@stardustlc/dsh-suite 0.2.6 → 0.2.9

package/README.en.md

@@ -14,9 +14,9 @@ Re-verify the whole suite against any built Harness checkout (writes a JSON repo
 node scripts/verify-compat.mjs --harness-root <harness checkout>
 ```
 
-## 兼容性
+## Compatibility
 
-Validation host: Harness `0.2.0-rc.1` built from official sources (commit `407e65c8`) with Node `24.16.0` on 2026-09-28, re-verified 2026-09-29. This repository is the bundle (it ships no tests of its own); all 18 suite components mount together in one host and pass the contract checks: 99 tools and 35 skills registered, with tool schemas and health-check contracts passing. No live ports or external services were exercised in this round.
+Validation host: Harness `0.2.0-rc.2` built from its official release tag (commit `639ed01539`), Windows and Node `24.16.0`. All 18 components mount together with 99 tools and 35 skills; tool schemas and health contracts pass. The suite also has 11 manifest, lockfile and offline-environment tests. Version 0.2.9 upgrades Calendar to 0.9.3 and RSS to 0.4.3, fixing connection form behavior and subscription URL comparison. Other verified component pins remain in place. See the [current validation record](docs/validation-2026-10-01-calendar-rss.md) for desktop and live-service limits, and the [0.2.8 record](docs/validation-2026-10-01.md) for the previous Dream, Email and Slack fixes.
 
 ## Install / Uninstall
 
@@ -56,11 +56,11 @@ Keep your profile's `cordis.patch.yml` configuration overrides, then restart Web
 | | dsh-calendar | CalDAV list/create/update/delete/search (Google/iCloud/Nextcloud/custom); ships a month/week/agenda panel in Settings (remembers your view, week view starts at 07:00, **drag to reschedule**) where the connection is entered, tested and saved |
 | | dsh-rss | RSS/Atom subscriptions + cross-feed search + incremental fetch |
 | | dsh-cite | Crossref lookup + four citation styles + BibTeX |
-| | dsh-dream | Session replay → reflection → dream journal → AGENTS.md bridge (privacy masking) |
+| | dsh-dream | Session replay → source verification → lesson review → project-rule preview, apply and rollback (privacy masking) |
 | Media | dsh-ffmpeg | probe/cut/concat/encode/subtitle/frames/GIF/adjust (speed/volume/mute/rotate), ten tools |
 | | dsh-voice | edge-tts synthesis + ASR transcription + voice preview |
 | | dsh-ppt | One prompt to HTML slideshow + PPTX export: 7 layouts (quote/table) + speaker notes |
-| | dsh-hyperframes | HyperFrames by HeyGen bundle of 20 skills |
+| | dsh-hyperframes | HyperFrames by HeyGen bundle of 21 skills |
 | | dsh-remotion | Remotion programmatic-video skill |
 | DevOps | @stardustlc/dsh-docker | Seven container tools (incl. health) + exec approval gate |
 | | dsh-sql | SQLite/MySQL/PostgreSQL + read-only guard + approval gate + stats/CSV |
@@ -91,6 +91,7 @@ node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --repor
 node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --contracts-only --json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/smoke-report.json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/install-report.json
+node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --registry-components --registry-suite --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/registry-report.json
 ```
 
 `--workspace-root` selects the parent of the component repositories. `--report` saves JSON, `--json` prints only JSON, and failures return a nonzero exit status. `--contracts-only` validates existing `lib/` artifacts without rebuilding or running unit tests.

package/README.md

@@ -17,7 +17,7 @@ node scripts/verify-compat.mjs --harness-root <harness 检出>   # 或在套件
 
 ## 兼容性
 
-验证宿主：官方源码构建的 Harness `0.2.0-rc.1`（commit `407e65c8`）+ Node `24.16.0`（2026-09-29 复核）。本仓库是组合包（不含独立测试），套件内 18 个组件在同一宿主中共同加载并通过契约检查：共注册 99 个工具、35 个技能，工具 schema 与健康检查契约全部通过。本轮未启用真实端口与外部服务。
+验证宿主：官方发布标签源码构建的 Harness `0.2.0-rc.2`（commit `639ed01539`）+ Windows / Node `24.16.0`。18 个组件共同加载，注册 99 个工具、35 个技能，工具 schema 与健康检查契约通过。套件另有 11 项清单、锁文件与离线环境测试。0.2.9 升级 Calendar 0.9.3 和 RSS 0.4.3，修复连接表单及订阅 URL 比较问题；其余组件保持已验证版本。验证范围与桌面、真实服务限制见 [本轮验收记录](docs/validation-2026-10-01-calendar-rss.md)，此前的 Dream、Email 和 Slack 修复见 [0.2.8 记录](docs/validation-2026-10-01.md)。
 
 ## 安装
 
@@ -59,11 +59,11 @@ dsh plugin --profile web remove @stardustlc/dsh-suite
 | | dsh-calendar | CalDAV 日程查建改删搜（Google/iCloud/Nextcloud/自建）；设置页里带月/周/议程面板（记住上次视图、周视图从 07:00 起、**拖动即可改期**），连接配置在面板内填写并先测后存 |
 | | dsh-rss | RSS/Atom 订阅 + 跨订阅搜索 + 增量抓取 |
 | | dsh-cite | Crossref 文献检索 + 四种引文格式 + BibTeX |
-| | dsh-dream | 会话回放 → 反思 → 梦境日记 → 桥接 AGENTS.md（含隐私脱敏） |
+| | dsh-dream | 会话回放 → 来源核验 → 经验审阅 → 项目规则预览、写入与回滚（含隐私脱敏） |
 | 🎬 媒体工坊 | dsh-ffmpeg | 探测/剪辑/拼接/转码/字幕/抽帧/GIF/调整（变速·音量·静音·旋转）十工具 |
 | | dsh-voice | edge-tts 合成 + ASR 转写 + 音色试听 |
 | | dsh-ppt | 一句话生成 HTML 放映 + PPTX 导出：7 页型（金句/表格）+ 演讲者备注 |
-| | dsh-hyperframes | HyperFrames by HeyGen 官方视频技能（20 个上游技能） |
+| | dsh-hyperframes | HyperFrames by HeyGen 官方视频技能（21 个上游技能） |
 | | dsh-remotion | Remotion React 编程式视频技能 |
 | 🔧 DevOps | dsh-docker | 容器七工具（含 health 自检）+ exec 审批门（@stardustlc/dsh-docker） |
 | | dsh-sql | SQLite/MySQL/PostgreSQL + 只读保护 + 审批门 + 统计/CSV |
@@ -108,6 +108,7 @@ node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --repor
 node scripts/verify-local.mjs --harness-root C:/path/to/deepseek-harness --contracts-only --json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/smoke-report.json
 node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/install-report.json
+node scripts/smoke-harness.mjs --harness-root C:/path/to/deepseek-harness --install-tarballs ../.harness-validation/tarballs.json --registry-components --registry-suite --contract-report ../.harness-validation/offline-report.json --report ../.harness-validation/registry-report.json
 ```
 
 `--workspace-root` 可指定组件父目录；`--report` 保存 JSON，`--json` 让标准输出只包含 JSON。任何构建、测试或契约失败均返回非零退出码。`--contracts-only` 跳过重建与单元测试，检查当前 `lib/` 产物。

package/docs/validation-2026-10-01-calendar-rss.md

@@ -0,0 +1,27 @@
+# 0.2.9 validation / 验收记录
+
+## Changes
+
+Calendar 0.9.3 fixes three connection-form defects: switching from Google to a Basic-auth provider no longer inherits OAuth, environment credentials report their presence without exposing their values, and editing a connection draft clears the previous test result. RSS 0.4.3 preserves case-sensitive URL paths and query parameters during add, remove, OPML import and search while normalizing schemes, hosts and default ports.
+
+The suite pins both versions in its manifest and frozen lockfile. The other 16 component pins remain unchanged from 0.2.8.
+
+## Windows and host validation
+
+Calendar passes 178 tests and RSS passes 81. Four new regression cases in each component reproduced failures before the fixes. Fresh tarball installation checks verify every shipped lib file against the tested source artifact and pass 32 Calendar backend tests and four RSS URL tests.
+
+Official-source Harness 0.2.0-rc.2, commit `639ed01539`, mounts all 18 components. The full tool and skill contracts pass with 99 plugin tools and 35 plugin skills. The suite's 11 manifest, lockfile and offline-environment checks verify the component pins and registry integrity.
+
+Calendar browser acceptance uses an isolated E: profile with synthetic credentials and a local CalDAV HTTP fixture. It exercises Google-to-iCloud provider switching, connection testing, saving, event editing, clearing an outdated test result, discarding an edited connection draft, and month/week/agenda views. Visual checks cover 1280px and 900px windows. The fixture records authenticated REPORT/PUT requests and verifies that the environment password is not persisted in the profile. This establishes the shared plugin interface and protocol workflow, rather than authentication against a production provider.
+
+The release artifact is gated on official-CLI installation of the suite with all 18 components resolved from npm. This checks exact versions, tarball integrity, component loading, the full tool/skill inventory, minimal-PTC preset mounting and web authentication. The suite stays the single profile layer, avoiding duplicate direct component entries.
+
+## Feedback and limits
+
+The current audit covers 20 active dsh-* repositories. Open feedback remains in Email: issues #16, #17 and #20 are covered by existing releases; PR #18 conflicts with current code and its goal is already implemented. Issue #19 is a feature consultation about recipient policies, not a reported defect. This round does not merge the conflicting PR or post or close feedback.
+
+RSS subscription management UI, Email recipient policies and Dream experience-review feedback are feature proposals and are not shipped in this release.
+
+The earlier Email browser resource remains blocked and was not retested through another port or tool. This round does not establish production Google/iCloud, mail or Slack account success. Shared Web tests can support desktop plugin compatibility, but they do not establish Electron startup, native integration or all desktop UI flows. Native desktop acceptance remains separate.
+
+A separate read-only desktop check after the user opened the app finds the main process and its backend running, with a loopback listening port and no new startup crash log. The desktop profile links all 18 current component sources, including Calendar 0.9.3 and RSS 0.4.3. These checks do not inspect the desktop's complete runtime tool inventory or exercise native UI flows, and do not alter the foreground window or account configuration.

package/docs/validation-2026-10-01.md

@@ -0,0 +1,41 @@
+# 0.2.8 validation / 验收记录
+
+## Host and component scope
+
+Harness was built on Windows from the official `dsh-v0.2.0-rc.2` tag, commit `639ed01539`, using the frozen lockfile. The built CLI reports `0.2.0-rc.2`. Validation uses an isolated home on E: and excludes the user's service credentials.
+
+All 18 components load together: 99 tools, 35 skills, TypeScript/Python PTC catalogs, 19 output-schema checks and two skill-registry loss/recovery checks pass. Health fixtures validate responses; they do not establish real external-service readiness.
+
+The 18-component offline baseline passed 1,406 tests, with two default skips. Email's ten new regression tests bring the combined results from the component runs to 1,416 passes and two skips. Email 0.14.5 itself passes 295 tests. These are results from component runs, not a claim that every real service or native UI was exercised.
+
+This release pins Dream 0.6.0, Email 0.14.5, HyperFrames 0.4.2 and Slack 0.3.3. The suite's nine manifest/lockfile tests and two offline-environment tests all pass. The outdated lockfile reproduced `ERR_PNPM_OUTDATED_LOCKFILE`; a regression now checks every component's declared version, resolved version and registry integrity. Frozen source installation passes with pnpm 11.7.0. Both npm installation and source installation use the same component pins.
+
+The workspace's release-age exceptions name the 18 first-party components and three reviewed, exact versions from the new Slack SDK release (`@slack/socket-mode@3.1.0`, `@slack/types@3.2.0`, `@slack/web-api@8.2.0`). Component-name exclusions work in the tested pnpm 11.7 frozen installation; version-qualified exclusions rejected the newly published Dream and Email packages in that check. All other third-party dependencies retain the package manager's release-age policy, and all component versions remain exact manifest/lockfile pins.
+
+The built official CLI also started an isolated profile with all 18 local components. Every expected tool and skill was present, both media skill health checks passed, and the minimal-PTC preset mounted into an actual agent with `run_code` as its model tool. The launch token exchanged for a cookie (303), the unauthenticated index returned 401 and the authenticated index returned HTML (200). The fixture process then closed. The host additionally supplies one Windows sandbox skill, giving 36 skills in that startup profile.
+
+The release artifact is also gated on installation through the official CLI with all 18 components resolved from npm. That check compares registry tarball integrity, exact installed versions, the full tool/skill inventory, preset mounting and web authentication. Components must be transitive dependencies of the suite without duplicate direct profile layers.
+
+The installation review also found an unmet peer: Socket Mode SDK 3.0.1 requires Undici 7, but the combined dependency graph selected Undici 8. Slack 0.3.3 requires the official SDK 3.1 or newer, which supports Undici 7/8, and explicitly declares the matching transport dependency. Its package acceptance fixture installs a host Undici 8 alongside the plugin and checks that the installed SDK supports and resolves that transport, constructs a Socket Mode client and exports the plugin entry. Both README languages ship in the npm artifact. This check does not connect to a real Slack workspace.
+
+## Open feedback checked on 2026-10-01
+
+Twenty active `STARDUSTLC666/dsh-*` repositories were checked through GitHub. Only Email had open issues or pull requests at the check time.
+
+| Feedback | Evaluation and disposition |
+| --- | --- |
+| [Email #20](https://github.com/STARDUSTLC666/dsh-email/issues/20) | Reproduced. Fixed in 0.14.5: a named provider uses its own endpoints; card saves do not persist resolved default-card endpoints as shared settings. Explicit account endpoints, shared transport budgets and legacy inheritance remain supported. |
+| [Email #16](https://github.com/STARDUSTLC666/dsh-email/issues/16) | The newer SettingsForms API is already supported. Registration is optional; current tests cover modern settings and startup. |
+| [Email #17](https://github.com/STARDUSTLC666/dsh-email/issues/17) | Saved blank-host placeholders were already normalized in 0.14.2, including migration. Explicit custom ports and TLS choices are covered by regression tests. |
+| [Email PR #18](https://github.com/STARDUSTLC666/dsh-email/pull/18) | Targets the older settings implementation. The released fix covers both old and modern paths, so this PR is not applied over the newer implementation. |
+| [Email #19](https://github.com/STARDUSTLC666/dsh-email/issues/19) | Feature consultation. The explicit `sendApproval: false` option already exists. Recipient allow/deny lists need a separate policy covering multiple recipients, reply/forward behavior and host approval precedence. This maintenance release keeps existing approval behavior. |
+
+No public comments were posted and no issues or contributor PRs were closed as part of this audit.
+
+## Human operation and limits
+
+Dream 0.6.0 was tested in the actual Harness web UI with isolated data: tabs, filtering, long-content expansion, source/conflict review forms, generated commands and rollback preservation. Light and dark themes were inspected at wide and narrow viewports. The installed native desktop's Dream settings page also renders.
+
+Email's native Windows settings were exercised for adding a temporary card, Outlook/Gmail provider changes, automatic saving and deleting the temporary card. The original desktop configuration bytes were restored. These operations exposed the empty-address test and stale application-ID hint bugs; the final fixes have component behavior regressions but have not been retested in the native UI. A separate browser fixture was blocked by the browser's access policy and is not counted as successful UI verification.
+
+Successful real Outlook authorization, mailbox login, sending, Slack/DingTalk delivery, CalDAV mutations and production media rendering were not verified. Native human-operation checks for every one of the 18 components remain a separate validation scope.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardustlc/dsh-suite",
-  "version": "0.2.6",
+  "version": "0.2.9",
   "description": "DSH 插件全家桶：18 个组件覆盖邮件、日历、媒体创作、开发运维、消息通知与极简 PTC，一条命令安装。",
   "type": "module",
   "dsh": {
@@ -16,7 +16,9 @@
     "README.md",
     "README.en.md",
     "ptc-minimal.patch.yml",
-    "docs/validation-2026-09-27.md"
+    "docs/validation-2026-09-27.md",
+    "docs/validation-2026-10-01.md",
+    "docs/validation-2026-10-01-calendar-rss.md"
   ],
   "scripts": {
     "test": "node --test \"test/*.test.mjs\"",
@@ -42,21 +44,21 @@
   },
   "dependencies": {
     "@stardustlc/dsh-docker": "0.3.4",
-    "@stardustlc/dsh-dream": "0.5.0",
-    "dsh-calendar": "0.9.2",
+    "@stardustlc/dsh-dream": "0.6.0",
+    "dsh-calendar": "0.9.3",
     "dsh-cite": "0.3.5",
     "dsh-code-security": "0.3.6",
     "dsh-codex-port": "0.2.4",
     "dsh-dingtalk": "0.2.2",
-    "dsh-email": "0.14.4",
+    "dsh-email": "0.14.5",
     "dsh-ffmpeg": "0.4.4",
     "dsh-flakefinder": "0.3.4",
-    "dsh-hyperframes": "0.4.1",
+    "dsh-hyperframes": "0.4.2",
     "dsh-minimal-ptc": "0.5.2",
     "dsh-ppt": "0.5.1",
     "dsh-remotion": "0.3.4",
-    "dsh-rss": "0.4.2",
-    "dsh-slack": "0.3.2",
+    "dsh-rss": "0.4.3",
+    "dsh-slack": "0.3.3",
     "dsh-sql": "0.4.4",
     "dsh-voice": "0.3.5"
   },