@jayyuen66/dsh-ocr-review 0.1.10 → 0.1.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +39 -2
  2. package/README.md +5 -5
  3. package/README.zh-CN.md +5 -5
  4. package/THIRD_PARTY_NOTICES.md +9 -6
  5. package/docs/DETAIL.md +2 -2
  6. package/docs/DETAIL.zh.md +1 -1
  7. package/host.js +5 -5
  8. package/package.json +46 -46
package/CHANGELOG.md CHANGED
@@ -1,9 +1,46 @@
1
1
  # Changelog
2
2
 
3
3
  本文件遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/) 的格式，版本号遵循
4
- [语义化版本](https://semver.org/lang/zh-CN/)，最新版本在最上。条目自 0.1.0 起；更早的
4
+ [语义化版本](https://semver.org/lang/zh-CN/)，最新版本在最上。这里的偏离是刻意的：版本标题不写
5
+ 发布日期（各版发布时间以 npm registry 为准，`npm view <包名> time` 取得到），并按需增设标准六类
6
+ 之外的小节（如 `Docs`、`Verification`）。条目自 0.1.0 起；更早的
5
7
  1.0.0 / 0.6.x 是作用域迁移前的历史编号，npm 已永久记录，不在本文件重建。
6
8
 
9
+ ## 0.1.11
10
+
11
+ 这一版把宿主开发基线抬到 `0.2.2-alpha.3`，同步 shared `0.2.3`，并把外部 `ocr`
12
+ 契约抬到 `1.13.4`；随包文档的版本声明改由门禁与 manifest / catalog 对齐，测试补上
13
+ 平台桩与几处会随环境变脸的断言。对外工具与 Remote 方法名单不变。
14
+
15
+ ### Changed
16
+
17
+ - **宿主开发基线与支持窗口**：`devDependencies` 的 dsh 家族抬到 `0.2.2-alpha.3`，
18
+ cordis 抬到 `4.0.6-alpha.2`，schemastery fork 抬到 `3.18.6-alpha.2`；`engines.dsh`
19
+ 与 dsh 家族 peer 保持 `^0.2.1-rc.3 || ^0.2.2-alpha.2` 并集窗口，同时覆盖 rc 线与
20
+ alpha 线。
21
+ - **shared 抬到 `0.2.3`**：catalog、单仓 overrides 与 lockfile 同源到 0.2.3；
22
+ THIRD_PARTY_NOTICES 的依赖表同步。
23
+ - **OCR 契约抬到 `1.13.4`**：`package.json` 的 `ocrCliVersion`、`lib/cli.ts` 的
24
+ `EXPECTED_OCR_CLI_VERSION`、两侧 README、两份 DETAIL 与 THIRD_PARTY_NOTICES 的验证
25
+ 版本/运行期依赖行都由门禁核对到同一枚数字。
26
+ - **发布链**：CI 与 publish 的 pnpm 固定到 `12.11.2`；registry 预检的包名与 shared
27
+ 依赖名改从 `package.json` 读取，不再维护第二份字面量。
28
+ - **测试**：新增 `test/fixtures/platform-stub.ts`，平台相关用例统一走它；Windows
29
+ 非提权环境跳过符号链接越界用例（跳过的是 symlink 前提，不是用例意图）；CLI
30
+ 默认解析改用全新记忆槽；临时目录回收移到文件顶层；飞行中的 `busy` 断言收紧为必须
31
+ 为 `true`。
32
+ - **随包文档**：图标来源补上上游 path 的几何取值；README 说明本地目录安装需要
33
+ Node ≥ 22.18；DETAIL 明确 `startupVerify` 同时门控装载期的端点自检与版本测量。
34
+
35
+ ### Verification
36
+
37
+ - `npm run check`：typecheck、lint、双构建、全套用例、四项 100% 覆盖率与 oxfmt 全绿。
38
+ - `pnpm install --frozen-lockfile --ignore-scripts`（pnpm `12.11.2`）通过；
39
+ `pnpm run sync --check` 与 `node scripts/bump-manifests.mjs` 无漂移。
40
+ - `smoke dsh-ocr-review --tarball` 在 dsh `0.2.2-alpha.3` 沙箱命中本包层；tarball
41
+ 含 `host.js`、`client.js`、`docs/`、`locale/`、`CHANGELOG.md` 与
42
+ `THIRD_PARTY_NOTICES.md`。
43
+
7
44
  ## 0.1.10
8
45
 
9
46
  一轮跨面审查修复：路径闸、MCP 配置写面与并发覆盖、provider 面与解析判据收口；设置卡与工具出口同步加固。对外工具与 Remote 方法名单不变。
@@ -176,7 +213,7 @@
176
213
  ### Changed
177
214
 
178
215
  - **外部 ocr CLI 改由用户自装**：判据先扫 PATH、其次才是随包兜底，装法由用户自选；版本声明
179
- 一处（package.json 的 `ocrCliVersion`），代码镜像与两侧 README 由门禁对齐。按安装来源
216
+ 一处（package.json 的 `ocrCliVersion`，初值 1.13.0；此前的随包 CLI 不记版本），代码镜像与两侧 README 由门禁对齐。按安装来源
180
217
  （brew / npm）给对应的那条安装命令；来源判不出来时退回部署项 `ocrInstallHint` 的偏好。
181
218
  - **实测版本与声明不符时不只说给人听**：probe 端点回 `expectedVersion`/`consistent`，工具回执
182
219
  的 hint 也带上那句不一致说明。
package/README.md CHANGED
@@ -67,9 +67,9 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
67
67
  Remove with `dsh plugin --profile web remove @jayyuen66/dsh-ocr-review`. The package is on the public npm registry, so installation needs no credentials.
68
68
 
69
69
  - **Upgrading an installed copy is remove-then-add.** On a profile running HMR (the shipped ones do), `add` on a package the profile already depends on refuses before pnpm runs (`already-installed`) — run `remove` first, then `add` the target version; the new one starts without a restart. Without HMR the same `add` runs pnpm and reports `restart-required`.
70
- - **Requires Node.js `>= 22.12` and host `dsh` on the `0.2.1-rc.3` / `0.2.2-alpha.2` line.** The host reads `engines.dsh` (`^0.2.1-rc.3`) and decides on it alone; prereleases participate in the comparison. An incompatible host needs the explicit risk grant `dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<version> --dsh-version <exact> --accept-risk`. The support window rolls: this package is verified against the three most recently released host versions at publish time and re-verified once the window moves, so the version number in this bullet is not a standing promise.
70
+ - **Requires Node.js `>= 22.12` and host `dsh` on the `0.2.1-rc.3` or `0.2.2-alpha.2` line.** The host reads `engines.dsh` (`^0.2.1-rc.3 || ^0.2.2-alpha.2`) and decides on it alone; prereleases participate in the comparison. An incompatible host needs the explicit risk grant `dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<version> --dsh-version <exact> --accept-risk`. The support window rolls: this package is verified against every released host version inside the window at publish time and re-verified once the window moves, so the version number in this bullet is not a standing promise.
71
71
  - **No `@deepseek-ai/*` under `dependencies`, by contract** (`test/publish-manifest.test.ts` enforces it). Consumer profiles install with `nodeLinker: hoisted` and `autoInstallPeers: false`, so a host package there is materialized as a real directory next to the copy the running host already loaded. `@deepseek-ai/dsh-tools` keys its scheduler with a plain `Symbol` (not `Symbol.for`), so symbol identity is per instance and **every native tool call in that profile throws** — while this package's build, typecheck and coverage gates stay green right up to that moment.
72
- - **The five host packages `host.js` imports as values are required peers**: `@deepseek-ai/schemastery` (the host fork — only it resolves `.volatile()` fields), `@deepseek-ai/dsh-credentials`, `@deepseek-ai/dsh-home-paths`, `@deepseek-ai/dsh-atomic-write` and `@deepseek-ai/dsh-typert-protocol` (the Remote service base). Each is repeated in `devDependencies` at the same pin so this repository's own typecheck resolves them; the build externalizes all manifest tables, keeping bare specifiers in the artifact.
72
+ - **The five host packages `host.js` imports as values are required peers**: `@deepseek-ai/schemastery` (the host fork — only it resolves `.volatile()` fields), `@deepseek-ai/dsh-credentials`, `@deepseek-ai/dsh-home-paths`, `@deepseek-ai/dsh-atomic-write` and `@deepseek-ai/dsh-typert-protocol` (the Remote service base). Each also appears in `devDependencies` pinned to the compile-time host line (which may differ from the peer support window above) so this repository's own typecheck resolves them; the build externalizes all manifest tables, keeping bare specifiers in the artifact.
73
73
  - **What ships** (see `files` in `package.json`): `host.js`, `client.js`, `cordis.patch.yml`, `scripts/`, `locale/*.json`, `docs/`, `icon.svg`, `CHANGELOG.md` and `THIRD_PARTY_NOTICES.md`. `prepare` rebuilds the bundles, so nothing stale is published.
74
74
 
75
75
  ### <img src="https://api.iconify.design/lucide/arrow-down-to-line.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Shared version floor
@@ -78,11 +78,11 @@ If your profile pins `@jayyuen66/dsh-plugin-shared` with a pnpm `overrides` entr
78
78
 
79
79
  ## <img src="https://api.iconify.design/lucide/terminal.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> The external CLI
80
80
 
81
- This package spawns `ocr`; it never installs or upgrades it. The command contract is verified against **1.13.3** (`EXPECTED_OCR_CLI_VERSION` in `lib/cli.ts`, declared once as `ocrCliVersion` in package.json — tests pin the manifest, the code constant and both READMEs to the same string).
81
+ This package spawns `ocr`; it never installs or upgrades it. The command contract is verified against **1.13.4** (`EXPECTED_OCR_CLI_VERSION` in `lib/cli.ts`, declared once as `ocrCliVersion` in package.json — tests pin the manifest, the code constant and both READMEs to the same string).
82
82
 
83
83
  ```sh
84
84
  brew install open-code-review # the formula tracks the newest release
85
- npm i -g @alibaba-group/open-code-review@1.13.3 # pinned to the version this plugin verifies against
85
+ npm i -g @alibaba-group/open-code-review@1.13.4 # pinned to the version this plugin verifies against
86
86
  ```
87
87
 
88
88
  - **brew cannot pin.** `homebrew/core` carries one stable formula and no versioned variant, so `brew install` / `brew upgrade` always yields whatever is newest upstream. The npm command is the only one that can carry the verified version.
@@ -232,7 +232,7 @@ pnpm run check # typecheck (both sides) → lint → client build → host bui
232
232
  - Coverage thresholds are **100%** across four metrics over the surface `vitest.config.ts` opts into (`coverageInclude`: `host.ts` + `lib/**`); two areas are deliberately outside it: the client half (`src/**`) is exercised through the bundle and the settings-card tests, and `scripts/get-cred.mjs` is driven by process-level tests spawning a child (v8 coverage cannot see a child process) — its behavioral gate lives in `test/get-cred.test.ts`.
233
233
  - Adding this package's **local directory** to a profile (`pnpm add <path>`) needs pnpm ≥ 12.3.0: earlier pnpm 12 releases resolve an unaliased local path as a registry package name (upstream #14437, fixed in 12.3.0). Installing from the registry is unaffected.
234
234
  - Bundle freshness is pinned by `test/build-host.test.ts`: a stale `host.js` / `client.js` fails the suite. Never hand-edit the bundles; `prepare` rebuilds them.
235
- - The plugin source is TypeScript loaded directly by the host's cordis loader (Node ≥ 22.18 type stripping); the bundles exist for the published npm surface.
235
+ - The plugin source is TypeScript loaded directly by the host's cordis loader (Node ≥ 22.18 type stripping); the bundles exist for the published npm surface. Installing from a local path (`pnpm add <path>`) therefore needs Node ≥ 22.18 — the `>= 22.12` floor above applies to the published bundles only.
236
236
 
237
237
  ## <img src="https://api.iconify.design/lucide/scale.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> License
238
238
 
package/README.zh-CN.md CHANGED
@@ -67,7 +67,7 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
67
67
  卸载用 `dsh plugin --profile web remove @jayyuen66/dsh-ocr-review`。包在公共 npm 上，安装不需要凭据。
68
68
 
69
69
  - **升级已装的那一份要「先 remove 再 add」。** profile 跑着 HMR（出厂那几个都跑）时，`add` 一个 profile 已经依赖着的包会在 pnpm 动手之前就被拒（`already-installed`）——先 `remove` 再 `add` 目标版本，新版不必重启就起跑。没跑 HMR 时同一个 `add` 照样走 pnpm，报 `restart-required`。
70
- - **要求 Node.js `>= 22.12`，宿主 dsh 在 `0.2.1-rc.3` / `0.2.2-alpha.2` 线上。** 宿主只读 `engines.dsh`（`^0.2.1-rc.3`）并独立裁决，预发布号参与比较。不合的宿主要显式登记风险豁免：`dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<版本> --dsh-version <确切运行版本> --accept-risk`。支持窗口是滚动的：本包在发布时最近的三个已发布宿主版本上逐版取证，窗口滚动后重新取证，不把这一句里的版本号当长期承诺。
70
+ - **要求 Node.js `>= 22.12`，宿主 dsh 在 `0.2.1-rc.3` 或 `0.2.2-alpha.2` 线上。** 宿主只读 `engines.dsh`（`^0.2.1-rc.3 || ^0.2.2-alpha.2`）并独立裁决，预发布号参与比较。不合的宿主要显式登记风险豁免：`dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<版本> --dsh-version <确切运行版本> --accept-risk`。支持窗口是滚动的：本包在发布时把窗口内的每个已发布宿主版本逐版取证，窗口滚动后重新取证，不把这一句里的版本号当长期承诺。
71
71
  - **`dependencies` 里不放任何 `@deepseek-ai/*`，这是契约**（`test/publish-manifest.test.ts` 钉着）。消费方 profile 用 `nodeLinker: hoisted` 与 `autoInstallPeers: false` 安装，宿主包进了那张表就会落成真实目录，与宿主进程已加载的那份并存。`@deepseek-ai/dsh-tools` 的调度器键是普通 `Symbol`（不是 `Symbol.for`），符号身份按实例计算——那个 profile 里**每一次原生工具调用都抛**，而本包的构建、类型检查与覆盖率门在此前一路绿。
72
72
  - **`host.js` 以值导入的五枚宿主包是非 optional 的 peer**：`@deepseek-ai/schemastery`（宿主 fork——`.volatile()` 的解析只在它有实现）、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`（Remote 的 Service 基类）。五枚同时以同一钉版另列进 `devDependencies`，本仓自己的类型检查才解析得到；构建对 manifest 三张表一律外部化，产物里保持裸说明符。
73
73
  - **发布面**（以 `package.json` 的 `files` 为准）：`host.js`、`client.js`、`cordis.patch.yml`、`scripts/`、`locale/*.json`、`docs/`、`icon.svg`、`CHANGELOG.md` 与 `THIRD_PARTY_NOTICES.md`。`prepare` 重建两个 bundle，发出去的永远是当前源码的产物。
@@ -78,11 +78,11 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
78
78
 
79
79
  ## <img src="https://api.iconify.design/lucide/terminal.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 外部 CLI
80
80
 
81
- 本包只 spawn `ocr`，从不安装或升级它。命令契约按 **1.13.3** 核对（`lib/cli.ts` 的 `EXPECTED_OCR_CLI_VERSION`，版本号只在 package.json 的 `ocrCliVersion` 声明一次——测试把 manifest、代码常量与两侧 README 钉成同一个串）。
81
+ 本包只 spawn `ocr`，从不安装或升级它。命令契约按 **1.13.4** 核对（`lib/cli.ts` 的 `EXPECTED_OCR_CLI_VERSION`，版本号只在 package.json 的 `ocrCliVersion` 声明一次——测试把 manifest、代码常量与两侧 README 钉成同一个串）。
82
82
 
83
83
  ```sh
84
84
  brew install open-code-review # formula 只跟上游最新版
85
- npm i -g @alibaba-group/open-code-review@1.13.3 # 钉在本包核对的那一版
85
+ npm i -g @alibaba-group/open-code-review@1.13.4 # 钉在本包核对的那一版
86
86
  ```
87
87
 
88
88
  - **brew 钉不住版本。** `homebrew/core` 里只有一份 stable formula、没有版本化变体，`brew install` / `brew upgrade` 拿到的永远是上游最新。带得上核对版本的只有 npm 那条。
@@ -163,7 +163,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3 # 钉在本包核对的那
163
163
  | `providers()` | — | `{providers（每条附 hasKey 布尔）, current, getCredReady, source, endpointVerify, ocrBinary}`，不含任何明文 key。`ocrBinary` 是那份纯文件系统的可得性判定再补上版本上下文（`source`、`channel`、`expectedVersion`、`measuredVersion: string \| null`、`installHint`）；读这个方法不起进程 |
164
164
  | `select(request)` | `{provider, model}`，两者必须命中 `describe()` 给的清单 | `{ok, applied, llmTest}`（`autoVerify` 关闭时 `llmTest` 为 null） |
165
165
  | `migrate()` | — | `{ok, migrated, skippedUnknown}` |
166
- | `test()` | — | `{ok, output}`——`ok` 是**测试结论**，不是这次调用成没成；output 先脱敏再截 8000 字符 |
166
+ | `test()` | — | `{ok, output}`——`ok` 是**测试结论**，不是这次调用成没成；output 先脱敏再截前 8000 个 UTF-16 码元 |
167
167
  | `probe()` | — | `{ok, version, expectedVersion, consistent, output, reason, changeText}`——15 秒墙钟内跑一次 `ocr version`，恒定带 `OCR_NO_UPDATE=1`。`consistent` 是三态（`null` = 没量到，此时宣称「不一致」就是把没证据的事说成结论）；`reason` 点名失败那一档；`changeText` 只在真有一条该给的命令时非空 |
168
168
  | `mcp()` | — | `{ok, json, revision}`——只回 `mcp_servers` 对象（pretty JSON），不含 providers/keys；`revision` 是这一支的摘要 |
169
169
  | `saveMcp(request)` | `{json, revision?}`——原始 JSON 文本，上限 64 KiB；stdio/remote 条目逐字段校验；`revision` 取 `mcp()` 交回的那一枚 | `{ok, count, revision}`——只写 `mcp_servers`，其他配置原样保留。基线过期时整笔拒绝（盘上不动）并回可读的「读取之后已被改动」；不带基线则沿用原来的后写覆盖 |
@@ -216,7 +216,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3 # 钉在本包核对的那
216
216
 
217
217
  | 现象 / 问题 | 结论 |
218
218
  | --- | --- |
219
- | 把 exit 0 当成评审成功 | exit 0 不等于成功：`status` 不在 success / complete / partial / completed_with_warnings / completed_with_errors / skipped 白名单内即按失败报。`partial` 指部分文件失败、但覆盖与评论仍有效。解析失败时回显脱敏后原文的前 500 个 UTF-16 码元 |
219
+ | 把 exit 0 当成评审成功 | exit 0 不等于成功：`status` 不在 success / complete / partial / completed_with_warnings / completed_with_errors / skipped 白名单内即按失败报。`failed` 在名单里但**单独判成不成功**——它是 CLI 非零退出时照发的那份回执，覆盖明细（哪些文件没审成）由它承载，不与「解析失败、回显原文」混同。`partial` 指部分文件失败、但覆盖与评论仍有效。解析失败时回显脱敏后原文的前 500 个 UTF-16 码元 |
220
220
  | 摘要有没有覆盖全部产出？ | 两件不同的事，不能互相替代。`droppedCount` / `invalidCommentCount` 只说明**本摘要**有没有列全评论（调大 `maxComments` 或置 0 再复核）。**这一场**有没有把选中的文件审完看 `coverage`（`selected` 是分母，`failedItems` 给出文件名与原因）、`budgetExceeded` 与 `toolCalls` |
221
221
  | `add` 被拒，报 `already-installed` | HMR profile 对已装包的 `add` 在 pnpm 动手之前就拒——先 `remove` 再 `add` 目标版本（见「安装」） |
222
222
  | dsh 退出时后台进程怎么办？ | 收割守护在任何宿主退出方式下（含 kill -9 后被收养）以 TERM→1s→KILL 收走 review/scan 的进程树；取消工具调用即终止对应的后台进程 |
package/THIRD_PARTY_NOTICES.md CHANGED
@@ -20,8 +20,11 @@
20
20
  - 上游许可：MIT，Copyright (c) Paweł Kuna
21
21
  - 取用图标：`code`（https://icones.js.org/icons/tabler/code）
22
22
 
23
- `icon.svg` 的形状取自该图标的**两枚尖括号**：坐标整体平移（+1, −1）并去掉中间的斜杠笔画，
24
- 另加一枚对勾段（形态对齐 Tabler `check` 的笔画风格）。改动都不引入新的第三方形状：把
23
+ `icon.svg` 的形状取自该图标的**两枚尖括号**（上游 outline `code` 的 path 实量：左枚
24
+ `M7 8l-4 4 4 4`、右枚 `M17 8l4 4-4 4`）：左枚平移 (+1, −1) 落到 `m8 7`；右枚纵坐标同样收 1，
25
+ 横坐标从 17 落到 14——按同一平移本该落在 18，这里比它多收 4，两枚起点的间距因此由 10 变 6；
26
+ 中间的斜杠笔画（`M14 4l-4 16`）去掉。另加一枚
27
+ 对勾段（形态对齐 Tabler `check` 的圆角折线笔画）。改动都不引入新的第三方形状：把
25
28
  `currentColor` 换成本包插件图标配色（`#658EFF` 主色 + `#54ECE7` 底衬），并把外层 `<g>` 与
26
29
  画布尺寸对齐本族插件统一的 `36×36` / `viewBox 0 0 24 24` 规格。
27
30
 
@@ -56,7 +59,7 @@ SOFTWARE.
56
59
  - 上游项目：`open-code-review`
57
60
  - 上游仓库：https://github.com/alibaba/open-code-review
58
61
  - 上游许可：Apache-2.0，Copyright 2026 Alibaba
59
- - 验证版本：1.13.3（声明在 package.json 的 `ocrCliVersion`，代码里的镜像常量与两侧 README 由门禁对齐同一枚数字）
62
+ - 验证版本：1.13.4（声明在 package.json 的 `ocrCliVersion`，代码里的镜像常量、两侧 README 与随包文档由门禁对齐同一枚数字）
60
63
 
61
64
  本包**使用**而非**包含**以下接口（`host.ts` / `lib/cli.ts` 的头注释按该版本源码逐条核对）：
62
65
 
@@ -81,9 +84,9 @@ SOFTWARE.
81
84
 
82
85
  | 依赖 | 版本 | 许可 | 引入方 |
83
86
  | --- | --- | --- | --- |
84
- | `@alibaba-group/open-code-review` | 1.13.3（核对版本，非依赖） | Apache-2.0（Alibaba） | **不在依赖表里**：用户自选 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@<版本>`，本包只 spawn 它 |
87
+ | `@alibaba-group/open-code-review` | 1.13.4（核对版本，非依赖） | Apache-2.0（Alibaba） | **不在依赖表里**：用户自选 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@<版本>`，本包只 spawn 它 |
85
88
  | `js-yaml` | 5.4.3（精确钉版） | MIT | `scripts/get-cred.mjs` 读 dsh 托管凭据文档 |
86
- | `@jayyuen66/dsh-plugin-shared` | catalog（伞根 0.2.2） | MIT | `host.ts` / `lib/*` / `src/*` 的 job-outcome、locale、record、errors、card-* 等公共面（值导入，构建时外部化） |
89
+ | `@jayyuen66/dsh-plugin-shared` | catalog（伞根 0.2.3） | MIT | `host.ts` / `lib/*` / `src/*` 的 job-outcome、locale、record、errors、card-* 等公共面（值导入，构建时外部化） |
87
90
  | `zod` | catalog（伞根 4.6.7） | MIT | 设置卡 `src/remote.ts` 的 strict codec 形状校验；client 产物由宿主 `PLATFORM_MODULES` 提供 |
88
91
 
89
- dsh 宿主侧的包分两档：产物里以**值**导入、且列在 `peerDependencies` 的五枚（`@deepseek-ai/schemastery` 宿主 fork、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`）由宿主在场提供、不随本包分发；其余 `@deepseek-ai/dsh-*` 与 `@deepseek-ai/cordis` 只在 `devDependencies` 里，用途是把类型绑到官方声明上（type-only 绑定），产物里不留说明符。本包按 dsh `0.2.2-alpha.2` 逐条核对过（同版的 cordis `4.0.6-alpha.1` 与 schemastery `3.18.6-alpha.1` fork 一并核对）。
92
+ dsh 宿主侧的包分两档：产物里以**值**导入、且列在 `peerDependencies` 的五枚（`@deepseek-ai/schemastery` 宿主 fork、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`）由宿主在场提供、不随本包分发；其余 `@deepseek-ai/dsh-*` 与 `@deepseek-ai/cordis` 只在 `devDependencies` 里，用途是把类型绑到官方声明上（type-only 绑定），产物里不留说明符。本包按 dsh `0.2.2-alpha.3` 逐条核对过（同版的 cordis `4.0.6-alpha.2` 与 schemastery `3.18.6-alpha.2` fork 一并核对）。
package/docs/DETAIL.md CHANGED
@@ -15,11 +15,11 @@ The card's MCP-servers editor writes the **external `ocr` tool's own** configura
15
15
 
16
16
  ## Restart-only values
17
17
 
18
- `llmTestTimeoutMs` (90000), `startupVerify` (on: the endpoint self-check runs at load), `ocrBackgroundMaxMs` (0 = no backstop window), `stdoutMaxBytes` (400000), `ocrNoAutoUpdate` (false: upstream auto-upgrade stays on unless you say otherwise) and `ocrInstallHint` (`both`/`brew`/`npm`). Set them in the `config:` block of this plugin's row in `cordis.patch.yml`.
18
+ `llmTestTimeoutMs` (90000), `startupVerify` (on: the load-time endpoint self-check and the one CLI version measurement both run at apply — the switch gates any process spawn at load), `ocrBackgroundMaxMs` (0 = no backstop window), `stdoutMaxBytes` (400000), `ocrNoAutoUpdate` (false: upstream auto-upgrade stays on unless you say otherwise) and `ocrInstallHint` (`both`/`brew`/`npm`). Set them in the `config:` block of this plugin's row in `cordis.patch.yml`.
19
19
 
20
20
  ## What it needs from outside
21
21
 
22
- The `ocr` command line, expected at version **1.13.3**; the expectation is declared once as `ocrCliVersion` in `package.json`, and the code constant plus both READMEs mirror that string, so a mismatch is reported (as a hint, never a hard failure) rather than papered over. Install paths are `brew install open-code-review` or `npm i -g @alibaba-group/open-code-review@1.13.3`. With no candidate on PATH at all, the pre-check reports "no ocr candidate on either path" plus an install hint; "command not found" (exit 127) is the different case where a candidate exists but the binary cannot actually be run. The version probe always forces `OCR_NO_UPDATE=1` so probing cannot trigger an upgrade.
22
+ The `ocr` command line, expected at version **1.13.4**; the expectation is declared once as `ocrCliVersion` in `package.json`, and the code constant plus both READMEs mirror that string, so a mismatch is reported (as a hint, never a hard failure) rather than papered over. Install paths are `brew install open-code-review` or `npm i -g @alibaba-group/open-code-review@1.13.4`. With no candidate on PATH at all, the pre-check reports "no ocr candidate on either path" plus an install hint; "command not found" (exit 127) is the different case where a candidate exists but the binary cannot actually be run. The version probe always forces `OCR_NO_UPDATE=1` so probing cannot trigger an upgrade.
23
23
 
24
24
  API credentials are not stored here: the plugin writes a `api_key_cmd` that calls a helper script, so the key is fetched at run time instead of landing in a config file. If that script is missing, the card warns rather than sending an unauthenticated request.
25
25
 
package/docs/DETAIL.zh.md CHANGED
@@ -19,7 +19,7 @@
19
19
 
20
20
  ## 需要外部提供什么
21
21
 
22
- `ocr` 命令行，期望版本 **1.13.3**；这个期望唯一声明在 `package.json` 的 `ocrCliVersion`，代码常量与两份 README 镜像同一个字符串，版本不符只作为提示报出，从不中断评审。装法是 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@1.13.3`。PATH 上一个候选都没有时，预检报「no ocr candidate on either path」并附安装提示；「command not found」（exit 127）是另一种情况：候选在，但真二进制跑不起来。版本探测一律强制 `OCR_NO_UPDATE=1`，以免探测顺手触发升级。
22
+ `ocr` 命令行，期望版本 **1.13.4**；这个期望唯一声明在 `package.json` 的 `ocrCliVersion`，代码常量与两份 README 镜像同一个字符串，版本不符只作为提示报出，从不中断评审。装法是 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@1.13.4`。PATH 上一个候选都没有时，预检报「no ocr candidate on either path」并附安装提示；「command not found」（exit 127）是另一种情况：候选在，但真二进制跑不起来。版本探测一律强制 `OCR_NO_UPDATE=1`，以免探测顺手触发升级。
23
23
 
24
24
  API 凭据不存这里：本插件写的是一个 `api_key_cmd`，运行时的密钥由那支辅助脚本现取，不进配置文件。脚本缺失时卡上给出告警，而不是发一次没有鉴权的请求。
25
25
 
package/host.js CHANGED
@@ -1000,7 +1000,7 @@ function resolveOutputFormat(value) {
1000
1000
  // lib/cli.ts
1001
1001
  /** Homebrew 安装路径（`Cellar` / `Homebrew` 任一段）。 */
1002
1002
  const HOMEBREW_PATH = /(?:^|[/\\])(?:Cellar|Homebrew)(?:[/\\]|$)/iu;
1003
- /** `ocr` 版本行：`open-code-review v1.13.3`（允许预发布/构建元数据）。 */
1003
+ /** `ocr` 版本行：`open-code-review v1.13.4`（允许预发布/构建元数据）。 */
1004
1004
  const OCR_VERSION = /open-code-review\s+v?(?<version>\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)/u;
1005
1005
  /** `--exclude` 的模式条数上限。**不是审查范围的上限**，只是防一条失控输入把命令串撑爆；
1006
1006
  * 真实使用里几十条就到头，给到 2000 是为了"尽量不截断"——超了会明确告警，不静默丢。 */
@@ -1033,7 +1033,7 @@ const BACKGROUND_FLAG = "--background";
1033
1033
  * test/readme-parity.test.ts 再断言两侧 README 写的也是它。三处只有一处是人写的、
1034
1034
  * 靠门禁钉住另两处，就不会出现「README 教用户装 A、代码按 B 校验」这种两边各自自洽的错。
1035
1035
  */
1036
- const EXPECTED_OCR_CLI_VERSION = "1.13.3";
1036
+ const EXPECTED_OCR_CLI_VERSION = "1.13.4";
1037
1037
  /** 报错用的值形态（永不调用可能被劫持的 toJSON/toString）。host.ts 的入参闸
1038
1038
  * （effort/wait）复用同一口径，故导出。 */
1039
1039
  function describeValue(value) {
@@ -4626,8 +4626,8 @@ function textBlock(value) {
4626
4626
  * 按调用携带的 `SandboxPolicyRequest` 只有 `session` 与 `mode` 两个字段，**没有**附加可写
4627
4627
  * 路径、没有自定义 HOME、没有目录级豁免；而 `SandboxMode` 的取值只有
4628
4628
  * `read-only | workspace-write | danger-full-access` 三档，中间那一档的可写根就是
4629
- * `workspaceRoot` 一枚。两处声明都取自本包实际解析到的那版（dsh-sandbox-policy 与
4630
- * dsh-sandbox 的 0.2.1-rc.3，`lib/types/index.d.ts`）。
4629
+ * `workspaceRoot` 一枚。两处声明都取自本包实际解析到的 dsh-sandbox-policy 与
4630
+ * dsh-sandbox 的 `lib/types/index.d.ts`。
4631
4631
  * 可选的收紧路径只有「改 ocr 自己的状态落点」或「等上游加字段」，两者都不是本包能在
4632
4632
  * 一次补丁里做完的事。故此处维持放开，但把边界写明：放开的是 ocr 这一个子进程的整棵
4633
4633
  * 文件系统写权限，不是宿主其它能力；且 ocr 读什么、写什么仍由上面那条 argv 闸与
@@ -5192,7 +5192,7 @@ function cliStatusPayload(status, config, messages, measured) {
5192
5192
  * @returns 同一份摘要，或 hint 尾部多了一句的副本。
5193
5193
  */
5194
5194
  function withCliVersionNote(summary, measured, messages) {
5195
- if (measured === null || measured === "1.13.3") return summary;
5195
+ if (measured === null || measured === "1.13.4") return summary;
5196
5196
  const note = format(messages.versionMismatch, {
5197
5197
  actual: measured,
5198
5198
  expected: EXPECTED_OCR_CLI_VERSION
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@jayyuen66/dsh-ocr-review",
3
- "version": "0.1.10",
3
+ "version": "0.1.11",
4
4
  "description": "dsh 工作区代码审查插件：把 open-code-review（ocr CLI）封装为 7 个模型工具 + 设置卡片（从宿主设置服务的 provider 清单选 provider/model 应用到 OCR 配置）。",
5
5
  "keywords": [
6
6
  "ai-code-review",
@@ -54,49 +54,49 @@
54
54
  "registry": "https://registry.npmjs.org"
55
55
  },
56
56
  "dependencies": {
57
- "@jayyuen66/dsh-plugin-shared": "0.2.2",
57
+ "@jayyuen66/dsh-plugin-shared": "0.2.3",
58
58
  "js-yaml": "5.4.3",
59
59
  "zod": "4.6.7"
60
60
  },
61
61
  "devDependencies": {
62
- "@deepseek-ai/cordis": "4.0.6-alpha.1",
63
- "@deepseek-ai/cordis-plugin-include": "1.0.11-alpha.1",
64
- "@deepseek-ai/cordis-plugin-loader": "1.0.7-alpha.1",
65
- "@deepseek-ai/dsh-agent": "0.2.2-alpha.2",
66
- "@deepseek-ai/dsh-api-remotes": "0.2.2-alpha.2",
67
- "@deepseek-ai/dsh-atomic-write": "0.2.2-alpha.2",
68
- "@deepseek-ai/dsh-bash-local": "0.2.2-alpha.2",
69
- "@deepseek-ai/dsh-client-locale": "0.2.2-alpha.2",
70
- "@deepseek-ai/dsh-client-store": "0.2.2-alpha.2",
71
- "@deepseek-ai/dsh-client-ui-layout": "0.2.2-alpha.2",
72
- "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.2-alpha.2",
73
- "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-alpha.2",
74
- "@deepseek-ai/dsh-client-ui-settings": "0.2.2-alpha.2",
75
- "@deepseek-ai/dsh-client-ui-slots": "0.2.2-alpha.2",
76
- "@deepseek-ai/dsh-credentials": "0.2.2-alpha.2",
77
- "@deepseek-ai/dsh-home-paths": "0.2.2-alpha.2",
78
- "@deepseek-ai/dsh-host-webserver": "0.2.2-alpha.2",
79
- "@deepseek-ai/dsh-http-proxy": "0.2.2-alpha.2",
80
- "@deepseek-ai/dsh-jobs": "0.2.2-alpha.2",
81
- "@deepseek-ai/dsh-jobs-local": "0.2.2-alpha.2",
82
- "@deepseek-ai/dsh-llm": "0.2.2-alpha.2",
83
- "@deepseek-ai/dsh-output-retention": "0.2.2-alpha.2",
84
- "@deepseek-ai/dsh-package-manifest": "0.2.2-alpha.2",
85
- "@deepseek-ai/dsh-ptc-runtime": "0.2.2-alpha.2",
86
- "@deepseek-ai/dsh-sandbox": "0.2.2-alpha.2",
87
- "@deepseek-ai/dsh-scope": "0.2.2-alpha.2",
88
- "@deepseek-ai/dsh-session": "0.2.2-alpha.2",
89
- "@deepseek-ai/dsh-session-projection": "0.2.2-alpha.2",
90
- "@deepseek-ai/dsh-settings": "0.2.2-alpha.2",
91
- "@deepseek-ai/dsh-shell": "0.2.2-alpha.2",
92
- "@deepseek-ai/dsh-subprocess": "0.2.2-alpha.2",
93
- "@deepseek-ai/dsh-subprocess-local": "0.2.2-alpha.2",
94
- "@deepseek-ai/dsh-system-prompt": "0.2.2-alpha.2",
95
- "@deepseek-ai/dsh-timeout": "0.2.2-alpha.2",
96
- "@deepseek-ai/dsh-tools": "0.2.2-alpha.2",
97
- "@deepseek-ai/dsh-typert-protocol": "0.2.2-alpha.2",
98
- "@deepseek-ai/dsh-user-approval": "0.2.2-alpha.2",
99
- "@deepseek-ai/schemastery": "3.18.6-alpha.1",
62
+ "@deepseek-ai/cordis": "4.0.6-alpha.2",
63
+ "@deepseek-ai/cordis-plugin-include": "1.0.11-alpha.2",
64
+ "@deepseek-ai/cordis-plugin-loader": "1.0.7-alpha.2",
65
+ "@deepseek-ai/dsh-agent": "0.2.2-alpha.3",
66
+ "@deepseek-ai/dsh-api-remotes": "0.2.2-alpha.3",
67
+ "@deepseek-ai/dsh-atomic-write": "0.2.2-alpha.3",
68
+ "@deepseek-ai/dsh-bash-local": "0.2.2-alpha.3",
69
+ "@deepseek-ai/dsh-client-locale": "0.2.2-alpha.3",
70
+ "@deepseek-ai/dsh-client-store": "0.2.2-alpha.3",
71
+ "@deepseek-ai/dsh-client-ui-layout": "0.2.2-alpha.3",
72
+ "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.2-alpha.3",
73
+ "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-alpha.3",
74
+ "@deepseek-ai/dsh-client-ui-settings": "0.2.2-alpha.3",
75
+ "@deepseek-ai/dsh-client-ui-slots": "0.2.2-alpha.3",
76
+ "@deepseek-ai/dsh-credentials": "0.2.2-alpha.3",
77
+ "@deepseek-ai/dsh-home-paths": "0.2.2-alpha.3",
78
+ "@deepseek-ai/dsh-host-webserver": "0.2.2-alpha.3",
79
+ "@deepseek-ai/dsh-http-proxy": "0.2.2-alpha.3",
80
+ "@deepseek-ai/dsh-jobs": "0.2.2-alpha.3",
81
+ "@deepseek-ai/dsh-jobs-local": "0.2.2-alpha.3",
82
+ "@deepseek-ai/dsh-llm": "0.2.2-alpha.3",
83
+ "@deepseek-ai/dsh-output-retention": "0.2.2-alpha.3",
84
+ "@deepseek-ai/dsh-package-manifest": "0.2.2-alpha.3",
85
+ "@deepseek-ai/dsh-ptc-runtime": "0.2.2-alpha.3",
86
+ "@deepseek-ai/dsh-sandbox": "0.2.2-alpha.3",
87
+ "@deepseek-ai/dsh-scope": "0.2.2-alpha.3",
88
+ "@deepseek-ai/dsh-session": "0.2.2-alpha.3",
89
+ "@deepseek-ai/dsh-session-projection": "0.2.2-alpha.3",
90
+ "@deepseek-ai/dsh-settings": "0.2.2-alpha.3",
91
+ "@deepseek-ai/dsh-shell": "0.2.2-alpha.3",
92
+ "@deepseek-ai/dsh-subprocess": "0.2.2-alpha.3",
93
+ "@deepseek-ai/dsh-subprocess-local": "0.2.2-alpha.3",
94
+ "@deepseek-ai/dsh-system-prompt": "0.2.2-alpha.3",
95
+ "@deepseek-ai/dsh-timeout": "0.2.2-alpha.3",
96
+ "@deepseek-ai/dsh-tools": "0.2.2-alpha.3",
97
+ "@deepseek-ai/dsh-typert-protocol": "0.2.2-alpha.3",
98
+ "@deepseek-ai/dsh-user-approval": "0.2.2-alpha.3",
99
+ "@deepseek-ai/schemastery": "3.18.6-alpha.2",
100
100
  "@e18e/eslint-plugin": "0.8.1",
101
101
  "@types/node": "26.6.6",
102
102
  "@types/react": "19.3.0",
@@ -115,15 +115,15 @@
115
115
  "vitest": "5.0.5"
116
116
  },
117
117
  "peerDependencies": {
118
- "@deepseek-ai/dsh-atomic-write": "^0.2.1-rc.3",
119
- "@deepseek-ai/dsh-credentials": "^0.2.1-rc.3",
120
- "@deepseek-ai/dsh-home-paths": "^0.2.1-rc.3",
121
- "@deepseek-ai/dsh-typert-protocol": "^0.2.1-rc.3",
118
+ "@deepseek-ai/dsh-atomic-write": "^0.2.1-rc.3 || ^0.2.2-alpha.2",
119
+ "@deepseek-ai/dsh-credentials": "^0.2.1-rc.3 || ^0.2.2-alpha.2",
120
+ "@deepseek-ai/dsh-home-paths": "^0.2.1-rc.3 || ^0.2.2-alpha.2",
121
+ "@deepseek-ai/dsh-typert-protocol": "^0.2.1-rc.3 || ^0.2.2-alpha.2",
122
122
  "@deepseek-ai/schemastery": "^3.18.6-alpha.1"
123
123
  },
124
124
  "icon": "icon.svg",
125
125
  "engines": {
126
- "dsh": "^0.2.1-rc.3",
126
+ "dsh": "^0.2.1-rc.3 || ^0.2.2-alpha.2",
127
127
  "node": ">=22.12.0"
128
128
  },
129
129
  "dsh": {
@@ -136,7 +136,7 @@
136
136
  "immediately": true
137
137
  }
138
138
  },
139
- "ocrCliVersion": "1.13.3",
139
+ "ocrCliVersion": "1.13.4",
140
140
  "scripts": {
141
141
  "build:client": "node build-client.mjs",
142
142
  "build": "node build-host.mjs",