@hanamesh/dsh-app-host 0.6.14 → 0.6.15

package/README.md

@@ -1,4 +1,8 @@
-0.6.14 候选：严格读取标准分发目录的精确 npm 三目标与 agentPlugins，保留历史固定 GitHub DTO；目录事实仅展示，不决定兼容或升级。R1-COMBO-01 原始 26 条目响应已纳入回归。
+0.6.15 候选：市场保留官方 CLI 的 stdout/stderr 真实失败原因并脱敏，在卡片与安装确认的技术详情中显示。正文显示 pnpm 真实错误类别；宿主发布时间检查失败时列出受影响包，说明默认 24 小时与实际 cutoff，并提示到 DSH 设置检查版本、升级 DSH 或等待后手动重试；不修改 profile、pnpm 供应链策略或安装执行路径。
+
+官方桌面 0.2.0-rc.2 自带 pnpm 11.7.0 对同一包的多条精确 `minimumReleaseAgeExclude` 只采用首条，旧版条目会遮住后列新版，整份 lockfile 检查因而可阻断无关插件安装。本机桌面 0.2.1-rc.3 自带的 pnpm 11.28.5 已合并这些条目，相同样本通过；未推定首次修复版本。请通过官方渠道升级 DSH，保留失败的技术详情；AppHost 不绕过该检查。见 [兼容说明](docs/DSH_COMPATIBILITY.md)。
+
+0.6.14：严格读取标准分发目录的精确 npm 三目标与 agentPlugins，保留历史固定 GitHub DTO；目录事实仅展示，不决定兼容或升级。R1-COMBO-01 原始 26 条目响应已纳入回归。
 
 > I51 R1 返修（待复审）：供应商指引跟随宿主中英菜单，默认正文只写用途和结果；实现解释、交接固定规则及具名设置默认值保留在技术详情。交接的保存操作与套件来源选择前置，自有字段按单列排列；设置值、默认值、权限、读写协议均不变。
 

package/dist/client-ui.js

@@ -130,7 +130,9 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy122": "为什么：",
     "copy123": "安装命令返回成功，但 profile 读回的版本与固定版本不一致",
     "copy124": "包不在当前 registry 上——尚未发布到 npm，或客户端 registry 设置不对",
-    "copy125": "DSH 安装命令失败，查看宿主日志",
+    "copy125": "DSH 安装命令失败，请展开技术详情查看原始原因",
+    "installAgeRejected": "宿主的依赖发布时间检查未通过（默认需发布满 24 小时，以技术详情中的 cutoff 为准）。已知 DSH 0.2.0-rc.2 内置 pnpm 11.7.0 对同名多条白名单只认第一条。请在 DSH 设置中检查当前版本并升级 DSH，或等待受影响版本满足规则后手动重试。",
+    "installAffectedPackages": "受影响包：",
     "copy126": "当前宿主未提供安装参数（profile / node 路径）",
     "copy127": "目录里已没有这一项，刷新后重试",
     "copy128": "registry 上的最新版是预发布版（rc），客户端未允许安装预发布版",
@@ -433,7 +435,9 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy122": "Reason: ",
     "copy123": "Installation command succeeded, but the version read from the profile differs from the confirmed version",
     "copy124": "Package not found in the current registry. It may not be published, or the registry setting may be incorrect",
-    "copy125": "DSH installation command failed. See the host logs",
+    "copy125": "DSH installation failed. Expand Technical details for the original cause",
+    "installAgeRejected": "The host rejected a dependency's release age (the default requires 24 hours since publication; see the actual cutoff in Technical details). Known issue: pnpm 11.7.0 bundled with DSH 0.2.0-rc.2 only recognizes the first allowlist entry for a package name. Check your version in DSH Settings and upgrade DSH, or wait until the affected versions meet the rule before trying again manually.",
+    "installAffectedPackages": "Affected packages: ",
     "copy126": "This host has not provided installation parameters (profile / Node path)",
     "copy127": "This item is no longer in the catalog. Refresh before trying again",
     "copy128": "The latest registry version is a prerelease, which this client has not allowed",
@@ -831,8 +835,16 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
         defaults&&names?h('div',null,h('h3',null,t('设置名称与默认值')),h('dl',null,...['enabled','ports','allowedOrigins','ttlMs','pollMs'].flatMap(key=>[h('dt',{key:key+'-name'},names[key]),h('dd',{key:key+'-value'},Array.isArray(defaults[key])?defaults[key].join(', '):typeof defaults[key]==='boolean'?(defaults[key]?t('开'):t('关')):String(defaults[key]))]))):null,
         value?.rules?h('div',null,h('h3',null,t('固定规则（不能关）')),h('ul',null,...value.rules.map(row=>h('li',{key:row.rule},t(row.rule),h('br',null),h('small',null,t('为什么：')+t(row.why)))))):null));
   }
-  const FAILURE_REASONS={...CORE_SUITE_FAILURES,INSTALL_READBACK_MISMATCH:t('安装命令返回成功，但 profile 读回的版本与固定版本不一致'),REGISTRY_LOOKUP_FAILED:t('包不在当前 registry 上——尚未发布到 npm，或客户端 registry 设置不对'),DSH_PLUGIN_FAILED:t('DSH 安装命令失败，查看宿主日志'),LIBRARY_INSTALL_UNAVAILABLE:t('当前宿主未提供安装参数（profile / node 路径）'),CATALOG_ITEM_MISSING:t('目录里已没有这一项，刷新后重试'),UNSTABLE_VERSION:t('registry 上的最新版是预发布版（rc），客户端未允许安装预发布版'),RUNTIME_ARCHIVE_UNAVAILABLE:t('运行时归档下载失败，检查网络或来源'),OPERATION_TIMEOUT:t('10 分钟内没有结果，可稍后重试'),PACKAGE_DENIED:t('HanaMesh 套件自身不能从市场安装或卸载'),INSTANCE_IN_USE:t('先关闭该应用的所有视图再卸载')};
-  const failureReason=code=>t(FAILURE_REASONS[code])??t('详细原因见宿主日志');
+  const FAILURE_REASONS={...CORE_SUITE_FAILURES,INSTALL_READBACK_MISMATCH:t('安装命令返回成功，但 profile 读回的版本与固定版本不一致'),REGISTRY_LOOKUP_FAILED:t('包不在当前 registry 上——尚未发布到 npm，或客户端 registry 设置不对'),DSH_PLUGIN_FAILED:t('DSH 安装命令失败，请展开技术详情查看原始原因'),LIBRARY_INSTALL_UNAVAILABLE:t('当前宿主未提供安装参数（profile / node 路径）'),CATALOG_ITEM_MISSING:t('目录里已没有这一项，刷新后重试'),UNSTABLE_VERSION:t('registry 上的最新版是预发布版（rc），客户端未允许安装预发布版'),RUNTIME_ARCHIVE_UNAVAILABLE:t('运行时归档下载失败，检查网络或来源'),OPERATION_TIMEOUT:t('10 分钟内没有结果，可稍后重试'),PACKAGE_DENIED:t('HanaMesh 套件自身不能从市场安装或卸载'),INSTANCE_IN_USE:t('先关闭该应用的所有视图再卸载')};
+  const failureReason=(code,details)=>{
+    const diagnostic=code==='DSH_PLUGIN_FAILED'?details?.diagnostic??'':'',pnpmCode=diagnostic.match(/\bERR_PNPM_[A-Z0-9_]+\b/)?.[0];
+    if(pnpmCode==='ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION'){
+      const packages=[...new Set([...diagnostic.matchAll(/((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*@\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+was published\b/g)].map(match=>match[1]))];
+      return pnpmCode+' · '+t('宿主的依赖发布时间检查未通过（默认需发布满 24 小时，以技术详情中的 cutoff 为准）。已知 DSH 0.2.0-rc.2 内置 pnpm 11.7.0 对同名多条白名单只认第一条。请在 DSH 设置中检查当前版本并升级 DSH，或等待受影响版本满足规则后手动重试。')+(packages.length?' '+t('受影响包：')+packages.join(', '):'');
+    }
+    return(pnpmCode?pnpmCode+' · ':'')+(t(FAILURE_REASONS[code])??t('详细原因见宿主日志'));
+  };
+  const operationNotice=op=>op?h('div',null,h('p',{role:op.failed?'alert':'status',className:op.failed?'hm-library-failed':'hm-library-ok',style:{overflowWrap:'anywhere'}},t(op.text)),op.diagnostic?h('details',null,h('summary',null,t('技术详情')),h('pre',{style:{whiteSpace:'pre-wrap',overflowWrap:'anywhere'}},op.diagnostic)):null):null;
   const suiteRecoveryText=details=>details?.stage==='suite-upgrade'?t('；升级未完成，部分组件可能已改变。当前读回：')+(details.actual?.components?.map(c=>c.label+' '+(c.version??t('检测不到'))+(c.active?'':t('（未启用）'))).join('；')||t('检测不到'))+t('。请完全退出客户端，使用补齐命令（仅 macOS / Linux 终端；Windows 安全命令暂未提供）修复并重新打开：')+details.command:'';
   /** pluginManager applied it, but the profile could not be read back: the installed list may still say 「需重启」. */
   const baselineText=result=>result?.restartBaseline?.updated===false?t('；但应用库没能读回 profile（')+result.restartBaseline.code+t('），已安装列表可能仍显示「需重启」'):'';
@@ -966,7 +978,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
       if(!outcome)outcome={ok:false,code:'OPERATION_TIMEOUT'};
       const liveLoaded=outcome.ok&&outcome.result?.status==='applied';
       if(outcome.ok&&!awaitReadback&&!liveLoaded)setChanged(true);
-      setPending(p=>({...p,[key]:outcome.ok?(awaitReadback?{label,text:()=>(t(label)+t('读回中…')),busy:true}:{label,text:()=>(liveLoaded?t(label)+t('完成，已生效，可以直接使用')+baselineText(outcome.result):t(label)+t('完成，重启 DSH 后生效'))}):{label,text:()=>(outcome.unknown?t(label)+t('结果不可追溯，请查看已安装列表后再明确操作'):t(label)+t('失败：')+outcome.code+'（'+failureReason(outcome.code)+'）'+recoveryText(outcome.recovery)+suiteRecoveryText(outcome.details)),failed:true}}));
+      setPending(p=>({...p,[key]:outcome.ok?(awaitReadback?{label,text:()=>(t(label)+t('读回中…')),busy:true}:{label,text:()=>(liveLoaded?t(label)+t('完成，已生效，可以直接使用')+baselineText(outcome.result):t(label)+t('完成，重启 DSH 后生效'))}):{label,text:()=>(outcome.unknown?t(label)+t('结果不可追溯，请查看已安装列表后再明确操作'):t(label)+t('失败：')+outcome.code+'（'+failureReason(outcome.code,outcome.details)+'）'+recoveryText(outcome.recovery)+suiteRecoveryText(outcome.details)),failed:true,diagnostic:outcome.details?.diagnostic}}));
       await load();return outcome;}catch(e){const code=String(e.message??e);setPending(p=>({...p,[key]:{label,text:()=>(t(label)+t('失败：')+code),failed:true}}));return{ok:false,code};}};
     const confirmTarget=async()=>{
       const selected=targetSelection;if(selected?.status!=='confirmation-required'||pendingOperations[selected.item.id]?.busy)return;
@@ -1044,14 +1056,14 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
       else if(row)action=h('span',null,t('已安装，重启 DSH 后生效'));
       return h('article',{key:item.id,'data-hanamesh-library-item':item.id,'data-hanamesh-kind':item.kind},h('h3',null,item.displayName),h('p',null,item.summary),
         h('small',null,t(KIND_TEXT[item.kind])+' · '+(item.publisher?.name??t('未知发布者'))+' · '+(item.latestVersion??'—')+((item.categories??[]).length?' · '+item.categories.join('、'):'')),
-        state,action,op&&!busy?h('p',{role:op.failed?'alert':'status',className:op.failed?'hm-library-failed':'hm-library-ok'},t(op.text)):null);};
+        state,action,op&&!busy?operationNotice(op):null);};
     const catalogSection=receipt?h('div',{className:'hm-app-frame'},h('div',null,h('strong',null,receipt.instance.appId),h('button',{type:'button',disabled:closing,onClick:()=>void close()},closing?t('关闭中…'):t('关闭视图'))),h('iframe',{ref:frame,src:receipt.uiUrl,title:receipt.instance.appId,sandbox:'allow-forms allow-modals allow-popups allow-same-origin allow-scripts'})):
       h('div',{className:'hm-library-grid',key:'catalog'},...items.map(card));
     const moreButton=nextCursor&&!receipt?h('button',{type:'button',className:'hm-library-more',key:'more',onClick:()=>void more()},t('更多')):null;
     const installedSection=!receipt&&(installed.length||plugins.length)?h('section',{className:'hm-market-installed',key:'installed'},h('h2',null,t('已安装')),h('ul',null,
         ...installed.map(row=>h('li',{key:'app:'+row.packageName,'data-hanamesh-installed':row.packageName},t('应用 · ')+(row.name??row.packageName)+' · '+row.packageName+' '+(row.version??'')+' · '+(t(STATE_TEXT[row.state]??row.state)))),
         ...plugins.filter(row=>!PROTECTED.has(row.packageName)).map(row=>h('li',{key:'plugin:'+row.packageName,'data-hanamesh-installed':row.packageName},t('插件 · ')+row.packageName+' '+(row.version??'')+' · '+(t(STATE_TEXT[row.state]??row.state))+(row.bundle&&!row.active&&row.state==='installed'?t('（未启用为 profile 层）'):''),
-          row.state==='installed'&&!PROTECTED.has(row.packageName)&&!pending['plugin:'+row.packageName]?h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/plugins/uninstall',{packageName:row.packageName},'plugin:'+row.packageName,t('卸载'))},t('卸载')):pending['plugin:'+row.packageName]?h('span',{className:pending['plugin:'+row.packageName].failed?'hm-library-failed':'hm-library-ok'},' '+t(pending['plugin:'+row.packageName].text)):null)))):null;
+          row.state==='installed'&&!PROTECTED.has(row.packageName)&&!pending['plugin:'+row.packageName]?h('button',{type:'button',onClick:()=>void operate('/hanamesh/library/plugins/uninstall',{packageName:row.packageName},'plugin:'+row.packageName,t('卸载'))},t('卸载')):pending['plugin:'+row.packageName]?operationNotice(pending['plugin:'+row.packageName]):null)))):null;
     // The seat owner may ask for a subsection to come first; `installed` is the only one it names today.
     const body=preferredSubsectionId==='installed'?[installedSection,catalogSection,moreButton]:[catalogSection,moreButton,installedSection];
     return h('section',{className:embedded?'hm-market hm-market-embedded':'hm-library-overlay hm-market'},
@@ -1071,7 +1083,7 @@ h('div',{className:'hm-source-add'},h('input',{value:draft,placeholder:'https://
           target.status==='confirmation-required'?h('div',null,h('button',{type:'button',onClick:()=>void confirmTarget()},t('确认安装')),h('button',{type:'button',onClick:()=>{targetSequence++;void reportHandoff(targetSelection?.handoffId,'cancelled');setTarget({...targetSelection,status:'cancelled'});}},t('取消'))):
           target.status==='failed'?FailureNotice({error:target.diagnostic??target.error}):h('p',{role:['readback-failed','suite-upgrade-failed'].includes(target.status)?'alert':'status'},({resolving:t('正在查询市场目录…'),installing:t('安装中…'),installed:t('安装完成，请查看已安装列表'),'installed-live':t('安装完成，已加载，可以直接使用'),cancelled:t('已取消，未安装'),'result-unavailable':t('安装结果不可追溯，请查看已安装列表；不会自动重试'),'already-installed':t('已安装，无需重复安装'),failed:t('未安装：')+(target.error??pending[target.item?.id]?.text??t('安装失败')),'readback-failed':target.error,'suite-upgrade-failed':suiteTargetFailure(target)})[target.status]),
           target.item?.source?h('div',{'aria-label':t('目录条目来源')},h('p',null,target.item.source.sourceId+' · '+target.item.source.sourceRef),...(target.item.source.sourceLinks??[]).map((link,index)=>h('p',{key:index},h('a',{href:link.sourceUrl,target:'_blank',rel:'noopener noreferrer'},link.sourceId+' · '+link.sourceRef),h('small',null,' '+link.firstSeenAt+' / '+link.lastSeenAt)))):null,
-          target.item&&pending[target.item.id]?h('p',{role:pending[target.item.id].failed?'alert':'status'},t(pending[target.item.id].text)):null,
+          target.item?operationNotice(pending[target.item.id]):null,
           ['installed','already-installed'].includes(target.status)&&target.item?.installed?.state==='registered'?openButton(target.item.installed):null):null,
       verification===true?h('section',{'aria-label':t('C-MARKET 合约验证')},h('h2',null,t('C-MARKET 合约验证')),
         h('p',null,t('测试版；输入与输出仅供当前客户端验证。安装仍须在正常确认框确认。')),

package/dist/library/install.js

@@ -3,6 +3,8 @@ import { join, resolve, dirname, sep, delimiter } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {safeGitEnv,guardNodeBinary,spawnGitSafe} from '../git-process.js';
 import { randomUUID } from 'node:crypto';
+import { stripVTControlCharacters } from 'node:util';
+import { redact } from '../runtime.js';
 import { AppHostError, requireCondition, SerialQueue } from '../errors.js';
 import { validateDefinition } from '../descriptor.js';
 import { itemKind } from './catalog.js';
@@ -66,7 +68,9 @@ export function createLibraryInstaller({profileDir,profileName,dataRoot,nodeBina
     const options={cwd:profileDir,workerNode:supervisorNode,env:safeGitEnv({HOME:process.env.HOME,DSH_HOME:process.env.DSH_HOME,LANG:process.env.LANG??'C.UTF-8',PATH:commandPath(nodeBinary??desktopLauncher.command)})},tail=['plugin','--profile',profileName,...args];
     if(launcherAvailable)options.env=safeGitEnv({...options.env,DSH_HOME:desktopLauncher.home,PATH:commandPath(desktopLauncher.command)});
     const result=await spawn(launcherAvailable?desktopLauncher.command:nodeBinary,launcherAvailable?tail:[...(desktopCli?['--expose-internals',fileURLToPath(new URL('./desktop-cli.js',import.meta.url)),desktopCli.entry,desktopCli.runtimeDir,desktopCli.supportDir]:[dshBin]),...tail],options);
-    requireCondition(result.code===0,'DSH_PLUGIN_FAILED','DSH plugin operation failed.',{code:result.code,signal:result.signal,stderr:String(result.stderr??'').slice(-2000)},502);return result;}
+    const clean=text=>redact(stripVTControlCharacters(String(text??''))).replace(/(https?:\/\/)[^/\s@]+@/g,'$1[REDACTED]@').slice(-2000);
+    const stdout=clean(result.stdout),stderr=clean(result.stderr);
+    requireCondition(result.code===0,'DSH_PLUGIN_FAILED','DSH plugin operation failed.',{code:result.code,signal:result.signal,stderr,diagnostic:[stdout,stderr].filter(Boolean).join('\n')||`DSH plugin exited with code ${result.code}${result.signal?' ('+result.signal+')':''}.`},502);return result;}
   /** The exact version `dsh plugin add` will pin: the registry's `latest` dist-tag, re-checked here (the catalog's `latestVersion` is a hint only). */
   async function latest(name){
     const base=new URL(registry);requireCondition(['https:','http:'].includes(base.protocol),'REGISTRY_DENIED','Registry URL is invalid.');

package/dist/library/service.js

@@ -36,7 +36,11 @@ export function createLibraryService({domain,host,config={},dataRoot,ledgerReade
   async function installedPlugins(){return config.profileDir?await scanInstalledPlugins({profileDir:config.profileDir,bootDependencies}):[];}
   const settingsWriter=new SerialQueue();
   function persist(update){return settingsWriter.run(async()=>{const next={...update(state),revision:state.revision+1};await domain.global.set(next);state=next;});}
-  async function operation(type,task){const operationId=randomUUID();emit({type:`library.${type}-started`,operationId});const work=Promise.resolve().then(()=>task(operationId)).then(result=>{emit({type:`library.${type}-done`,operationId,result});return result;},error=>{emit({type:`library.${type}-failed`,operationId,code:error.code??'LIBRARY_OPERATION_FAILED',...(error.recovery?{recovery:error.recovery}:{}),...(error.details?.stage==='suite-upgrade'?{details:{stage:'suite-upgrade',actual:error.details.actual,command:SUITE_INSTALL_COMMAND}}:{})});throw error;}).finally(()=>running.delete(operationId));running.set(operationId,work);work.catch(()=>{});return{operationId,status:'started'};}
+  async function operation(type,task){const operationId=randomUUID();emit({type:`library.${type}-started`,operationId});const work=Promise.resolve().then(()=>task(operationId)).then(result=>{emit({type:`library.${type}-done`,operationId,result});return result;},error=>{
+    const details=error.details?.stage==='suite-upgrade'?{stage:'suite-upgrade',actual:error.details.actual,command:SUITE_INSTALL_COMMAND}:{};
+    if(error instanceof AppHostError&&error.code==='DSH_PLUGIN_FAILED'&&typeof error.details?.diagnostic==='string')details.diagnostic=error.details.diagnostic;
+    emit({type:`library.${type}-failed`,operationId,code:error.code??'LIBRARY_OPERATION_FAILED',...(error.recovery?{recovery:error.recovery}:{}),...(Object.keys(details).length?{details}:{})});throw error;
+  }).finally(()=>running.delete(operationId));running.set(operationId,work);work.catch(()=>{});return{operationId,status:'started'};}
   const requireInstaller=(message)=>requireCondition(ready(),'LIBRARY_INSTALL_UNAVAILABLE',message,{need:unavailable()},503);
   /**
    * The host itself loaded/unloaded a plugin (pluginManager `applied`): it no longer waits for a restart. When the profile

package/docs/DSH_COMPATIBILITY.md

@@ -33,6 +33,12 @@ Internal connection HTTPS/bind-address handling changed upstream; the local HTTP
 
 ## Installation behavior
 
+0.6.15 retains the monitored public CLI. CLI failures carry bounded, redacted stdout and stderr through the asynchronous operation's diagnostic details; the market shows the original cause in an expandable panel. The main failure message includes the exact pnpm category. A minimum-release-age rejection lists affected package versions, explains the default 24-hour requirement while deferring to the actual cutoff, explains the known first-entry-only defect in pnpm 11.7.0 bundled with DSH 0.2.0-rc.2, and directs the person to DSH Settings to check the version and upgrade DSH, or wait until the rule is met before a manual retry. No profile configuration, dependency exclusion or supply-chain policy is changed.
+
+The official 0.2.0-rc.2 bundled pnpm 11.7.0 uses only the first matching package-name rule in `minimumReleaseAgeExclude`: an earlier exact old-version entry shadows a later exact new-version entry. The existing lockfile verifier can therefore reject an unrelated installation even though the new version is visibly listed. The 11.7.0 package obtained from npm has the same entry and core bytes as the supplied Desktop copy. Official Desktop 0.2.1-rc.3's pnpm 11.28.5 unions all matching exact versions and passes the same diagnostic profile. This establishes two tested endpoints, not the first fixed version. Both Desktop CLI and in-process manager use this pnpm path and set `ELECTRON_RUN_AS_NODE=1`; switching to the manager does not correct the 11.7.0 rule evaluation.
+
+The rc.2 manager lacks the explicit `saveExact` option, but that alone does not prove exact installation unavailable: normal pnpm 10.33.0 and 11.7.0 both saved an explicitly supplied `name@version` as an exact spec in diagnostic runs. The retained CLI requirement below comes from the scoped environment and Git monitor contract; no manager path is added by 0.6.15.
+
 AppHost reads public package metadata resolved from the proven Desktop runtime, or the CLI/profile package anchor.
 It never infers capability from the presence of a method alone or from function source text. Unknown versions do not
 enable live exact installation. Compatible manager versions at least `0.2.1-alpha.2` support `saveExact`,

package/docs/LICENSES.json

@@ -1,7 +1,7 @@
 {
   "package": {
     "name": "@hanamesh/dsh-app-host",
-    "version": "0.6.14",
+    "version": "0.6.15",
     "license": "SEE LICENSE IN LICENSE",
     "source": "git+https://github.com/yzsnstotz/hanamesh-plugin-app-host.git",
     "purpose": "Application ownership, view leases, Router forwarding, and application library for official DSH"

package/docs/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "currentCandidate": {
-    "version": "0.6.14",
+    "version": "0.6.15",
     "dshTarget": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
     "vendorSha256VerifiedAtBuild": false,
     "libProvisionDistribution": "随包分发、源仓不变; bundleDependencies; original LICENSE retained, no relicensing",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanamesh/dsh-app-host",
-  "version": "0.6.14",
+  "version": "0.6.15",
   "description": "HanaMesh application ownership, durable view leases, and application library for official DSH 0.2.x",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -68,28 +68,6 @@
     "docs/DSH_COMPATIBILITY.md",
     "docs/INSTALLATION_STATUS.md"
   ],
-  "scripts": {
-    "build": "node scripts/build.mjs",
-    "test": "node scripts/safe-git.mjs node --test --test-reporter=tap --test-concurrency=1 tests/*.test.mjs",
-    "test:contract": "pnpm run build && node --test --test-reporter=tap --test-concurrency=1 tests/install-target-contract.test.mjs tests/catalog-major-compat.test.mjs",
-    "test:mutation": "node scripts/safe-git.mjs node scripts/mutations.mjs",
-    "test:types": "tsc --noEmit --strict --target ES2022 --module NodeNext --moduleResolution NodeNext tests/consumer.mts",
-    "test:native-driver": "node scripts/safe-git.mjs node --test --test-reporter=tap tests/native/driver.test.mjs",
-    "check": "node scripts/safe-git.mjs node scripts/check.mjs",
-    "prepack": "npm run build",
-    "demo": "node examples/demo.mjs",
-    "preflight:dsh": "node scripts/preflight-dsh.mjs",
-    "check:consistency": "node scripts/check-consistency.mjs",
-    "check:toolchain": "node scripts/check-toolchain.mjs",
-    "preflight": "node scripts/preflight.mjs",
-    "verify:pack": "node scripts/safe-git.mjs node scripts/verify-package.mjs",
-    "check:devkit-supply": "node scripts/check-devkit-consumption.mjs",
-    "check:provision-supply": "node scripts/check-provision-consumption.mjs",
-    "install:safe": "node scripts/safe-git.mjs pnpm install --frozen-lockfile",
-    "release:check": "hanamesh-release check --lockfile pnpm-lock.yaml",
-    "release:publish": "hanamesh-release publish --lockfile pnpm-lock.yaml",
-    "prepublishOnly": "hanamesh-release source-guard"
-  },
   "dsh": {
     "bundle": {
       "patch": "./profile/cordis.patch.yml"
@@ -153,8 +131,27 @@
     "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
     "@hanamesh/release-platform-gate": "file:vendor/hanamesh-release-platform-gate-0.1.9.tgz"
   },
-  "packageManager": "pnpm@10.33.0",
   "bundleDependencies": [
     "@hanamesh/lib-provision"
-  ]
-}
+  ],
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "test": "node scripts/safe-git.mjs node --test --test-reporter=tap --test-concurrency=1 tests/*.test.mjs",
+    "test:contract": "pnpm run build && node --test --test-reporter=tap --test-concurrency=1 tests/install-target-contract.test.mjs tests/catalog-major-compat.test.mjs",
+    "test:mutation": "node scripts/safe-git.mjs node scripts/mutations.mjs",
+    "test:types": "tsc --noEmit --strict --target ES2022 --module NodeNext --moduleResolution NodeNext tests/consumer.mts",
+    "test:native-driver": "node scripts/safe-git.mjs node --test --test-reporter=tap tests/native/driver.test.mjs",
+    "check": "node scripts/safe-git.mjs node scripts/check.mjs",
+    "demo": "node examples/demo.mjs",
+    "preflight:dsh": "node scripts/preflight-dsh.mjs",
+    "check:consistency": "node scripts/check-consistency.mjs",
+    "check:toolchain": "node scripts/check-toolchain.mjs",
+    "preflight": "node scripts/preflight.mjs",
+    "verify:pack": "node scripts/safe-git.mjs node scripts/verify-package.mjs",
+    "check:devkit-supply": "node scripts/check-devkit-consumption.mjs",
+    "check:provision-supply": "node scripts/check-provision-consumption.mjs",
+    "install:safe": "node scripts/safe-git.mjs pnpm install --frozen-lockfile",
+    "release:check": "hanamesh-release check --lockfile pnpm-lock.yaml",
+    "release:publish": "hanamesh-release publish --lockfile pnpm-lock.yaml"
+  }
+}