@perrylink/dsh-plugin-doctor 0.1.5 → 0.1.6

package/CHANGELOG.md

@@ -1,12 +1,16 @@
 # Changelog
 
+## 0.1.6
+
+- **Docs/design sync (no CLI behavior change)**: the README's verified-badge section now documents the final shipped badge design (monospace UPPERCASE + letter-spacing + shield-check mark + 5px corners; platinum/silver left panel with deep-navy label text; one solid GitHub-conventional state block on the right) and describes the family gate as reading the committed tree (no install/build; R2/R4 gated by each repo's own `ci.yml`). The "状态" section and CI snippet now pin 0.1.6. Published so the npm page matches the repository; `scripts/` and `badges/` are not in the npm `files` list, so the installed CLI surface is identical to 0.1.5.
+
 ## 0.1.5
 
 - **Group aliases (encoding-safe)**: `--only` now accepts the ASCII aliases `R`, `K`, `D`, `CC` (case-insensitive) in addition to the Chinese group names. Chinese group names had silently rotted into double-encoded mojibake in 35 repos' `plugin-doctor.yml`, which made `--only` match nothing.
 - **Refuse to pass silently**: an `--only` value that matches no registered group, or a run in which zero checks execute, now exits **2** with the available groups instead of the previous "0 checks, exit 0" false green. This is the root-cause guard for the mojibake class of bug.
 - **`tests/selftest.mjs`**: seven real CLI cases (good fixture, alias case-insensitivity, single group, Chinese full name, unknown group, mojibake group, broken fixture) run in a `%TEMP%` sandbox; wired into `npm test`, `ci.yml` and `publish.yml`.
 - **Verified badge program**: `data/verified-repos.json` (declared repos), `scripts/verify.mjs` (audits each repo's own `plugin-doctor` CI gate through the GitHub API — no cloning, no installing, no executing third-party code), `scripts/badge.mjs` (SVG renderer), `data/verified.json` (registry, generated by CI), `badges/<owner>__<repo>.svg`, and `.github/workflows/verified.yml` (daily + on push). Badge meaning: `dsh-doctor passing|warning|failing|no data` — the repo's own static R+K gate is green on the current default-branch HEAD. The gate covers 16 checks (R0/R1/R3/R5/R6/R7/R8 + K1–K9) on the committed tree; R2/R4 read built artifacts and are gated by each repo's own `ci.yml`. Not a certification badge: no Scorecard, provenance or install smoke.
-- **Badge visual design (2026-09-09)**: silver/platinum metallic label with deep-navy text plus GitHub-conventional state colors (green/amber/red/grey) and per-state path-drawn glyphs (check / exclamation / cross / dash), 20px, 1px border. Chosen against rendered candidates with a vision-model review: gold was rejected as a pass color (it reads as a warning), a borderless silver label was rejected as invisible on white, and every state now differs by both color and glyph. Per-state gradient ids keep several badges safe to inline in one document.
+- **Badge visual design (2026-09-09)**: modern grammar borrowed from the ecosystem's newer badges (dsh.directory: monospace UPPERCASE + letter-spacing + mark + gradient; awesome-dsh-plugin: seal block) — platinum/silver left panel with a shield-check mark and deep-navy monospace label (五行 金行主导 = 白/银/铂金, 水行 = 墨蓝), one solid GitHub-conventional state block on the right (green/amber/red/grey) with the state word plus a path-drawn glyph (check / exclamation / cross / dash), 5px corners, 1px border. Chosen by vision-model review of rendered candidates: gold as a pass color reads as a warning, a borderless platinum panel vanishes on white, and a thin state bar or tiny dot is unreadable at 20px — the solid state block won. Per-state gradient ids keep several badges safe to inline in one document.
 - **Gate hardening after the 2026-09-09 sweep**: the family `plugin-doctor.yml` no longer runs install/build. A naive `npm run build` fails without the pinned harness aliases (`HARNESS_COMMIT` + `gen-aliases`) and its prebuild wiped the committed `lib/`, which produced 17 false-red gates. The gate now reads the committed tree only and reports R2/R4 without gating on them.
 - **Repo infrastructure**: `ci.yml` (node 22/24: syntax check, self-test, `npm pack --dry-run`), `scorecard.yml` (OpenSSF Scorecard with `publish_results`), `publish.yml` (tag-triggered npm publish with provenance; skips cleanly when `NPM_TOKEN` is absent), README badge row.
 

package/README.md

@@ -64,7 +64,7 @@ node doctor.mjs --repo <路径> --json report.json
 ```
 
 - 注册表 `data/verified.json` 是唯一事实来源，由 `.github/workflows/verified.yml` 每日 + 每次相关 push 刷新。刷新只读 GitHub API：解析各仓 HEAD 的 `plugin-doctor.yml` 门禁配置（必须钉住 `@perrylink/dsh-plugin-doctor@<版本>`、`--only` 参数可用、含 R0/K1 实跑自校验），再核对 HEAD 那次 `plugin-doctor` workflow run 的结论。**本仓 CI 不克隆、不安装、不执行任何第三方代码。**
-- 徽章外观：label 用**银白/铂金金属渐变 + 墨蓝字**（金行主导、水行在字），值区用 **GitHub 惯例状态色**（绿/橙/红/灰）；状态另用**路径绘制的图标**（✓ / ! / ✕ / –）冗余表达，色觉障碍下同样可读。1px 描边是必需的——去掉后银白 label 在白色 README 背景上会消失。
+- 徽章外观：视觉语言对齐生态里较新的两枚徽章（`dsh.directory` 的等宽大写 + 字距 + 标记 + 渐变，`awesome-dsh-plugin` 的印章块）——**银白/铂金金属左段 + 盾牌勾标记 + 墨蓝等宽大写字**（金行主导、水行在字），右段是**整块 GitHub 惯例状态色**（绿/橙/红/灰）配等宽大写状态词，状态另用**路径绘制的图标**（✓ / ! / ✕ / –）冗余表达，色觉障碍下同样可读。5px 圆角 + 1px 描边；**描边是必需的**——去掉后银白左段在白色 README 背景上会消失。
 - 四种状态（值文本用 shields / GitHub Actions 惯用词）：`passing`（绿，HEAD 上 run success）/ `warning`（橙：HEAD 还没跑、run 仍在队列、或缺少门禁配置的前置条件）/ `failing`（红：HEAD 上 run 失败，或门禁配置不成立——含 `--only` 参数是双重编码乱码的"假门禁"）/ `no data`（灰：API 查询失败）。徽章是**动态**的：不再通过就会变红。R+K 的精确口径不在徽章文字里，而在本节与注册表 `meaning` 字段（徽章链接指回本节）。
 - 加入方式：向 `data/verified-repos.json` 提 PR 增加 `{ "repo": "<owner>/<name>", "package": "<npm 包名>" }`，并按下面的门禁在自己的仓里加 `plugin-doctor.yml`；条目必须通过上面的门禁核对。
 - 门禁步骤（完整工作流见任一家族仓的 `.github/workflows/plugin-doctor.yml`；分组名用 YAML `\u` 转义构造，文件保持纯 ASCII，避免编码往返把中文分组名变成乱码；末尾自校验 R0/K1 确实跑了）：
@@ -136,10 +136,10 @@ SURVEY.md                全渠道检测方法梳理 + 判据出处
 ## 状态
 
 正式仓库：GitHub `PerryLink/dsh-plugin-doctor`（Apache-2.0），npm `@perrylink/dsh-plugin-doctor`
-（**latest=0.1.4**；0.1.5 已入库待发布，见 `CHANGELOG.md`）。CI 用法（**请用 ASCII 别名**）：
+（**latest=0.1.6**，见 `CHANGELOG.md`）。CI 用法（**请用 ASCII 别名**）：
 
 ```powershell
-npx --yes @perrylink/dsh-plugin-doctor@0.1.4 --repo . --no-smoke --only "R,K"
+npx --yes @perrylink/dsh-plugin-doctor@0.1.6 --repo . --no-smoke --only "R,K"
 ```
 
-35 个插件仓已内置 `.github/workflows/plugin-doctor.yml`（install→build→npx 静态 R/K 门禁）。
+35 个插件仓已内置 `.github/workflows/plugin-doctor.yml`（只读已提交树 → npx 静态 R/K 门禁 + R0/K1 实跑自校验）。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@perrylink/dsh-plugin-doctor",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Zero-dependency static + sandbox smoke detector for DeepSeek Harness (dsh) plugins: package-structure gates (R), cordis contract scans (K), keyless-headless sandbox smoke (D), and ecosystem-listing checks (CC).",
   "type": "module",
   "main": "doctor.mjs",