@stofone/dsh-agent-roster 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -4,6 +4,40 @@
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-11-03
+
+### A tab that behaves like a marketplace, not a filter on a list
+
+0.12.0 put a search field above the tabs. That was still the wrong shape: search belonged to a page about
+collections, and browsing still meant "pick a source, then read". The panel now opens on its own **Library**
+tab — search, tags, and one list that spans this machine and every subscribed source.
+
+- `GET /plugins/dsh-agent-roster/catalog` returns every roster in view in one response: this machine plus
+  each subscribed collection, with tags, member counts, member roles and where each one lives.
+- The tag strip is a real filter: counts are computed from everything in view, multiple tags are AND, and
+  the selection never writes back to a file. The segmented control switches between **by source** (this
+  machine, then one group per collection) and **flat** (one list, source named per row).
+- Search keeps its own route and its own ranking (`lib/search.js`): two characters, 240 ms debounce, and the
+  in-flight request is aborted when you keep typing, so typing never queues requests.
+- Compiled artifacts now carry what it takes to be *found*: `source.title`, `description`, `tags`, `license`
+  and `maintainers`. A subscribed roster is one file (`dist/<id>-<ver>.json`) resolved through `files` in the
+  index — previously the artifact knew its id and version and nothing else, so remote results could only be
+  searched by id.
+- The panel's tag chips were inheriting the sidebar's full-width row form; they are now chips (own width,
+  pill border, count attached), and the narrow layout gets the same 18px gutter as the rest of the page.
+
+### Changed
+
+- The header lookup field is gone; its behaviour lives inside the Library tab. `lookup.*` strings were
+  replaced by `catalog.*` (both locales).
+- `flattenCompiledToRoster` and `rosterViewOf` now fall back to artifact metadata, so a remote roster keeps
+  its title and tags after being flattened into a v1 document.
+
+### Fixed
+
+- `GET /catalog` and search share one `gatherEntries()` path; before, each route assembled local + remote
+  entries itself, which is how a cache or concurrency fix lands in one and not the other.
+
 ## [0.12.0] - 2026-11-03
 
 ### The panel answers "which one", not "show me everything"
@@ -581,6 +615,7 @@ point is now one search field above the tabs.
   且所有返回值先过 `lib/json.js#lossless`。
 
 [Unreleased]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.12.0...main
+[0.13.0]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.11.1...v0.12.0
 [0.11.1]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/dsh-agent-roster/dsh-agent-roster/compare/v0.10.7...v0.11.0

package/README.md

@@ -306,22 +306,30 @@ id belongs to the team, and the plugin never writes team state. What it does own
 failure that only exists on a red card never reaches the next compile, which is exactly how a gate
 turns into decoration.
 
-## Find one roster, not a catalogue
+## The library tab: find by capability, not by source
 
-The panel used to open on a list of collections. That answers "what is published"; the question people
-actually arrive with is "who can do this". So the first control is now one search field above the tabs:
+The panel opens on **Library**, which is meant to read like a plugin marketplace: one search field, one row
+of tags, and one list that spans this machine and every subscribed source.
 
 ```
 要找什么能力？例：数据质量、发版、代码评审
 ```
 
-It searches this machine and every subscribed source in one request. Each row says **why** it matched
-(`标签：数据质量 · 成员角色：数据质量工程师`) and where it lives (`来自 agent-roster-collective`), and
-carries the action you need next — open it locally, or pull that collection from the row.
+Two characters in, after a 240 ms pause, the panel asks `/search` a question. Every row says **why** it
+matched (`标签：数据质量 · 成员角色：数据质量工程师`) and where it lives (`来自 agent-roster-collective`),
+and carries the next action — open it locally, or pull that collection — inside the row.
+
+With an empty field it **browses**: `/catalog` flattens this machine and the subscribed sources in one
+response, the tag strip summarises every tag in view with its count (multiple tags are AND), and the
+segmented control switches between **by source** (this machine, then one group per collection) and **flat**
+(one list, source named per row). Tag filtering is view state only; it never writes back to a file.
 
 Multiple words are AND, not OR: `data kubernetes` returns nothing rather than every roster that merely
-mentions "data". Ranking is a pure function in `lib/search.js`, so it is unit-tested rather than
-eyeballed.
+mentions "data". Ranking is a pure function in `lib/search.js`, so it is unit-tested rather than eyeballed.
+
+Subscribed rosters resolve through `files` in the index, which points at a concrete compiled artifact
+(`dist/<id>-<ver>.json`). The artifact carries its own title, description, tags, licence and maintainers,
+so finding a roster from a distance costs one file — not a clone.
 
 ## Tools
 
@@ -385,7 +393,7 @@ data directory, the team state directory and the version.
 
 A badge at the top summarises how many items need attention
 
-The client plugin adds an **Agent Roster** entry to the left sidebar: one row in the `sidebar.panellist` slot plus the matching key in the `main` slot. Clicking the row opens a full-width page with three tabs — the panel is not only a viewer:
+The client plugin adds an **Agent Roster** entry to the left sidebar: one row in the `sidebar.panellist` slot plus the matching key in the `main` slot. Clicking the row opens a full-width page with five tabs — the panel is not only a viewer:
 
 | Tab | What you can do |
 |---|---|
@@ -509,7 +517,7 @@ test/             unit tests
 
 Verified on this machine:
 
-- `npm test` — 307/307 passing (format, parse, validate, registry, paths, bridge, verify buckets, digests and provenance, roster diff, capability requirements and the capability gate, library organization, registry schema, lossless JSON, write plan/apply, all routes, panel snapshot and hints, dictionary consistency, tool contracts, client loader contract, library snapshot, config view, package manifest, declared fields and captain block, schema/constant alignment, the v2 role/roster/compiled layers and their schema alignment, v1→v2 migration, run records feeding the plan, remote registry and one-click install).
+- `npm test` — 308/308 passing (format, parse, validate, registry, paths, bridge, verify buckets, digests and provenance, roster diff, capability requirements and the capability gate, library organization, registry schema, lossless JSON, write plan/apply, all routes, panel snapshot and hints, dictionary consistency, tool contracts, client loader contract, library snapshot, config view, package manifest, declared fields and captain block, schema/constant alignment, the v2 role/roster/compiled layers and their schema alignment, v1→v2 migration, run records feeding the plan, remote registry and one-click install).
 - `npm run smoke` — `apply()` registers all six tools through a real `defineTool` from a DSH bundle; `roster_list` / `roster_show` / `roster_create` / `roster_verify` / `roster_diff` execute, every output survives `lossless` checks, `path` overrides are honored, effect disposal runs cleanly. The same command then loads `client.js` against a stubbed module table and asserts the three slot registrations, style injection and effect disposal.
 - CLI: `validate --dir examples` returns exit 0 over both example libraries.
 - Installed into a real profile with the plugin manager (`plugin_manager install_bundle` against this directory → `link:` dependency + bundle entry); the profile re-reads the linked files on restart.

package/README.zh.md

@@ -292,21 +292,27 @@ node bin/cli.mjs compile --roster examples-orchestration/rosters/core-review \
 
 回执由执行施工图的队长会话写，不由插件写：任务 id 属于团队，插件从不写团队状态。插件负责的是合并——只活在红卡上的失败，下一次编译就消失了，门也就变成了装饰。
 
-## 找一份档案，而不是翻一个目录
+## 档案库：按能力找，而不是按来源翻
 
-面板原来从「合集」进：先展开一个来源，再看里面有什么。那回答的是「发布了什么」，而人真正带来的
-问题是「谁会做这件事」。所以现在第一个控件就是页签上方的一个搜索框：
+面板的第一个页签是**档案库**，定位接近一个插件市场：一个搜索框、一排标签、一份横跨本机与所有订阅来源的清单。
 
 ```
 要找什么能力？例：数据质量、发版、代码评审
 ```
 
-一次请求同时搜本机与所有订阅来源。每一行都写清**为什么命中**（`标签：数据质量 · 成员角色：数据质量工程师`）
-与**它住在哪**（`来自 agent-roster-collective`），并且把下一步动作放在行内：本机的直接打开，远端的
-当场把这个集合拉下来。
+输入两个字以上，停顿 240 毫秒后向 `/search` 提一个问题。每一行都写清**为什么命中**
+（`标签：数据质量 · 成员角色：数据质量工程师`）与**它住在哪**（`来自 agent-roster-collective`），
+并把下一步放在行内：本机的「打开」，远端的「拉取」。
+
+不输入时是**浏览**：`/catalog` 一次把本机与订阅来源摊平返回；上方标签池汇总全库出现过的标签与计数，
+多选是「且」；右侧可以在**按来源**（本机 + 每个 collection 各一组）与**平铺**（一份清单，来源写在行内）
+之间切换。标签筛选只影响视图，不写回文件。
 
 多个词是「且」不是「或」：`data kubernetes` 一条都不返，而不是把所有提到 data 的档案都堆上来。
-排序逻辑是 `lib/search.js` 里的纯函数，因此它被单测钉住，而不是靠肉眼看着顺。
+排序是 `lib/search.js` 里的纯函数，所以它被单测钉住，而不是靠肉眼看着顺。
+
+订阅来源的档案在索引里由 `files` 指向具体的编译产物（`dist/<id>-<ver>.json`）。产物自带标题、描述、
+标签、许可与维护者——「从远处找一份档案」因此只需要拉一个文件，不必先克隆一个仓库。
 
 ## 工具
 
@@ -363,10 +369,11 @@ node bin/cli.mjs compile --roster examples-orchestration/rosters/core-review \
 团队状态目录与版本号也列在同一处。导入与新建档案挪到档案页签的搜索框右侧，刷新只属于档案源页签
 （绕过一小时的缓存，直接回源读公共索引）。
 
-客户端插件在左侧全局栏新增一行 **Agent Roster** 图标（`sidebar.panellist` 列表槽），并在 `main` 槽用同一个面板 id 注册整页内容；点图标即在主区域打开，宽度与对话页一致。面板分三个页签，不只是看：
+客户端插件在左侧全局栏新增一行 **Agent Roster** 图标（`sidebar.panellist` 列表槽），并在 `main` 槽用同一个面板 id 注册整页内容；点图标即在主区域打开，宽度与对话页一致。面板分五个页签，不只是看：
 
 | 页签 | 能做什么 |
 |---|---|
+| 档案库 | 按能力找档案：搜索（横跨本机与订阅来源，命中给出处）、标签筛选、按来源聚合或平铺，行内直接打开或拉取 |
 | 档案 | 浏览每个工作区 × 每座档案库，展开成员；**新建 / 编辑 / 复制 / 删除 / 导入 / 导出**档案。编辑器有表单与源码两种模式（源码就是文件原文）；写之前由宿主校验，覆盖已有文件会留一份 `.bak` |
 | 团队 | 读一个配置好的状态目录（默认 `.agent-teams`），列出运行时真正建出来的每个团队：档案、成员档案与模型路由、每个持久化成员是否真的与其档案一致，以及该团队的任务 |
 | 档案源 | 列出订阅的公共 registry 目录，每个 collection 一个「拉取到本机」按钮；可展开先看里面有哪些档案 |
@@ -479,7 +486,7 @@ test/             单测
 
 本机已验证：
 
-- `npm test` —— 307/307 通过（格式、解析、校验、扫描、路径、桥接、核对四桶、摘要与溯源、档案差异、能力要求与能力闸门、档案库组织、索引 schema、无损 JSON、写入计划与执行、六条路由、快照与提示、两本词典一致、工具契约、客户端加载器契约、包清单、配置视图、样式 token 约束、声明层字段与队长段、schema 与常量对齐、v2 角色/组装/编译三层及其 schema 对齐、v1→v2 迁移、执行回执并入施工图）。
+- `npm test` —— 308/308 通过（格式、解析、校验、扫描、路径、桥接、核对四桶、摘要与溯源、档案差异、能力要求与能力闸门、档案库组织、索引 schema、无损 JSON、写入计划与执行、六条路由、快照与提示、两本词典一致、工具契约、客户端加载器契约、包清单、配置视图、样式 token 约束、声明层字段与队长段、schema 与常量对齐、v2 角色/组装/编译三层及其 schema 对齐、v1→v2 迁移、执行回执并入施工图）。
 - `npm run smoke` —— 用真实 DSH bundle 的 `defineTool` 注册六个工具，逐个调用：输出全部通过无损校验、`path` 覆盖生效、释放干净；同一条命令随后用桩模块表加载 `client.js`，断言三处槽位注册、样式只注入一次、effect 可回收。
 - CLI：`validate --dir examples` 对两座示例库退出码 0。
 - 用插件管理器真的装进了本机 profile（`plugin_manager install_bundle` 指向本仓库 → `link:` 依赖 + bundle 条目），重启后按链接读取本仓库文件。