zhu1090093659/dsh-web v0.4.14

dsh-web v0.4.14

on GitHub

This release focuses on control plane governance, cross-platform runtime hardening, and low-level protocol resilience: the Workshop (dsh-market) relay control plane has been overhauled with a convergence cache and unified rate-limit budgets to eliminate Cloudflare account API exhaustion, and its deployment pipeline is fully migrated to the Cloudflare official cf CLI; remote access (dsh-remote-bridge) corrects the default push relay address and routes relay leases by subscription tier; the plugin manager (dsh-plugin-manager) adds systemd user unit restarts and bundle landing verification; the aggregate package retires the web-ui-update row; the Windows shell (dsh-win-bash) runs payloads from a verified cache outside the package and cleans up private temporary directories upon exit to eliminate ERR_PNPM_EPERM locks; the browser view (dsh-browser-view) supports clipped and scaled lossless PNG screenshots; and dsh-git-graph pins child git processes to English to prevent overwrite guard misjudgment. The four satellite repositories align to 0.4.14.

Relay control plane overhaul and rate-limit budget tightening: The relay control plane introduces a convergence cache and a D1 account budget guard (capped at 600 calls per 5 minutes), answering active claims directly from cached state without spending Cloudflare account API quota and resolving claim storm throttles. The default transport mode flips to bridge, and leases support subscription-tier routing and multi-meeting-point distribution. D1 migration 0011 adds three nullable convergence cache columns. All 15 relay limits are unified and locked in relay-limits.js, with registration/claim and bridge connection windows tightened to 300 seconds. Relay failures return unified frozen error codes. deploy-market switches completely to the official cf CLI with network-layer retry logic, and the default push relay endpoint is corrected to the account service actually used by the mobile app.
Plugin manager adds systemd service restart and bundle landing verification: When the host runs under a systemd user service, the plugin manager identifies the cgroup and INVOCATION_ID to request a unit-level restart via systemd, adding a fourth systemd state to the restart wire protocol. A new bundle landing verification check (bundleSelectionMissing) rejects updates where build-script gates write dependencies to the profile but drop bundle entries. The aggregate package officially retires the web-ui-update (dsh-update) row, maintaining smooth compatibility for existing profiles via tombstone exports and retiredPlugins registration.
Windows shell execution and lifecycle hardening: Resolves the ERR_PNPM_EPERM package-directory lock defect on Windows (issue #1996), where persistent background bash processes blocked plugin updates and reinstalls; dsh-win-bash now unpacks and executes verified payloads outside node_modules under <DSH_HOME>/win-bash/runtime/<key>. Each shell process reclaims its private temporary directory upon termination, timeout, abort, or cancellation, and orphaned temporary directories are swept on plugin mount (issue #1993).
Browser view adds clipped and scaled lossless PNG screenshots: dsh-browser-view adds clip (CSS pixel bounding box matching browser_snapshot), scale (1x/2x/3x), and format (defaulting to lossless png) parameters to browser_screenshot, preventing fine 1-2px layout details from being lost to lossy JPEG compression or wasting vision token budgets, while planning screenshot sizes based on the tab's active viewport.
Task board event stream resilience and team settings card refinement: Resolves an issue where silent disconnects or write failures caused SSE event streams to stall without triggering browser reconnects; the transport now resynchronizes snapshots on connect/reconnect and polls in-flight tasks until settled. The team settings section is refactored into a standard nested settings card layout to prevent label squeezing and broken wrapping, and task boards support syncing GitHub issue close state grouped by repository.
The four satellite repositories align to 0.4.14: All four satellites publish first and align to 0.4.14. The skin center (dsh-skins, ff01ddcfe00588656ade6e35a8410f91bdf8a12c) includes intake decision commit f4c2992; pet (dsh-pet, 9ed843bccee3d2604ce0ac31f55cbde9bda97c7f) includes review decision commit da737fc; the community plugin index (dsh-community-plugins, a58eab289e159a9e8bf9f634ef4ed09537042536) expands to 150 plugins (adding dsh-model-everything and dsh-composer-ease with zero modifications to existing entries); and the preset center (dsh-presets, d6828f85ac7900c02e8f5a6e1fa66e4995895cfc) aligns versions cleanly.

Upgrade Notes

• Relay Control Plane Rate Limit Budget Tightening: The rate-limit window for the relay control plane (dsh-market Worker) is tightened from 60s to 300s, the per-id budget is lowered from 6 to 3, and the per-IP budget is adjusted to 60 (counted per client IP directly); the bridge door reuses this 300s window, effectively reducing connection budgets from 6 per minute to 6 per 5 minutes. This is a user-perceptible change: under network jitter or frequent reconnects, clients are more likely to receive HTTP 429 rate-limit responses, and clients will wait according to their backoff window.
• Relay Database Migration and Transport Mode Flip:
  • D1 migration 0011_relay_lease_convergence_cache.sql adds three nullable columns (converged_at / token_cache / token_at) to relay_leases. Legacy rows reading NULL automatically re-converge and populate the cache without requiring a backfill. The deployment sequence in scripts/deploy-market strictly enforces cf d1 migrations apply before cf deploy.
  • The default relay lease transport mode flips from quick to bridge, but existing lease rows retain their recorded transport mode (the upsert's ON CONFLICT clause does not overwrite the mode column), so the default flip only affects newly created leases.
• Restart Protocol Fourth State and Legacy Page Compatibility: The restart wire protocol in dsh-plugin-manager adds a fourth state systemd (wire shape {restart: {mode: 'systemd', unit}}). On hosts managed by systemd user units, an unrefreshed browser page clicking Restart will display an error due to the unrecognized mode; simply refreshing the page restores normal behavior with no data loss.
• Retirement of web-ui-update Row from Aggregate: Aggregate @linxin666/dsh-web-all removes the web-ui-update (dsh-update) mount row while maintaining tombstone subpath exports and retiredPlugins registration. Profiles that previously set this entry to disabled will log a patch: entry "web-ui-update" not found warning on startup until the user runs an update via the plugin manager; host startup and data integrity are unaffected.
• Upgrade Entry Support Matrix and Manual Recovery:
  • The upgrade matrix follows 0.4.13: There is no Doctor pre-launch migration; executing dsh web directly does not install new versions (it only fixes row names after startup); only the plugin manager update task performs backups, --dump-config prechecks, and rollbacks. Manual CLI upgrades retain orphaned disabled override rows.
  • If manual recovery is needed, follow the three standard steps:
    1. dsh plugin remove @linxin666/dsh-web-all (or legacy name @linxin666/dsh-web-ui-all)
    2. dsh plugin add @linxin666/dsh-web-all@0.4.14
    3. In dsh.profile.bundles, in-place replace the legacy name with @linxin666/dsh-web-all (the official CLI only updates dependencies, not bundles; missing this step causes skipping profile bundle). If interrupted leaving empty dependencies while bundles points to the old name, do not run dsh plugin install; repeat the three steps above.
• Platform Verification Notice: This release was fully verified with the complete local test suite, runtime checks, and pre-release audits on Linux (Ubuntu x86_64) (tested). macOS and Windows remain unverified on physical hardware. Unverified areas include: dsh-win-bash out-of-package runtime staging and private temp directory reclamation (Windows-specific paths covered only by single-platform CI), dsh-plugin-manager systemd restarts in production environments (verified via unit tests and mock units, but not in complex cgroup hierarchies), and file permissions, rename, and backup behavior on Windows.

New Features

• [remote-bridge] Route relay leases by subscription tier
• [remote-bridge] Make relay control plane base and suffix configurable
• [remote-bridge] Reword pairing panel and link iOS beta Discord
• [browser-view] Capture lossless PNG screenshots with clip and scale
• [market] Deploy Cloudflare Workers and D1 migrations with official cf CLI
• [dsh-web-all] Retire dsh-update row from aggregate package
• [task-board] Sync GitHub issue close state and group by repository

Bug Fixes

• [remote-bridge] Point default push relay URL to account service used by the app
• [plugin-manager] Request systemd unit restart when host is launched by systemd user service
• [market] Grade tunnel id before binding to prevent undefined values in D1 batch
• [market] Pass lease id into convergence cache check to prevent redundant re-convergences
• [market] Supply explicit nulls for bridged lease fields to eliminate undefined bindings
• [task-board-team] Open team settings card collapsed by default
• [task-board-team] Render team settings block as a nested settings card
• [market] Return frozen storage failure code when registration write fails
• [win-bash] Run payload from verified cache copy outside package to prevent EPERM locks on Windows (#1996)
• [win-bash] Reclaim each shell's private temporary directory upon termination and sweep orphans (#1993)
• [market] Prune raw heartbeats on short window and forward captured deployment output
• [market] Prevent relay claim path from spending account API budget via convergence cache and guards
• [market] Add flow-control window to bridge streams and return frozen error codes on failure
• [market] Retry deployments on CLI network-layer failure wording
• [git-graph] Pin git child locale to English (LANG=C) to prevent overwrite guard misjudgment
• [test] Allow cohort gate to recognize workspace overrides as declared exemptions
• [remote-bridge] Claim relay leases on demand and deduplicate state logs
• [market] Stop calling Cloudflare API once account budget is exhausted
• [remote-bridge] Cap failed claim retries within Cloudflare rate-limit window
• [market] Bound relay lease GC and gracefully handle exhausted account budgets
• [remote-bridge] Include approval category in push payloads to render actionable banner buttons
• [task-board] Terminate stalled SSE event streams and poll in-flight tasks until settled
• [plugin-manager] Fail installation when bundle selection fails to land in profile
• [plugin-manager] Clean up orphan overrides pointing to retired rows on CLI-created profiles
• [plugin-manager] Check exit code when removing new package during migration rollback and report incomplete status
• [plugin-manager] Allow retrying updates directly after boot preflight failure without 409 blocking

Other Changes

• [remote-bridge] Document reason for explicit relay URL configuration on local1 test host
• [notes] Record bridge flow-control fence and quiet window
• [remote-bridge] Replace fixed sleeps with refusal fences to define test quiet window
• [market] Update relay test doubles to refuse bindings rejected by D1
• [notes] Point control-plane note at limits module
• [market] Consolidate all 15 relay limits and window budgets into a single module
• [market] Pin frozen error codes and response schemas for relay proxy path
• [market] Pin community merge commits and rebuild store catalog (expanded to 150 plugins)
• [archive] Record root cause of Cloudflare 429 throttles from relay claim storm
• [notes] Add CLI network-layer wording to retry note
• [notes] Record removal of desktop host coupling from cohort gate
• [notes] Document cohort gate declared overrides exemption logic
• [deps] Regenerate pnpm-lock.yaml for rc.5 workspace overrides
• [deps] Pin workspace @deepseek-ai cohort to host DSH tree (development mode)
• [notes] Document client-initiated socket epoch recreation within cold-start window
• [archive] Point cutover return step at new-relay backup
• [archive] Record measured relay rollback
• [archive] Record cutover readings and rollback/return procedure
• [archive] Hand off relay cutover, evidence, and remaining steps
• [notes] Record shipped relay server, env contract, and HTTP passthrough boundary
• [notes] Propose moving relay meeting point off Cloudflare
• [notes] Synchronize relay control-plane note with budget guards
• [archive] Record desktop shell SSE forwarding probe results
• [task-board] Record event stream stall recovery and in-flight verification note
• [task-board] Document five mirror re-read entry points in README
• [task-board] List stream error among mirror re-read trigger conditions