Turtle
38c7a9fbf4
* feat(release): publish package source, declaration maps, and documentation Every release member publishes its TypeScript source and the declaration maps that resolve into it, and @deepseek-ai/dsh publishes the repository Markdown documentation staged from docs/ at prepack time. The ./src/* export most members already declared now resolves for an installed consumer, and a consumer editor follows a declaration to the implementation. Bundled JavaScript maps stay unpublished; the vendored family and the Desktop runtime file policy are unchanged. Rationale: .agents/notes/implemented/process/2026-10-08-published-source-and-docs.md * feat(release): publish JavaScript maps and compress bundles Every emitted JavaScript map ships beside the bundle it describes, and the workspace build and the client preset compress bundles without mangling identifiers. The documentation payload now mirrors the website publication manifest and is removed again by `postpack`; Desktop and the Python executable exclude the published source, documentation, and maps; `clean` removes a staged copy. Typert's publication contract gains the Remote declaration map. * fix(release): keep node bundles readable for the worker image The browser worker image lowers `yield*` only as a whole statement and rewrites `for await` loops by their source layout, so compressed node-side entries either fail that lowering or lower to unparseable code. Only the browser bundles keep compression, which removes about a third of their text. The bundle-purity assertion now matches the module-loader call regardless of the quote style compression picks, and the release-pack fixture exercises the installed package's new documentation requirement. * feat(release): publish the whole documentation tree `@deepseek-ai/dsh` copies `docs/` in full instead of the website's page set: the maintainer documents, the generated migration records, the translation guidelines, and the `*.i18n.yaml` consistency records ship with the installed package, so the documentation's own links resolve without a checkout. * feat(release): publish the upgrade guides with the documentation The staged documentation keeps the website's page set and adds every `docs/upgrade-guide/` document, which is what an installed reader consults when a released change breaks something. The rest of the maintainer tree stays out. * test(release): expect source and maps in master's new payload cases * feat(release): keep installed docs and source readable in Desktop Desktop keeps the published src/ and docs/ trees inside app.asar, and every model shell call receives DSH_INSTALL_DIR and DSH_NODE_EXECUTABLE so an agent can read them through Electron's Node mode. Staging also generates docs/upgrade-guide/README.md, an index of the upgrade guides grouped by the release they upgrade from. Minified client bundles print string literals with backticks: the worker image packer now recognizes those chunk requests, client license banners are prepended after minification so their text survives, and the affected artifact tests accept either quote. * test(desktop): read archived docs through the Windows PowerShell form Regenerate the config catalog for the shifted shell-env source line. * test(desktop): wait for the GUI-subsystem Electron process from PowerShell * build(release): publish source and maps from the message-quotes package * build(release): publish source and maps from packages new on master * build(release): publish source and maps from the tool-office package
description, kind
| description | kind |
|---|---|
| Signed GitHub webhook adapter for deployments routing authenticated JSON events into the webhook runtime. | package-reference |
@deepseek-ai/dsh-webhook-github
English | 中文
Summary
dsh-webhook-github registers one exact HTTP route on the injected ctx.webServer. It bounds and verifies GitHub's raw JSON body, projects a provider-neutral delivery, calls ctx.webhookRuntime.dispatch(), and returns 202 without waiting for rules or Sessions. Use it when a deployment needs authenticated GitHub ingress for the generic webhook runtime.
Table of Contents
- Configuration
- HTTP contract
- Dedicated listener composition
- Model Experience
- Known Limitations and Deferred Work
- Dev Note
Configuration
| Key | Meaning |
|---|---|
source |
Non-empty adapter instance carried to rules, such as primary-github. |
path |
Exact non-root pathname without trailing slash, query, or fragment. |
secretEnv |
Credential reference containing the GitHub webhook secret. |
maxBodyBytes |
Positive safe-integer ceiling for the untouched request body. |
All fields are required. The secret reference is resolved for every request, so rotation affects the next delivery without reloading the plugin.
HTTP contract
Only POST application/json is accepted. The adapter reads a bounded UTF-8 body, requires X-Hub-Signature-256, X-GitHub-Delivery, and X-GitHub-Event, resolves the secret, verifies HMAC before JSON parsing, and requires a top-level lossless-JSON object. It never logs the secret, signature, or payload.
| Status | Meaning |
|---|---|
202 |
Verified JSON was dispatched in memory. |
400 |
Required header, UTF-8, JSON, or top-level object was invalid. |
401 |
Signature was invalid. |
405 |
Method was not POST. |
413 |
Declared or streamed body exceeded maxBodyBytes. |
415 |
Media type was not application/json. |
503 |
Credential or webhook runtime was unavailable. |
202 does not state that any rule matched or that a Session was created. GitHub event-specific field validation belongs to each rule; the adapter guarantees only authenticated generic JSON.
Dedicated listener composition
The normal Web profile already owns ctx.webServer. Mount another dsh-host-webserver and this adapter inside a group that isolates only webServer; the adapter still inherits credentials and webhookRuntime. The GitHub review guide uses 127.0.0.1:3081/github behind a TLS reverse proxy while the UI remains on port 3080.
The package distributes the example overlay and rule module under examples/github-review/. Install this package and its dsh-webhook peer into the profile before loading that installed overlay; the guide gives the complete commands.
Model Experience
Indirectly, through dsh-webhook: this adapter contributes no prompt or tool schema; a matching rule owns the Session request and model-visible text.
KV Cache effect
Independent. Authentication and HTTP dispatch do not touch a model request; any new Session prefix belongs to the consuming rule and runtime.
Known Limitations and Deferred Work
- No TLS — the injected development WebServer is normally loopback-only behind a TLS reverse proxy or tunnel.
- Generic payload validation only — rules own validation of the GitHub event fields they consume.
- No provider acknowledgement of downstream work —
202precedes arbitrary rule calls and Session creation. - No form encoding — GitHub must send
application/json;application/x-www-form-urlencodedis rejected.
Dev Note
Working context for maintainers — click to expand
None.