The web configuration surface (apiproxy) served only model-provider plus
explicit allowlist namespaces, so a third-party plugin's settings card (e.g.
the web-ui image-understanding plugin's describe-image) showed "namespace not
exposed" and was uneditable. Let a plugin opt its namespace in via
`settings.register(..., { configurable: true })`, and let a deployment expose
any shipped third-party namespace via the gateway's new `exposeSettings`
config (the web-app bundle lists describe-image). Default stays not-exposed.
Co-Authored-By: Claude <noreply@anthropic.com>
Register the dsh CLI launcher from the desktop shell, prefer the vendored
pnpm in the CLI plugin command, and update the desktop and CLI reference docs.
Co-Authored-By: Claude <noreply@anthropic.com>
Add an in-app plugin marketplace fed by a remote web catalog: the host
plugin-inventory gateway gains marketplaceList/Install/Uninstall remotes,
a durable per-user install table reconciled against the actual profile, and
git/npm/tarball/bundle install paths with non-interactive git and vendored
pnpm. The Web Settings surface gains a sibling 插件市场 tab that lists the
catalog with recommended badges, repository links, and a combined sort
(recommended first, then catalog priority, then id).
Add a host + client skill manager: list local skills by direct filesystem
discovery, and install/uninstall/toggle/edit their SKILL.md from git/npm/
tarball/local sources in the writable user root.
Co-Authored-By: Claude <noreply@anthropic.com>
The install input matched the catalog search field, and the install button plus
the enable/disable toggles now use the shared Button primitive (primary /
outline sm), replacing unstyled native buttons. The install hint clarifies that
registry installs require a published npm package.
Co-Authored-By: Claude <noreply@anthropic.com>
The About section hardcoded its version; the main process now exposes
get-app-info so it reads app.getVersion() dynamically, and the update result
carries the manifest release date. The manifest generator orders versions
numerically (0.10.0 outranks 0.9.0). A new stage-release script copies
releases.json plus installers into the deepseek-harness-web site root's
updates/, which deploy.py publishes to OSS alongside the download page, so the
app and web share one update channel. The About section also gains links to the
release site and official site.
Co-Authored-By: Claude <noreply@anthropic.com>
Image recognition and the chat model shared DEEPSEEK_API_KEY: the
image-recognition bundle defaulted apiKeyEnv to the model key, so saving one
overwrote the other. Point the bundle at IMAGE_RECOGNITION_API_KEY and guard
both the provider and the settings card against a stale model ref, so vision
never reads or writes the chat key. Also add a clear-key button, default the
model to qwen3-vl-flash on the DashScope compatible-mode endpoint, and send
file images as base64 with a normalized base URL.
Co-Authored-By: Claude <noreply@anthropic.com>
Make the HTTP vision provider's configuration independent of the main chat
model: the API key default moves from DEEPSEEK_API_KEY to IMAGE_RECOGNITION_API_KEY,
and the URL and model get image-recognition-specific defaults (Aliyun DashScope
compatible-mode and qwen3-vl-flash) instead of the chat model's deepseek-v4-flash.
The provider fails loud when no model is configured.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds an unsigned, manual-download update flow. The main process fetches the OSS
updates/releases.json manifest (DSH_UPDATE_URL overrides), compares the latest
version, and on startup and hourly prompts to open the per-platform installer
URL; a preload bridge exposes the same check to the SPA's About "check for
updates" button, which renders the version, notes, and a download link.
scripts/generate-release-json.mjs builds the manifest from the packaged
.dmg/.exe. Windows nsis packaging is configured.
Co-Authored-By: Claude <noreply@anthropic.com>
Installing a plugin now activates it without a restart: the CLI boot provides a
dshReloadProfile handle that re-runs the profile composition and applies it to
the running root Include, and the install/uninstall Remotes recompose live when
the handle is present (restartRequired: false). Registry installs try the
ordered INSTALL_REGISTRIES mirrors with the official npm registry as the final
fallback, erroring only when every source is unreachable. The enable/disable
guard splits into a REQUIRED_PLUGINS blacklist and a USER_TOGGLEABLE_PLUGINS
whitelist (default toggleable) generated from the running plugin list, and the
offline optional-bundle catalog is emptied (default bundles are not
installable/uninstallable). The plugin-list tab becomes a registry install form
and shows immediate-activation instead of a restart notice.
Co-Authored-By: Claude <noreply@anthropic.com>
The RemoteNamespaceService reserves `install` as its private registration
method, so a Remote method also named `install` collided at client-api boot
(`pluginInventory/install conflicts with its namespace service`). Rename the
plugin-install Remote to `installPlugin` across host, client, and tests.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds an install surface to the plugin-inventory gateway: availableBundles lists
the curated offline-installable optional bundles (AVAILABLE_BUNDLES); install
composes an offline bundle into the profile's dsh.profile.bundles, or for a
registry spec runs pnpm against the writable profile via the bundled Node and a
vendored pnpm (gated behind the dshAllowPluginInstall context flag, set only by
the desktop boot); uninstall removes a bundle layer. The reconcile logic from
`dsh plugin add` moves into app-boot as shared helpers. The desktop vendored
pnpm into the harness and sets the allow-install env; the plugin-list SPA gains
an installable-bundles section. Tests cover the guard, install helpers, and the
SPA section at 100% host coverage.
Co-Authored-By: Claude <noreply@anthropic.com>
Splits the enable/disable guard into two code-editable lists: REQUIRED_PLUGINS
(the blacklist of load-bearing core that must never be disabled) and
USER_TOGGLEABLE_PLUGINS (the whitelist, which overrides the blacklist for an
explicitly toggleable plugin). A plugin on neither list is toggleable by
default. isRequiredPlugin and isUserToggleable derive from the two lists.
Co-Authored-By: Claude <noreply@anthropic.com>
Notes the preview build as unofficial in the conversation hero and describes the
image-recognition plugin as an extension beyond the official DeepSeek surface.
Co-Authored-By: Claude <noreply@anthropic.com>
Registers a new `settings.section` (id `about`) in ui-settings-general that
introduces PineSound, names the product build, shows the current version, and
offers a check-updates control (a client-side placeholder comparing against a
known-latest constant pending a real update channel). Adds a 16px info icon to
ui-primitives and wires the section into the settings nav. Tests cover the
registration and the About component; READMEs and translation-pairing hashes
are updated.
Co-Authored-By: Claude <noreply@anthropic.com>
The plugin-list tab rendered one flat list of every Loader entry — no separate
"system plugins" section — with each card showing its real enabled state and an
enable/disable button (a required plugin shows only a read-only note). The
enable/disable guard flipped from default-protect to default-open: only the
small REQUIRED_PLUGINS core (entry tree, Remote RPC spine, session/agent spines)
is protected from being disabled, so the shipped plugins are actually
toggleable. Tests, host READMEs, and the enable-disable agent note track the new
grouping and guard.
Co-Authored-By: Claude <noreply@anthropic.com>
The plugin-list tab now splits by current state: disabled plugins sit in the
main list with an enable button (so a bundle-default-disabled plugin can be
re-enabled), while enabled plugins sit in the collapsible system section —
a user-added enabled plugin keeps a disable toggle, a required one shows
none. setEnabled refuses to disable a required plugin but allows re-enabling
a disabled one, verifying the fiber activates and reverting a
dependency-missing enable.
Co-Authored-By: Claude <noreply@anthropic.com>
User-added (toggleable) plugins carry an enable/disable button in the main
list; required system plugins sit in a separate collapsible 'system plugins'
section with no controls. The system section starts expanded so the existing
web e2e/snapshot (which targets a system plugin row) still passes.
Co-Authored-By: Claude <noreply@anthropic.com>
Every entry now carries a protected flag. The guard is default-protect:
disabling a plugin another plugin injects breaks the dependent, and enabling
one whose service is unavailable fails the boot (dsh-tool-ralph: pending on
workflowEngine). setEnabled refuses and the UI hides the toggle for every
shipped plugin; only opt-in-bundle plugins (USER_TOGGLEABLE_PLUGINS in
required.ts) are toggleable.
Co-Authored-By: Claude <noreply@anthropic.com>
Update the plugin-inventory READMEs from read-only to toggleable and record
the in-page enable/disable capability as an Agent Note.
Co-Authored-By: Claude <noreply@anthropic.com>
Each expanded plugin card gains an enable/disable button wired to
pluginInventory.setEnabled; the tab re-lists after toggling. Adds zh/en
copy for the toggle states.
Co-Authored-By: Claude <noreply@anthropic.com>
pluginInventory/setEnabled calls ctx.loader.update({disabled}) for a live
effect and writes an explicit disabled override into the profile's user
patch layer so the choice survives a restart. The patch row id is the bare
entry options.id, not the group-prefixed tree id.
Co-Authored-By: Claude <noreply@anthropic.com>
Unit-render the card after expanding its disclosure header, asserting the
three configurable controls appear (getByLabelText throws when absent).
Co-Authored-By: Claude <noreply@anthropic.com>
The RPC settings.describe only serves namespaces on the WEB_SETTINGS_NAMESPACES
and PRODUCT_SETTINGS_NAMESPACES allowlists; a namespace absent from both answers
settings-not-exposed even when its owner registered it. image-recognition-http
was missing, so the plugin-config card's scope stayed unavailable and the card
rendered nothing. Add it to the web allowlist beside web-search-deepseek.
Co-Authored-By: Claude <noreply@anthropic.com>
The apply test now expects four plugin.item cards (bash, agent-loop,
web-search, image-recognition), a cardCount of 4, and two credential
re-reads (web-search and image-recognition both watch the reference).
Co-Authored-By: Claude <noreply@anthropic.com>
Expose ImageRecognitionRuntime.available() and gate the image-task pre-step
injection on it, so the capability is dormant until an endpoint is
configured instead of guiding the model to a call that can only fail.
Co-Authored-By: Claude <noreply@anthropic.com>
Add the image-recognition bundle to the web profile template so the
capability is on by default for new web profiles.
Co-Authored-By: Claude <noreply@anthropic.com>
Document the four image-recognition packages and the vision group, register
the vision domain in the package index, add the capability decision as an
Agent Note, declare the invariants peer dep, and drop the unused agents
injection from the consumer.
Co-Authored-By: Claude <noreply@anthropic.com>
An image-recognition card in the Plugins settings page (endpoint + key),
cloned from the web-search card: baseURL via the settings section, the key
through the credentials domain.
Co-Authored-By: Claude <noreply@anthropic.com>
Mounts the capability seam, the configurable HTTP provider, and the
model-facing recognition consumer. Not in any default profile's bundles
list — a user opts in per profile.
Co-Authored-By: Claude <noreply@anthropic.com>
Registers the recognize_image tool and a bundled image-recognition skill,
and hooks agent/pre-step to deterministically inject the skill body when a
step input carries an image (content block or image path/URL), so the model
recognizes the image before continuing the task.
Co-Authored-By: Claude <noreply@anthropic.com>
Registers an OpenAI-compatible chat-completions provider into
ctx.imageRecognition with a user-editable baseURL + API key via a settings
section and the credential plane. Logs the secret-free vision request body
as the image-recognition/llm-request session event.
Co-Authored-By: Claude <noreply@anthropic.com>
Service Definition for ctx.imageRecognition: a provider registry and
provider-selecting execution, mirrored on the web seam (duplicate ids
rejected, order-independent selection, ImageRecognitionError taxonomy).
Co-Authored-By: Claude <noreply@anthropic.com>
Every release member now declares publishConfig.access: public, so the scope no
longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored
framework and the native packages.
check-workspace-constraints drops the per-sequence expectation and holds every
release member to public, which is what stops a member from drifting back.
Access is a property of the package, not of a version: the dsh packages already
published as restricted become world-readable at their next publication.
Pine