diff --git a/.claude/launch.json b/.claude/launch.json deleted file mode 100644 index d2ac19b830..0000000000 --- a/.claude/launch.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "version": "0.0.1", - "configurations": [ - { - "name": "dsh-web", - "runtimeExecutable": "env", - "runtimeArgs": [ - "DSH_HOME=/Users/jyc/projects/agentProjects/deepseek-harness/.claude/worktrees/tool-call-side-effects-fix-680343/tmp/dsh_home", - "DSH_TELEMETRY_DISABLED=1", - "node", - "apps/cli/lib/bin.js", - "web", - "--port", - "3080" - ], - "port": 3080 - } - ] -} diff --git a/apps/cli/tests/fixtures/github-repository-plugin/.dsh-plugin/package.json b/apps/cli/tests/fixtures/github-repository-plugin/.dsh-plugin/package.json index 60ea50e091..6871a4d053 100644 --- a/apps/cli/tests/fixtures/github-repository-plugin/.dsh-plugin/package.json +++ b/apps/cli/tests/fixtures/github-repository-plugin/.dsh-plugin/package.json @@ -12,6 +12,9 @@ "prepack": "tsc --noEmit && tsdown src/plugin.ts src/mcp-server.ts --no-config --tsconfig tsconfig.json --out-dir lib --platform node --target es2024 --clean && dsh-plugin-prepare" }, "dsh": { + "skills": [ + "../skills" + ], "mcpServers": "./.mcp.json", "entry": "./lib/plugin.mjs" }, diff --git a/apps/cli/tests/fixtures/github-repository-plugin/skills/github-source-proof/SKILL.md b/apps/cli/tests/fixtures/github-repository-plugin/skills/github-source-proof/SKILL.md new file mode 100644 index 0000000000..eae668a4f9 --- /dev/null +++ b/apps/cli/tests/fixtures/github-repository-plugin/skills/github-source-proof/SKILL.md @@ -0,0 +1,6 @@ +--- +name: github-source-proof +description: Proves that dsh installed a private repository Plugin from an exact GitHub source. +--- + +This skill exists only in the GitHub repository source fixture. diff --git a/apps/cli/tests/github-repository-plugin.built.e2e.ts b/apps/cli/tests/github-repository-plugin.built.e2e.ts index ddba0be8b6..7bb4706dd7 100644 --- a/apps/cli/tests/github-repository-plugin.built.e2e.ts +++ b/apps/cli/tests/github-repository-plugin.built.e2e.ts @@ -125,11 +125,7 @@ async function startPublishedPackageRegistry(root: string): Promise { - // The fixture deliberately carries no skill root: this composition's agent - // plane lives behind agent presets, whose per-preset `skills` realm has no - // seam for a deployment-level provider yet — see the repository-plugin - // README's Known Limitations. - it('installs the published prepare dependency, then builds and runs MCP and TypeScript Plugin contributions from a private exact GitHub source', async () => { + it('installs the published prepare dependency, then builds and runs skill, MCP, and TypeScript Plugin contributions from a private exact GitHub source', async () => { expect(existsSync(dshBin), 'the repository Plugin acceptance must run the built dsh entry').toBe(true) expect(source, 'DSH_GITHUB_REPOSITORY_PLUGIN_SOURCE is required by this CI lane').toMatch( /^github:[^/\s#&]+\/[^/\s#&]+#[0-9a-f]{40}&path:\/.*\/\.dsh-plugin$/u, @@ -205,6 +201,9 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () => expect(registry.requests, runtimeDiagnostic).toContain('GET /@deepseek-ai/dsh-repository-plugin/-/dsh-repository-plugin-0.0.1.tgz') const firstRequest = JSON.stringify(server.requests[0]!.body) const secondRequest = JSON.stringify(server.requests[1]!.body) + expect(firstRequest, runtimeDiagnostic).toContain( + 'Proves that dsh installed a private repository Plugin from an exact GitHub source.', + ) expect(firstRequest, runtimeDiagnostic).toContain('mcp__github_repository__proof') expect(firstRequest, runtimeDiagnostic).toContain('Proves that an MCP server compiled from the exact GitHub repository package is active.') expect(secondRequest, runtimeDiagnostic).toContain('MCP_FROM_GITHUB_REPOSITORY') @@ -222,6 +221,7 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () => prepack: 'tsc --noEmit && tsdown src/plugin.ts src/mcp-server.ts --no-config --tsconfig tsconfig.json --out-dir lib --platform node --target es2024 --clean && dsh-plugin-prepare', }, dsh: { + skills: ['../skills'], mcpServers: './.mcp.json', entry: './lib/plugin.mjs', }, @@ -235,6 +235,8 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () => typescript: '6.0.3', }, }) + expect(readFileSync(join(installed, 'dsh-plugin-assets/skills/0/github-source-proof/SKILL.md'), 'utf8')) + .toContain('This skill exists only in the GitHub repository source fixture.') expect(readFileSync(join(installed, 'dsh-plugin-assets/.mcp.json'), 'utf8')).toContain('lib/mcp-server.mjs') expect(readFileSync(join(installed, 'lib/plugin.mjs'), 'utf8')).toContain('TS_PLUGIN_FROM_GITHUB_REPOSITORY') expect(readFileSync(join(installed, 'lib/mcp-server.mjs'), 'utf8')).toContain('MCP_FROM_GITHUB_REPOSITORY') diff --git a/packages/self-modification/repository-plugin/README.i18n.yaml b/packages/self-modification/repository-plugin/README.i18n.yaml index 5af810d3ec..6b0e958c2c 100644 --- a/packages/self-modification/repository-plugin/README.i18n.yaml +++ b/packages/self-modification/repository-plugin/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/self-modification/repository-plugin/README.md -README.md: 794d176dc69bf45ca61472e081bf2bf623851761 -README.zh.md: 6d8428e6baa75fe37fefa2d2c55ae73ca450dc1a +README.md: 666f00e02b9ab33bff348df6b4ff90e3f3bfecc7 +README.zh.md: b09f68bc17a4eb08df6ecbb3782e14bf26fb7d7f diff --git a/packages/self-modification/repository-plugin/README.md b/packages/self-modification/repository-plugin/README.md index 794d176dc6..666f00e02b 100644 --- a/packages/self-modification/repository-plugin/README.md +++ b/packages/self-modification/repository-plugin/README.md @@ -122,7 +122,6 @@ Stable registrations preserve the owning surface's normal prefix behavior. Loadi ## Known Limitations and Deferred Work -- **Skill contributions do not reach preset-composed sessions** — `dsh.skills` mounts a host-plane provider into the host `skills` registry, but a composition whose agent plane lives behind agent presets moves that registry into each preset's private realm: the wrapper then has no host registry to wait on, and a host-registered catalog would not reach any session's model-facing skill surface either. Until the skills registry grows the host+per-scope layering the tools registry has (or repository skills are delivered as directories a preset's provider scans), a preset-composed deployment should not declare `dsh.skills`; MCP and entry contributions are unaffected because the tools registry is host-plane and layered. - **No code sandbox** — `dsh.entry`, npm dependencies, and package lifecycle scripts execute with the DSH host's authority; repository trust is mandatory. - **Entry-only service dependencies are not pre-gated** — the generated wrapper cannot declare an entry module's `inject` before importing it. Any service beyond those implied by Skills or MCP must already exist when the wrapper mounts the entry, or that repository generation rejects. - **No MCP authentication protocol** — static headers may use environment expansion, but OAuth-bearing definitions reject and private-server login flows are not implemented here. diff --git a/packages/self-modification/repository-plugin/README.zh.md b/packages/self-modification/repository-plugin/README.zh.md index 6d8428e6ba..b09f68bc17 100644 --- a/packages/self-modification/repository-plugin/README.zh.md +++ b/packages/self-modification/repository-plugin/README.zh.md @@ -122,7 +122,6 @@ Namespace 插件：具名导出 `name`／`inject`／`apply`、准备阶段常量 ## 已知限制与暂缓事项 -- **skill 贡献到达不了由 preset 组装的会话**：`dsh.skills` 会把一个宿主面 provider 挂进宿主 `skills` 注册表，而 agent 面移入 agent preset 的组合把该注册表搬进了每个 preset 的私有 realm：此时包装层没有可等待的宿主注册表，即便注册进宿主目录也到不了任何会话面向模型的 skill 面。在 skills 注册表获得 tools 注册表那样的宿主＋按作用域分层（或 repository skill 改为以目录交付、由 preset 的 provider 扫描）之前，preset 组装的部署不应声明 `dsh.skills`；MCP 与入口贡献不受影响，因为 tools 注册表在宿主面且分层。 - **没有代码沙箱**：`dsh.entry`、NPM 依赖和包生命周期脚本以 DSH 宿主权限执行；必须信任该 repository。 - **入口专用服务依赖不会预先门控**：生成的包装层无法在导入入口模块前声明其 `inject`。除 skill 或 MCP 隐含的服务外，其他任何服务在包装层挂载入口时都必须已经存在，否则该 repository generation 会被拒绝。 - **没有 MCP 认证协议**：静态 header 可以使用环境变量展开，但带 OAuth 的定义会被拒绝，私有 server 登录流程不在此实现。