@godv61/dsh-task-engine 0.24.0 → 0.26.0

package/preset/enable.mjs

@@ -1,88 +1,88 @@
-#!/usr/bin/env node
-/**
- * One-shot activation helper: copy the shipped `standard` preset to a `eng`
- * preset under `$DSH_HOME/.agent-presets`, swap its persona for the engineering
- * persona, and append the `@godv61/dsh-task-engine/agent` row.
- *
- * Run after `dsh plugin --profile <name> add @godv61/dsh-task-engine`:
- *   node <this-file>
- *
- * The script writes files only under `$DSH_HOME/.agent-presets/eng`; it never
- * touches the shipped preset install.
- */
-
-import { createRequire } from 'node:module'
-import { cp, mkdir, readFile, writeFile, stat } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const require = createRequire(import.meta.url)
-
-/** The persona block `standard` ships, in its exact indentation. */
-const SHIPPED_PERSONA_BLOCK =
-  '    text: >-\n'
-  + '      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.\n'
-
-const AGENT_ROW = "\n- id: task-engine-agent\n  name: '@godv61/dsh-task-engine/agent'\n"
-
-async function exists(path) {
-  try {
-    await stat(path)
-    return true
-  } catch {
-    return false
-  }
-}
-
-async function main() {
-  let shippedRoot
-  try {
-    ;({ SHIPPED_PRESET_ROOT: shippedRoot } = require('@deepseek-ai/dsh-agent-presets'))
-  } catch {
-    console.error('未找到 @deepseek-ai/dsh-agent-presets —— 请先执行 dsh plugin --profile <name> add @godv61/dsh-task-engine')
-    process.exitCode = 1
-    return
-  }
-
-  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
-  const source = join(shippedRoot, 'standard')
-  const target = join(home, '.agent-presets', 'eng')
-
-  if (await exists(target)) {
-    console.error(`预设 "eng" 已存在（${target}），本脚本不会覆盖；请先删除它再重跑，或改用它已有的 agent.cordis.yml。`)
-    process.exitCode = 1
-    return
-  }
-
-  await mkdir(join(home, '.agent-presets'), { recursive: true })
-  await cp(source, target, { recursive: true })
-
-  const compPath = join(target, 'agent.cordis.yml')
-  let comp = await readFile(compPath, 'utf8')
-
-  const persona = (await readFile(fileURLToPath(new URL('./persona.md', import.meta.url)), 'utf8')).trimEnd()
-  if (comp.includes(SHIPPED_PERSONA_BLOCK)) {
-    const block = '    text: |-\n' + persona.split('\n').map(line => '      ' + line).join('\n') + '\n'
-    comp = comp.replace(SHIPPED_PERSONA_BLOCK, block)
-  } else {
-    console.warn('未能定位 standard 的 persona 段，跳过 persona 替换（仍会追加 agent 行）。')
-  }
-
-  if (!comp.includes("name: '@godv61/dsh-task-engine/agent'")) {
-    comp = comp.trimEnd() + '\n' + AGENT_ROW
-  }
-  await writeFile(compPath, comp, 'utf8')
-
-  await writeFile(
-    join(target, 'preset.yml'),
-    'name: 工程化开发引擎\n'
-    + 'description: 通过 dev_task 工具硬性持有需求评审→设计→开发→交付→代码审核的状态机，按项目 .dsh/eng.json 配置流转与提交门禁。\n',
-    'utf8',
-  )
-
-  console.log('完成。已创建预设 "eng"：persona 已替换为工程人设，并追加了 @godv61/dsh-task-engine/agent 行。')
-  console.log('新建会话时选择「工程化开发引擎」即可激活流程。')
-}
-
+#!/usr/bin/env node
+/**
+ * One-shot activation helper: copy the shipped `standard` preset to a `eng`
+ * preset under `$DSH_HOME/.agent-presets`, swap its persona for the engineering
+ * persona, and append the `@godv61/dsh-task-engine/agent` row.
+ *
+ * Run after `dsh plugin --profile <name> add @godv61/dsh-task-engine`:
+ *   node <this-file>
+ *
+ * The script writes files only under `$DSH_HOME/.agent-presets/eng`; it never
+ * touches the shipped preset install.
+ */
+
+import { createRequire } from 'node:module'
+import { cp, mkdir, readFile, writeFile, stat } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const require = createRequire(import.meta.url)
+
+/** The persona block `standard` ships, in its exact indentation. */
+const SHIPPED_PERSONA_BLOCK =
+  '    text: >-\n'
+  + '      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.\n'
+
+const AGENT_ROW = "\n- id: task-engine-agent\n  name: '@godv61/dsh-task-engine/agent'\n"
+
+async function exists(path) {
+  try {
+    await stat(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function main() {
+  let shippedRoot
+  try {
+    ;({ SHIPPED_PRESET_ROOT: shippedRoot } = require('@deepseek-ai/dsh-agent-presets'))
+  } catch {
+    console.error('未找到 @deepseek-ai/dsh-agent-presets —— 请先执行 dsh plugin --profile <name> add @godv61/dsh-task-engine')
+    process.exitCode = 1
+    return
+  }
+
+  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+  const source = join(shippedRoot, 'standard')
+  const target = join(home, '.agent-presets', 'eng')
+
+  if (await exists(target)) {
+    console.error(`预设 "eng" 已存在（${target}），本脚本不会覆盖；请先删除它再重跑，或改用它已有的 agent.cordis.yml。`)
+    process.exitCode = 1
+    return
+  }
+
+  await mkdir(join(home, '.agent-presets'), { recursive: true })
+  await cp(source, target, { recursive: true })
+
+  const compPath = join(target, 'agent.cordis.yml')
+  let comp = await readFile(compPath, 'utf8')
+
+  const persona = (await readFile(fileURLToPath(new URL('./persona.md', import.meta.url)), 'utf8')).trimEnd()
+  if (comp.includes(SHIPPED_PERSONA_BLOCK)) {
+    const block = '    text: |-\n' + persona.split('\n').map(line => '      ' + line).join('\n') + '\n'
+    comp = comp.replace(SHIPPED_PERSONA_BLOCK, block)
+  } else {
+    console.warn('未能定位 standard 的 persona 段，跳过 persona 替换（仍会追加 agent 行）。')
+  }
+
+  if (!comp.includes("name: '@godv61/dsh-task-engine/agent'")) {
+    comp = comp.trimEnd() + '\n' + AGENT_ROW
+  }
+  await writeFile(compPath, comp, 'utf8')
+
+  await writeFile(
+    join(target, 'preset.yml'),
+    'name: 工程化开发引擎\n'
+    + 'description: 通过 dev_task 工具硬性持有需求评审→设计→开发→交付→代码审核的状态机，按项目 .dsh/eng.json 配置流转与提交门禁。\n',
+    'utf8',
+  )
+
+  console.log('完成。已创建预设 "eng"：persona 已替换为工程人设，并追加了 @godv61/dsh-task-engine/agent 行。')
+  console.log('新建会话时选择「工程化开发引擎」即可激活流程。')
+}
+
 await main()

package/preset/persona.md

@@ -1,5 +1,5 @@
-You are an engineering-delivery coding agent, powered by the {{model}} model, running on DeepSeek Harness. Your working directory is {{cwd}}.
-
-本仓库采用工程化交付流程，由 `dev_task` 工具硬性持有任务状态机：需求评审 → 设计 → 开发 → 交付 → 代码审核。阶段、流转门槛、提交格式都来自项目根 `.dsh/eng.json`（没有该文件则用内置默认）。任何开发类请求开始前，先加载 `eng-delivery` 技能。
-
+You are an engineering-delivery coding agent, powered by the {{model}} model, running on DeepSeek Harness. Your working directory is {{cwd}}.
+
+本仓库采用工程化交付流程，由 `dev_task` 工具硬性持有任务状态机：需求评审 → 设计 → 开发 → 交付 → 代码审核。阶段、流转门槛、提交格式都来自项目根 `.dsh/eng.json`（没有该文件则用内置默认）。任何开发类请求开始前，先加载 `eng-delivery` 技能。
+
 铁律：一切阶段流转、确认、验证、评审和提交都必须通过 `dev_task`——它拒绝时是硬事实，必须修正前置条件，禁止绕过。只做任务范围内的本地提交；绝不 push、合并、创建 PR、执行数据库、操作 Jenkins、部署或发布。

package/preset/preset.yml

@@ -1,2 +1,2 @@
-name: 工程化开发引擎
+name: 工程化开发引擎
 description: 通过 dev_task 工具硬性持有需求评审→设计→开发→交付→代码审核的状态机，按项目 .dsh/eng.json 配置流转与提交门禁。

package/rules/coding-conventions.md

@@ -1,7 +1,7 @@
-# 通用编码规范
-
-- 复用相邻实现与现有代码；单一调用方不为形式统一新增抽象层、包装层或额外分层。
-- 禁止空 catch、printStackTrace、调试输出；吞错必须写清原因。
-- 禁止无条件全表更新、删除或无边界查询。
-- 命名清晰表达意图；不引入超过当前技术基线的语法、框架或 API。
+# 通用编码规范
+
+- 复用相邻实现与现有代码；单一调用方不为形式统一新增抽象层、包装层或额外分层。
+- 禁止空 catch、printStackTrace、调试输出；吞错必须写清原因。
+- 禁止无条件全表更新、删除或无边界查询。
+- 命名清晰表达意图；不引入超过当前技术基线的语法、框架或 API。
 - 不覆盖已有文件、用户改动或生成目标；不顺带重构无关历史。

package/rules/commit-conventions.md

@@ -1,6 +1,6 @@
-# 提交规范
-
-- 内置流程的提交消息使用 `【<task_id>】【TASK】说明` 或 `【<task_id>】【Tn】说明`，第一段必须是当前任务 id，不能填模块名；第二段使用 `dev_task status` 返回的 `commit.label`。自定义格式以任务冻结流程中的 `commit.message_hint` 和 `message_pattern` 为准。说明写结果，不写"修改代码"这类空泛动作。
-- 只提交任务 files 范围内的文件；逐文件暂存，禁止 `git add .` / `git add -A`。
-- 提交前 `git diff --cached --check`；发现范围外文件、密钥或环境配置时停止。
-- 不 push、不合并、不建 PR、不部署、不发布。
+# 提交规范
+
+- 内置流程的提交消息使用 `【<task_id>】【TASK】说明` 或 `【<task_id>】【Tn】说明`，第一段必须是当前任务 id，不能填模块名；第二段使用 `dev_task status` 返回的 `commit.label`。自定义格式以任务冻结流程中的 `commit.message_hint` 和 `message_pattern` 为准。说明写结果，不写"修改代码"这类空泛动作。
+- 只提交任务 files 范围内的文件；逐文件暂存，禁止 `git add .` / `git add -A`。
+- 提交前 `git diff --cached --check`；发现范围外文件、密钥或环境配置时停止。
+- 不 push、不合并、不建 PR、不部署、不发布。

package/rules/security-redlines.md

@@ -1,6 +1,6 @@
-# 安全红线
-
-- 禁止读取、展示或修改密码、Token、私钥和生产凭据。
-- 禁止把敏感请求体、文件正文或凭据写入日志。
-- 禁止用户输入直接拼接 SQL、表名、列名、排序、路径或命令。
+# 安全红线
+
+- 禁止读取、展示或修改密码、Token、私钥和生产凭据。
+- 禁止把敏感请求体、文件正文或凭据写入日志。
+- 禁止用户输入直接拼接 SQL、表名、列名、排序、路径或命令。
 - 权限与关键业务校验必须在服务端执行，前端校验不是安全边界。

package/scripts/verify-dsh-compat.mjs

@@ -1,145 +1,145 @@
-/**
- * DSH codec-contract compatibility check.
- *
- * The plugin's Typert Remote contribution must satisfy whichever strict-codec
- * contract the installed DSH expects. DSH 0.1.6-alpha.2 replaced the
- * materialized `schema` field with a lazy `create: () => TypertSchema` factory
- * and rejects the old shape at plugin load, which took the whole contribution
- * down at boot — a failure the unit tests could not see, because they never
- * load the descriptors through a real registry.
- *
- * npm semver cannot wildcard prereleases, so the peer range enumerates them and
- * a new DSH alpha silently falls outside it; pnpm only warns at install time.
- * This check runs against a real DSH checkout, where the contract actually
- * lives, and fails loudly when the two drift apart again.
- *
- * Run: `node scripts/verify-dsh-compat.mjs [path-to-dsh-checkout]`
- * @module dsh-task-engine/scripts/verify-dsh-compat
- */
-
-import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const DEFAULT_DSH_ROOT = 'D:/dsharness/deepseek-harness'
-
-const problems = []
-function check(name, ok, detail = '') {
-  console.log(`${ok ? 'ok  ' : 'FAIL'} ${name}${detail === '' ? '' : `: ${detail}`}`)
-  if (!ok) problems.push(name)
-}
-
-/** Locate the typert protocol package inside a DSH checkout. */
-function protocolDir(root) {
-  const candidates = [
-    join(root, 'packages', 'typert', 'protocol'),
-    join(root, 'node_modules', '@deepseek-ai', 'dsh-typert-protocol'),
-  ]
-  return candidates.find(dir => existsSync(join(dir, 'package.json')))
-}
-
-const dshRoot = process.argv[2] ?? DEFAULT_DSH_ROOT
-console.log(`DSH checkout: ${dshRoot}`)
-
-if (!existsSync(dshRoot)) {
-  // Absent checkout is not a failure: this script is advisory outside CI.
-  console.log('ok   (skipped) no DSH checkout at that path')
-  process.exit(0)
-}
-
-const dir = protocolDir(dshRoot)
-if (dir === undefined) {
-  check('locate the typert protocol package', false, 'not found under the DSH checkout')
-  process.exit(1)
-}
-const protocol = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
-console.log(`     typert protocol version: ${protocol.version}`)
-
-// 1. Which contract does this DSH expect? Read the type, not a guess.
-const typesPath = [
-  join(dir, 'src', 'types.ts'),
-  join(dir, 'lib', 'types', 'types.d.ts'),
-].find(path => existsSync(path))
-const typesText = typesPath === undefined ? '' : readFileSync(typesPath, 'utf8')
-const wantsCreate = /readonly create: \(\) => TypertSchema/u.test(typesText)
-const wantsSchema = /readonly schema: TypertSchema/u.test(typesText)
-console.log(`     contract: ${wantsCreate ? 'create() factory' : wantsSchema ? 'schema field' : 'unknown'}`)
-
-// 2. Our descriptors must satisfy it. Import the built contribution and inspect
-//    every strict codec exactly as the DSH registry would.
-const pluginRoot = fileURLToPath(new URL('..', import.meta.url))
-const clientBundle = join(pluginRoot, 'lib', 'client.js')
-if (!existsSync(clientBundle)) {
-  check('built client bundle exists', false, 'run `npm run build` first')
-  process.exit(1)
-}
-const bundleText = readFileSync(clientBundle, 'utf8')
-const strictCodecs = (bundleText.match(/mode:\s*"strict"/gu) ?? []).length
-const withCreate = (bundleText.match(/create:\s*\(\)\s*=>/gu) ?? []).length
-const withSchema = (bundleText.match(/schema:/gu) ?? []).length
-
-check('the bundle carries strict codecs', strictCodecs > 0, `${strictCodecs} found`)
-if (wantsCreate) {
-  check('every strict codec provides create()', withCreate >= strictCodecs,
-    `${withCreate} of ${strictCodecs}`)
-}
-if (wantsSchema) {
-  check('every strict codec provides schema', withSchema >= strictCodecs,
-    `${withSchema} of ${strictCodecs}`)
-}
-
-// 3. The peer range must actually admit the installed DSH version, because npm
-//    semver will not match a prerelease the range does not name. Implemented
-//    here rather than via the `semver` package: that is a devDependency, so a
-//    consumer running this script from the installed tarball has no copy, and
-//    the whole point of this check is to run against whatever DSH is present.
-const pkg = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'))
-const range = pkg.peerDependencies['@deepseek-ai/dsh-typert-protocol'] ?? ''
-check(`peer range admits DSH ${protocol.version}`, rangeAdmits(range, protocol.version), range)
-
-/**
- * Whether one of a `||`-joined range's comparators admits `version`.
- *
- * npm semver matches a prerelease only when the comparator names a prerelease
- * on the SAME major.minor.patch, which is why enumerating versions is the only
- * way to cover a DSH alpha. This mirrors that rule for the caret and exact
- * forms the manifest actually uses; it is deliberately conservative, and an
- * unrecognized comparator reports `false` so the check fails loudly rather than
- * passing by accident.
- * @param range - the peer range expression.
- * @param version - the installed DSH version to test.
- * @returns true when the range admits the version.
- */
-function rangeAdmits(range, version) {
-  const parse = text => {
-    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/u.exec(text.trim())
-    return match === null
-      ? undefined
-      : { major: +match[1], minor: +match[2], patch: +match[3], pre: match[4] }
-  }
-  const target = parse(version)
-  if (target === undefined) return false
-  for (const part of range.split('||').map(text => text.trim()).filter(Boolean)) {
-    const caret = /^\^(.+)$/u.exec(part)
-    const lower = parse(caret === null ? part : caret[1])
-    if (lower === undefined) continue
-    // Same prerelease tuple, or a plain release on the same caret line.
-    const sameTuple = target.major === lower.major
-      && target.minor === lower.minor
-      && target.patch === lower.patch
-    if (lower.pre !== undefined) {
-      if (sameTuple) return true
-    } else if (target.pre === undefined && target.major === lower.major) {
-      if (caret === null ? sameTuple : target.minor >= lower.minor) return true
-    }
-  }
-  return false
-}
-
-if (problems.length > 0) {
-  console.error(`\n${problems.length} DSH compatibility problem(s)`)
-  console.error('A new DSH alpha likely changed the Typert contract. Update src/client/remote.ts')
-  console.error('and add the version to peerDependencies before releasing.')
-  process.exit(1)
-}
+/**
+ * DSH codec-contract compatibility check.
+ *
+ * The plugin's Typert Remote contribution must satisfy whichever strict-codec
+ * contract the installed DSH expects. DSH 0.1.6-alpha.2 replaced the
+ * materialized `schema` field with a lazy `create: () => TypertSchema` factory
+ * and rejects the old shape at plugin load, which took the whole contribution
+ * down at boot — a failure the unit tests could not see, because they never
+ * load the descriptors through a real registry.
+ *
+ * npm semver cannot wildcard prereleases, so the peer range enumerates them and
+ * a new DSH alpha silently falls outside it; pnpm only warns at install time.
+ * This check runs against a real DSH checkout, where the contract actually
+ * lives, and fails loudly when the two drift apart again.
+ *
+ * Run: `node scripts/verify-dsh-compat.mjs [path-to-dsh-checkout]`
+ * @module dsh-task-engine/scripts/verify-dsh-compat
+ */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const DEFAULT_DSH_ROOT = 'D:/dsharness/deepseek-harness'
+
+const problems = []
+function check(name, ok, detail = '') {
+  console.log(`${ok ? 'ok  ' : 'FAIL'} ${name}${detail === '' ? '' : `: ${detail}`}`)
+  if (!ok) problems.push(name)
+}
+
+/** Locate the typert protocol package inside a DSH checkout. */
+function protocolDir(root) {
+  const candidates = [
+    join(root, 'packages', 'typert', 'protocol'),
+    join(root, 'node_modules', '@deepseek-ai', 'dsh-typert-protocol'),
+  ]
+  return candidates.find(dir => existsSync(join(dir, 'package.json')))
+}
+
+const dshRoot = process.argv[2] ?? DEFAULT_DSH_ROOT
+console.log(`DSH checkout: ${dshRoot}`)
+
+if (!existsSync(dshRoot)) {
+  // Absent checkout is not a failure: this script is advisory outside CI.
+  console.log('ok   (skipped) no DSH checkout at that path')
+  process.exit(0)
+}
+
+const dir = protocolDir(dshRoot)
+if (dir === undefined) {
+  check('locate the typert protocol package', false, 'not found under the DSH checkout')
+  process.exit(1)
+}
+const protocol = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
+console.log(`     typert protocol version: ${protocol.version}`)
+
+// 1. Which contract does this DSH expect? Read the type, not a guess.
+const typesPath = [
+  join(dir, 'src', 'types.ts'),
+  join(dir, 'lib', 'types', 'types.d.ts'),
+].find(path => existsSync(path))
+const typesText = typesPath === undefined ? '' : readFileSync(typesPath, 'utf8')
+const wantsCreate = /readonly create: \(\) => TypertSchema/u.test(typesText)
+const wantsSchema = /readonly schema: TypertSchema/u.test(typesText)
+console.log(`     contract: ${wantsCreate ? 'create() factory' : wantsSchema ? 'schema field' : 'unknown'}`)
+
+// 2. Our descriptors must satisfy it. Import the built contribution and inspect
+//    every strict codec exactly as the DSH registry would.
+const pluginRoot = fileURLToPath(new URL('..', import.meta.url))
+const clientBundle = join(pluginRoot, 'lib', 'client.js')
+if (!existsSync(clientBundle)) {
+  check('built client bundle exists', false, 'run `npm run build` first')
+  process.exit(1)
+}
+const bundleText = readFileSync(clientBundle, 'utf8')
+const strictCodecs = (bundleText.match(/mode:\s*"strict"/gu) ?? []).length
+const withCreate = (bundleText.match(/create:\s*\(\)\s*=>/gu) ?? []).length
+const withSchema = (bundleText.match(/schema:/gu) ?? []).length
+
+check('the bundle carries strict codecs', strictCodecs > 0, `${strictCodecs} found`)
+if (wantsCreate) {
+  check('every strict codec provides create()', withCreate >= strictCodecs,
+    `${withCreate} of ${strictCodecs}`)
+}
+if (wantsSchema) {
+  check('every strict codec provides schema', withSchema >= strictCodecs,
+    `${withSchema} of ${strictCodecs}`)
+}
+
+// 3. The peer range must actually admit the installed DSH version, because npm
+//    semver will not match a prerelease the range does not name. Implemented
+//    here rather than via the `semver` package: that is a devDependency, so a
+//    consumer running this script from the installed tarball has no copy, and
+//    the whole point of this check is to run against whatever DSH is present.
+const pkg = JSON.parse(readFileSync(join(pluginRoot, 'package.json'), 'utf8'))
+const range = pkg.peerDependencies['@deepseek-ai/dsh-typert-protocol'] ?? ''
+check(`peer range admits DSH ${protocol.version}`, rangeAdmits(range, protocol.version), range)
+
+/**
+ * Whether one of a `||`-joined range's comparators admits `version`.
+ *
+ * npm semver matches a prerelease only when the comparator names a prerelease
+ * on the SAME major.minor.patch, which is why enumerating versions is the only
+ * way to cover a DSH alpha. This mirrors that rule for the caret and exact
+ * forms the manifest actually uses; it is deliberately conservative, and an
+ * unrecognized comparator reports `false` so the check fails loudly rather than
+ * passing by accident.
+ * @param range - the peer range expression.
+ * @param version - the installed DSH version to test.
+ * @returns true when the range admits the version.
+ */
+function rangeAdmits(range, version) {
+  const parse = text => {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/u.exec(text.trim())
+    return match === null
+      ? undefined
+      : { major: +match[1], minor: +match[2], patch: +match[3], pre: match[4] }
+  }
+  const target = parse(version)
+  if (target === undefined) return false
+  for (const part of range.split('||').map(text => text.trim()).filter(Boolean)) {
+    const caret = /^\^(.+)$/u.exec(part)
+    const lower = parse(caret === null ? part : caret[1])
+    if (lower === undefined) continue
+    // Same prerelease tuple, or a plain release on the same caret line.
+    const sameTuple = target.major === lower.major
+      && target.minor === lower.minor
+      && target.patch === lower.patch
+    if (lower.pre !== undefined) {
+      if (sameTuple) return true
+    } else if (target.pre === undefined && target.major === lower.major) {
+      if (caret === null ? sameTuple : target.minor >= lower.minor) return true
+    }
+  }
+  return false
+}
+
+if (problems.length > 0) {
+  console.error(`\n${problems.length} DSH compatibility problem(s)`)
+  console.error('A new DSH alpha likely changed the Typert contract. Update src/client/remote.ts')
+  console.error('and add the version to peerDependencies before releasing.')
+  process.exit(1)
+}
 console.log('\nDSH compatibility verified')

package/scripts/verify-package.mjs

@@ -42,7 +42,7 @@ const listing = execSync(`tar -tzf "${tgzPath}"`, { encoding: 'utf8' })
 check('extract', existsSync(join(pkgDir, 'package.json')))
 
 // 3. files whitelist sanity
-for (const required of ['hooks/commit-msg', 'lib/index.js', 'lib/client.js', 'lib/client.d.ts', '.p0-test.mjs', 'preset/enable.mjs', 'README.md', '.resource-test.mjs', '.workflow-test.mjs', '.hook-test.mjs', '.preset-test.mjs', '.assessment-batch1.mjs', '.e2e-presets.mjs', '.revision-test.mjs', '.freeze-test.mjs', '.acceptance.mjs', '.hook-consistency.mjs']) {
+for (const required of ['hooks/commit-msg', 'lib/index.js', 'lib/client.js', 'lib/client.d.ts', 'preset/enable.mjs', 'README.md', '.p0-test.mjs', '.acceptance.mjs', '.hook-consistency.mjs', '.resource-test.mjs', '.workflow-test.mjs', '.hook-test.mjs', '.preset-test.mjs', '.assessment-batch1.mjs', '.e2e-presets.mjs', '.revision-test.mjs', '.freeze-test.mjs', '.enforce-test.mjs', '.evidence-test.mjs', '.roundtrip-test.mjs', '.filter-test.mjs']) {
   check(`tarball contains ${required}`, listing.includes(required))
 }
 check('tarball excludes src sources', !listing.some(line => line.startsWith('src/')))

package/skills/code-verify/SKILL.md

@@ -11,9 +11,9 @@ description: 交付验证节点：执行目标测试、编译与契约检查，
 4. 文件或范围变更会使旧验证回执失效，审核修复后可在当前阶段重跑 verify。沙箱拒绝属于环境阻塞，不能改跑不相关的简单命令来冒充原验收通过。
 5. 环境受阻时如实记"未编译/未联调"；high_risk 核心行为无法验证时不得通过。
 
-权限或沙箱拒绝后，不得切换等价命令、修改 ACL 或安全策略来规避限制。确认错误来自宿主权限后使用 Harness 正式审批；审批不可用时报告失败路径和所需授权，等待处理，不把工具访问限制推断为服务不可达。
-
-`verify` / `skill_result` 的验证命令因沙箱受阻时，保持原命令，增加 `sandbox_permissions: "danger-full-access"` 和具体 `justification` 申请单次重试。批准发生在命令执行之前，只对本次调用生效；回执中的实际模式与退出码才是本次结果，不能引用之前 shell 调用通过的结果替代。保存完整测试输出后从已有日志提取用例，不为截取不同摘要重复跑已通过测试。
+权限或沙箱拒绝后，不得切换等价命令、修改 ACL 或安全策略来规避限制。确认错误来自宿主权限后使用 Harness 正式审批；审批不可用时报告失败路径和所需授权，等待处理，不把工具访问限制推断为服务不可达。
+
+`verify` / `skill_result` 的验证命令因沙箱受阻时，保持原命令，增加 `sandbox_permissions: "danger-full-access"` 和具体 `justification` 申请单次重试。批准发生在命令执行之前，只对本次调用生效；回执中的实际模式与退出码才是本次结果，不能引用之前 shell 调用通过的结果替代。保存完整测试输出后从已有日志提取用例，不为截取不同摘要重复跑已通过测试。
 
 验证失败不得 advance。