@stardustlc/dsh-suite 0.2.5 → 0.2.8

package/README.en.md

@@ -14,9 +14,9 @@ Re-verify the whole suite against any built Harness checkout (writes a JSON repo
 node scripts/verify-compat.mjs --harness-root <harness checkout>
 ```
 
-## 兼容性
+## Compatibility
 
-Validation host: Harness `0.2.0-rc.1` built from official sources (commit `407e65c8`) with Node `24.16.0` on 2026-09-28, re-verified 2026-09-29. This repository is the bundle (it ships no tests of its own); all 18 suite components mount together in one host and pass the contract checks: 96 tools and 35 skills registered, with tool schemas and health-check contracts passing. No live ports or external services were exercised in this round.
+Validation host: Harness `0.2.0-rc.2` built from its official release tag (commit `639ed01539`), Windows and Node `24.16.0`. All 18 components mount together with 99 tools and 35 skills; tool schemas and health contracts pass. The suite also has 11 manifest, lockfile and offline-environment tests. Version 0.2.8 pins Dream 0.6.0, Email 0.14.5, HyperFrames 0.4.2 and Slack 0.3.3. See the [validation record](docs/validation-2026-10-01.md) for feedback dispositions, verification scope and live-service limits.
 
 ## Install / Uninstall
 
@@ -56,11 +56,11 @@ Keep your profile's `cordis.patch.yml` configuration overrides, then restart Web
 | | dsh-calendar | CalDAV list/create/update/delete/search (Google/iCloud/Nextcloud/custom); ships a month/week/agenda panel in Settings (remembers your view, week view starts at 07:00, **drag to reschedule**) where the connection is entered, tested and saved |
 | | dsh-rss | RSS/Atom subscriptions + cross-feed search + incremental fetch |
 | | dsh-cite | Crossref lookup + four citation styles + BibTeX |
-| | dsh-dream | Session replay → reflection → dream journal → AGENTS.md bridge (privacy masking) |
+| | dsh-dream | Session replay → source verification → lesson review → project-rule preview, apply and rollback (privacy masking) |
 | Media | dsh-ffmpeg | probe/cut/concat/encode/subtitle/frames/GIF/adjust (speed/volume/mute/rotate), ten tools |
 | | dsh-voice | edge-tts synthesis + ASR transcription + voice preview |
 | | dsh-ppt | One prompt to HTML slideshow + PPTX export: 7 layouts (quote/table) + speaker notes |
-| | dsh-hyperframes | HyperFrames by HeyGen bundle of 20 skills |
+| | dsh-hyperframes | HyperFrames by HeyGen bundle of 21 skills |
 | | dsh-remotion | Remotion programmatic-video skill |
 | DevOps | @stardustlc/dsh-docker | Seven container tools (incl. health) + exec approval gate |
 | | dsh-sql | SQLite/MySQL/PostgreSQL + read-only guard + approval gate + stats/CSV |
@@ -91,6 +91,7 @@ node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --repor
 node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --contracts-only --json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/smoke-report.json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/install-report.json
+node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --registry-components --registry-suite --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/registry-report.json
 ```
 
 `--workspace-root` selects the parent of the component repositories. `--report` saves JSON, `--json` prints only JSON, and failures return a nonzero exit status. `--contracts-only` validates existing `lib/` artifacts without rebuilding or running unit tests.

package/README.md

@@ -17,7 +17,7 @@ node scripts/verify-compat.mjs --harness-root <harness 检出>   # 或在套件
 
 ## 兼容性
 
-验证宿主：官方源码构建的 Harness `0.2.0-rc.1`（commit `407e65c8`）+ Node `24.16.0`（2026-09-29 复核）。本仓库是组合包（不含独立测试），套件内 18 个组件在同一宿主中共同加载并通过契约检查：共注册 96 个工具、35 个技能，工具 schema 与健康检查契约全部通过。本轮未启用真实端口与外部服务。
+验证宿主：官方发布标签源码构建的 Harness `0.2.0-rc.2`（commit `639ed01539`）+ Windows / Node `24.16.0`。18 个组件共同加载，注册 99 个工具、35 个技能，工具 schema 与健康检查契约通过。套件另有 11 项清单、锁文件与离线环境测试。0.2.8 锁定 Dream 0.6.0、Email 0.14.5、HyperFrames 0.4.2 和 Slack 0.3.3；验证范围、反馈处理及真实服务限制见 [验收记录](docs/validation-2026-10-01.md)。
 
 ## 安装
 
@@ -59,11 +59,11 @@ dsh plugin --profile web remove @stardustlc/dsh-suite
 | | dsh-calendar | CalDAV 日程查建改删搜（Google/iCloud/Nextcloud/自建）；设置页里带月/周/议程面板（记住上次视图、周视图从 07:00 起、**拖动即可改期**），连接配置在面板内填写并先测后存 |
 | | dsh-rss | RSS/Atom 订阅 + 跨订阅搜索 + 增量抓取 |
 | | dsh-cite | Crossref 文献检索 + 四种引文格式 + BibTeX |
-| | dsh-dream | 会话回放 → 反思 → 梦境日记 → 桥接 AGENTS.md（含隐私脱敏） |
+| | dsh-dream | 会话回放 → 来源核验 → 经验审阅 → 项目规则预览、写入与回滚（含隐私脱敏） |
 | 🎬 媒体工坊 | dsh-ffmpeg | 探测/剪辑/拼接/转码/字幕/抽帧/GIF/调整（变速·音量·静音·旋转）十工具 |
 | | dsh-voice | edge-tts 合成 + ASR 转写 + 音色试听 |
 | | dsh-ppt | 一句话生成 HTML 放映 + PPTX 导出：7 页型（金句/表格）+ 演讲者备注 |
-| | dsh-hyperframes | HyperFrames by HeyGen 官方视频技能（20 个上游技能） |
+| | dsh-hyperframes | HyperFrames by HeyGen 官方视频技能（21 个上游技能） |
 | | dsh-remotion | Remotion React 编程式视频技能 |
 | 🔧 DevOps | dsh-docker | 容器七工具（含 health 自检）+ exec 审批门（@stardustlc/dsh-docker） |
 | | dsh-sql | SQLite/MySQL/PostgreSQL + 只读保护 + 审批门 + 统计/CSV |
@@ -108,6 +108,7 @@ node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --repor
 node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --contracts-only --json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/smoke-report.json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/install-report.json
+node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --registry-components --registry-suite --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/registry-report.json
 ```
 
 `--workspace-root` 可指定组件父目录；`--report` 保存 JSON，`--json` 让标准输出只包含 JSON。任何构建、测试或契约失败均返回非零退出码。`--contracts-only` 跳过重建与单元测试，检查当前 `lib/` 产物。

package/docs/validation-2026-10-01.md

@@ -0,0 +1,41 @@
+# 0.2.8 validation / 验收记录
+
+## Host and component scope
+
+Harness was built on Windows from the official `dsh-v0.2.0-rc.2` tag, commit `639ed01539`, using the frozen lockfile. The built CLI reports `0.2.0-rc.2`. Validation uses an isolated home on E: and excludes the user's service credentials.
+
+All 18 components load together: 99 tools, 35 skills, TypeScript/Python PTC catalogs, 19 output-schema checks and two skill-registry loss/recovery checks pass. Health fixtures validate responses; they do not establish real external-service readiness.
+
+The 18-component offline baseline passed 1,406 tests, with two default skips. Email's ten new regression tests bring the combined results from the component runs to 1,416 passes and two skips. Email 0.14.5 itself passes 295 tests. These are results from component runs, not a claim that every real service or native UI was exercised.
+
+This release pins Dream 0.6.0, Email 0.14.5, HyperFrames 0.4.2 and Slack 0.3.3. The suite's nine manifest/lockfile tests and two offline-environment tests all pass. The outdated lockfile reproduced `ERR_PNPM_OUTDATED_LOCKFILE`; a regression now checks every component's declared version, resolved version and registry integrity. Frozen source installation passes with pnpm 11.7.0. Both npm installation and source installation use the same component pins.
+
+The workspace's release-age exceptions name the 18 first-party components and three reviewed, exact versions from the new Slack SDK release (`@slack/socket-mode@3.1.0`, `@slack/types@3.2.0`, `@slack/web-api@8.2.0`). Component-name exclusions work in the tested pnpm 11.7 frozen installation; version-qualified exclusions rejected the newly published Dream and Email packages in that check. All other third-party dependencies retain the package manager's release-age policy, and all component versions remain exact manifest/lockfile pins.
+
+The built official CLI also started an isolated profile with all 18 local components. Every expected tool and skill was present, both media skill health checks passed, and the minimal-PTC preset mounted into an actual agent with `run_code` as its model tool. The launch token exchanged for a cookie (303), the unauthenticated index returned 401 and the authenticated index returned HTML (200). The fixture process then closed. The host additionally supplies one Windows sandbox skill, giving 36 skills in that startup profile.
+
+The release artifact is also gated on installation through the official CLI with all 18 components resolved from npm. That check compares registry tarball integrity, exact installed versions, the full tool/skill inventory, preset mounting and web authentication. Components must be transitive dependencies of the suite without duplicate direct profile layers.
+
+The installation review also found an unmet peer: Socket Mode SDK 3.0.1 requires Undici 7, but the combined dependency graph selected Undici 8. Slack 0.3.3 requires the official SDK 3.1 or newer, which supports Undici 7/8, and explicitly declares the matching transport dependency. Its package acceptance fixture installs a host Undici 8 alongside the plugin and checks that the installed SDK supports and resolves that transport, constructs a Socket Mode client and exports the plugin entry. Both README languages ship in the npm artifact. This check does not connect to a real Slack workspace.
+
+## Open feedback checked on 2026-10-01
+
+Twenty active `STARDUSTLC666/dsh-*` repositories were checked through GitHub. Only Email had open issues or pull requests at the check time.
+
+| Feedback | Evaluation and disposition |
+| --- | --- |
+| [Email #20](https://github.com/STARDUSTLC666/dsh-email/issues/20) | Reproduced. Fixed in 0.14.5: a named provider uses its own endpoints; card saves do not persist resolved default-card endpoints as shared settings. Explicit account endpoints, shared transport budgets and legacy inheritance remain supported. |
+| [Email #16](https://github.com/STARDUSTLC666/dsh-email/issues/16) | The newer SettingsForms API is already supported. Registration is optional; current tests cover modern settings and startup. |
+| [Email #17](https://github.com/STARDUSTLC666/dsh-email/issues/17) | Saved blank-host placeholders were already normalized in 0.14.2, including migration. Explicit custom ports and TLS choices are covered by regression tests. |
+| [Email PR #18](https://github.com/STARDUSTLC666/dsh-email/pull/18) | Targets the older settings implementation. The released fix covers both old and modern paths, so this PR is not applied over the newer implementation. |
+| [Email #19](https://github.com/STARDUSTLC666/dsh-email/issues/19) | Feature consultation. The explicit `sendApproval: false` option already exists. Recipient allow/deny lists need a separate policy covering multiple recipients, reply/forward behavior and host approval precedence. This maintenance release keeps existing approval behavior. |
+
+No public comments were posted and no issues or contributor PRs were closed as part of this audit.
+
+## Human operation and limits
+
+Dream 0.6.0 was tested in the actual Harness web UI with isolated data: tabs, filtering, long-content expansion, source/conflict review forms, generated commands and rollback preservation. Light and dark themes were inspected at wide and narrow viewports. The installed native desktop's Dream settings page also renders.
+
+Email's native Windows settings were exercised for adding a temporary card, Outlook/Gmail provider changes, automatic saving and deleting the temporary card. The original desktop configuration bytes were restored. These operations exposed the empty-address test and stale application-ID hint bugs; the final fixes have component behavior regressions but have not been retested in the native UI. A separate browser fixture was blocked by the browser's access policy and is not counted as successful UI verification.
+
+Successful real Outlook authorization, mailbox login, sending, Slack/DingTalk delivery, CalDAV mutations and production media rendering were not verified. Native human-operation checks for every one of the 18 components remain a separate validation scope.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardustlc/dsh-suite",
-  "version": "0.2.5",
+  "version": "0.2.8",
   "description": "DSH 插件全家桶：18 个组件覆盖邮件、日历、媒体创作、开发运维、消息通知与极简 PTC，一条命令安装。",
   "type": "module",
   "dsh": {
@@ -16,7 +16,8 @@
     "README.md",
     "README.en.md",
     "ptc-minimal.patch.yml",
-    "docs/validation-2026-09-27.md"
+    "docs/validation-2026-09-27.md",
+    "docs/validation-2026-10-01.md"
   ],
   "scripts": {
     "test": "node --test \"test/*.test.mjs\"",
@@ -42,21 +43,21 @@
   },
   "dependencies": {
     "@stardustlc/dsh-docker": "0.3.4",
-    "@stardustlc/dsh-dream": "0.4.1",
+    "@stardustlc/dsh-dream": "0.6.0",
     "dsh-calendar": "0.9.2",
     "dsh-cite": "0.3.5",
     "dsh-code-security": "0.3.6",
     "dsh-codex-port": "0.2.4",
     "dsh-dingtalk": "0.2.2",
-    "dsh-email": "0.14.4",
+    "dsh-email": "0.14.5",
     "dsh-ffmpeg": "0.4.4",
     "dsh-flakefinder": "0.3.4",
-    "dsh-hyperframes": "0.4.1",
+    "dsh-hyperframes": "0.4.2",
     "dsh-minimal-ptc": "0.5.2",
     "dsh-ppt": "0.5.1",
     "dsh-remotion": "0.3.4",
     "dsh-rss": "0.4.2",
-    "dsh-slack": "0.3.2",
+    "dsh-slack": "0.3.3",
     "dsh-sql": "0.4.4",
     "dsh-voice": "0.3.5"
   },