@stofone/dsh-agent-roster 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,80 @@
 
 遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/) 与 [SemVer](https://semver.org/lang/zh-CN/)。
 
+## [Unreleased]
+
+## [0.7.0] - 2026-11-02
+
+### Honest verification (issue #2)
+
+- **`omitted` is split in two.** "The roster did not declare this field" and "the roster declared
+  a value, the runtime never persisted it" used to collapse into one status that the summary
+  counted as "not degraded". They are now `omitted` (nothing to check, expected) and
+  `not-persisted` (sent, no receipt, counted as degraded). `systemPrompt` lands in the second
+  bucket because `team.json` members have no `executionPrompt` key at all — the persona was
+  never actually verified before.
+- **One predicate instead of three.** `isBindingFaithful` now delegates to
+  `summarizeBinding(...).faithful`, so the note and the implementation cannot drift apart again.
+- **Four mutually exclusive buckets** in `roster_verify`: `faithful` / `unverified` / `drift` /
+  `missing`. `ok` requires `drift === 0 && missing === 0`, and `unverified` is printed on the
+  status line and the summary instead of hiding inside "degraded".
+- **Materialised tool filters are visible.** Each member shows `deny`/`allow` counts and a
+  digest of the normalised list; the same `toolPolicy` materialising into two different deny
+  lists inside one team is reported as policy drift.
+- **Provenance.** `roster_create` emits `roster:<id>@<version>#<sha8>` for the created team's
+  description; `roster_verify` parses it back and reports `absent` / `id-only` / `match` /
+  `differ` / `unknown-roster`. The plugin still never writes team state.
+- **New tool `roster_diff`** — roster-to-roster diff for generation hand-over: members matched
+  by name (`aliases` are a hint, never auto-merged), effective values compared with their
+  origin, persona compared by length and hash only.
+
+### Capability requirements (new sibling file)
+
+- **`capabilities.yaml`** — an optional file next to `roster.yaml` that declares what the
+  deployment must provide: `requires.skills`, `requires.toolPolicies`, `onMissing`
+  (`refuse` | `degraded`), `asOf` (date only) and `notes`. Unknown keys and unknown requirement
+  categories are errors: model routing, plugin versions, credential pointers and business
+  preconditions have no evidence source, so declaring them would only manufacture a new kind of
+  false green.
+- **Three states, not two.** `checkCapabilities` answers `present` / `missing` / `unknown`;
+  only `missing` (the evidence source explicitly says no) trips the gate. `unknown` is neither a
+  pass nor a failure and is always printed.
+- **`roster_create` refuses instead of warning.** With a `missing` requirement under
+  `onMissing: refuse` it emits no `agent_teams_add_member` argument at all and prints where each
+  requirement has to be installed. `onMissing: degraded` hands over the arguments and records
+  the debt.
+- **`roster_verify`** gains `requires=<missing>missing/<declared>` and `capabilityBlocked` in its
+  status line, a capability section in the body, `ok` includes `capabilityBlocked === 0`, and a
+  structured `capabilities` field.
+- **`roster_show`** prints the declaration block.
+- New `schema/capabilities.v1.schema.json`, pinned to `lib/capabilities.js` by
+  `test/capabilities.test.js`.
+
+- **The panel sees it.** Capability requirements surface as roster diagnostics: a missing
+  `toolPolicies` requirement is `error` under `refuse` (the sidebar badge turns red) and `warn`
+  under `degraded`; skill requirements are `capability-skills-unverified` / `info` because the
+  panel snapshot is synchronous and cannot enumerate the catalogue; an unset `knownToolPolicies`
+  yields one `capability-cross-check-skipped` entry naming the affected rosters.
+
+### Docs
+
+- README (both languages): six tools, the new verification buckets, `roster_diff`, a
+  "one roster per directory, two generations per machine" section answering how to keep both
+  generations side by side, and a "capability requirements" section covering the three-state
+  check and the gate.
+
+## [0.6.2] - 2026-10-30
+
+### Packaging
+
+- `peerDependencies` for `@deepseek-ai/dsh-tools` no longer uses the wildcard. node-semver only
+  admits a prerelease version when one comparator in the range shares its exact
+  `major.minor.patch` tuple and itself carries a prerelease tag, so `*` — like the broad
+  `>=0.0.1-rc.1 <0.2.0` form — silently excludes every prerelease harness build. The range is now
+  `^0.1.0-rc.1 || ^0.2.0-rc.1 || ^0.2.1-rc.1 || ^0.3.0-rc.1`, which admits the 0.1.x, 0.2.0-x,
+  0.2.1-x and 0.3.x prerelease lines while still refusing 0.4.x prereleases.
+- No runtime change; the peer stays optional because the host always provides the module.
+
 ## [0.6.1] - 2026-10-30
 
 ### Custom registry mirror
@@ -189,5 +263,6 @@
 - 工具返回值含 `undefined` 键，运行时按 `value is not lossless JSON` 整次拒绝；缺失值统一写 `null`，
   且所有返回值先过 `lib/json.js#lossless`。
 
-[Unreleased]: https://github.com/STofone/dsh-agent-roster/compare/v0.2.0...main
+[Unreleased]: https://github.com/STofone/dsh-agent-roster/compare/v0.7.0...main
+[0.7.0]: https://github.com/STofone/dsh-agent-roster/releases/tag/v0.7.0
 [0.2.0]: https://github.com/STofone/dsh-agent-roster/releases/tag/v0.2.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 STofone
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 STofone
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.