@stofone/dsh-agent-roster 0.10.4 → 0.10.6

package/CHANGELOG.md

@@ -4,6 +4,30 @@
 
 ## [Unreleased]
 
+## [0.10.6] - 2026-11-03
+
+### Fixed
+
+- **An index cached before an upgrade kept feeding the old shape.** The cache stored an index document
+  with no notion of what shape it had, so after upgrading to 0.10.3 — the release that added
+  `collection.files` — the panel kept reading a cached index without `files`, fell back to the v1 path, and
+  404'd. Caches now carry `CACHE_VERSION`; a mismatch refetches once.
+- A failed fetch on the v1 fallback path now says *why* it is likely failing: if the collection has no
+  `files` mapping, the diagnostic points at a stale index (refresh, or delete `.index-cache`) instead of
+  leaving a bare `HTTP 404`.
+
+## [0.10.5] - 2026-11-03
+
+### Fixed
+
+- **`roster_index` could not run at all.** Its `execute()` called `loadRemotePanel` and `fetchCollection`,
+  neither of which was imported; the module loaded fine and threw `ReferenceError` on the first call.
+  It now imports both, and a test executes the tool so this class of breakage cannot pass silently again.
+- **Every public collection answered HTTP 404.** `loadRemotePanel` rebuilds each registry collection from
+  an explicit field list, and `files` was not on it — so every URL fell back to the v1 path
+  `<id>/roster.yaml`, which no longer exists for a v2 library. The projection keeps `files` now, with a
+  test that fails if the field is dropped again.
+
 ## [0.10.4] - 2026-11-03
 
 ### Fixed
@@ -500,7 +524,9 @@
 - 工具返回值含 `undefined` 键，运行时按 `value is not lossless JSON` 整次拒绝；缺失值统一写 `null`，
   且所有返回值先过 `lib/json.js#lossless`。
 
-[Unreleased]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.4...main
+[Unreleased]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.6...main
+[0.10.6]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.5...v0.10.6
+[0.10.5]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.4...v0.10.5
 [0.10.4]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.3...v0.10.4
 [0.10.3]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.2...v0.10.3
 [0.10.2]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.1...v0.10.2

package/README.md

@@ -480,7 +480,7 @@ test/             unit tests
 
 Verified on this machine:
 
-- `npm test` — 293/293 passing (format, parse, validate, registry, paths, bridge, verify buckets, digests and provenance, roster diff, capability requirements and the capability gate, library organization, registry schema, lossless JSON, write plan/apply, all routes, panel snapshot and hints, dictionary consistency, tool contracts, client loader contract, library snapshot, config view, package manifest, declared fields and captain block, schema/constant alignment, the v2 role/roster/compiled layers and their schema alignment, v1→v2 migration, run records feeding the plan, remote registry and one-click install).
+- `npm test` — 295/295 passing (format, parse, validate, registry, paths, bridge, verify buckets, digests and provenance, roster diff, capability requirements and the capability gate, library organization, registry schema, lossless JSON, write plan/apply, all routes, panel snapshot and hints, dictionary consistency, tool contracts, client loader contract, library snapshot, config view, package manifest, declared fields and captain block, schema/constant alignment, the v2 role/roster/compiled layers and their schema alignment, v1→v2 migration, run records feeding the plan, remote registry and one-click install).
 - `npm run smoke` — `apply()` registers all six tools through a real `defineTool` from a DSH bundle; `roster_list` / `roster_show` / `roster_create` / `roster_verify` / `roster_diff` execute, every output survives `lossless` checks, `path` overrides are honored, effect disposal runs cleanly. The same command then loads `client.js` against a stubbed module table and asserts the three slot registrations, style injection and effect disposal.
 - CLI: `validate --dir examples` returns exit 0 over both example libraries.
 - Installed into a real profile with the plugin manager (`plugin_manager install_bundle` against this directory → `link:` dependency + bundle entry); the profile re-reads the linked files on restart.

package/README.zh.md

@@ -454,7 +454,7 @@ test/             单测
 
 本机已验证：
 
-- `npm test` —— 293/293 通过（格式、解析、校验、扫描、路径、桥接、核对四桶、摘要与溯源、档案差异、能力要求与能力闸门、档案库组织、索引 schema、无损 JSON、写入计划与执行、六条路由、快照与提示、两本词典一致、工具契约、客户端加载器契约、包清单、配置视图、样式 token 约束、声明层字段与队长段、schema 与常量对齐、v2 角色/组装/编译三层及其 schema 对齐、v1→v2 迁移、执行回执并入施工图）。
+- `npm test` —— 295/295 通过（格式、解析、校验、扫描、路径、桥接、核对四桶、摘要与溯源、档案差异、能力要求与能力闸门、档案库组织、索引 schema、无损 JSON、写入计划与执行、六条路由、快照与提示、两本词典一致、工具契约、客户端加载器契约、包清单、配置视图、样式 token 约束、声明层字段与队长段、schema 与常量对齐、v2 角色/组装/编译三层及其 schema 对齐、v1→v2 迁移、执行回执并入施工图）。
 - `npm run smoke` —— 用真实 DSH bundle 的 `defineTool` 注册六个工具，逐个调用：输出全部通过无损校验、`path` 覆盖生效、释放干净；同一条命令随后用桩模块表加载 `client.js`，断言三处槽位注册、样式只注入一次、effect 可回收。
 - CLI：`validate --dir examples` 对两座示例库退出码 0。
 - 用插件管理器真的装进了本机 profile（`plugin_manager install_bundle` 指向本仓库 → `link:` 依赖 + bundle 条目），重启后按链接读取本仓库文件。

package/lib/remote.js

@@ -49,6 +49,15 @@ export const DEFAULT_REGISTRY_URL =
 /** 缓存目录名，放在档案库根下，跟着 `$DSH_HOME` 走。 */
 export const CACHE_DIR_NAME = ".index-cache";
 
+/**
+ * 索引缓存的语义版本。
+ *
+ * 缓存里存的是**索引的形状**，而形状会随插件版本变（0.10.3 给 collection 加了 `files`）。
+ * 不认版本号的缓存会在升级后继续提供旧形状，表现就是"面板明明装了新版，仍然 404"。
+ * 索引语义再变时把这里 +1，老缓存自动失效、重取一次。
+ */
+export const CACHE_VERSION = 2;
+
 /** entry 文件所在的仓库前缀（只支持 GitHub raw，不引入 git 协议）。 */
 export const GITHUB_RAW = "https://raw.githubusercontent.com";
 
@@ -266,6 +275,7 @@ export async function loadRegistry(source, options = {}) {
       });
     }
     writeCache(cachePath, {
+      cacheVersion: CACHE_VERSION,
       sourceId: source.id,
       fetchedAt: current,
       etag: fetched.etag,
@@ -567,6 +577,17 @@ export async function fetchCollection(collection, options = {}) {
     }
     if (loaded === null) {
       diagnostics.push(diagnostic("warn", "collection-fetch-failed", `${collection.id}/${rosterId} 拉取失败：${lastError || "未知原因"}`));
+      // 没有 files 映射时退回的是 v1 路径；v2 库在那条路径上必然 404。
+      // 这时最可能的原因是"索引是升级前缓存的"，提示一句比让用户猜有用。
+      if (listedPath === null) {
+        diagnostics.push(
+          diagnostic(
+            "info",
+            "index-may-be-stale",
+            `${collection.id} 的索引里没有 files 映射，回退到了 v1 路径；若刚升级过插件，先刷新索引（缓存按版本失效，也可删 .index-cache）`,
+          ),
+        );
+      }
       continue;
     }
     const parsed = parseDocumentText(loaded.text, { file: loaded.url });
@@ -669,6 +690,7 @@ export function cachePathFor(cacheDir, id) {
 function readCache(file) {
   try {
     const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (parsed?.cacheVersion !== CACHE_VERSION) return null;
     if (typeof parsed?.fetchedAt !== "number" || typeof parsed?.document !== "object" || parsed.document === null) return null;
     return parsed;
   } catch {

package/lib/service.js

@@ -461,6 +461,7 @@ export async function loadRemotePanel(config, options = {}) {
       repo: collection.repo,
       ref: collection.ref,
       path: collection.path,
+      files: collection.files,
       rosters: collection.rosters,
       tags: collection.tags,
       license: collection.license,

package/lib/tools.js

@@ -19,6 +19,8 @@ import { LIMITS } from "./format.js";
 import { resolveDirSpec } from "./home.js";
 import { lossless } from "./json.js";
 import { findRoster, loadRosterAt, scanRosterLibrary } from "./registry.js";
+import { fetchCollection } from "./remote.js";
+import { loadRemotePanel } from "./service.js";
 import {
   renderBridgePlan,
   renderCapabilityGate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stofone/dsh-agent-roster",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "description": "多 Agent 团队的静态成员档案定义与校验层：档案库在面板里看得见、改得动，团队成员的人设、模型与工具边界固化成可校验、可版本化的文件，并在 dsh-agent-teams 创建成员时把档案桥接给运行时。",
   "type": "module",
   "main": "index.js",