@bruc3van/dsh-doctor 0.5.4 → 0.5.6

package/src/migrate.mjs

@@ -1,14 +1,14 @@
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
-import { basename, join, relative, resolve } from 'node:path'
+import { basename, isAbsolute, join, relative, resolve } from 'node:path'
 import semver from 'semver'
 import ts from 'typescript'
 import { parseDocument } from 'yaml'
-import { atomicWrite, sha256 } from './safe-write.mjs'
+import { atomicWrite, sha256, sha256File, writeNewFile } from './safe-write.mjs'
 import { loadMigration, verifyHarnessCheckout } from './migration-catalog.mjs'
 
 const SOURCE_EXTENSIONS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.mts', '.cts'])
 const SOURCE_DIRS_TO_SKIP = new Set(['.git', 'node_modules', 'coverage'])
-const ARTIFACT_DIRS = ['lib', 'dist', 'build']
+const ARTIFACT_DIRS = ['lib', 'dist', 'build', 'out']
 const DEPENDENCY_FIELDS = ['dependencies', 'peerDependencies', 'devDependencies', 'optionalDependencies']
 const LOCKFILES = new Set(['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock'])
 const NON_RUNTIME_TEXT_EXTENSIONS = new Set(['.md', '.mdx', '.txt', '.snap'])
@@ -80,12 +80,17 @@ function moduleLiteral(node) {
 
 function namedImports(node) {
   const bindings = node.importClause?.namedBindings
-  if (!bindings || !ts.isNamedImports(bindings)) return []
-  return bindings.elements.map(item => ({
+  if (bindings && ts.isNamedImports(bindings)) return bindings.elements.map(item => ({
     imported: item.propertyName?.text ?? item.name.text,
     local: item.name.text,
     typeOnly: node.importClause.isTypeOnly || item.isTypeOnly,
   }))
+  if (ts.isExportDeclaration(node) && node.exportClause && ts.isNamedExports(node.exportClause)) return node.exportClause.elements.map(item => ({
+    imported: item.propertyName?.text ?? item.name.text,
+    local: item.name.text,
+    typeOnly: node.isTypeOnly || item.isTypeOnly,
+  }))
+  return []
 }
 
 function quoteModule(text) {
@@ -117,10 +122,11 @@ function analyzeFile(file, pluginRoot, catalog, origin) {
       handledLiterals.add(literal)
       const moduleName = literal.text
       const rootName = packageRoot(moduleName)
-      if (removed.has(rootName)) {
+      const moduleRemoved = removed.has(rootName)
+      const symbolRules = catalog.symbols.modules[moduleName]
+      if (moduleRemoved || symbolRules !== undefined) {
         const where = location(source, literal, pluginRoot)
-        const symbolRules = catalog.symbols.modules[moduleName]
-        const specs = ts.isImportDeclaration(node) ? namedImports(node) : []
+        const specs = namedImports(node)
         const exact = []
         const remaining = []
         for (const spec of specs) {
@@ -128,17 +134,29 @@ function analyzeFile(file, pluginRoot, catalog, origin) {
           if (rule?.confidence === 'exact') {
             exact.push({ ...spec, imported: rule.toSymbol, toModule: rule.toModule, fromSymbol: spec.imported, reason: rule.reason })
             findings.push({ code: 'MIG_MOVED_SYMBOL', severity: 'error', message: `${spec.imported} moved to ${rule.toModule}`, location: where, evidence: { module: moduleName, symbol: spec.imported, targetModule: rule.toModule, replacement: rule.toSymbol }, autoFix: 'safe' })
-          } else {
+          } else if (rule?.confidence === 'semantic' || moduleRemoved) {
             remaining.push(spec)
             const semantic = rule?.confidence === 'semantic'
             findings.push({ code: semantic ? 'MIG_SEMANTIC_API_CHANGE' : 'MIG_REMOVED_PACKAGE_REFERENCE', severity: 'error', message: semantic ? `${spec.imported} requires a semantic migration: ${rule.reason}` : `${moduleName} was removed without a safe automatic replacement`, location: where, evidence: { module: moduleName, ...(spec.imported ? { symbol: spec.imported } : {}) }, autoFix: 'none' })
-            unresolved.push({ file: where.file, package: rootName, symbol: spec.imported, reason: rule?.reason ?? 'No exact replacement is known.' })
-          }
+            unresolved.push({
+              file: where.file,
+              package: rootName,
+              symbol: spec.imported,
+              ...(rule?.toModule ? { targetModule: rule.toModule } : {}),
+              ...(rule?.toSymbol ? { targetSymbol: rule.toSymbol } : {}),
+              reason: rule?.reason ?? 'No exact replacement is known.',
+            })
+          } else remaining.push(spec)
         }
         const declarationText = ts.isImportDeclaration(node) ? text.slice(node.getStart(source), node.getEnd()) : ''
         const simpleNamedImport = exact.length > 0 && ts.isImportDeclaration(node) && node.importClause?.namedBindings && ts.isNamedImports(node.importClause.namedBindings) && node.importClause.name === undefined && node.attributes === undefined && node.assertClause === undefined && !/\/(?:\/|\*)/.test(declarationText)
         if (simpleNamedImport) {
-          for (const item of exact) exactTargets.set(`${rootName}\0${item.toModule}`, { fromPackage: rootName, toPackage: packageRoot(item.toModule) })
+          for (const item of exact) exactTargets.set(`${rootName}\0${item.toModule}`, {
+            fromPackage: rootName,
+            toPackage: packageRoot(item.toModule),
+            relationship: 'client',
+            typeOnly: item.typeOnly,
+          })
           const groups = new Map()
           for (const item of exact) {
             const list = groups.get(item.toModule) ?? []
@@ -148,7 +166,7 @@ function analyzeFile(file, pluginRoot, catalog, origin) {
           const generated = [...groups].map(([target, items]) => importText(target, items, node.importClause.isTypeOnly))
           if (remaining.length > 0) generated.unshift(importText(moduleName, remaining, node.importClause.isTypeOnly))
           replacements.push({ start: node.getStart(source), end: node.getEnd(), next: generated.join('\n'), exact })
-        } else if (specs.length === 0 || exact.length > 0) {
+        } else if (moduleRemoved && (specs.length === 0 || exact.length > 0)) {
           for (const finding of findings) if (finding.code === 'MIG_MOVED_SYMBOL' && finding.location.line === where.line && exact.some(item => item.fromSymbol === finding.evidence.symbol)) finding.autoFix = 'none'
           findings.push({ code: 'MIG_REMOVED_PACKAGE_REFERENCE', severity: 'error', message: `${moduleName} was removed and this reference cannot be rewritten safely`, location: where, evidence: { module: moduleName, kind: ts.SyntaxKind[node.kind] }, autoFix: 'none' })
           unresolved.push({ file: where.file, package: rootName, module: moduleName, reason: 'Default, namespace, side-effect, export, require, dynamic import, or module augmentation reference.' })
@@ -177,12 +195,28 @@ function readManifest(pluginRoot) {
   return { file, value, text }
 }
 
-function targetVersion(name, catalog) {
+function actualTargetVersion(catalog, requested) {
+  if (requested === undefined) return catalog.manifest.to.version
+  const version = semver.valid(requested)
+  if (version === null) throw new Error(`--target-version must be an exact semantic version, received ${requested}`)
+  const catalogVersion = semver.parse(catalog.manifest.to.version)
+  const target = semver.parse(version)
+  if (catalogVersion === null || target === null || target.major !== catalogVersion.major || target.minor !== catalogVersion.minor || target.patch !== catalogVersion.patch) {
+    throw new Error(`--target-version ${requested} is outside the catalog's ${catalogVersion?.major}.${catalogVersion?.minor}.${catalogVersion?.patch} release line`)
+  }
+  if (semver.lt(target, catalogVersion)) {
+    throw new Error(`--target-version ${requested} predates the catalog target ${catalog.manifest.to.version}`)
+  }
+  return version
+}
+
+function targetVersion(name, catalog, actualTarget) {
+  if (name.startsWith('@deepseek-ai/dsh-')) return actualTarget
   if (catalog.packages.targetVersions?.[name] !== undefined) return catalog.packages.targetVersions[name]
-  return name.startsWith('@deepseek-ai/dsh-') ? catalog.manifest.to.version : undefined
+  return undefined
 }
 
-function manifestFindings(manifest, catalog) {
+function manifestFindings(manifest, catalog, actualTarget) {
   const findings = []
   for (const field of DEPENDENCY_FIELDS) {
     const dependencyMap = manifest.value[field]
@@ -195,7 +229,7 @@ function manifestFindings(manifest, catalog) {
         findings.push({ code: 'MIG_REMOVED_PACKAGE_REFERENCE', severity: 'error', message: `${field}.${name} targets a removed package`, location: { file: 'package.json' }, evidence: { field, package: name, range }, autoFix: 'conditional' })
         continue
       }
-      const target = targetVersion(name, catalog)
+      const target = targetVersion(name, catalog, actualTarget)
       if (target === undefined) continue
       const validRange = typeof range === 'string' ? semver.validRange(range) : null
       if (validRange === null) findings.push({ code: 'MIG_INVALID_DEPENDENCY_RANGE', severity: 'error', message: `${field}.${name} has a non-registry range that cannot prove target compatibility`, location: { file: 'package.json' }, evidence: { field, package: name, range, target }, autoFix: field === 'devDependencies' ? 'safe' : 'none' })
@@ -203,6 +237,12 @@ function manifestFindings(manifest, catalog) {
     }
   }
   const client = manifest.value.dsh?.client
+  if (client !== undefined && (client === null || Array.isArray(client) || typeof client !== 'object')) {
+    findings.push({ code: 'MIG_INVALID_MANIFEST', severity: 'error', message: 'dsh.client must be an object', location: { file: 'package.json' }, evidence: { field: 'dsh.client' }, autoFix: 'none' })
+    return findings
+  }
+  if (client !== undefined && typeof client.platform !== 'string') findings.push({ code: 'MIG_INVALID_MANIFEST', severity: 'error', message: 'dsh.client.platform must be a string', location: { file: 'package.json' }, evidence: { field: 'dsh.client.platform' }, autoFix: 'none' })
+  if (client?.immediately !== undefined && typeof client.immediately !== 'boolean') findings.push({ code: 'MIG_INVALID_MANIFEST', severity: 'error', message: 'dsh.client.immediately must be a boolean', location: { file: 'package.json' }, evidence: { field: 'dsh.client.immediately' }, autoFix: 'none' })
   for (const field of ['inject', 'external']) {
     const values = client?.[field]
     if (values !== undefined && !Array.isArray(values)) {
@@ -289,7 +329,7 @@ function patchTargetFindings(pluginRoot, manifest, harness) {
   return findings
 }
 
-function planManifest(manifest, sourceResults, artifactResults, opaqueReferences, catalog) {
+function planManifest(manifest, sourceResults, artifactResults, opaqueReferences, catalog, actualTarget) {
   const next = structuredClone(manifest.value)
   const exactTargets = sourceResults.flatMap(result => result.exactTargets)
   const sourceReferences = new Set(sourceResults.flatMap(result => result.remainingPackages))
@@ -302,18 +342,24 @@ function planManifest(manifest, sourceResults, artifactResults, opaqueReferences
     for (const removedPackage of presentRemoved) {
       const stillUsed = sourceReferences.has(removedPackage) || clientGraph.includes(removedPackage) || opaqueReferences.has(removedPackage) || (sourceResults.length === 0 && artifactText.includes(removedPackage))
       if (!stillUsed) delete deps[removedPackage]
-      for (const move of exactTargets.filter(item => item.fromPackage === removedPackage)) {
-        const version = targetVersion(move.toPackage, catalog)
-        if (version !== undefined && deps[move.toPackage] === undefined) deps[move.toPackage] = version
-      }
     }
     if (field === 'devDependencies') {
       for (const [name, range] of Object.entries(deps)) {
-        const target = targetVersion(name, catalog)
+        const target = targetVersion(name, catalog, actualTarget)
         if (target !== undefined && !catalog.packages.removed.includes(name) && (semver.validRange(range) === null || !semver.satisfies(target, range))) deps[name] = target
       }
     }
   }
+  for (const move of new Map(exactTargets.map(item => [`${item.relationship}\0${item.toPackage}`, item])).values()) {
+    const fields = catalog.packages.dependencyPolicies?.[move.toPackage]?.[move.relationship]
+    const version = targetVersion(move.toPackage, catalog, actualTarget)
+    if (!Array.isArray(fields) || version === undefined) continue
+    for (const field of fields) {
+      if (!DEPENDENCY_FIELDS.includes(field)) throw new Error(`migration catalog has an invalid dependency field ${field}`)
+      const deps = next[field] ??= {}
+      if (deps[move.toPackage] === undefined) deps[move.toPackage] = version
+    }
+  }
   const changes = []
   for (const field of DEPENDENCY_FIELDS) {
     const before = manifest.value[field] ?? {}
@@ -336,10 +382,17 @@ function summarize(findings, safeEdits, unresolved) {
   }
 }
 
+function analysisInputs(root) {
+  return walkAll(root, SOURCE_DIRS_TO_SKIP)
+    .map(file => ({ file: relativePath(root, file), hash: sha256File(file) }))
+    .sort((left, right) => left.file.localeCompare(right.file))
+}
+
 export function analyzeMigration(pluginRoot = process.cwd(), options = {}) {
   const root = resolve(pluginRoot)
   if (!statSync(root).isDirectory()) throw new Error(`plugin root is not a directory: ${root}`)
-  const catalog = loadMigration(options.from ?? 'dsh-v0.1.1-rc.2', options.to ?? 'dsh-v0.1.2-alpha.2')
+  const catalog = loadMigration(options.from ?? 'dsh-v0.1.1-rc.2', options.to ?? 'dsh-v0.1.2-alpha.3')
+  const actualTarget = actualTargetVersion(catalog, options.targetVersion)
   const harness = verifyHarnessCheckout(catalog, options.harnessRoot)
   const manifest = readManifest(root)
   const sourceFiles = walk(root, SOURCE_DIRS_TO_SKIP).filter(file => !isTopLevelArtifact(root, file))
@@ -348,10 +401,10 @@ export function analyzeMigration(pluginRoot = process.cwd(), options = {}) {
   const opaqueReferences = opaqueReferenceFindings(root, sourceFiles, manifest, catalog)
   const sourceRemoved = sources.some(item => item.findings.some(finding => ['MIG_REMOVED_PACKAGE_REFERENCE', 'MIG_SEMANTIC_API_CHANGE', 'MIG_MOVED_SYMBOL'].includes(finding.code)))
   const artifactRemoved = artifacts.some(item => item.findings.some(finding => ['MIG_REMOVED_PACKAGE_REFERENCE', 'MIG_SEMANTIC_API_CHANGE', 'MIG_MOVED_SYMBOL'].includes(finding.code)))
-  const findings = [...manifestFindings(manifest, catalog), ...patchTargetFindings(root, manifest, harness), ...sources.flatMap(item => item.findings), ...opaqueReferences.findings, ...artifacts.flatMap(item => item.findings)]
+  const findings = [...manifestFindings(manifest, catalog, actualTarget), ...patchTargetFindings(root, manifest, harness), ...sources.flatMap(item => item.findings), ...opaqueReferences.findings, ...artifacts.flatMap(item => item.findings)]
   if (!sourceRemoved && artifactRemoved) findings.push({ code: 'MIG_SOURCE_ARTIFACT_DRIFT', severity: 'error', message: 'built artifacts still reference removed APIs although source files do not', location: { file: '.' }, evidence: { artifactDirectories: ARTIFACT_DIRS }, autoFix: 'none' })
   findings.push({ code: 'MIG_RUNTIME_VERIFICATION_REQUIRED', severity: 'info', message: 'static analysis cannot prove activation and lifecycle behavior; run migrate verify --level runtime', location: { file: '.' }, evidence: {}, autoFix: 'none' })
-  const manifestPlan = planManifest(manifest, sources, artifacts, opaqueReferences.packages, catalog)
+  const manifestPlan = planManifest(manifest, sources, artifacts, opaqueReferences.packages, catalog, actualTarget)
   const changed = [...sources.filter(item => item.changed), ...(manifestPlan.changed ? [manifestPlan] : [])]
   const safeEdits = changed.map(item => ({
     file: relativePath(root, item.file),
@@ -363,28 +416,92 @@ export function analyzeMigration(pluginRoot = process.cwd(), options = {}) {
   return {
     schemaVersion: 1,
     command: 'migrate analyze',
-    migration: { id: catalog.manifest.id, from: catalog.manifest.from, to: catalog.manifest.to, harness },
+    migration: {
+      id: catalog.manifest.id,
+      from: catalog.manifest.from,
+      to: catalog.manifest.to,
+      actualTarget: { version: actualTarget, catalogVersion: catalog.manifest.to.version, catalogExact: actualTarget === catalog.manifest.to.version },
+      references: catalog.manifest.references ?? {},
+      harness,
+    },
     plugin: { root, name: manifest.value.name ?? basename(root), version: manifest.value.version ?? 'unknown', manifestFile: manifest.file, packageManager: existsSync(join(root, 'pnpm-lock.yaml')) ? 'pnpm' : existsSync(join(root, 'yarn.lock')) ? 'yarn' : 'npm' },
     summary: summarize(findings, safeEdits, unresolved),
     findings,
     safeEdits,
     semanticTasks: unresolved,
+    sourceInvestigation: {
+      required: harness.exact !== true || unresolved.length > 0 || actualTarget !== catalog.manifest.to.version,
+      targetRef: catalog.manifest.to.ref,
+      catalogReferences: catalog.manifest.references ?? {},
+      semanticTargets: [...new Set(unresolved.map(item => item.targetModule).filter(Boolean))],
+    },
     verification: { status: 'analyzed', level: 'static-analysis', passed: findings.every(item => item.severity !== 'error') },
+    _inputs: analysisInputs(root),
     _plan: changed.map(item => ({ file: item.file, snapshot: { file: item.file, exists: true, hash: sha256(item.text) }, nextText: item.nextText })),
   }
 }
 
 export function publicMigrationReport(report) {
-  const { _plan, ...value } = report
+  const { _inputs, _plan, ...value } = report
   const harness = { ...value.migration.harness }
   delete harness.fromEntryIds
   delete harness.toEntryIds
   return { ...value, migration: { ...value.migration, harness } }
 }
 
+export function createMigrationPlan(report) {
+  const publicReport = publicMigrationReport(report)
+  const payload = {
+    schemaVersion: 1,
+    command: 'migrate apply plan',
+    plugin: { root: report.plugin.root, manifestFile: report.plugin.manifestFile },
+    migration: {
+      id: report.migration.id,
+      from: report.migration.from.ref,
+      to: report.migration.to.ref,
+      targetVersion: report.migration.actualTarget.version,
+      harness: {
+        status: report.migration.harness.status,
+        fromCommit: report.migration.harness.fromCommit,
+        toCommit: report.migration.harness.toCommit,
+      },
+    },
+    reportHash: sha256(JSON.stringify(publicReport)),
+    inputs: report._inputs,
+    edits: report.safeEdits,
+  }
+  return { ...payload, planId: sha256(JSON.stringify(payload)) }
+}
+
+function readMigrationPlan(file) {
+  const value = JSON.parse(readFileSync(resolve(file), 'utf8'))
+  if (value?.schemaVersion !== 1 || value.command !== 'migrate apply plan' || typeof value.planId !== 'string') throw new Error('invalid migration plan file')
+  const { planId, ...payload } = value
+  if (sha256(JSON.stringify(payload)) !== planId) throw new Error('migration plan file digest does not match its contents')
+  return value
+}
+
+function assertMigrationPlan(report, plan) {
+  const current = createMigrationPlan(report)
+  if (plan.plugin.root !== current.plugin.root || plan.plugin.manifestFile !== current.plugin.manifestFile) throw new Error('migration plan targets a different plugin')
+  if (plan.migration.id !== current.migration.id || plan.migration.from !== current.migration.from || plan.migration.to !== current.migration.to || plan.migration.targetVersion !== current.migration.targetVersion) throw new Error('migration plan targets a different catalog or actual target version')
+  if (plan.reportHash !== current.reportHash || JSON.stringify(plan.inputs) !== JSON.stringify(current.inputs) || JSON.stringify(plan.edits) !== JSON.stringify(current.edits)) throw new Error('plugin analysis changed after the preview; create and review a new migration plan')
+  return current
+}
+
 export function applyMigration(report, options = {}) {
   if (options.safe !== true) throw new Error('migrate apply requires --safe')
-  if (options.yes !== true) return { mode: 'preview', ...publicMigrationReport(report) }
+  if (options.planFile === undefined) throw new Error('migrate apply requires --plan-file so the confirmed preview can be verified')
+  const planFile = resolve(options.planFile)
+  const planRelative = relative(report.plugin.root, planFile)
+  if (planRelative === '' || (planRelative !== '..' && !planRelative.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`) && !isAbsolute(planRelative))) throw new Error('migration plan file must be outside the plugin root')
+  if (options.yes !== true) {
+    const plan = createMigrationPlan(report)
+    writeNewFile(planFile, `${JSON.stringify(plan, null, 2)}\n`)
+    return { mode: 'preview', plan: { file: planFile, id: plan.planId }, ...publicMigrationReport(report) }
+  }
+  const plan = readMigrationPlan(planFile)
+  const verifiedPlan = assertMigrationPlan(report, plan)
   // Exact edits remain safe when semantic work remains; unresolved references keep the removed dependency.
   for (const item of report._plan) {
     const currentExists = existsSync(item.snapshot.file)
@@ -392,8 +509,8 @@ export function applyMigration(report, options = {}) {
     if (currentExists !== item.snapshot.exists || sha256(current) !== item.snapshot.hash) throw new Error(`${item.snapshot.file} changed after the preview; diagnose again before applying`)
   }
   const writes = report._plan.map(item => ({ ...atomicWrite(item.snapshot, item.nextText), beforeHash: item.snapshot.hash, afterHash: sha256(item.nextText) }))
-  const verification = analyzeMigration(report.plugin.root, { from: report.migration.from.ref, to: report.migration.to.ref, harnessRoot: report.migration.harness.root })
-  return { mode: 'applied', writes, report: publicMigrationReport(verification) }
+  const verification = analyzeMigration(report.plugin.root, { from: report.migration.from.ref, to: report.migration.to.ref, targetVersion: report.migration.actualTarget.version, harnessRoot: report.migration.harness.root })
+  return { mode: 'applied', plan: { file: planFile, id: verifiedPlan.planId }, writes, report: publicMigrationReport(verification) }
 }
 
 export function formatMigrationReport(report, language = 'en') {

package/src/safe-write.mjs

@@ -1,11 +1,38 @@
 import { createHash, randomBytes } from 'node:crypto'
-import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readFileSync, readSync, renameSync, statSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 
 export function sha256(text) {
   return createHash('sha256').update(text).digest('hex')
 }
 
+export function sha256File(file) {
+  const hash = createHash('sha256')
+  const descriptor = openSync(file, 'r')
+  const buffer = Buffer.allocUnsafe(64 * 1024)
+  try {
+    let bytesRead
+    do {
+      bytesRead = readSync(descriptor, buffer, 0, buffer.length, null)
+      if (bytesRead > 0) hash.update(buffer.subarray(0, bytesRead))
+    } while (bytesRead > 0)
+  } finally {
+    closeSync(descriptor)
+  }
+  return hash.digest('hex')
+}
+
+export function writeNewFile(file, text) {
+  mkdirSync(dirname(file), { recursive: true })
+  try {
+    writeFileSync(file, text, { flag: 'wx', mode: 0o600 })
+  } catch (error) {
+    if (error?.code === 'EEXIST') throw new Error(`${file} already exists; choose a new migration plan path`)
+    throw error
+  }
+  return { file }
+}
+
 export function snapshotFile(file) {
   const exists = existsSync(file)
   const text = exists ? readFileSync(file, 'utf8') : ''

package/skills/dsh-plugin-upgrade/evals/evals.json

@@ -1,76 +0,0 @@
-{
-  "skill_name": "dsh-plugin-upgrade",
-  "evals": [
-    {
-      "id": 1,
-      "prompt": "检查这个只有后端 bundle 的 DSH 插件能否从 DSH 0.1.1 升级到 0.1.2。它的 peerDependencies 仍是 ^0.1.1，不要改文件。",
-      "expected_output": "Records the plugin's actual version ranges, uses the current exact-ref catalog as the analysis baseline, identifies target range mismatch, and does not claim runtime compatibility.",
-      "expectations": [
-        "Uses migrate analyze before proposing edits",
-        "Distinguishes the requested 0.1.1 to 0.1.2 upgrade from the catalog's exact reference refs",
-        "Reports the exact verification status as analyzed",
-        "Does not write files or execute build scripts"
-      ]
-    },
-    {
-      "id": 2,
-      "prompt": "把这个前端插件升级到 DSH 0.1.2。源码里有 import type { ClientContext, ISessions } from '@deepseek-ai/dsh-client-runtime/client'，可以安全改的帮我改，其他的列出来。",
-      "expected_output": "Recognizes that write authorization does not decide whether 0.1.1 may be dropped, asks the compatibility question, and waits before applying changes; after a 0.1.2-only answer, safely moves ClientContext while leaving ISessions as a semantic task.",
-      "expectations": [
-        "Detects type-only imports from source rather than relying on the bundle",
-        "Explicitly asks whether the same release must preserve DSH 0.1.1 compatibility",
-        "Does not preview, apply, edit, install, build, or run the plugin until that decision is answered",
-        "Uses migrate apply --safe and requires explicit confirmation for writes",
-        "Does not mechanically rewrite the semantic ISessions contract"
-      ]
-    },
-    {
-      "id": 3,
-      "prompt": "完整升级这个混合前后端插件并验证，Harness 在 /workspace/deepseek-harness。构建失败也要把现场路径告诉我。",
-      "expected_output": "Analyzes first, asks whether the same release must retain 0.1.1, and waits before safe apply or executable gates; after the decision, performs the selected migration and verification matrix and reports retained failure state.",
-      "expectations": [
-        "Uses the exact Harness refs and verifies the catalog commits",
-        "Treats legacy compatibility as an explicit product decision rather than inferring it from an upgrade request",
-        "Runs static, build, then runtime verification in order",
-        "Uses a temporary DSH_HOME and reports retained failure state",
-        "Keeps business behavior verification separate from activation smoke"
-      ]
-    },
-    {
-      "id": 4,
-      "prompt": "帮我升级这个插件，但机器上的 dsh-doctor 是旧版，而且我没有授权修改全局 npm 包。请先检查有没有新版本，再继续迁移。",
-      "expected_output": "Checks the registry read-only, selects one exact-version npx CLI with the required catalog, avoids global installation, asks for the unresolved compatibility intent, and reports the selected version and update status without starting writes or executable verification.",
-      "expectations": [
-        "Checks the local CLI version and exact migration catalog before use",
-        "Uses npm view as a read-only registry update check",
-        "Pins one resolved npx package version for all migration phases",
-        "Does not install or update a global CLI without explicit authorization",
-        "Reports local, registry, selected CLI, catalog, and update-status evidence",
-        "Stops at analyzed until the developer chooses 0.1.2-only or dual-version support"
-      ]
-    },
-    {
-      "id": 5,
-      "prompt": "升级这个插件到 DSH 0.1.2，但同一个 npm 版本还必须继续支持 0.1.1。可以修改代码并执行测试；如果单一产物做不到，先告诉我冲突和可选方案，不要自行放弃旧版。",
-      "expected_output": "Records an explicit dual-version requirement, assesses whether imports, manifests, graph declarations, and artifacts can coexist, selects or proposes an adapter/conditional-build/separate-release strategy, and verifies both version rows before claiming compatibility.",
-      "expectations": [
-        "Records the compatibility intent as dual-version without asking a redundant question",
-        "Treats 0.1.2 safe codemods as candidates that still require 0.1.1 review",
-        "Does not widen peer ranges or claim one-artifact support without installation and runtime evidence",
-        "Separately verifies build, artifact, runtime, and behavior evidence for DSH 0.1.1 and 0.1.2",
-        "Reports an exact incompatibility and asks before switching to separate releases or dropping 0.1.1"
-      ]
-    },
-    {
-      "id": 6,
-      "prompt": "这是一次 breaking release，只需要支持 DSH 0.1.2，不再兼容 0.1.1。先分析再按安全流程修改和验证。",
-      "expected_output": "Records the explicit 0.1.2-only intent without asking a redundant compatibility question, then follows analyze, safe preview/apply, semantic migration, and target verification gates.",
-      "expectations": [
-        "Records the compatibility intent as 0.1.2-only",
-        "Does not ask again whether 0.1.1 compatibility must be retained",
-        "Still separates write authorization from compatibility intent and follows preview and confirmation safeguards",
-        "Reports only the 0.1.2 verification evidence actually achieved"
-      ]
-    }
-  ]
-}