@jayyuen66/dsh-ocr-review 0.1.8 → 0.1.10

package/CHANGELOG.md

@@ -4,6 +4,69 @@
 [语义化版本](https://semver.org/lang/zh-CN/)，最新版本在最上。条目自 0.1.0 起；更早的
 1.0.0 / 0.6.x 是作用域迁移前的历史编号，npm 已永久记录，不在本文件重建。
 
+## 0.1.10
+
+一轮跨面审查修复：路径闸、MCP 配置写面与并发覆盖、provider 面与解析判据收口；设置卡与工具出口同步加固。对外工具与 Remote 方法名单不变。
+
+### Changed
+
+- **MCP 写面加 revision 基线**：`mcp()` 回执新增 `revision`，`saveMcp` 入参加可选 `revision`——带基线时锁内比对，过期整笔拒绝回 `mcpSaveConflict`；不带基线沿用旧的后写覆盖语义（旧客户端兼容）。双开卡片或手改 config.json 时后保存者不再静默抹掉他人更新。
+- **发布链加固**（`.github/workflows/publish.yml`）：发布步 `pnpm install --ignore-scripts`、构建移至无凭据步、`pnpm publish --ignore-scripts`，生命周期脚本不再能接触发布凭据；`prepack` 删除改 `prepare`（同为双构建）。
+- **依赖与元数据**：js-yaml 改精确钉 `5.4.3`；`@deepseek-ai/schemastery` peer 放宽为 `^3.18.6-alpha.1`；catalog 的 shared 抬到 0.2.2；author 改对象形（name+url）。
+
+### Fixed
+
+- **路径闸**（`lib/argv-guard.ts`）：归一后落在文件系统根（`/`、盘符根、UNC 根）一律拒绝，堵 `--rule /etc/passwd` 被当仓内文件读进 OCR；`statSync` 改 `throwIfNoEntry: false`；会话根判定改 `path.isAbsolute`（Windows `C:/…` 不再落相对分支）。
+- **Remote 拒绝判据**（`lib/remote-shape.ts`）：`isRemoteRefused` 收 `unknown`，须同时满足 `ok===false`、非空 `error`、整数 `status`，null/NaN/原始值不再误判；状态码集中为导出常量 `OCR_REFUSE_STATUS`。
+- **MCP 配置**（`lib/mcp-config.ts`）：写失败独立文案；输出容器改 null 原型（`__proto__` 键不再丢失/污染）；写侧把盘上同条目的未知字段接回；providers.chatgpt 非法改显式报错；读侧加 64 KiB 上限；URL 判据拒空主机。
+- **OCR config 迁移**（`lib/ocr-config.ts`）：不覆写已有非空 `api_key_cmd`；provider/model 入口一次 trim；空白 `language` 不落键；迁移写回统一走 `renderConfigDoc`。
+- **provider 面**（`lib/provider-projection.ts`、`lib/provider-source.ts`）：baseURL 禁内嵌 `user:pass@`、空白/控制字符与无主机；`apiKeyEnv` 按导出白名单收口，非法 ref 单独暴露；health 与探测异常收口，失败出口统一 `settingsFailed()`。
+- **解析与聚合**（`lib/parse.ts`、`lib/severity.ts`）：`isCount` 限安全整数域、`toolCallsOf` 总数口径、warnings 限流；`hitsContract` 只认 reviewable 文件/组，`{"error":…}` 载荷不再假报 0 文件；`byCategory` 落 null 原型。
+- **工具出口守卫**（`lib/output.ts`）：新增容器形状闸；违规收集改 `ViolationSink`，收集期截断 20 条/2000 字，不再先攒几十万条。
+- **host**（`host.ts`）：后台作业剪枝与取文案包 try 并先 killProc（不留无主 OCR 进程）；saveMcp/chatGpt 加外层 try 回可读回执；装载期 fire-and-forget 自检包 try（防未处理 rejection 终止宿主）；effort 未知值回落设置卡值。
+- **设置卡**（`src/client-entry.ts`）：channel 改逐值比对；MCP 未读成功时禁编辑/保存；llmTest 失败按失败着色；refresh 并发只认最后一次。
+- **CLI 与凭据脚本**（`lib/cli.ts`、`scripts/get-cred.mjs`）：pgrep 探针退出码 1（无匹配）不再算被拒；preview 也转发 `--max-tokens`；YAML 报错不再读 message/toString，防明文 snippet 外泄。
+
+### Added
+
+- **测试三层**：`test/e2e/stub-ocr.e2e.test.ts`（官方执行器真 spawn stub 全链路）、`test/e2e/real-cli.e2e.test.ts`（真 ocr 二进制对照，缺席显式跳过）、`test/platform/guards.platform.test.ts`、`test/property/parse-chain.property.test.ts`（fast-check）、`test/ref-syntax-parity.test.ts`、`test/write-surface.test.ts`；devDependencies 新增 fast-check 4.10.2 与 `@deepseek-ai/dsh-bash-local` / `@deepseek-ai/dsh-subprocess-local`。
+
+## 0.1.9
+
+这一版把后台评审的作业归属钉到发起会话，并把设置卡与读面校验统一到 shared 组件和 zod；
+插件页展示面进包，宿主开发线抬到 0.2.2-alpha.2。对外工具与 Remote 方法名单不变，后台作业的可见性按发起会话收紧。
+
+### Changed
+
+- **后台作业按会话归属**：能解析到活 Agent 时，`jobs.start` 带 `owner`；`job_list` / `job_output` /
+  `job_kill` 对该作业只在所属会话可见。会话销毁只回收它自己的作业（活的 kill、已落定的 remove），
+  不再按 kind 全量回收别的会话的评审；解析不到活 Agent 的调用仍起无主作业，只在插件卸载时统一收。
+- **作业台账**：新增 id → 发起会话的最小台账。注册表对没有 caller 的视图隐藏有主作业，卸载时靠它
+  枚举；已落定记录的裁剪按 caller 可见面（无主桶 + 自己的）计算。
+- **设置卡迁到 shared 组件与 zod**：`src/remote.ts` 的三个 strict codec 改由 zod schema 生成；
+  `src/client-entry.ts` 的枚举、计数与 providers 载荷改 zod 逐层校验，控件改用 shared 的
+  `CARD_UI_CSS` / `CardForm` / `Field` 等。`zod` 进 `dependencies`，client 产物按宿主
+  `PLATFORM_MODULES` 外置。
+- **插件页展示面进包**：新增 `locale/en.json`、`locale/zh.json` 与 `docs/DETAIL.md`、
+  `docs/DETAIL.zh.md`；`exports` 增加 `./locale/*.json`，`files` 收进 locale 与 docs。
+- **宿主开发线抬到 `0.2.2-alpha.2`**：devDependencies 与 catalog/overrides 同值；`engines.dsh`
+  与 peer 写支持窗口 `^0.2.1-rc.3`，README 补滚动窗口说明。
+- **正则常量提升**：argv-guard / config-store / mcp-config / output / parse / provider-projection
+  的内联正则提取为命名常量，行为不变，满足 lint 的重复字面量门禁。
+
+### Fixed
+
+- **脱敏不再误伤路径段**：独立 key 形态的匹配落在 `/` 或 `\` 两侧时按路径段保留，不再把带大写
+  组件的仓库路径（例如 `Documents/...`）抹成 `***REDACTED***`。
+- **会话销毁的回收范围**：`session/disposed` 过去按 kind 回收全部 OCR 作业，会把别的会话正在读的
+  评审一并杀掉；现在只收 payload 那条会话的作业，认不出会话就什么都不做。
+
+### Docs
+
+- README 双语补后台作业的归属、容量桶、清理与残留暴露面，改正 `ocrReview` 方法数与 peer 枚数；
+  DETAIL 改正无 key 的 provider（列出但禁用）与 `timeoutMinutes` 的取值口径；`THIRD_PARTY_NOTICES`
+  同步 zod 依赖与 dsh 0.2.2-alpha.2 的核对基线。
+
 ## 0.1.8
 
 这一版把外部 OCR 契约从 1.13.0 抬到 **1.13.3**，并把模型工具面从「审查/扫描/委托/会话」扩到

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 JayYuen666
+Copyright (c) 2026 JayYuen (JayYuen666)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/v/@jayyuen66/dsh-ocr-review?style=flat-square&logo=npm&logoColor=white" alt="npm version" /></a>
-  <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/dm/@jayyuen66/dsh-ocr-review?style=flat-square" alt="npm downloads" /></a>
+  <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/d18m/@jayyuen66/dsh-ocr-review?style=flat-square" alt="npm downloads (total)" /></a>
   <a href="https://github.com/JayYuen666/dsh-ocr-review/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/JayYuen666/dsh-ocr-review/ci.yml?branch=main&style=flat-square&label=ci" alt="ci" /></a>
   <img src="https://img.shields.io/badge/license-MIT-4c1?style=flat-square" alt="MIT" />
   <img src="https://img.shields.io/badge/node-%3E%3D22.12-4c1?style=flat-square&logo=nodedotjs&logoColor=white" alt="node" />
@@ -53,7 +53,7 @@
 - **One settings card also carries the admin surfaces**: a validated MCP servers JSON editor (saving touches only `mcp_servers`) and a ChatGPT section that reports `ocr auth` status and switches OCR's provider/model. Both are human-managed; neither is a model tool (a stdio MCP server runs commands, and OAuth sign-in needs a browser plus a local callback).
 - **Wraps the external `ocr` (open-code-review) CLI into seven model tools.** The host validates tool arguments not at all, so every shape, type and enum gate lives in this package: user-controlled strings are single-quote escaped, enums are whitelist-clamped, and wrong-typed values error instead of silently narrowing or widening a review.
 - **One settings card** (the web client half) picks provider/model from the host's own `llm-pi-ai` settings entry and key status from the host credentials service. When either service is absent the card shows the degradation reason; tools and settings keep working.
-- **Applying a selection writes the CLI's own `~/.opencodereview/config.json`** — as an `api_key_cmd` command that reads the host credential ref at OCR runtime. A plaintext key is never written anywhere.
+- **Applying a selection writes the CLI's own `~/.opencodereview/config.json`** — as an `api_key_cmd` command that reads the host credential ref at OCR runtime. The plugin never writes a plaintext key into `config.json`; the `.bak` it copies before the first rewrite keeps whatever the file held before, which may include a pre-migration plaintext key (mode 0600) — delete that backup after migrating.
 - **Results are a structured summary with two distinct notions**: what OCR found (`status`, `aggregation`, `topComments`, `warnings`) and whether the run actually covered the selected files (`coverage`, `budgetExceeded`, `toolCalls`). The CLI is invoked with `--audience agent`, which suppresses its progress output — the second notion is only reachable through those fields.
 - **CLI availability is one judgement** (`resolveOcrAvailability` in `lib/cli.ts`): pure filesystem, never a spawn, re-read per call. The card status row, the detail-page badge and the activation guidance all render that one answer, so "which copy is in use" cannot be told three ways.
 - **Background runs (`wait: false`) are official host jobs**: `job_list` / `job_output` / `job_kill` can observe and stop a review that outlives the tool call.
@@ -67,10 +67,10 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
 Remove with `dsh plugin --profile web remove @jayyuen66/dsh-ocr-review`. The package is on the public npm registry, so installation needs no credentials.
 
 - **Upgrading an installed copy is remove-then-add.** On a profile running HMR (the shipped ones do), `add` on a package the profile already depends on refuses before pnpm runs (`already-installed`) — run `remove` first, then `add` the target version; the new one starts without a restart. Without HMR the same `add` runs pnpm and reports `restart-required`.
-- **Requires Node.js `>= 22.12` and host `dsh` on the `0.2.1-rc.3` line.** The host reads `engines.dsh` (`^0.2.1-rc.3`) and decides on it alone; prereleases participate in the comparison. An incompatible host needs the explicit risk grant `dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<version> --dsh-version <exact> --accept-risk`.
+- **Requires Node.js `>= 22.12` and host `dsh` on the `0.2.1-rc.3` / `0.2.2-alpha.2` line.** The host reads `engines.dsh` (`^0.2.1-rc.3`) and decides on it alone; prereleases participate in the comparison. An incompatible host needs the explicit risk grant `dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<version> --dsh-version <exact> --accept-risk`. The support window rolls: this package is verified against the three most recently released host versions at publish time and re-verified once the window moves, so the version number in this bullet is not a standing promise.
 - **No `@deepseek-ai/*` under `dependencies`, by contract** (`test/publish-manifest.test.ts` enforces it). Consumer profiles install with `nodeLinker: hoisted` and `autoInstallPeers: false`, so a host package there is materialized as a real directory next to the copy the running host already loaded. `@deepseek-ai/dsh-tools` keys its scheduler with a plain `Symbol` (not `Symbol.for`), so symbol identity is per instance and **every native tool call in that profile throws** — while this package's build, typecheck and coverage gates stay green right up to that moment.
 - **The five host packages `host.js` imports as values are required peers**: `@deepseek-ai/schemastery` (the host fork — only it resolves `.volatile()` fields), `@deepseek-ai/dsh-credentials`, `@deepseek-ai/dsh-home-paths`, `@deepseek-ai/dsh-atomic-write` and `@deepseek-ai/dsh-typert-protocol` (the Remote service base). Each is repeated in `devDependencies` at the same pin so this repository's own typecheck resolves them; the build externalizes all manifest tables, keeping bare specifiers in the artifact.
-- **What ships**: `host.js`, `client.js`, `cordis.patch.yml`, `scripts/`, `icon.svg`, `CHANGELOG.md` and `THIRD_PARTY_NOTICES.md`. `prepack` rebuilds the bundles, so nothing stale is published.
+- **What ships** (see `files` in `package.json`): `host.js`, `client.js`, `cordis.patch.yml`, `scripts/`, `locale/*.json`, `docs/`, `icon.svg`, `CHANGELOG.md` and `THIRD_PARTY_NOTICES.md`. `prepare` rebuilds the bundles, so nothing stale is published.
 
 ### <img src="https://api.iconify.design/lucide/arrow-down-to-line.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Shared version floor
 
@@ -105,13 +105,13 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # pinned to the version thi
 - **It does not install or upgrade the CLI.** The brew/npm commands are shown, never run; there is no update action and no clipboard API (a non-secure context would fail silently, looking like a dead button).
 - **No HTTP route of its own.** The data plane is one official Typert Remote namespace (`ocrReview`) through the host `/api` gateway; authentication, Host / DNS-rebinding / Origin checks and body limits are the gateway's. This package holds no CSRF token, no body cap and no route disposer.
 - **No CLI subcommand.** `dsh ocr …` does not exist.
-- **It reads no file outside** the CLI's config path, the temp files it creates itself, and the host settings / credentials services it is handed.
+- **The plugin itself reads no file outside** the CLI's config path, the host credential document and `$DSH_HOME/.env` (through `scripts/get-cred.mjs`), the PATH directories it probes for the `ocr` binary, the OCR session store it lists, the temp files it creates, and the host settings / credentials services it is handed. Repository contents are read by the `ocr` child process as the reviewed input.
 - What it *does* consume: the host `settings` and `credentials` services (provider list, key status), `shell` (every `ocr` subprocess), `jobs` (background runs) and `systemPrompt` (one routing section). A missing settings or credentials service degrades the card only — the tools keep working.
 
 ## <img src="https://api.iconify.design/lucide/plug.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Enabling it in dsh
 
 - `dsh.bundle.patch` in `package.json` points at `cordis.patch.yml`, whose single registration line is `- id: ocr-review` with `name` set to the bare package name — the bare name is what makes the host scan the client half.
-- The card needs a web profile (`dsh.client.platform: web`, `immediately: true`). The five `ocrReview` methods are installed unconditionally on the apply fiber, so a host whose web layer never comes up (a TUI) still has the tools and settings.
+- The card needs a web profile (`dsh.client.platform: web`, `immediately: true`). The nine `ocrReview` methods are installed unconditionally on the apply fiber, so a host whose web layer never comes up (a TUI) still has the tools and settings.
 - The gateway exposes the methods only to clients of this profile; this package adds nothing in front of it.
 - Deployment defaults go on the registration line's `config:` (cordis validates through the exported `Config` schema); precedence: settings-card runtime value > line config > built-in default.
 
@@ -128,7 +128,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # pinned to the version thi
 | `ocr_llm` | action providers/models: read-only LLM catalogue queries; no review and no connectivity test |
 | List caps | exclude and path take up to 2000 entries each; exceeding the cap rejects the call. Entries are never silently dropped — "reviewed fewer files than the list" must not be reportable as success |
 
-`wait: false` starts a background run with no host deadline (poll `ocr_session`; the subprocess is also an official job, see [Background runs as host jobs](#background-runs-as-host-jobs)), and the reaper guard takes the OCR process tree down when dsh exits in any way. Cancelling the tool call stops the corresponding background process.
+`wait: false` starts a background run with no host deadline (poll `ocr_session`; the subprocess is also an official job, see [Background runs as host jobs](#background-runs-as-host-jobs)), and on POSIX the reaper guard takes the OCR process tree down when dsh exits in any way (Windows has no reaper, see [Platforms](#platforms)). Cancelling the tool call stops the corresponding background process.
 
 ## <img src="https://api.iconify.design/lucide/sliders-horizontal.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Settings
 
@@ -149,7 +149,7 @@ The deployment keys below are deliberately **not** on the card — they are plai
 | --- | --- | --- |
 | `llmTestTimeoutMs` | `90000` | Wall clock for `ocr llm test`, shared by autoVerify and the card's test connection; raise it on slow machines |
 | `startupVerify` | `true` | Run the endpoint self-check (and one version measurement) at apply. The same switch governs both, because the criterion is "may a load spawn processes"; turn it off if loads must stay process-free |
-| `ocrBackgroundMaxMs` | `0` | Backstop window for background reviews (registry wait to the deadline, then kill); 0 = no window — a run ends only when the host exits, the session stops, the plugin unloads or the job is killed |
+| `ocrBackgroundMaxMs` | `0` | Backstop window for background reviews (registry wait to the deadline, then kill); 0 = no window — an owned run also ends when its session stops, while an agentless one ends only when the host exits, the plugin unloads or the job is killed |
 | `stdoutMaxBytes` | `400000` | Shell executor stdout cap, shared by foreground and background runs (review results go through the `--output` temp file precisely to step outside it) |
 | `ocrNoAutoUpdate` | `false` | true puts `OCR_NO_UPDATE=1` on every command this package spawns, stopping upstream's mid-review `npm i -g` of a newer release; false keeps upstream behaviour. The version probe sets the variable regardless |
 | `ocrInstallHint` | `both` | Which install command to lead with when nothing is installed: `both` / `brew` / `npm`. A fallback, not an override — an existing copy is always described by its own source, because telling a formula user to run `npm i -g` leaves a second copy behind while PATH still resolves the old one. The npm command always carries the verified version; the brew one never can |
@@ -165,8 +165,8 @@ One official Typert Remote namespace, `ocrReview` (`OCR_REMOTE_NAMESPACE` in `li
 | `migrate()` | — | `{ok, migrated, skippedUnknown}` |
 | `test()` | — | `{ok, output}` — `ok` is the **test verdict**, not whether the call ran; output is redacted first, then cut to 8000 characters |
 | `probe()` | — | `{ok, version, expectedVersion, consistent, output, reason, changeText}` — one `ocr version` under a 15 s wall clock, with `OCR_NO_UPDATE=1`. `consistent` is three-state (`null` = nothing was measured, where claiming a mismatch would be claiming without evidence); `reason` names the failure arm; `changeText` carries the install/upgrade sentence only when there is a command to give |
-| `mcp()` | — | `{ok, json}` — only the `mcp_servers` object as pretty JSON, never providers or keys |
-| `saveMcp(request)` | `{json}` — raw JSON text, at most 64 KiB; stdio/remote entries are validated field by field | `{ok, count}` — writes only `mcp_servers`; other config is preserved |
+| `mcp()` | — | `{ok, json, revision}` — only the `mcp_servers` object as pretty JSON, never providers or keys; `revision` is that branch's digest |
+| `saveMcp(request)` | `{json, revision?}` — raw JSON text, at most 64 KiB; stdio/remote entries are validated field by field; `revision` is the digest from `mcp()` | `{ok, count, revision}` — writes only `mcp_servers`; other config is preserved. A stale `revision` refuses the whole write (nothing is written) and returns a readable "changed after it was read" error; omitting it keeps the old last-writer-wins behavior |
 | `auth()` | — | `{ok, output, loginCommand}` — read-only `ocr auth status --provider chatgpt`; sign-in itself stays a terminal action because it needs a browser and a local callback |
 | `chatGpt(request)` | `{model}` | `{ok, model}` — sets `provider: "chatgpt"` and `providers.chatgpt.model`, writes no key |
 
@@ -189,9 +189,10 @@ Refusals answer `{ok: false, error, status}` where `status` is a **retained sema
 | --- | --- |
 | What the model gains | `job_list` shows the review, `job_output` reads its stdout/stderr (non-consuming — it never steals bytes from the session reader), `job_kill` stops it. Results still come from the `ocr_session` record |
 | No registry, no background | A host without the jobs service makes `wait: false` throw an error naming the missing piece instead of starting a subprocess nobody can observe; foreground runs are unaffected |
-| The shared bucket | The unowned job slots are shared host-wide and overflow refuses new starts, so one hung CLI parks a slot forever. That is what the optional `ocrBackgroundMaxMs` backstop is for — it uses the registry's own wait + kill, not a host timer |
-| Cleanup | Settled records of this kind are pruned down to a fixed window before each start; live and stopping records are never pruned (the registry answers overflow by refusing, not by killing somebody's review). At unload, live jobs are killed through the registry and settled ones removed |
-| Exposure | Unowned means any caller can list / read / kill it. Known and accepted for this adoption; closing it would mean rolling the job registration back |
+| Ownership | When the calling agent resolves to a live session, the job is started with that session as its `owner`; `job_list` / `job_output` / `job_kill` then only reach it from that session. A call with no live agent starts an agentless job |
+| Capacity buckets | Owned jobs count against their owner's bucket; agentless jobs share the unowned bucket host-wide. Overflow refuses a new start, so one hung CLI can park a slot — the optional `ocrBackgroundMaxMs` backstop uses the registry's own wait + kill, not a host timer |
+| Cleanup | Before each start, settled records of this kind visible to that caller (the shared unowned bucket plus the caller's own) are pruned to a fixed window; live and stopping records are never pruned (the registry answers overflow by refusing, not by killing somebody's review). A session disposal kills or removes only that session's jobs; unload reclaims everything, using a small id → owner ledger because the registry hides other owners' jobs |
+| Exposure | An owned job is visible to, and killable by, its own session only. Agentless jobs remain visible to every caller — the residual exposure, present only when no live agent could be resolved |
 | Nothing may throw | An error raised inside a host event handler takes the whole host process down, and the official package does not cover producers either — the cancel chain catches at two layers, each pinned by its own test |
 
 ## <img src="https://api.iconify.design/lucide/lock.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Data and privacy
@@ -200,7 +201,7 @@ Refusals answer `{ok: false, error, status}` where `status` is a **retained sema
 | --- | --- |
 | Process boundary | The reviewed repository's paths and diff content go into the `ocr` child process, and the CLI sends them to the LLM endpoint configured in its own config.json — that egress is the review feature itself and does not pass through the dsh host. Plaintext keys never appear in tool results or Remote payloads; a value resolved by the host is used only to confirm "it resolves right now" and is discarded on the spot |
 | Redaction | All raw CLI stdout/stderr leaving this package (failure details, llm test, parse-failure echoes, session passthrough) goes through `redactKeyMaterial()`: bearer and assignment forms strictly, the standalone-key form only with random-string features, so file paths handed to the model are not erased with it |
-| On disk | Two places only: the CLI's `config.json` (plus its temp sibling, the `.bak` backup and the short-lived lock) and `ocr-review-*` / `ocr-scan-*` temp files, deleted right after reading. Pre-migration plaintext may persist in that `.bak` (mode 0600) — delete the backup yourself to be rid of it. Outside these two, the only writer is the CLI's own npm wrapper unless `ocrNoAutoUpdate` is on |
+| On disk | The CLI's `config.json` (plus its temp sibling, the `.bak` backup and the short-lived lock), the `ocr-review-*` / `ocr-scan-*` temp files (deleted right after reading), and `ocr-session-export-*` directories, which hold the HTML returned by `ocr_session` `export` and are left in place for the caller. Pre-migration plaintext may persist in that `.bak` (mode 0600) — delete the backup yourself to be rid of it. Outside these, the only writer is the CLI's own npm wrapper unless `ocrNoAutoUpdate` is on |
 
 ## <img src="https://api.iconify.design/lucide/triangle-alert.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Known boundaries
 
@@ -209,7 +210,7 @@ Refusals answer `{ok: false, error, status}` where `status` is a **retained sema
 - **Version reads cost a spawn** and never happen on render; the card shows the last measurement or nothing — a page render cannot install, update or probe anything.
 - **The atomic-write lock timeout surfaces in English.** Contention past the official wait budget throws the official package's own timeout text — the one user-visible error here that bypasses the bilingual message table.
 - **`partial` is a terminal success state.** Some files failed but coverage stands and the comments are valid; it is neither upgraded to success nor folded into failure.
-- **Unowned background jobs are visible to every session** (see Background runs) — accepted with the adoption, and the only way to close it is to roll the registration back.
+- **Agentless background jobs are visible to every session** (see Background runs). A call that cannot resolve a live agent starts one; owned jobs are fenced to their session.
 
 ## <img src="https://api.iconify.design/lucide/circle-help.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> FAQ
 
@@ -218,7 +219,7 @@ Refusals answer `{ok: false, error, status}` where `status` is a **retained sema
 | Exit 0 was taken as a successful review | Exit 0 is not success: any `status` outside success / complete / partial / completed_with_warnings / completed_with_errors / skipped reports as failure. `partial` means some files failed while coverage and the comments stand. A parse failure echoes the first 500 redacted UTF-16 code units of the raw output |
 | Did the summary cover everything? | Two notions, neither replaces the other. `droppedCount` / `invalidCommentCount` say whether **this summary** listed every comment (raise `maxComments` or set 0 and re-check). Whether **the run** covered the selected files is `coverage` (`selected` is the denominator, `failedItems` names the files with their reasons) plus `budgetExceeded` and `toolCalls` |
 | `add` was refused with `already-installed` | HMR profiles refuse `add` on an already-installed package before pnpm runs — `remove` first, then `add` the target version (see Install) |
-| What happens to background processes when dsh exits? | The reaper guard takes the review/scan process tree down with TERM→1s→KILL on any host exit (including kill -9 followed by adoption); cancelling the tool call stops the corresponding background process |
+| What happens to background processes when dsh exits? | On POSIX the reaper guard takes the review/scan process tree down with TERM→1s→KILL on any host exit (including kill -9 followed by adoption); Windows has no reaper, so a hard host exit can leave an orphaned process. Cancelling the tool call stops the corresponding background process |
 | Where might a plaintext key still sit? | Nowhere this package writes. A pre-migration config's plaintext may survive in the `.bak` produced by the first write after you migrate (mode 0600); delete that backup to be rid of it |
 
 ## <img src="https://api.iconify.design/lucide/wrench.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> Development
@@ -230,7 +231,7 @@ pnpm run check   # typecheck (both sides) → lint → client build → host bui
 
 - Coverage thresholds are **100%** across four metrics over the surface `vitest.config.ts` opts into (`coverageInclude`: `host.ts` + `lib/**`); two areas are deliberately outside it: the client half (`src/**`) is exercised through the bundle and the settings-card tests, and `scripts/get-cred.mjs` is driven by process-level tests spawning a child (v8 coverage cannot see a child process) — its behavioral gate lives in `test/get-cred.test.ts`.
 - Adding this package's **local directory** to a profile (`pnpm add <path>`) needs pnpm ≥ 12.3.0: earlier pnpm 12 releases resolve an unaliased local path as a registry package name (upstream #14437, fixed in 12.3.0). Installing from the registry is unaffected.
-- Bundle freshness is pinned by `test/build-host.test.ts`: a stale `host.js` / `client.js` fails the suite. Never hand-edit the bundles; `prepack` rebuilds them.
+- Bundle freshness is pinned by `test/build-host.test.ts`: a stale `host.js` / `client.js` fails the suite. Never hand-edit the bundles; `prepare` rebuilds them.
 - The plugin source is TypeScript loaded directly by the host's cordis loader (Node ≥ 22.18 type stripping); the bundles exist for the published npm surface.
 
 ## <img src="https://api.iconify.design/lucide/scale.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> License

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/v/@jayyuen66/dsh-ocr-review?style=flat-square&logo=npm&logoColor=white" alt="npm version" /></a>
-  <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/dm/@jayyuen66/dsh-ocr-review?style=flat-square" alt="npm downloads" /></a>
+  <a href="https://www.npmjs.com/package/@jayyuen66/dsh-ocr-review"><img src="https://img.shields.io/npm/d18m/@jayyuen66/dsh-ocr-review?style=flat-square" alt="npm downloads (total)" /></a>
   <a href="https://github.com/JayYuen666/dsh-ocr-review/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/JayYuen666/dsh-ocr-review/ci.yml?branch=main&style=flat-square&label=ci" alt="ci" /></a>
   <img src="https://img.shields.io/badge/license-MIT-4c1?style=flat-square" alt="MIT" />
   <img src="https://img.shields.io/badge/node-%3E%3D22.12-4c1?style=flat-square&logo=nodedotjs&logoColor=white" alt="node" />
@@ -53,7 +53,7 @@
 - **设置卡还承载两块管理面**：可校验的 MCP servers JSON 编辑器（保存只改 `mcp_servers`），以及报告 `ocr auth` 登录态并切换 OCR provider/model 的 ChatGPT 区。两块都由人操作，不是模型工具（stdio MCP server 会执行命令，OAuth 登录需要浏览器与本地回调）。
 - **把外部 `ocr`（open-code-review）CLI 封装成七个模型工具。** 宿主对工具入参零校验，形状、类型与枚举闸全在本包内：用户可控字符串一律单引号转义，枚举一律白名单钳制，错类型直接报错——绝不静默收窄或放宽审查范围。
 - **一张设置卡片**（client 半）从宿主自己的 `llm-pi-ai` 设置条目取 provider/model 清单、从宿主凭据服务取 key 状态。两个服务缺席时卡片显示降级原因，工具与设置照常可用。
-- **应用一次选择写的是 CLI 自己的 `~/.opencodereview/config.json`**——写进去的是 `api_key_cmd` 命令，OCR 运行期经它读宿主凭据 ref；任何地方都不落明文 key。
+- **应用一次选择写的是 CLI 自己的 `~/.opencodereview/config.json`**——写进去的是 `api_key_cmd` 命令，OCR 运行期经它读宿主凭据 ref；本包不把明文 key 写进 `config.json`，但首次改写前复制的 `.bak` 保留改写前的整份内容，其中可能有迁移前的明文 key（权限 0600），迁移后自行删除该备份。
 - **评审结果是一份结构化摘要，字段分两套口径**：OCR 审出了什么（`status`/`aggregation`/`topComments`/`warnings`），以及这一场有没有真把选中的文件审完（`coverage`/`budgetExceeded`/`toolCalls`）。CLI 以 `--audience agent` 被调用，进度输出被它压掉——后一套口径只能从这些字段里读。
 - **CLI 可得性只有一份判据**（`lib/cli.ts` 的 `resolveOcrAvailability`）：纯读文件系统、绝不起进程、每次调用现读。设置卡状态行、插件详情页徽标与启用指引渲染的都是这同一份答案，「用的是哪一份」不许有三套说法。
 - **后台运行（`wait: false`）是官方宿主作业**：`job_list` / `job_output` / `job_kill` 看得见、读得到、也停得掉一场超出工具调用生命周期的评审。
@@ -67,10 +67,10 @@ dsh plugin --profile web add @jayyuen66/dsh-ocr-review
 卸载用 `dsh plugin --profile web remove @jayyuen66/dsh-ocr-review`。包在公共 npm 上，安装不需要凭据。
 
 - **升级已装的那一份要「先 remove 再 add」。** profile 跑着 HMR（出厂那几个都跑）时，`add` 一个 profile 已经依赖着的包会在 pnpm 动手之前就被拒（`already-installed`）——先 `remove` 再 `add` 目标版本，新版不必重启就起跑。没跑 HMR 时同一个 `add` 照样走 pnpm，报 `restart-required`。
-- **要求 Node.js `>= 22.12`，宿主 dsh 在 `0.2.1-rc.3` 线上。** 宿主只读 `engines.dsh`（`^0.2.1-rc.3`）并独立裁决，预发布号参与比较。不合的宿主要显式登记风险豁免：`dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<版本> --dsh-version <确切运行版本> --accept-risk`。
+- **要求 Node.js `>= 22.12`，宿主 dsh 在 `0.2.1-rc.3` / `0.2.2-alpha.2` 线上。** 宿主只读 `engines.dsh`（`^0.2.1-rc.3`）并独立裁决，预发布号参与比较。不合的宿主要显式登记风险豁免：`dsh plugin --profile <p> allow-version @jayyuen66/dsh-ocr-review@<版本> --dsh-version <确切运行版本> --accept-risk`。支持窗口是滚动的：本包在发布时最近的三个已发布宿主版本上逐版取证，窗口滚动后重新取证，不把这一句里的版本号当长期承诺。
 - **`dependencies` 里不放任何 `@deepseek-ai/*`，这是契约**（`test/publish-manifest.test.ts` 钉着）。消费方 profile 用 `nodeLinker: hoisted` 与 `autoInstallPeers: false` 安装，宿主包进了那张表就会落成真实目录，与宿主进程已加载的那份并存。`@deepseek-ai/dsh-tools` 的调度器键是普通 `Symbol`（不是 `Symbol.for`），符号身份按实例计算——那个 profile 里**每一次原生工具调用都抛**，而本包的构建、类型检查与覆盖率门在此前一路绿。
 - **`host.js` 以值导入的五枚宿主包是非 optional 的 peer**：`@deepseek-ai/schemastery`（宿主 fork——`.volatile()` 的解析只在它有实现）、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`（Remote 的 Service 基类）。五枚同时以同一钉版另列进 `devDependencies`，本仓自己的类型检查才解析得到；构建对 manifest 三张表一律外部化，产物里保持裸说明符。
-- **发布面**：`host.js`、`client.js`、`cordis.patch.yml`、`scripts/`、`icon.svg`、`CHANGELOG.md` 与 `THIRD_PARTY_NOTICES.md`。`prepack` 重建两个 bundle，发出去的永远是当前源码的产物。
+- **发布面**（以 `package.json` 的 `files` 为准）：`host.js`、`client.js`、`cordis.patch.yml`、`scripts/`、`locale/*.json`、`docs/`、`icon.svg`、`CHANGELOG.md` 与 `THIRD_PARTY_NOTICES.md`。`prepare` 重建两个 bundle，发出去的永远是当前源码的产物。
 
 ### <img src="https://api.iconify.design/lucide/arrow-down-to-line.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> shared 的版本下限
 
@@ -105,13 +105,13 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 - **它不安装、不升级 CLI。** brew/npm 命令只展示、不执行；没有更新动作，也不接剪贴板 API（非安全上下文会静默失败，看上去像按钮没反应）。
 - **没有自己的 HTTP 路由。** 数据面是一枚官方 Typert Remote 命名空间（`ocrReview`），经宿主 `/api` 网关到达；认证、Host / DNS 重绑定 / Origin 判据与请求体上限都是网关的。本包没有 CSRF token、没有 body 上限，也没有路由释放器。
 - **没有 CLI 子命令。** 不存在 `dsh ocr …`。
-- **不读以下范围之外的文件**：CLI 配置路径、自己创建的临时文件、以及宿主交给它的设置 / 凭据服务。
+- **本插件自己不读以下范围之外的文件**：CLI 配置路径、宿主凭据文档与 `$DSH_HOME/.env`（经 `scripts/get-cred.mjs`）、为找 `ocr` 二进制而探测的 PATH 目录、`ocr_session` 列出的会话存储、自己创建的临时文件，以及宿主交给它的设置 / 凭据服务。被审查仓库的内容由 `ocr` 子进程作为评审输入读取。
 - 它*确实*消费的：宿主 `settings` 与 `credentials` 服务（provider 清单、key 状态）、`shell`（每一条 `ocr` 子进程）、`jobs`（后台运行）与 `systemPrompt`（一段路由）。settings 或 credentials 缺席只降级卡片——工具照常可用。
 
 ## <img src="https://api.iconify.design/lucide/plug.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 在 dsh 里启用
 
 - `package.json` 的 `dsh.bundle.patch` 指向 `cordis.patch.yml`，其唯一注册行是 `- id: ocr-review`、`name` 为裸包名——宿主只按裸包名扫描 client 半。
-- 卡片要 web profile（`dsh.client.platform: web`、`immediately: true`）。五个 `ocrReview` 方法由 apply fiber 无条件注册，宿主的 web 层从不起（如 TUI）时工具与设置照常在。
+- 卡片要 web profile（`dsh.client.platform: web`、`immediately: true`）。九个 `ocrReview` 方法由 apply fiber 无条件注册，宿主的 web 层从不起（如 TUI）时工具与设置照常在。
 - 网关只把方法暴露给本 profile 的客户端；本包不在它前面再加一层。
 - 部署默认写在注册行的 `config:` 上（cordis 按导出的 `Config` schema 校验）；优先级：设置卡运行时值 > 行 config > 内置默认。
 
@@ -128,7 +128,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 | `ocr_llm` | action providers/models：只读查询 LLM 清单；不评审、不测连通性 |
 | 清单上限 | exclude 与 path 各收 2000 条；超限直接拒绝整次调用。条目绝不静默丢弃——「比清单少审了几份」不许以成功的口径上报 |
 
-`wait: false` 起后台运行、不挂宿主 deadline（用 `ocr_session` 轮询；该子进程同时是一枚官方作业，见[后台运行与官方作业](#后台运行与官方作业)）；dsh 以任何方式退出时，收割守护把 OCR 进程树收走。取消工具调用即终止对应的后台进程。
+`wait: false` 起后台运行、不挂宿主 deadline（用 `ocr_session` 轮询；该子进程同时是一枚官方作业，见[后台运行与官方作业](#后台运行与官方作业)）；POSIX 上 dsh 以任何方式退出时，收割守护把 OCR 进程树收走（Windows 没有收割，见「已知边界」）。取消工具调用即终止对应的后台进程。
 
 ## <img src="https://api.iconify.design/lucide/sliders-horizontal.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 设置项
 
@@ -149,7 +149,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 | --- | --- | --- |
 | `llmTestTimeoutMs` | `90000` | `ocr llm test` 的墙钟，autoVerify 与卡片「测试连接」共用；评审机慢就调大 |
 | `startupVerify` | `true` | 装载期跑一次端点自检（顺带量一次版本）。两条归同一开关，因为判据同是「装载期允不允许起进程」；要求装载零进程的部署关掉它 |
-| `ocrBackgroundMaxMs` | `0` | 后台评审的兜底回收窗口（注册表等到 deadline 即 kill）；0 = 不设窗口——只有宿主退出、会话停止、插件卸载或作业被杀才结束 |
+| `ocrBackgroundMaxMs` | `0` | 后台评审的兜底回收窗口（注册表等到 deadline 即 kill）；0 = 不设窗口——有主作业还会在所属会话停止时结束，无主作业则只在宿主退出、插件卸载或作业被杀时结束 |
 | `stdoutMaxBytes` | `400000` | shell 执行器的 stdout 缓冲上限，前台与后台共用（评审结果走 `--output` 临时文件，正是为了绕开它） |
 | `ocrNoAutoUpdate` | `false` | 置真时本包起的每条命令都带 `OCR_NO_UPDATE=1`，拦住上游在评审中途把新版 `npm i -g` 装上；置假保持上游行为。版本探测不受本开关影响，恒定带上该变量 |
 | `ocrInstallHint` | `both` | 还没装时先推哪条装法：`both` / `brew` / `npm`。只是兜底而非覆盖——机器上已有一份时按那份自己的来源说，因为对着 brew 用户端出 `npm i -g` 会多出第二份、PATH 上还是旧的。npm 那条恒带核对版本，brew 那条恒带不了 |
@@ -165,8 +165,8 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 | `migrate()` | — | `{ok, migrated, skippedUnknown}` |
 | `test()` | — | `{ok, output}`——`ok` 是**测试结论**，不是这次调用成没成；output 先脱敏再截 8000 字符 |
 | `probe()` | — | `{ok, version, expectedVersion, consistent, output, reason, changeText}`——15 秒墙钟内跑一次 `ocr version`，恒定带 `OCR_NO_UPDATE=1`。`consistent` 是三态（`null` = 没量到，此时宣称「不一致」就是把没证据的事说成结论）；`reason` 点名失败那一档；`changeText` 只在真有一条该给的命令时非空 |
-| `mcp()` | — | `{ok, json}`——只回 `mcp_servers` 对象（pretty JSON），不含 providers/keys |
-| `saveMcp(request)` | `{json}`——原始 JSON 文本，上限 64 KiB；stdio/remote 条目逐字段校验 | `{ok, count}`——只写 `mcp_servers`，其他配置原样保留 |
+| `mcp()` | — | `{ok, json, revision}`——只回 `mcp_servers` 对象（pretty JSON），不含 providers/keys；`revision` 是这一支的摘要 |
+| `saveMcp(request)` | `{json, revision?}`——原始 JSON 文本，上限 64 KiB；stdio/remote 条目逐字段校验；`revision` 取 `mcp()` 交回的那一枚 | `{ok, count, revision}`——只写 `mcp_servers`，其他配置原样保留。基线过期时整笔拒绝（盘上不动）并回可读的「读取之后已被改动」；不带基线则沿用原来的后写覆盖 |
 | `auth()` | — | `{ok, output, loginCommand}`——只读 `ocr auth status --provider chatgpt`；登录本身要浏览器与本地回调，仍留在终端执行 |
 | `chatGpt(request)` | `{model}` | `{ok, model}`——写 `provider: "chatgpt"` 与 `providers.chatgpt.model`，不写 key |
 
@@ -189,9 +189,10 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 | --- | --- |
 | 模型多看到的 | `job_list` 列得出这场评审、`job_output` 读得到它的 stdout/stderr（非消费式——不会从会话读取器那里抢字节）、`job_kill` 停得掉它。评审结果仍以 `ocr_session` 会话记录为准 |
 | 没注册表就没后台 | 宿主没有 jobs 服务时，`wait: false` 直接抛错点名缺件，而不是起一个没人看得见的子进程；前台运行不受影响 |
-| 共用桶 | 未拥有的作业槽全宿主共用，满员直接拒绝新 start，一条挂死的 CLI 会永久占一格。`ocrBackgroundMaxMs` 那个可选兜底窗口就是为它设的——用注册表自己的 wait + kill，不用宿主 timer |
-| 清理 | 每次登记前把本 kind 的已落定记录剪到固定窗口；在跑与正在收的一条不剪（注册表对超额的答法是拒绝，不是替人杀评审）。卸载时，活着的经注册表 kill，已落定的 remove |
-| 暴露面 | 未拥有意味着任何 caller 都能 list / read / kill。这是本次换装已知并接受的暴露面；收回它的唯一方式是回滚作业登记 |
+| 归属 | 调用方能解析到活会话时，作业以该会话为 `owner` 登记；此后只有那个会话能经 `job_list` / `job_output` / `job_kill` 碰到它。解析不到活 Agent 的调用起的是无主作业 |
+| 容量桶 | 有主作业计入各自 owner 的桶；无主作业共用全宿主的未拥有桶。满员都直接拒绝新 start，一条挂死的 CLI 会占住一格——`ocrBackgroundMaxMs` 那个可选兜底窗口就是为它设的，用注册表自己的 wait + kill，不用宿主 timer |
+| 清理 | 每次登记前，把该 caller 可见面（无主桶 + 自己的）里本 kind 的已落定记录剪到固定窗口；在跑与正在收的一条不剪（注册表对超额的答法是拒绝，不是替人杀评审）。会话销毁只回收该会话的作业；卸载时统一回收全部，有主作业的 id 靠一份最小的「id → owner」台账枚举，因为注册表对别的 owner 隐藏它们 |
+| 暴露面 | 有主作业只对所属会话可见、也只由它可 kill。无主作业仍对所有 caller 可见——这是残留暴露面，只发生在解析不到活 Agent 的时候 |
 | 取消链里不许抛 | 宿主事件处理器里抛出的错误会把整个宿主进程带下来，官方件也不替生产者兜——取消链在两层各兜一次，每层各有一条用例钉着 |
 
 ## <img src="https://api.iconify.design/lucide/lock.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 数据与隐私
@@ -200,7 +201,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 | --- | --- |
 | 进程边界 | 被审查仓库的路径与 diff 内容进 `ocr` 子进程，CLI 再把它们发给自己在 config.json 里配置的 LLM 端点——这条外发是审查功能本身，不经 dsh 宿主。明文 key 不进工具返回、也不进 Remote 应答；宿主侧解析到的值只用于确认「现在解析得到」，当场丢弃 |
 | 原始输出脱敏 | 本包出去的 CLI 原始 stdout/stderr（失败详情、llm test、解析失败回显、session 透传）统一过 `redactKeyMaterial()`：Bearer 与赋值形态从严抹除，独立 key 形态额外要求随机串特征，免得把要交给模型的文件路径一起抹掉 |
-| 写盘范围 | 只有两处：CLI 的 `config.json`（含临时文件、`.bak` 备份与短暂的锁）与系统临时目录下的 `ocr-review-*` / `ocr-scan-*`（读完即删）。迁移前的明文可能留在那次写入产生的 `.bak` 里（权限 0600）——要彻底清掉需自行删除该备份。这两处之外，`ocrNoAutoUpdate` 没置真时唯一的写者就是 CLI 自己那层 npm 包装 |
+| 写盘范围 | CLI 的 `config.json`（含临时文件、`.bak` 备份与短暂的锁）、系统临时目录下的 `ocr-review-*` / `ocr-scan-*`（读完即删），以及 `ocr-session-export-*` 目录——那是 `ocr_session` 的 `export` 返回的 HTML，留给调用方，不自动删除。迁移前的明文可能留在那次写入产生的 `.bak` 里（权限 0600）——要彻底清掉需自行删除该备份。这些之外，`ocrNoAutoUpdate` 没置真时唯一的写者就是 CLI 自己那层 npm 包装 |
 
 ## <img src="https://api.iconify.design/lucide/triangle-alert.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 已知边界
 
@@ -209,7 +210,7 @@ npm i -g @alibaba-group/open-code-review@1.13.3      # 钉在本包核对的那
 - **读版本要起一次进程**，页面渲染绝不触发；卡片只显示最近一次测量或什么都不显示——渲染一页装不了、更不了、也探不了任何东西。
 - **原子写的锁超时以英文出现。** 争用超过官方等待上限时抛的是官方件自己的超时文本——这是本包唯一一条绕过双语消息表的用户可见错误。
 - **`partial` 是终态里的成功档。** 部分文件失败但覆盖仍成立、评论仍有效；既不被抬成成功，也不被折进失败。
-- **未拥有的后台作业对所有会话可见**（见「后台运行与官方作业」）——随本次换装一并接受，收回它的唯一方式是回滚登记。
+- **无主的后台作业对所有会话可见**（见「后台运行与官方作业」）。解析不到活 Agent 的调用会起这种作业；有主作业则被围栏在自己的会话里。
 
 ## <img src="https://api.iconify.design/lucide/circle-help.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 常见问题
 
@@ -230,7 +231,7 @@ pnpm run check   # typecheck（两侧）→ lint → client 构建 → host 构
 
 - 覆盖率阈值**四项 100%**，分母是 `vitest.config.ts` 里 `coverageInclude` 选定的那一面（`host.ts` + `lib/**`）；两块刻意在分母外：客户端半（`src/**`）经 bundle 与设置卡用例覆盖，`scripts/get-cred.mjs` 由进程级用例另起进程驱动（v8 覆盖率看不到子进程），它的行为门禁在 `test/get-cred.test.ts`。
 - 往 profile 加本包的**本地目录**（`pnpm add <路径>`）需要 pnpm ≥ 12.3.0：更早的 pnpm 12 把无别名的本地路径当 registry 包名解析（上游 #14437，12.3.0 修复）。从 registry 装不受影响。
-- 产物新鲜度由 `test/build-host.test.ts` 钉着：`host.js` / `client.js` 落后于源码就红。发布物不手改；`prepack` 重建。
+- 产物新鲜度由 `test/build-host.test.ts` 钉着：`host.js` / `client.js` 落后于源码就红。发布物不手改；`prepare` 重建。
 - 插件源码是 TypeScript，由宿主的 cordis Loader 直接加载（Node ≥ 22.18 类型剥离）；bundle 只为 npm 发布面存在。
 
 ## <img src="https://api.iconify.design/lucide/scale.svg?color=%23658EFF&height=22" height="22" width="22" align="absmiddle" alt="" /> 许可

package/THIRD_PARTY_NOTICES.md

@@ -25,6 +25,32 @@
 `currentColor` 换成本包插件图标配色（`#658EFF` 主色 + `#54ECE7` 底衬），并把外层 `<g>` 与
 画布尺寸对齐本族插件统一的 `36×36` / `viewBox 0 0 24 24` 规格。
 
+`icon.svg` 随包分发，没有独立的 npm 包承载上游许可文本，因此在下文完整保留 MIT 正文：
+
+```text
+MIT License
+
+Copyright (c) Paweł Kuna
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
 ## 机制与接口来源：open-code-review（ocr CLI）
 
 - 上游项目：`open-code-review`
@@ -56,6 +82,8 @@
 | 依赖 | 版本 | 许可 | 引入方 |
 | --- | --- | --- | --- |
 | `@alibaba-group/open-code-review` | 1.13.3（核对版本，非依赖） | Apache-2.0（Alibaba） | **不在依赖表里**：用户自选 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@<版本>`，本包只 spawn 它 |
-| `js-yaml` | ^5.4.3 | MIT | `scripts/get-cred.mjs` 读 dsh 托管凭据文档 |
+| `js-yaml` | 5.4.3（精确钉版） | MIT | `scripts/get-cred.mjs` 读 dsh 托管凭据文档 |
+| `@jayyuen66/dsh-plugin-shared` | catalog（伞根 0.2.2） | MIT | `host.ts` / `lib/*` / `src/*` 的 job-outcome、locale、record、errors、card-* 等公共面（值导入，构建时外部化） |
+| `zod` | catalog（伞根 4.6.7） | MIT | 设置卡 `src/remote.ts` 的 strict codec 形状校验；client 产物由宿主 `PLATFORM_MODULES` 提供 |
 
-dsh 宿主侧的包分两档：产物里以**值**导入、且列在 `peerDependencies` 的四枚（`@deepseek-ai/schemastery` 宿主 fork、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write`）由宿主在场提供、不随本包分发；其余 `@deepseek-ai/dsh-*` 与 `@deepseek-ai/cordis` 只在 `devDependencies` 里，用途是把类型绑到官方声明上（type-only 绑定），产物里不留说明符。本包按 dsh `0.2.1-rc.3` 逐条核对过（同版的 cordis `4.0.5` 与 schemastery `3.18.5` fork 一并核对）。
+dsh 宿主侧的包分两档：产物里以**值**导入、且列在 `peerDependencies` 的五枚（`@deepseek-ai/schemastery` 宿主 fork、`@deepseek-ai/dsh-credentials`、`@deepseek-ai/dsh-home-paths`、`@deepseek-ai/dsh-atomic-write` 与 `@deepseek-ai/dsh-typert-protocol`）由宿主在场提供、不随本包分发；其余 `@deepseek-ai/dsh-*` 与 `@deepseek-ai/cordis` 只在 `devDependencies` 里，用途是把类型绑到官方声明上（type-only 绑定），产物里不留说明符。本包按 dsh `0.2.2-alpha.2` 逐条核对过（同版的 cordis `4.0.6-alpha.1` 与 schemastery `3.18.6-alpha.1` fork 一并核对）。