile.

Screenshots and documentation

  • Chinese docs: README.md, docs/display-behavior.md, screenshots in docs/; English docs: README.en.md, docs/display-behavior.en.md, screenshots in docs/en/.
  • Pre-release checks: node build.mjs (rebuild plugin/client.js and plugin/cordis.patch.yml) → node build.mjs --check → npm test (124 tests) → cd plugin && npm pack --dry-run (10 files).
  • Release assets are produced by node scripts/build-release.mjs: two zips plus SHA256SUMS.txt, after validating version consistency, package name, bundle patch, and build artifacts.

Verification

  • SHA-256 checksums for the release archives are in SHA256SUMS.txt next to them; on Windows use certutil -hashfile <file> SHA256.
  • Verified on DeepSeek Harness 0.2.2-rc.1 (desktop profile); engines.dsh remains >=0.2.2-rc.1 <0.3.0.
Assets 5
Loading