@xdxer/dingtalk-agent 0.1.5-beta.12 → 0.1.5-beta.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,14 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to `@xdxer/dingtalk-agent` are documented here. The project follows semantic versioning; prerelease entries describe release candidates and do not imply that Live canaries or registry publication have completed.
|
|
4
4
|
|
|
5
|
+
## 0.1.5-beta.13 - 2026-07-25
|
|
6
|
+
|
|
7
|
+
Evidence hygiene: a forgery negative that could not have caught the forgery it described now can, and it was proven by deleting the guard it protects. Ships on the `beta` dist-tag; `latest` stays at 0.1.4. Merged as PR #60.
|
|
8
|
+
|
|
9
|
+
### Fixed
|
|
10
|
+
|
|
11
|
+
- **A forgery negative that could not have caught the forgery it described (closes #53).** Scenario #75 claimed to cover "a hand-written receipt missing fields but with a self-consistent hash", and asserted only that the error contained `非法`. The fixture hashed with `digest(JSON.stringify(...))` while production uses `digest(stableStringify(...))` — so the file was never self-consistent under the real algorithm, and the refusal came from the hash mismatch rather than from the structural contract. Delete the strict field-set check and the scenario would have stayed green: the exact regression it exists to catch. The fixture now hashes the way production does (a forger can recompute a keyless integrity digest — that is the premise of #42's trust boundary), and the assertions bind to the stable structural reasons (`字段集必须恰为`, `id 与文件名不一致`) instead of the generic word. Verified by mutation: with the field-set check removed from the build, #75 fails. The scenario's `expected_output` also stops calling the digest a "签名 hash" in one sentence and disclaiming it in the next.
|
|
12
|
+
|
|
5
13
|
## 0.1.5-beta.12 - 2026-07-25
|
|
6
14
|
|
|
7
15
|
One unreachable path made reachable: the completion predicate a scheduled run is judged against now travels to that run as a managed artifact, instead of being a name the run holds with no body behind it. Ships on the `beta` dist-tag; `latest` stays at 0.1.4. Merged as PR #57.
|