@perrylink/dsh-plugin-doctor 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.2.1] - 2026-09-12
+
+### Fixed
+
+- Widen the stale-peer-range detector beyond the single `>=0.1.0-rc.N <0.2.0` shape it was written for, and stop claiming the `--dsh` default is "npm 已发布 latest" (npm `@deepseek-ai/dsh` latest is `0.1.5-rc.1`). The default itself is unchanged: 38 downstream CI gates rely on it as a peer-floor smoke.
+
 ## 0.2.0
 
 - **Silent-pass fixes (the load-bearing change)** — three ways this tool could return a green result without having actually decided anything are now closed:

package/doctor.mjs

@@ -27,7 +27,10 @@ const USAGE = `dsh-plugin-doctor ${VERSION} —— dsh 插件完整性 + 运行
   --repo, -r <路径>      被检插件仓（含 package.json）
   --workspace, -w <路径> 兄弟仓所在工作区根（用于 CC 组核对本地清单；缺省=工具自身父目录）
   --no-smoke        跳过动态沙箱冒烟（默认执行；需网络 + pnpm）
-  --dsh <版本>      冒烟宿主版本（默认 ${'0.1.2-rc.1'} = npm 已发布 latest）
+  --dsh <版本>      冒烟宿主版本（默认 ${'0.1.2-rc.1'} = peer 下限：刻意用最老的受支持线做
+                    向后兼容冒烟，不是 npm latest —— npm @deepseek-ai/dsh 实测 latest 为
+                    0.1.5-rc.1、next 为 0.1.5-rc.2。38 个下游仓的 plugin-doctor.yml 吃这个
+                    默认值，改默认值会静默改变那些门禁的含义）
   --only <分组>     只跑指定分组（逗号分隔）。推荐用 ASCII 别名（编码安全）：
                       R  = 静态·包结构
                       K  = 静态·cordis 契约扫描

package/lib/checks-package.mjs

@@ -170,8 +170,17 @@ export function addChecks(doctor, ctx) {
     if (!peers.length) return skip('无 dsh 相关 peer 声明')
     const problems = []
     for (const [k, v] of peers) {
-      if (/(0\.1\.0-rc\.8|0\.1\.1-rc\.2)/.test(String(v))) problems.push(`${k}: ${v} 含旧 rc 版本（2026-09-05 起全仓统一为 >=0.1.2-rc.1 <0.2.0）`)
-      if (/^>=\s*0\.1\.0-rc\.\d+\s*<\s*0\.2\.0/.test(String(v))) problems.push(`${k}: ${v} 是旧 prerelease-tuple 区间（裸解析只匹配 0.1.0-rc.8 单行）`)
+      const s = String(v)
+      // Enumerating two literals (0.1.0-rc.8 / 0.1.1-rc.2) only caught the shapes
+      // that happened to exist on 2026-09-05; every other old line slipped through.
+      // Match the whole old-line family instead.
+      if (/(0\.1\.0-rc\.|0\.1\.1-rc\.|0\.1\.2-alpha\.|0\.1\.3-alpha\.)/.test(s)) problems.push(`${k}: ${s} 含旧 rc/alpha 版本（2026-09-05 起全仓统一为 >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0）`)
+      // A single-arm prerelease-tuple range admits only the one prerelease it
+      // names: `>=0.1.2-rc.1 <0.2.0` (no `||`) rejects 0.1.5-rc.1 — exactly the
+      // false green the OR form exists to fix. Flag any bare arm.
+      if (!s.includes('||') && /^>=\s*0\.1\.\d+-[0-9A-Za-z.]+/.test(s) && /<\s*0\.2\.0/.test(s)) {
+        problems.push(`${k}: ${s} 是单臂 prerelease-tuple 区间，不会放行更新的宿主线（须写成 >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0）`)
+      }
     }
     if (problems.length) return fail(problems.join('\n'))
     return pass(peers.map(([k, v]) => `${k} ${v}`).join('；'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@perrylink/dsh-plugin-doctor",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Zero-dependency static + sandbox smoke detector for DeepSeek Harness (dsh) plugins: package-structure gates (R), cordis contract scans (K), keyless-headless sandbox smoke (D), and ecosystem-listing checks (CC).",
   "type": "module",
   "main": "doctor.mjs",