@codebam/dsh-thinking-auditor 0.1.0 → 0.1.1

package/README.md

@@ -27,7 +27,30 @@ It is **not a lie detector**. It does not read intent and does not label a model
 
 ## Install
 
-Add a row to a profile patch (`~/.dsh/profiles/<profile>/cordis.patch.yml`):
+### npm / profile dependency (0.1.1+)
+
+Version `0.1.1` declares `dsh.bundle.patch`, so installing it through the dsh plugin command auto-activates it:
+
+```sh
+dsh plugin --profile <profile> add @codebam/dsh-thinking-auditor
+```
+
+`dsh plugin` appends the package to the profile's `dsh.profile.bundles`, and the bundle patch mounts the auditor row with the defaults (`enabled: true`, `gates.maxTier: verify`, `store.persist: true`). Restart dsh if the running profile does not hot-reload its bundle list.
+
+To change defaults per profile without editing the package, either tune the `thinking-audit` settings namespace or address the row by id in `~/.dsh/profiles/<profile>/cordis.patch.yml` (later layers win):
+
+```yaml
+- id: thinking-auditor
+  config:
+    gates:
+      maxTier: block # observe | verify | block | cancel
+```
+
+`0.1.0` has no bundle metadata, so it requires the explicit row below or an upgrade.
+
+### Source / pinned-path install
+
+When loading the plugin from a checkout or an absolute path instead of a profile dependency, add the row yourself (`~/.dsh/profiles/<profile>/cordis.patch.yml`):
 
 ```yaml
 - insert:

package/cordis.patch.yml

@@ -0,0 +1,21 @@
+# @codebam/dsh-thinking-auditor bundle patch.
+#
+# Declared through `dsh.bundle.patch` in package.json, so `dsh plugin add`
+# appends this package to the profile's `dsh.profile.bundles` and the row below
+# mounts automatically. The profile's own cordis.patch.yml and the home-level
+# patch are applied after every bundle layer, so a deployment can override this
+# row by id (or tune it from the `thinking-audit` settings namespace) without
+# editing the package.
+#
+# The row deliberately carries only the defaults a new deployment should get;
+# omitted fields resolve through the plugin's own defaults. Raise
+# `gates.maxTier` to `block` or `cancel` only when the deployment wants T2/T3.
+- insert:
+    - id: thinking-auditor
+      name: '@codebam/dsh-thinking-auditor'
+      config:
+        enabled: true
+        gates:
+          maxTier: verify
+        store:
+          persist: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codebam/dsh-thinking-auditor",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Claim-vs-evidence auditor for live DeepSeek Harness reasoning traces: session-less same-model auditing with deterministic verification gates.",
   "keywords": [
     "deepseek-harness",
@@ -29,11 +29,13 @@
   "main": "./index.mjs",
   "exports": {
     ".": "./index.mjs",
+    "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
   "files": [
     "index.mjs",
     "src/",
+    "cordis.patch.yml",
     "packaging/",
     "README.md",
     "LICENSE"
@@ -78,5 +80,10 @@
     "@deepseek-ai/dsh-tools": {
       "optional": true
     }
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
   }
 }

package/packaging/README.md

@@ -16,7 +16,7 @@ workspace. Copy them into the profile repo and pin the revision on first build.
 ## Steps
 
 1. **Pin the plugin.** In `pkgs/dsh-thinking-auditor.nix`, set `rev` to the
-   pushed commit/tag (`v0.1.0` by default) and replace `hash = lib.fakeHash`
+   pushed commit/tag (`v0.1.1` by default) and replace `hash = lib.fakeHash`
    with the hash Nix reports on the first build:
 
    ```sh
@@ -31,14 +31,17 @@ workspace. Copy them into the profile repo and pin the revision on first build.
 
 3. **Copy the plugin into `$DSH_HOME`.** Add Part A of
    `agents.nix.snippet` (`dshThinkingAuditor`) to the same attribute set as
-   the existing plugin copy blocks. It copies `index.mjs`, `src/`, and
-   `package.json` into `~/.dsh/profiles/thinking-auditor/` and symlinks
+   the existing plugin copy blocks. It copies `index.mjs`, `src/`,
+   `cordis.patch.yml`, and `package.json` into
+   `~/.dsh/profiles/thinking-auditor/` and symlinks
    `node_modules` to `~/.dsh/profiles/node_modules` for peer resolution.
 
 4. **Mount the plugin row.** Append Part B to the `dshProfilePatch`
-   concatenation in `home/agents.nix`. The default row caps the auditor at
-   T1; raise `gates.maxTier` to `block` or `cancel` only when the deployment
-   wants an irreversible-action gate or an explicit hard stop.
+   concatenation in `home/agents.nix`. This copy route keeps an explicit row;
+   a profile that depends on the package by name is auto-mounted through its
+   `dsh.bundle.patch` metadata. The default row caps the auditor at T1; raise
+   `gates.maxTier` to `block` or `cancel` only when the deployment wants an
+   irreversible-action gate or an explicit hard stop.
 
 5. **Verify the build.** From the profile repo:
 
@@ -71,6 +74,11 @@ workspace. Copy them into the profile repo and pin the revision on first build.
   session log, so it does not change session storage compatibility and is not
   uploaded by the official DeepSeek log route. Set `store.persist: false` to
   keep records memory-only.
+- `@codebam/dsh-thinking-auditor@0.1.1` declares `dsh.bundle.patch`, so a
+  profile that installs it with `dsh plugin add` auto-appends it to
+  `dsh.profile.bundles` and mounts the bundle row without a manual patch edit.
+  The explicit Nix copy route below remains useful for pinned, source-built
+  deployments.
 - `thinking-audit` is a live settings namespace when `dsh-settings-file` is
   mounted; thresholds and gates can be tuned there without editing the profile
   patch.

package/packaging/nixos/agents.nix.snippet

@@ -6,7 +6,9 @@
 # ---------------------------------------------------------------------------
 
       # @codebam/dsh-thinking-auditor is published from its own repository,
-      # pinned in pkgs/dsh-thinking-auditor.nix. Copy it into $DSH_HOME rather
+      # pinned in pkgs/dsh-thinking-auditor.nix. The package also declares
+      # dsh.bundle.patch, so a profile that depends on it by name activates it
+      # automatically; this copy route keeps the explicit row below. Copy it into $DSH_HOME rather
       # than symlinking: Node resolves a module through its symlink target, so
       # a symlinked module would look for @deepseek-ai/* next to the store
       # directory instead of the profile's node_modules.
@@ -18,6 +20,7 @@
         run ${pkgs.coreutils}/bin/cp -r ${pkgs.dsh-thinking-auditor}/lib/dsh-thinking-auditor/src "$HOME/.dsh/profiles/thinking-auditor/src"
         run ${pkgs.coreutils}/bin/chmod -R u+w "$HOME/.dsh/profiles/thinking-auditor/src"
         run ${pkgs.coreutils}/bin/cp -f ${pkgs.dsh-thinking-auditor}/lib/dsh-thinking-auditor/package.json "$HOME/.dsh/profiles/thinking-auditor/package.json"
+        run ${pkgs.coreutils}/bin/cp -f ${pkgs.dsh-thinking-auditor}/lib/dsh-thinking-auditor/cordis.patch.yml "$HOME/.dsh/profiles/thinking-auditor/cordis.patch.yml"
         run ${pkgs.coreutils}/bin/rm -f "$HOME/.dsh/profiles/thinking-auditor/node_modules"
         run ${pkgs.coreutils}/bin/ln -sfn "$HOME/.dsh/profiles/node_modules" "$HOME/.dsh/profiles/thinking-auditor/node_modules"
       '';

package/packaging/nixos/dsh-thinking-auditor.nix

@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation {
   pname = "dsh-thinking-auditor";
-  version = "0.1.0";
+  version = "0.1.1";
 
   # @codebam/dsh-thinking-auditor is published to npm from its own repository;
   # this host pins the reviewed revision so the profile copies exactly the
@@ -17,13 +17,13 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "codebam";
     repo = "dsh-thinking-auditor";
-    rev = "v0.1.0";
+    rev = "v0.1.1";
     hash = lib.fakeHash;
   };
 
   nativeBuildInputs = [ nodejs ];
 
-  # The published files are the ESM sources; there is no build step.
+  # The published files are the ESM sources plus the bundle patch; there is no build step.
   dontBuild = true;
 
   # home/agents.nix copies this directory into $DSH_HOME next to the profile's
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation {
   installPhase = ''
     runHook preInstall
     install -d -m 0755 "$out/lib/dsh-thinking-auditor"
-    cp -r index.mjs package.json src "$out/lib/dsh-thinking-auditor/"
+    cp -r index.mjs package.json cordis.patch.yml src "$out/lib/dsh-thinking-auditor/"
     cp LICENSE "$out/lib/dsh-thinking-auditor/"
     runHook postInstall
   '';