@crazyhappyone/dsh-tui 0.1.0-alpha.2 → 0.1.0-alpha.4

package/README.i18n.yaml

@@ -1,5 +1,5 @@
 # Bilingual-pair consistency record: both languages carry equal authority.
 # This source-only mirror has no DSH pairing runner. Recompute with:
 #   git hash-object README.md README.zh.md
-README.md: 2732b96d4d727ea1ebc8f01fe60b7d5d433799b3
-README.zh.md: dedd7687b52c3e9b853edf10848333949bb0087b
+README.md: 496d812168deb2af7d4a933f961b58c1cfd814cd
+README.zh.md: 8474c7be4cf16c0d5123222bab95b5231f34e185

package/README.md

@@ -1,5 +1,5 @@
 ---
-description: "Installable source-runtime launcher and private source mirror for the DeepSeek Harness terminal interface."
+description: "Installable source-runtime launcher and public source mirror for the DeepSeek Harness terminal interface."
 kind: "package-group"
 ---
 
@@ -7,12 +7,17 @@ kind: "package-group"
 
 English | [中文](README.zh.md)
 
+[![CI](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml)
+[![GitHub release](https://img.shields.io/github/v/release/zhangyang-crazy-one/dsh-tui?include_prereleases)](https://github.com/zhangyang-crazy-one/dsh-tui/releases)
+[![npm next](https://img.shields.io/npm/v/%40crazyhappyone%2Fdsh-tui/next?label=npm%40next)](https://www.npmjs.com/package/@crazyhappyone/dsh-tui)
+
 ## Summary
 
-`@crazyhappyone/dsh-tui` provides the `dsh-tui` command for running and safely updating the DeepSeek Harness terminal interface. The launcher manages a dedicated DSH source checkout, so it never pulls, resets, stashes, or cleans a contributor's development checkout. This repository also mirrors the `packages/tui/` bundle and renderer sources for review. DSH continues to own agents, sessions, tools, persistence, providers, permissions, and profile assembly.
+`@crazyhappyone/dsh-tui` provides the `dsh-tui` command for running and safely updating the DeepSeek Harness terminal interface. The launcher manages a dedicated DSH source checkout, so it never pulls, resets, stashes, or cleans a contributor's development checkout. This public repository also mirrors the `packages/tui/` bundle and renderer sources for review. DSH continues to own agents, sessions, tools, persistence, providers, permissions, and profile assembly.
 
 ## Table of Contents
 
+- [Screenshots](#screenshots)
 - [Install the launcher](#install-the-launcher)
 - [Run and update](#run-and-update)
 - [Configure the source runtime](#configure-the-source-runtime)
@@ -25,6 +30,19 @@ English | [中文](README.zh.md)
 
 -----
 
+<a id="screenshots"></a>
+## Screenshots
+
+Idle home:
+
+![dsh-tui idle home](assets/screenshots/dsh-tui-home.png)
+
+After sending `你好`:
+
+![dsh-tui response after sending hello](assets/screenshots/dsh-tui-hello.png)
+
+-----
+
 <a id="install-the-launcher"></a>
 ## Install the launcher
 
@@ -132,30 +150,26 @@ The launcher runtime must remain separate from the development checkout. To test
 <a id="publish-the-npm-package"></a>
 ## Publish the npm package
 
-The operator authenticates through npm's browser flow and verifies the selected account:
-
-```text
-npm config delete //registry.npmjs.org/:_authToken
-npm config set registry https://registry.npmjs.org/
-npm login --registry=https://registry.npmjs.org/ --auth-type=web
-npm whoami
-```
-
-`npm whoami` must print `crazyhappyone`. Never place the password, OTP, or npm token in this repository, an issue, command output captured for review, or an AI conversation.
+GitHub Actions tests every pull request and push to `main` on Node 22.19 and 24. Publishing starts only when a GitHub Release is published. The workflow rejects a release tag unless it equals `v` followed by the version in `package.json`; prereleases publish to npm's `next` tag and stable releases publish to `latest`.
 
-After tests and packed-install verification pass, publish a prerelease only with explicit operator approval:
+Configure npm Trusted Publishing once after `publish.yml` is present on the default branch. npm CLI 11.5.1 or newer can register the GitHub workflow through an authenticated browser session. The command below runs a compatible npm 11 temporarily and does not replace the globally installed npm:
 
 ```text
-npm publish --access public --tag next
+npx --yes npm@11 trust github @crazyhappyone/dsh-tui \
+  --file publish.yml \
+  --repository zhangyang-crazy-one/dsh-tui \
+  --allow-publish
 ```
 
-When npm requires two-factor authentication, the operator supplies the current code locally:
+The equivalent npm website settings are organization or user `zhangyang-crazy-one`, repository `dsh-tui`, workflow filename `publish.yml`, with no environment restriction. The workflow uses GitHub OIDC and stores no npm token, password, or OTP.
+
+For each release, bump `package.json`, merge the change after CI passes, then create a GitHub Release whose tag matches the package version:
 
 ```text
-npm publish --access public --tag next --otp=<six-digit-code>
+gh release create v0.1.0-alpha.4 --prerelease --generate-notes
 ```
 
-Promotion to `latest` is a separate release decision. Local implementation and verification never create or change a registry package automatically.
+The `Publish npm` workflow runs tests and packed-package verification again before publishing. Do not rerun an old release tag: npm versions are immutable. Promotion to stable is a new version and a non-prerelease GitHub Release.
 
 -----
 

package/README.zh.md

@@ -1,5 +1,5 @@
 ---
-description: "DeepSeek Harness 终端界面的可安装源码运行时 launcher 与 private 源码镜像。"
+description: "DeepSeek Harness 终端界面的可安装源码运行时 launcher 与公开源码镜像。"
 kind: "package-group"
 ---
 
@@ -7,12 +7,17 @@ kind: "package-group"
 
 [English](README.md) | 中文
 
+[![CI](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/zhangyang-crazy-one/dsh-tui/actions/workflows/ci.yml)
+[![GitHub release](https://img.shields.io/github/v/release/zhangyang-crazy-one/dsh-tui?include_prereleases)](https://github.com/zhangyang-crazy-one/dsh-tui/releases)
+[![npm next](https://img.shields.io/npm/v/%40crazyhappyone%2Fdsh-tui/next?label=npm%40next)](https://www.npmjs.com/package/@crazyhappyone/dsh-tui)
+
 ## 概述
 
-`@crazyhappyone/dsh-tui` 提供 `dsh-tui` 命令，用于运行和安全更新 DeepSeek Harness 终端界面。Launcher 管理专用 DSH 源码 checkout，因此不会 pull、reset、stash 或 clean 贡献者的开发 checkout。本仓库还镜像 `packages/tui/` bundle 与 renderer 源码以供审查。Agent、会话、工具、持久化、provider、权限与 profile 组装仍由 DSH 拥有。
+`@crazyhappyone/dsh-tui` 提供 `dsh-tui` 命令，用于运行和安全更新 DeepSeek Harness 终端界面。Launcher 管理专用 DSH 源码 checkout，因此不会 pull、reset、stash 或 clean 贡献者的开发 checkout。本公开仓库还镜像 `packages/tui/` bundle 与 renderer 源码以供审查。Agent、会话、工具、持久化、provider、权限与 profile 组装仍由 DSH 拥有。
 
 ## 目录
 
+- [截图](#screenshots)
 - [安装 launcher](#install-the-launcher)
 - [运行与更新](#run-and-update)
 - [配置源码运行时](#configure-the-source-runtime)
@@ -25,6 +30,19 @@ kind: "package-group"
 
 -----
 
+<a id="screenshots"></a>
+## 截图
+
+空闲首页：
+
+![dsh-tui 空闲首页](assets/screenshots/dsh-tui-home.png)
+
+发送 `你好` 后：
+
+![dsh-tui 发送你好后的响应](assets/screenshots/dsh-tui-hello.png)
+
+-----
+
 <a id="install-the-launcher"></a>
 ## 安装 launcher
 
@@ -132,30 +150,26 @@ Launcher runtime 必须与开发 checkout 分离。要安全测试其他源码
 <a id="publish-the-npm-package"></a>
 ## 发布 npm 包
 
-Operator 通过 npm browser flow 认证，并验证所选账号：
-
-```text
-npm config delete //registry.npmjs.org/:_authToken
-npm config set registry https://registry.npmjs.org/
-npm login --registry=https://registry.npmjs.org/ --auth-type=web
-npm whoami
-```
-
-`npm whoami` 必须打印 `crazyhappyone`。绝不要把密码、OTP 或 npm token 放入本仓库、issue、供审查捕获的命令输出或 AI conversation。
+GitHub Actions 会在每个 pull request 和向 `main` 的 push 上使用 Node 22.19 与 24 运行测试。只有发布 GitHub Release 才会启动 npm 发布。工作流要求 Release tag 等于 `v` 加 `package.json` 中的版本；prerelease 发布到 npm `next` tag，stable release 发布到 `latest`。
 
-测试与 packed-install 验证通过后，仅在 operator 显式批准时发布 prerelease：
+在 `publish.yml` 进入默认分支后，一次性配置 npm Trusted Publishing。npm CLI 11.5.1 或更高版本可以通过已认证的 browser session 注册 GitHub workflow。下面的命令会临时运行兼容的 npm 11，不替换全局安装的 npm：
 
 ```text
-npm publish --access public --tag next
+npx --yes npm@11 trust github @crazyhappyone/dsh-tui \
+  --file publish.yml \
+  --repository zhangyang-crazy-one/dsh-tui \
+  --allow-publish
 ```
 
-npm 要求双因素认证时，operator 在本地提供当前验证码：
+对应的 npm 网站配置为：organization or user 填 `zhangyang-crazy-one`，repository 填 `dsh-tui`，workflow filename 填 `publish.yml`，environment 留空。工作流使用 GitHub OIDC，不保存 npm token、密码或 OTP。
+
+每次发布时，先提升 `package.json` 版本，等待 CI 通过并合并，然后创建 tag 与 package version 一致的 GitHub Release：
 
 ```text
-npm publish --access public --tag next --otp=<six-digit-code>
+gh release create v0.1.0-alpha.4 --prerelease --generate-notes
 ```
 
-提升到 `latest` 是单独的 release 决策。本地实现与验证绝不会自动创建或更改 registry package。
+`Publish npm` workflow 会在发布前再次运行测试与 packed-package 验证。不要重新运行旧的 release tag：npm version 不可覆盖。提升到 stable 必须使用新版本并发布 non-prerelease GitHub Release。
 
 -----
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crazyhappyone/dsh-tui",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.4",
   "description": "Source-runtime launcher for the DeepSeek Harness terminal interface",
   "type": "module",
   "license": "MIT",
@@ -8,6 +8,7 @@
     "dsh-tui": "bin/dsh-tui.js"
   },
   "files": [
+    "assets/screenshots/*.png",
     "bin/dsh-tui.js",
     "src/**/*.js",
     "README.md",