@stofone/dsh-agent-roster 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/) 与 [SemVer](https://semver.org/lang/zh-CN/)。
 
+## [0.6.1] - 2026-10-30
+
+### Custom registry mirror
+
+- New config field `registryMirror`: type any npm registry URL in Settings (download section)
+  and index packages published as npm packages are fetched from there instead of the region
+  presets. Sub-paths are kept, so corporate Nexus layouts such as
+  `http://nexus.corp.local/repository/npm` work.
+- Precedence: a registry pinned inside a source wins, then `registryMirror`, then `region`.
+  A blank or malformed value is ignored instead of silently disabling downloads.
+- Tests: 195 passing (mirror normalisation, precedence, config-view passthrough).
+
+## [0.6.0] - 2026-10-30
+
+### Captain verification and applying a roster
+
+- The panel now compares an archive's `captain` block with what the deployment actually says:
+  provider / model / reasoning-effort / persona prefix are read from every profile's
+  `cordis.patch.yml` and reported as `match`, `differ`, `undeclared` or `unknown`.
+  Unreadable deployment config is never reported as a pass.
+- New `POST /plugins/dsh-agent-roster/apply`: picks an existing session or creates a new one,
+  applies the declared model to that session, and queues a prompt that builds the team with
+  `agent_teams_create` + `agent_teams_add_member` + `roster_verify`. The plugin still never
+  creates teams itself.
+- `/library` now also returns the session list (read-only) and the captain section.
+- `roster_verify` reports the captain checks next to the member checks.
+- Panel: captain card inside each archive with the declared routing, the four-state checks and an
+  "apply" row (existing session / new session + optional working directory).
+- Locale dictionary gained the `captain` section in both languages.
+- Header actions moved to where they act: import/new archive on the archive tab, "refresh sources"
+  on the sources tab (bypasses the TTL and re-reads the index), and a gear button that opens a
+  settings dialog (language, download region, roster directories, resolved paths).
+- The panel fills the whole page (no `max-width` on the outer container) and the archive
+  list gains a tag pool on the left: every tag in the library with its count, multi-select
+  narrows with AND semantics, one click clears.
+
 ## [0.5.1] - 2026-10-29
 
 ### Fixed

package/README.md

@@ -1,5 +1,7 @@
 # @stofone/dsh-agent-roster
 
+**English** | [简体中文](README.zh.md)
+
 Static member rosters for multi-agent teams in the [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness).
 
 A roster is a file on disk: who is on the team, what each member is for, which model route they use, and which tools they are allowed to touch. This plugin defines that file format, validates it, and translates it into `agent_teams_*` call arguments — nothing more.
@@ -166,8 +168,34 @@ All five are read-only with respect to team state. `roster_create` only produces
 
 `roster_list`, `roster_show`, `roster_create` and `roster_verify` all accept a `path` argument: when given, it is the library root, with no silent fallback to the configured directory.
 
+### Captain verification
+
+An archive's `captain` block is a declaration. The captain is the session that creates the team — it
+has no member row, its model comes from the deployment (`agent-default-model`) and its persona from
+the agent preset. The panel therefore **compares** instead of pretending to write: the Settings row
+shows the deployed provider / model per profile, and every archive with a captain block reports
+`match` / `differ` / `undeclared` / `unknown` per field. When the deployment cannot be read the
+state is `unknown`, never "passed".
+
+The **apply** action is the one write the panel offers here: it switches the chosen session to the
+declared model and queues a prompt that calls `agent_teams_create`, `agent_teams_add_member` per
+member and finally `roster_verify`. Creating the team stays with the runtime.
+
 ## Sidebar panel
 
+The panel takes the full page width; nothing constrains it to a reading column. The archive list has
+a **tag pool** on the left: every tag present in the library, with how many archives carry it. Clicking
+tags narrows the list — multiple selections are ANDed — and one button clears the selection. The tag
+pool is a filtered view only; it never writes tags back to files.
+
+Header actions follow the place they act on: **Import** and **New archive** sit in the archive tab
+next to the search box, **Refresh sources** sits in the sources tab (it bypasses the one-hour cache and
+re-reads the public index), and the header keeps a single **gear button** that opens the settings dialog.
+The dialog edits the language, the download region, the mirror address and the roster directories, and shows the resolved
+data directory, the team state directory and the version.
+
+A badge at the top summarises how many items need attention
+
 The client plugin adds an **Agent Roster** entry to the left sidebar: one row in the `sidebar.panellist` slot plus the matching key in the `main` slot. Clicking the row opens a full-width page with three tabs — the panel is not only a viewer:
 
 | Tab | What you can do |
@@ -205,6 +233,7 @@ repository's `index/registry.json`, and anyone who subscribes can see them in th
 | `/plugins/dsh-agent-roster/library` | GET | panel snapshot: libraries, rosters, teams, hints, counts, remote sources |
 | `/plugins/dsh-agent-roster/document` | GET | one roster's raw text plus its parsed form (editor) |
 | `/plugins/dsh-agent-roster/rosters` | POST | create / update / delete / import / export one roster |
+| `/plugins/dsh-agent-roster/apply` | POST | apply an archive's captain to an existing or new session and queue the team-building prompt |
 | `/plugins/dsh-agent-roster/collection` | GET | fetch one collection's rosters read-only (nothing is written) |
 | `/plugins/dsh-agent-roster/install` | POST | write one collection into the local library (idempotent, no overwrite by default) |
 | `/plugins/dsh-agent-roster/locale` | GET | `en` / `zh` dictionary for the panel |
@@ -220,7 +249,8 @@ All six are `exact` routes behind the host's `connection` fence and answer `405`
 | `agentTeamsStateDir` | `.agent-teams` | read only: where `roster_verify` and the Teams tab look for team state |
 | `language` | `"auto"` | panel language: `auto` follows DSH, or pin `zh` / `en` |
 | `indexes` | `[]` | public registry sources: an `https` `registry.json` or `npm:pkg`. Empty means the official source; `false` means local-only |
-| `region` | `"auto"` | download region: `china` reads npm-style index packages from the Tencent mirror; `auto` equals `global` (no probing, one less request) |
+| `region` | `"auto"` | download region: `china` reads npm-style index packages from the Tencent mirror; `auto` equals `global` (no probing, one less request) |
+| `registryMirror` | `""` | custom npm registry for download sources, e.g. `https://registry.npmmirror.com` or `http://nexus.corp.local/repository/npm`. Set it and it beats `region`; a registry pinned inside a source still beats both. Empty means no custom mirror |
 
 All six are `volatile`: changes apply immediately, no host restart.
 
@@ -245,7 +275,7 @@ An empty library is not an error. A missing one is reported as info, not error.
 
 ```bash
 npm install
-npm test          # node --test, 163 cases
+npm test          # node --test, 191 cases
 npm run smoke     # registers the tools against a real DSH bundle, asserts lossless output
 node scripts/check-locale.mjs   # static t() keys must exist in both dictionaries
 ```
@@ -269,7 +299,7 @@ test/             unit tests
 
 Verified on this machine:
 
-- `npm test` — 163/163 passing (format, parse, validate, registry, paths, bridge, verify, lossless JSON, write plan/apply, all routes, panel snapshot and hints, dictionary consistency, tool contracts, client loader contract, library snapshot, config view, package manifest, declared fields and captain block, schema/constant alignment, remote registry and one-click install).
+- `npm test` — 191/191 passing (format, parse, validate, registry, paths, bridge, verify, lossless JSON, write plan/apply, all routes, panel snapshot and hints, dictionary consistency, tool contracts, client loader contract, library snapshot, config view, package manifest, declared fields and captain block, schema/constant alignment, remote registry and one-click install).
 - `npm run smoke` — `apply()` registers all five tools through a real `defineTool` from a DSH bundle; `roster_list` / `roster_show` / `roster_create` / `roster_verify` execute, every output survives `lossless` checks, `path` overrides are honored, effect disposal runs cleanly. The same command then loads `client.js` against a stubbed module table and asserts the three slot registrations, style injection and effect disposal.
 - CLI: `validate --dir examples` returns exit 0 over both example libraries.
 - Installed into a real profile with the plugin manager (`plugin_manager install_bundle` against this directory → `link:` dependency + bundle entry); the profile re-reads the linked files on restart.

package/README.zh.md

@@ -1,5 +1,7 @@
 # @stofone/dsh-agent-roster
 
+[English](README.md) | **简体中文**
+
 面向多 Agent 团队的**静态成员档案**插件（DeepSeek Harness）。
 
 一份档案就是磁盘上的一个文件：团队里有谁、各自负责什么、走哪个模型路由、被允许碰哪些工具。本插件定义这套格式、校验它，并把它翻译成 `agent_teams_*` 的调用参数——仅此而已。
@@ -162,8 +164,27 @@ npx dsh-agent-roster list
 
 三个带路径的工具（`roster_list` / `roster_show` / `roster_create`）都接受 `path` 参数：给了就只看那个目录，不会悄悄回落到配置目录。
 
+### 队长核对
+
+档案里的 `captain` 段是声明。队长就是创建团队的那个会话——它没有成员行，模型来自部署
+（`agent-default-model`），人格来自 agent preset。所以面板做的是**核对**，不是假装能写：
+设置页显示每个 profile 里实际部署的 provider / model，每份带 captain 段的档案按字段报
+「一致 / 不一致 / 未声明 / 无法核对」。读不到部署配置时是「无法核对」，永远不会写成“通过”。
+
+**应用**是这块唯一会写入的动作：把选中会话切到声明里的模型，并排入一段提示词，让它依次调用
+`agent_teams_create`、逐成员 `agent_teams_add_member`，最后 `roster_verify` 核对。
+团队仍由运行时创建，插件不代劳。
+
 ## 左侧栏面板
 
+面板铺满整个页面宽度，外层容器不设阅读列宽度。档案列表左侧是**标签池**：列出全库出现过的标签
+以及各标签的档案数，点标签即筛选——多选是「且」，一个按钮清除选择。标签池只影响视图，不会把
+标签写回文件。
+
+头部只留一个齿轮按钮打开**设置弹窗**：语言、下载区、镜像地址、档案库目录都能在这里改；解析出来的数据目录、
+团队状态目录与版本号也列在同一处。导入与新建档案挪到档案页签的搜索框右侧，刷新只属于档案源页签
+（绕过一小时的缓存，直接回源读公共索引）。
+
 客户端插件在左侧全局栏新增一行 **Agent Roster** 图标（`sidebar.panellist` 列表槽），并在 `main` 槽用同一个面板 id 注册整页内容；点图标即在主区域打开，宽度与对话页一致。面板分三个页签，不只是看：
 
 | 页签 | 能做什么 |
@@ -199,6 +220,7 @@ npx dsh-agent-roster list
 | `/plugins/dsh-agent-roster/library` | GET | 面板快照：工作区、档案库、档案、团队、提示、计数、远端源状态 |
 | `/plugins/dsh-agent-roster/document` | GET | 单份档案的原文与解析结果（编辑器用） |
 | `/plugins/dsh-agent-roster/rosters` | POST | 新建 / 更新 / 删除 / 导入 / 导出单份档案 |
+| `/plugins/dsh-agent-roster/apply` | POST | 把档案里的队长应用到已有会话或新会话，并排入建团队提示词 |
 | `/plugins/dsh-agent-roster/collection` | GET | 拉取某个 collection 的档案内容（只读，不落盘） |
 | `/plugins/dsh-agent-roster/install` | POST | 把某个 collection 落盘到本机档案库（幂等，默认不覆盖） |
 | `/plugins/dsh-agent-roster/locale` | GET | 面板词典（`en` / `zh`） |
@@ -215,6 +237,7 @@ npx dsh-agent-roster list
 | `language` | `"auto"` | 面板语言：`auto` 跟随 DSH，或固定 `zh` / `en` |
 | `indexes` | `[]` | 公共档案源：`https` 的 `registry.json` 或 `npm:pkg`。留空 = 官方源；显式 `false` = 只在本机库工作 |
 | `region` | `"auto"` | 下载区：`china` 时用腾讯 npm 镜像读 npm 形式的目录包；`auto` 等同 `global`（不自动探测，省一次出网） |
+| `registryMirror` | `""` | 自定义 npm 镜像地址（如 `https://registry.npmmirror.com`、`http://nexus.corp.local/repository/npm`）。填了它优先于 `region`；源里自己写死的 registry 又优先于它。留空 = 不用自定义镜像 |
 
 六项都是 `volatile`：改完立即生效，无需重启。
 
@@ -239,7 +262,7 @@ npx dsh-agent-roster list
 
 ```bash
 npm install
-npm test          # node --test，163 个用例
+npm test          # node --test，191 个用例
 npm run smoke     # 用真实 DSH bundle 注册工具，断言输出可无损往返
 node scripts/check-locale.mjs   # client.js 里的静态 t() 键必须两本词典都有
 ```
@@ -261,7 +284,7 @@ test/             单测
 
 本机已验证：
 
-- `npm test` —— 163/163 通过（格式、解析、校验、扫描、路径、桥接、核对、无损 JSON、写入计划与执行、六条路由、快照与提示、两本词典一致、工具契约、客户端加载器契约、包清单、配置视图、样式 token 约束、声明层字段与队长段、schema 与常量对齐）。
+- `npm test` —— 191/191 通过（格式、解析、校验、扫描、路径、桥接、核对、无损 JSON、写入计划与执行、六条路由、快照与提示、两本词典一致、工具契约、客户端加载器契约、包清单、配置视图、样式 token 约束、声明层字段与队长段、schema 与常量对齐）。
 - `npm run smoke` —— 用真实 DSH bundle 的 `defineTool` 注册五个工具，逐个调用：输出全部通过无损校验、`path` 覆盖生效、释放干净；同一条命令随后用桩模块表加载 `client.js`，断言三处槽位注册、样式只注入一次、effect 可回收。
 - CLI：`validate --dir examples` 对两座示例库退出码 0。
 - 用插件管理器真的装进了本机 profile（`plugin_manager install_bundle` 指向本仓库 → `link:` 依赖 + bundle 条目），重启后按链接读取本仓库文件。