feat!: @refkit/dsh-plugin 0.2.0 — port to DeepSeek Harness 0.1.7

README.md

@@ -8,7 +8,7 @@ English | [中文](README.zh.md)
 - **`refkit_rights`** — re-check one license for a different intent without searching again.
 - **Web card** — thumbnail grid; license chip on every tile; green / blue / red / amber badges for allowed / credit required / not allowed / needs review; one-click credit copy.
 
-Eleven sources work with no key at all (Openverse, Met, Art Institute of Chicago, Wikimedia Commons, Rijksmuseum, Internet Archive, Project Gutenberg, PoetryDB, Poly Haven, ambientCG, nailbook). Add free keys for the rest under Settings → Plugins → refkit.
+Eleven sources work with no key at all (Openverse, Met, Art Institute of Chicago, Wikimedia Commons, Rijksmuseum, Internet Archive, Project Gutenberg, PoetryDB, Poly Haven, ambientCG, nailbook). Add free keys for the rest under **Plugins (sidebar) → refkit → Components → refkit**.
 
 ## Install
 
@@ -18,11 +18,11 @@ dsh plugin --profile web add @refkit/dsh-plugin
 dsh plugin --profile web add github:refkitjs/dsh-plugin
 ```
 
-Restart the dsh web host once so the profile picks up the bundle. Tested against `@deepseek-ai/dsh` 0.1.5-rc.2 (the `next` channel); dsh is in developer preview and its plugin API changes between release candidates.
+Restart the dsh web host once so the profile picks up the bundle. Tested against `@deepseek-ai/dsh` 0.1.7-rc.2. Requires dsh 0.1.x from 0.1.7-rc.2 on (`^0.1.7-rc.2`); dsh refuses to load it on older releases and on the 0.2.0 pre-releases (`next`) until support is widened. dsh is in developer preview and its plugin API changes between release candidates.
 
 ## Configuration
 
-Settings → Plugins → **refkit** (namespace `refkit`; changes apply on the next call). Keys are `secret` fields: masked in the card, never logged, never returned to the model. Each key also falls back to an environment variable — the same names `@refkit/mcp` reads, so one `.env` serves both.
+Keys and tuning are set on **Plugins (sidebar) → refkit → Components → refkit** (namespace `refkit`); changes apply on the next call, no restart needed. Keys are `secret` fields: never shown on the settings page (only a Set / Not set marker), never logged, never returned to the model, and stored in the profile's `cordis.patch.yml` (file mode 0600, plaintext). Each key left empty falls back to the environment variables in the table below (`REFKIT_*` first) — the same names `@refkit/mcp` reads, so one `.env` serves both. An invalid hand-edited `cordis.patch.yml` stops the plugin at startup until it's fixed.
 
 | Field | Env (first wins) | Enables |
 | --- | --- | --- |

README.zh.md

@@ -8,7 +8,7 @@
 - **`refkit_rights`** — 针对不同的使用意图重新校验同一条许可证,无需重新搜索。
 - **网页卡片** — 缩略图网格;每个卡片都带许可证标签;绿 / 蓝 / 红 / 黄四色徽章分别对应 allowed(允许) / credit required(需署名) / not allowed(不允许) / needs review(需人工复核);一键复制署名文本。
 
-十一个来源无需任何密钥即可使用（Openverse、Met、Art Institute of Chicago、Wikimedia Commons、Rijksmuseum、Internet Archive、Project Gutenberg、PoetryDB、Poly Haven、ambientCG、nailbook）。其余来源在「设置 → 插件 → refkit」里填入免费密钥即可启用。
+十一个来源无需任何密钥即可使用（Openverse、Met、Art Institute of Chicago、Wikimedia Commons、Rijksmuseum、Internet Archive、Project Gutenberg、PoetryDB、Poly Haven、ambientCG、nailbook）。其余来源在「插件（侧边栏）→ refkit → 包含的组件 → refkit」里填入免费密钥即可启用。
 
 ## 安装
 
@@ -18,11 +18,11 @@ dsh plugin --profile web add @refkit/dsh-plugin
 dsh plugin --profile web add github:refkitjs/dsh-plugin
 ```
 
-重启一次 dsh web host,让该 profile 加载该 bundle。已在 `@deepseek-ai/dsh` 0.1.5-rc.2(`next` 频道)上测试通过;dsh 目前处于开发者预览阶段,其插件 API 在各个 release candidate 之间会发生变化。
+重启一次 dsh web host,让该 profile 加载该 bundle。已在 `@deepseek-ai/dsh` 0.1.7-rc.2 上测试通过;要求 dsh 0.1.x 且不低于 0.1.7-rc.2(`^0.1.7-rc.2`),更低版本以及 0.2.0 预发布版(`next` 频道)的 dsh 会拒绝加载该插件,直到后续版本放宽支持范围。dsh 目前处于开发者预览阶段,其插件 API 在各个 release candidate 之间会发生变化。
 
 ## 配置
 
-Settings → Plugins → **refkit**(命名空间为 `refkit`;修改在下一次调用时生效)。所有 key 字段都是 `secret` 类型:在卡片中会被遮罩显示,不会被记录日志,也不会返回给模型。每个 key 都有对应的环境变量兜底——与 `@refkit/mcp` 读取的变量名相同,因此同一份 `.env` 可以同时服务这两者。
+密钥和调优参数在「插件（侧边栏）→ refkit → 包含的组件 → refkit」中设置(命名空间为 `refkit`);修改在下一次调用时生效,无需重启。所有 key 字段都是 `secret` 类型:设置页不会回显已保存的值(只显示 Set / Not set 标记),不会被记录日志,也不会返回给模型,并以明文形式存储在该 profile 的 `cordis.patch.yml` 中(文件权限 0600)。某个 key 留空时会依次回退读取下表列出的环境变量(`REFKIT_*` 优先)——与 `@refkit/mcp` 读取的变量名相同,因此同一份 `.env` 可以同时服务这两者。手动编辑后校验失败的 `cordis.patch.yml` 会使插件启动失败,直到修复为止。
 
 | 字段 | 环境变量(先匹配者优先) | 启用的来源 |
 | --- | --- | --- |

cordis.patch.yml

@@ -1,8 +1,9 @@
 # @refkit/dsh-plugin bundle patch: one row inserted into the profile roster.
 # Install with `dsh plugin --profile web add @refkit/dsh-plugin` (npm) or
 # `dsh plugin --profile web add github:refkitjs/dsh-plugin`. Keys go into
-# Settings -> Plugins -> refkit (or the REFKIT_* environment variables); the
-# non-secret defaults below can be overridden here or in the settings card.
+# Plugins (sidebar) → refkit → Components → refkit (or the environment
+# variables listed in the README, REFKIT_* first); the non-secret defaults
+# below can be overridden here or in the settings page.
 - insert:
     - id: refkit
       name: '@refkit/dsh-plugin'