@jayyuen66/dsh-ocr-review 0.1.11 → 0.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/README.md +7 -7
  3. package/README.zh-CN.md +7 -7
  4. package/THIRD_PARTY_NOTICES.md +6 -6
  5. package/client.js +54 -639
  6. package/cordis.patch.yml +3 -0
  7. package/docs/DETAIL.md +1 -1
  8. package/docs/DETAIL.zh.md +2 -2
  9. package/host.js +3 -3
  10. package/package.json +59 -57
package/CHANGELOG.md CHANGED
@@ -6,6 +6,21 @@
6
6
  之外的小节（如 `Docs`、`Verification`）。条目自 0.1.0 起；更早的
7
7
  1.0.0 / 0.6.x 是作用域迁移前的历史编号，npm 已永久记录，不在本文件重建。
8
8
 
9
+ ## 0.1.12
10
+
11
+ 外部 `ocr` 契约抬到 `1.13.5`，宿主开发基线抬到 `0.2.2-rc.1`、支持窗口由 `^0.2.1-rc.3 || ^0.2.2-alpha.2` 滚到 `^0.2.1-rc.5 || ^0.2.2-alpha.3`，`engines.node` 地板抬到 `>=24.9.0`；卡片组件改由 shared 的 `./client` 供。对外工具与 Remote 方法名单不变，需要留意的是 `engines.node` 抬高后 node 22 装不上本包。
12
+
13
+ ### Changed
14
+
15
+ - **shared 抬到 0.2.4**：catalog、生成物与 lockfile 随之同步；shared 新增的 `apply_patch` 目标解析由它自己的普通依赖 `@deepseek-ai/dsh-fs-patch` 提供，本包不需要重复声明。
16
+ - **OCR 契约抬到 `1.13.5`**：`lib/cli.ts` 的 `EXPECTED_OCR_CLI_VERSION` 与 `package.json` 的 `ocrCliVersion` 同值，两份 README、四份安装文档里钉版本的装法行、`THIRD_PARTY_NOTICES.md` 的验证版本与运行期依赖行都由 `test/readme-parity.test.ts` 核到同一枚数字——期望版本改了而装法行停在旧版时，用户照着装完会永远收到「实测与核对版本不一致」，而两侧文档各自自洽。
17
+ - **宿主开发基线**：`devDependencies` 的 dsh 家族抬到 `0.2.2-rc.1`，`@deepseek-ai/cordis` 抬到 `4.1.0`，cordis 插件组两枚抬到 `1.1.0`，`@deepseek-ai/schemastery` 抬到 `3.19.0`；`@deepseek-ai/dsh-ptc-runtime` 从 devDependencies 移除（源码与测试都不再引用它）。根 catalog 与 overrides 的投影同步，`pnpm-lock.yaml` 随之重解。
18
+ - **支持窗口与 Node 地板**：`engines.dsh` 与四枚 `@deepseek-ai/dsh*` peer 由 `^0.2.1-rc.3 || ^0.2.2-alpha.2` 改为 `^0.2.1-rc.5 || ^0.2.2-alpha.3`；`@deepseek-ai/schemastery` 的 peer 放宽为 `^3.18.5 || ^3.18.6-alpha.1`，与两条宿主线各自的实装版本对齐；`engines.node` 由 `>=22.12.0` 抬到 `>=24.9.0`（宿主 `0.2.2` 线自己的地板）。
19
+ - **卡片组件改由 shared 的 `./client` 供**：`src/client-entry.ts` 与 `src/remote.ts` 的运行期值导入迁到 `./client`，`package.json` 新增 `dsh.bundle.client.external`，`build-client.mjs` 的外置清单同步；`cordis.patch.yml` 因此插入一条**不写 id** 的 `@jayyuen66/dsh-plugin-shared` 组件行（写 id 会在插件页多出一个可关闭的组件，关掉后设置卡失去组件供应）。
20
+ - **`js-yaml` 抬到 5.5.0**：本包唯一直接消费它的解析路径不变，取值随伞根 catalog 与 overrides 同源。
21
+ - **CI 的 node 矩阵收敛**：`ci.yml` 的 `node: [22, 24]` 加 macOS 排除改为单格 `node: [24.9]`，两份 workflow 的 `node-version` 由 `24` 改为 `24.9`，与 `engines.node` 同值。
22
+ - **文档纠偏**：dsh 徽章由 `^0.2.1-rc.3` 抬到 `^0.2.1-rc.5`，与 `engines.dsh` 首条同值；`cordis.patch.yml` 的注册行由「唯一一行」改写为「两条条目」并说明 shared 那行为何不写 id；「本地目录安装需要 Node ≥ 22.18」那句原文推论成「`>= 24.9` 只约束发布产物」，而 `engines.node` 是 manifest 字段、不分安装路线，改为两条并列陈述（读源码需 ≥22.18，本包地板是 `>=24.9.0`），中文侧此前完全没有这一句；`THIRD_PARTY_NOTICES.md` 指向的 README 小节名 `External CLI status and version` 在两份 README 里都不存在，改为实际标题 “The external CLI”；`docs/DETAIL.zh.md` 的 `startupVerify` 补上「同时门控版本测量」那半，此前只有英文侧写了。
23
+
9
24
  ## 0.1.11
10
25
 
11
26
  这一版把宿主开发基线抬到 `0.2.2-alpha.3`，同步 shared `0.2.3`，并把外部 `ocr`
package/README.md CHANGED
@@ -11,8 +11,8 @@
11
11
  <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/d18m/@jayyuen66/dsh-ocr-review?style=flat-square" alt="npm downloads (total)" /></a>
12
12
  <a href="https://github.com/JayYuen666/dsh-ocr-review/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/JayYuen666/dsh-ocr-review/ci.yml?branch=main&style=flat-square&label=ci" alt="ci" /></a>
13
13
  <img src="https://img.shields.io/badge/license-MIT-4c1?style=flat-square" alt="MIT" />
14
- <img src="https://img.shields.io/badge/node-%3E%3D22.12-4c1?style=flat-square&logo=nodedotjs&logoColor=white" alt="node" />
15
- <img src="https://img.shields.io/badge/dsh-%5E0.2.1--rc.3-658EFF?style=flat-square" alt="dsh" />
14
+ <img src="https://img.shields.io/badge/node-%3E%3D24.9-4c1?style=flat-square&logo=nodedotjs&logoColor=white" alt="node" />
15
+ <img src="https://img.shields.io/badge/dsh-%5E0.2.1--rc.5-658EFF?style=flat-square" alt="dsh" />
16
16
  <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/powered_by_dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white" alt="powered by dsh" /></a>
17
17
  </p>
18
18
 
@@ -67,7 +67,7 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
67
67
  Remove with `dsh plugin --profile web remove @jayyuen66/dsh-ocr-review`. The package is on the public npm registry, so installation needs no credentials.
68
68
 
69
69
  - **Upgrading an installed copy is remove-then-add.** On a profile running HMR (the shipped ones do), `add` on a package the profile already depends on refuses before pnpm runs (`already-installed`) — run `remove` first, then `add` the target version; the new one starts without a restart. Without HMR the same `add` runs pnpm and reports `restart-required`.
70
- - **Requires Node.js `>= 22.12` and host `dsh` on the `0.2.1-rc.3` or `0.2.2-alpha.2` line.** The host reads `engines.dsh` (`^0.2.1-rc.3 || ^0.2.2-alpha.2`) and decides on it alone; prereleases participate in the comparison. An incompatible host needs the explicit risk grant `dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<version> --dsh-version <exact> --accept-risk`. The support window rolls: this package is verified against every released host version inside the window at publish time and re-verified once the window moves, so the version number in this bullet is not a standing promise.
70
+ - **Requires Node.js `>= 24.9` and host `dsh` on the `0.2.1-rc.5` or `0.2.2-alpha.3` line.** The host reads `engines.dsh` (`^0.2.1-rc.5 || ^0.2.2-alpha.3`) and decides on it alone; prereleases participate in the comparison. An incompatible host needs the explicit risk grant `dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<version> --dsh-version <exact> --accept-risk`. The support window rolls: this package is verified against every released host version inside the window at publish time and re-verified once the window moves, so the version number in this bullet is not a standing promise.
71
71
  - **No `@deepseek-ai/*` under `dependencies`, by contract** (`test/publish-manifest.test.ts` enforces it). Consumer profiles install with `nodeLinker: hoisted` and `autoInstallPeers: false`, so a host package there is materialized as a real directory next to the copy the running host already loaded. `@deepseek-ai/dsh-tools` keys its scheduler with a plain `Symbol` (not `Symbol.for`), so symbol identity is per instance and **every native tool call in that profile throws** — while this package's build, typecheck and coverage gates stay green right up to that moment.
72
72
  - **The five host packages `host.js` imports as values are required peers**: `@deepseek-ai/schemastery` (the host fork — only it resolves `.volatile()` fields), `@deepseek-ai/dsh-credentials`, `@deepseek-ai/dsh-home-paths`, `@deepseek-ai/dsh-atomic-write` and `@deepseek-ai/dsh-typert-protocol` (the Remote service base). Each also appears in `devDependencies` pinned to the compile-time host line (which may differ from the peer support window above) so this repository's own typecheck resolves them; the build externalizes all manifest tables, keeping bare specifiers in the artifact.
73
73
  - **What ships** (see `files` in `package.json`): `host.js`, `client.js`, `cordis.patch.yml`, `scripts/`, `locale/*.json`, `docs/`, `icon.svg`, `CHANGELOG.md` and `THIRD_PARTY_NOTICES.md`. `prepare` rebuilds the bundles, so nothing stale is published.
@@ -78,11 +78,11 @@ If your profile pins `@jayyuen66/dsh-plugin-shared` with a pnpm `overrides` entr
78
78
 
79
79
  ## <img src="https://api.iconify.design/lucide/terminal.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> The external CLI
80
80
 
81
- This package spawns `ocr`; it never installs or upgrades it. The command contract is verified against **1.13.4** (`EXPECTED_OCR_CLI_VERSION` in `lib/cli.ts`, declared once as `ocrCliVersion` in package.json — tests pin the manifest, the code constant and both READMEs to the same string).
81
+ This package spawns `ocr`; it never installs or upgrades it. The command contract is verified against **1.13.5** (`EXPECTED_OCR_CLI_VERSION` in `lib/cli.ts`, declared once as `ocrCliVersion` in package.json — tests pin the manifest, the code constant and both READMEs to the same string).
82
82
 
83
83
  ```sh
84
84
  brew install open-code-review # the formula tracks the newest release
85
- npm i -g @alibaba-group/open-code-review@1.13.4 # pinned to the version this plugin verifies against
85
+ npm i -g @alibaba-group/open-code-review@1.13.5 # pinned to the version this plugin verifies against
86
86
  ```
87
87
 
88
88
  - **brew cannot pin.** `homebrew/core` carries one stable formula and no versioned variant, so `brew install` / `brew upgrade` always yields whatever is newest upstream. The npm command is the only one that can carry the verified version.
@@ -110,7 +110,7 @@ npm i -g @alibaba-group/open-code-review@1.13.4 # pinned to the version thi
110
110
 
111
111
  ## <img src="https://api.iconify.design/lucide/plug.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Enabling it in dsh
112
112
 
113
- - `dsh.bundle.patch` in `package.json` points at `cordis.patch.yml`, whose single registration line is `- id: ocr-review` with `name` set to the bare package name — the bare name is what makes the host scan the client half.
113
+ - `dsh.bundle.patch` in `package.json` points at `cordis.patch.yml`, which carries **two entries**: `- name: "@jayyuen66/dsh-plugin-shared"` (the supplier of the card components, deliberately **without an `id`** so the plugin page does not list it as a switchable component) and `- id: ocr-review` with `name` set to the bare package name — the bare name is what makes the host scan the client half.
114
114
  - The card needs a web profile (`dsh.client.platform: web`, `immediately: true`). The nine `ocrReview` methods are installed unconditionally on the apply fiber, so a host whose web layer never comes up (a TUI) still has the tools and settings.
115
115
  - The gateway exposes the methods only to clients of this profile; this package adds nothing in front of it.
116
116
  - Deployment defaults go on the registration line's `config:` (cordis validates through the exported `Config` schema); precedence: settings-card runtime value > line config > built-in default.
@@ -232,7 +232,7 @@ pnpm run check # typecheck (both sides) → lint → client build → host bui
232
232
  - Coverage thresholds are **100%** across four metrics over the surface `vitest.config.ts` opts into (`coverageInclude`: `host.ts` + `lib/**`); two areas are deliberately outside it: the client half (`src/**`) is exercised through the bundle and the settings-card tests, and `scripts/get-cred.mjs` is driven by process-level tests spawning a child (v8 coverage cannot see a child process) — its behavioral gate lives in `test/get-cred.test.ts`.
233
233
  - Adding this package's **local directory** to a profile (`pnpm add <path>`) needs pnpm ≥ 12.3.0: earlier pnpm 12 releases resolve an unaliased local path as a registry package name (upstream #14437, fixed in 12.3.0). Installing from the registry is unaffected.
234
234
  - Bundle freshness is pinned by `test/build-host.test.ts`: a stale `host.js` / `client.js` fails the suite. Never hand-edit the bundles; `prepare` rebuilds them.
235
- - The plugin source is TypeScript loaded directly by the host's cordis loader (Node ≥ 22.18 type stripping); the bundles exist for the published npm surface. Installing from a local path (`pnpm add <path>`) therefore needs Node ≥ 22.18 — the `>= 22.12` floor above applies to the published bundles only.
235
+ - The plugin source is TypeScript loaded directly by the host's cordis loader (Node ≥ 22.18 type stripping); the bundles exist for the published npm surface. Installing from a local path (`pnpm add <path>`) therefore reads the source and needs Node ≥ 22.18, while this package's own declared floor is `engines.node` (`>=24.9.0`).
236
236
 
237
237
  ## <img src="https://api.iconify.design/lucide/scale.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> License
238
238
 
package/README.zh-CN.md CHANGED
@@ -11,8 +11,8 @@
11
11
  <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/d18m/@jayyuen66/dsh-ocr-review?style=flat-square" alt="npm downloads (total)" /></a>
12
12
  <a href="https://github.com/JayYuen666/dsh-ocr-review/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/JayYuen666/dsh-ocr-review/ci.yml?branch=main&style=flat-square&label=ci" alt="ci" /></a>
13
13
  <img src="https://img.shields.io/badge/license-MIT-4c1?style=flat-square" alt="MIT" />
14
- <img src="https://img.shields.io/badge/node-%3E%3D22.12-4c1?style=flat-square&logo=nodedotjs&logoColor=white" alt="node" />
15
- <img src="https://img.shields.io/badge/dsh-%5E0.2.1--rc.3-658EFF?style=flat-square" alt="dsh" />
14
+ <img src="https://img.shields.io/badge/node-%3E%3D24.9-4c1?style=flat-square&logo=nodedotjs&logoColor=white" alt="node" />
15
+ <img src="https://img.shields.io/badge/dsh-%5E0.2.1--rc.5-658EFF?style=flat-square" alt="dsh" />
16
16
  <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/powered_by_dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white" alt="powered by dsh" /></a>
17
17
  </p>
18
18
 
@@ -67,7 +67,7 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
67
67
  卸载用 `dsh plugin --profile web remove @jayyuen66/dsh-ocr-review`。包在公共 npm 上，安装不需要凭据。
68
68
 
69
69
  - **升级已装的那一份要「先 remove 再 add」。** profile 跑着 HMR（出厂那几个都跑）时，`add` 一个 profile 已经依赖着的包会在 pnpm 动手之前就被拒（`already-installed`）——先 `remove` 再 `add` 目标版本，新版不必重启就起跑。没跑 HMR 时同一个 `add` 照样走 pnpm，报 `restart-required`。
70
- - **要求 Node.js `>= 22.12`，宿主 dsh 在 `0.2.1-rc.3` 或 `0.2.2-alpha.2` 线上。** 宿主只读 `engines.dsh`（`^0.2.1-rc.3 || ^0.2.2-alpha.2`）并独立裁决，预发布号参与比较。不合的宿主要显式登记风险豁免：`dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<版本> --dsh-version <确切运行版本> --accept-risk`。支持窗口是滚动的：本包在发布时把窗口内的每个已发布宿主版本逐版取证，窗口滚动后重新取证，不把这一句里的版本号当长期承诺。
70
+ - **要求 Node.js `>= 24.9`，宿主 dsh 在 `0.2.1-rc.5` 或 `0.2.2-alpha.3` 线上。** 宿主只读 `engines.dsh`（`^0.2.1-rc.5 || ^0.2.2-alpha.3`）并独立裁决，预发布号参与比较。不合的宿主要显式登记风险豁免：`dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<版本> --dsh-version <确切运行版本> --accept-risk`。支持窗口是滚动的：本包在发布时把窗口内的每个已发布宿主版本逐版取证，窗口滚动后重新取证，不把这一句里的版本号当长期承诺。
71
71
  - **`dependencies` 里不放任何 `@deepseek-ai/*`，这是契约**（`test/publish-manifest.test.ts` 钉着）。消费方 profile 用 `nodeLinker: hoisted` 与 `autoInstallPeers: false` 安装，宿主包进了那张表就会落成真实目录，与宿主进程已加载的那份并存。`@deepseek-ai/dsh-tools` 的调度器键是普通 `Symbol`（不是 `Symbol.for`），符号身份按实例计算——那个 profile 里**每一次原生工具调用都抛**，而本包的构建、类型检查与覆盖率门在此前一路绿。
72
72
  - **`host.js` 以值导入的五枚宿主包是非 optional 的 peer**：`@deepseek-ai/schemastery`（宿主 fork——`.volatile()` 的解析只在它有实现）、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`（Remote 的 Service 基类）。五枚同时以同一钉版另列进 `devDependencies`，本仓自己的类型检查才解析得到；构建对 manifest 三张表一律外部化，产物里保持裸说明符。
73
73
  - **发布面**（以 `package.json` 的 `files` 为准）：`host.js`、`client.js`、`cordis.patch.yml`、`scripts/`、`locale/*.json`、`docs/`、`icon.svg`、`CHANGELOG.md` 与 `THIRD_PARTY_NOTICES.md`。`prepare` 重建两个 bundle，发出去的永远是当前源码的产物。
@@ -78,11 +78,11 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
78
78
 
79
79
  ## <img src="https://api.iconify.design/lucide/terminal.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 外部 CLI
80
80
 
81
- 本包只 spawn `ocr`，从不安装或升级它。命令契约按 **1.13.4** 核对（`lib/cli.ts` 的 `EXPECTED_OCR_CLI_VERSION`，版本号只在 package.json 的 `ocrCliVersion` 声明一次——测试把 manifest、代码常量与两侧 README 钉成同一个串）。
81
+ 本包只 spawn `ocr`，从不安装或升级它。命令契约按 **1.13.5** 核对（`lib/cli.ts` 的 `EXPECTED_OCR_CLI_VERSION`，版本号只在 package.json 的 `ocrCliVersion` 声明一次——测试把 manifest、代码常量与两侧 README 钉成同一个串）。
82
82
 
83
83
  ```sh
84
84
  brew install open-code-review # formula 只跟上游最新版
85
- npm i -g @alibaba-group/open-code-review@1.13.4 # 钉在本包核对的那一版
85
+ npm i -g @alibaba-group/open-code-review@1.13.5 # 钉在本包核对的那一版
86
86
  ```
87
87
 
88
88
  - **brew 钉不住版本。** `homebrew/core` 里只有一份 stable formula、没有版本化变体，`brew install` / `brew upgrade` 拿到的永远是上游最新。带得上核对版本的只有 npm 那条。
@@ -110,7 +110,7 @@ npm i -g @alibaba-group/open-code-review@1.13.4 # 钉在本包核对的那
110
110
 
111
111
  ## <img src="https://api.iconify.design/lucide/plug.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 在 dsh 里启用
112
112
 
113
- - `package.json` 的 `dsh.bundle.patch` 指向 `cordis.patch.yml`，其唯一注册行是 `- id: ocr-review`、`name` 为裸包名——宿主只按裸包名扫描 client 半。
113
+ - `package.json` 的 `dsh.bundle.patch` 指向 `cordis.patch.yml`，里面是**两条条目**：`- name: "@jayyuen66/dsh-plugin-shared"`（卡片组件的供应行，**刻意不写 `id`**，所以插件页不会把它列成可停用组件）与 `- id: ocr-review`、`name` 为裸包名——宿主只按裸包名扫描 client 半。
114
114
  - 卡片要 web profile（`dsh.client.platform: web`、`immediately: true`）。九个 `ocrReview` 方法由 apply fiber 无条件注册，宿主的 web 层从不起（如 TUI）时工具与设置照常在。
115
115
  - 网关只把方法暴露给本 profile 的客户端；本包不在它前面再加一层。
116
116
  - 部署默认写在注册行的 `config:` 上（cordis 按导出的 `Config` schema 校验）；优先级：设置卡运行时值 > 行 config > 内置默认。
@@ -232,7 +232,7 @@ pnpm run check # typecheck（两侧）→ lint → client 构建 → host 构
232
232
  - 覆盖率阈值**四项 100%**，分母是 `vitest.config.ts` 里 `coverageInclude` 选定的那一面（`host.ts` + `lib/**`）；两块刻意在分母外：客户端半（`src/**`）经 bundle 与设置卡用例覆盖，`scripts/get-cred.mjs` 由进程级用例另起进程驱动（v8 覆盖率看不到子进程），它的行为门禁在 `test/get-cred.test.ts`。
233
233
  - 往 profile 加本包的**本地目录**（`pnpm add <路径>`）需要 pnpm ≥ 12.3.0：更早的 pnpm 12 把无别名的本地路径当 registry 包名解析（上游 #14437，12.3.0 修复）。从 registry 装不受影响。
234
234
  - 产物新鲜度由 `test/build-host.test.ts` 钉着：`host.js` / `client.js` 落后于源码就红。发布物不手改；`prepare` 重建。
235
- - 插件源码是 TypeScript，由宿主的 cordis Loader 直接加载（Node ≥ 22.18 类型剥离）；bundle 只为 npm 发布面存在。
235
+ - 插件源码是 TypeScript，由宿主的 cordis Loader 直接加载（Node ≥ 22.18 类型剥离）；bundle 只为 npm 发布面存在。从本地目录安装（`pnpm add <路径>`）读的是源码，因此需要 Node ≥ 22.18，而本包自己声明的地板是 `engines.node`（`>=24.9.0`）。
236
236
 
237
237
  ## <img src="https://api.iconify.design/lucide/scale.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 许可
238
238
 
package/THIRD_PARTY_NOTICES.md CHANGED
@@ -59,7 +59,7 @@ SOFTWARE.
59
59
  - 上游项目：`open-code-review`
60
60
  - 上游仓库：https://github.com/alibaba/open-code-review
61
61
  - 上游许可：Apache-2.0，Copyright 2026 Alibaba
62
- - 验证版本：1.13.4（声明在 package.json 的 `ocrCliVersion`，代码里的镜像常量、两侧 README 与随包文档由门禁对齐同一枚数字）
62
+ - 验证版本：1.13.5（声明在 package.json 的 `ocrCliVersion`，代码里的镜像常量、两侧 README 与随包文档由门禁对齐同一枚数字）
63
63
 
64
64
  本包**使用**而非**包含**以下接口（`host.ts` / `lib/cli.ts` 的头注释按该版本源码逐条核对）：
65
65
 
@@ -76,7 +76,7 @@ SOFTWARE.
76
76
 
77
77
  这些都是 CLI 的外层面，但不是任何文档承诺过的稳定 API——本包把契约钉在上面那一版正是为了
78
78
  守住这一组接口；上游变更时以本包的契约闸测试（`test/cli.test.ts`、`test/parse.test.ts`）为
79
- 首道防线，版本对不上时卡片、徽标与工具回执都会说（见 README 的「External CLI status and version」）。
79
+ 首道防线，版本对不上时卡片、徽标与工具回执都会说（见 README 的 “The external CLI” 一节）。
80
80
 
81
81
  ## 运行期依赖
82
82
 
@@ -84,9 +84,9 @@ SOFTWARE.
84
84
 
85
85
  | 依赖 | 版本 | 许可 | 引入方 |
86
86
  | --- | --- | --- | --- |
87
- | `@alibaba-group/open-code-review` | 1.13.4（核对版本，非依赖） | Apache-2.0（Alibaba） | **不在依赖表里**：用户自选 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@<版本>`，本包只 spawn 它 |
88
- | `js-yaml` | 5.4.3（精确钉版） | MIT | `scripts/get-cred.mjs` 读 dsh 托管凭据文档 |
89
- | `@jayyuen66/dsh-plugin-shared` | catalog（伞根 0.2.3） | MIT | `host.ts` / `lib/*` / `src/*` 的 job-outcome、locale、record、errors、card-* 等公共面（值导入，构建时外部化） |
87
+ | `@alibaba-group/open-code-review` | 1.13.5（核对版本，非依赖） | Apache-2.0（Alibaba） | **不在依赖表里**：用户自选 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@<版本>`，本包只 spawn 它 |
88
+ | `js-yaml` | 5.5.0（精确钉版） | MIT | `scripts/get-cred.mjs` 读 dsh 托管凭据文档 |
89
+ | `@jayyuen66/dsh-plugin-shared` | catalog（伞根 ^0.2.4） | MIT | `host.ts` / `lib/*` / `src/*` 的 job-outcome、locale、record、errors、card-* 等公共面（值导入，构建时外部化） |
90
90
  | `zod` | catalog（伞根 4.6.7） | MIT | 设置卡 `src/remote.ts` 的 strict codec 形状校验；client 产物由宿主 `PLATFORM_MODULES` 提供 |
91
91
 
92
- dsh 宿主侧的包分两档：产物里以**值**导入、且列在 `peerDependencies` 的五枚（`@deepseek-ai/schemastery` 宿主 fork、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`）由宿主在场提供、不随本包分发；其余 `@deepseek-ai/dsh-*` 与 `@deepseek-ai/cordis` 只在 `devDependencies` 里，用途是把类型绑到官方声明上（type-only 绑定），产物里不留说明符。本包按 dsh `0.2.2-alpha.3` 逐条核对过（同版的 cordis `4.0.6-alpha.2` 与 schemastery `3.18.6-alpha.2` fork 一并核对）。
92
+ dsh 宿主侧的包分两档：产物里以**值**导入、且列在 `peerDependencies` 的五枚（`@deepseek-ai/schemastery` 宿主 fork、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`）由宿主在场提供、不随本包分发；其余 `@deepseek-ai/dsh-*` 与 `@deepseek-ai/cordis` 只在 `devDependencies` 里，用途是把类型绑到官方声明上（type-only 绑定），产物里不留说明符。本包按 dsh `0.2.2-rc.1` 逐条核对过（同版的 cordis `4.1.0` 与 schemastery `3.19.0` fork 一并核对）。