dsh-auto-review 0.10.2 → 0.10.4

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to `dsh-auto-review` are documented here. The repo is pre-release; versions follow the DeepSeek Harness `0.1.0-rc.x` target runtime and bump on every behavior change.
 
+## [0.10.4] - 2026-09-05
+
+### Fixed
+
+- `peerDependencies`: all 14 `@deepseek-ai/dsh-*` peer ranges moved from `>=0.1.0-rc.8 <0.2.0` to `>=0.1.2-rc.1 <0.2.0`. The old range matched only the `0.1.0-rc.8` line under bare (registry-driven) resolution while the `0.1.2-rc.1` production dependency wave demands `^0.1.2-rc.1` peers, so `pnpm install` of the packed tarball failed with `ERR_PNPM_NO_MATCHING_VERSION` (npm fell back to an ERESOLVE override). The range now resolves the `0.1.2-rc.1` line that the package actually ships against.
+
+## [0.10.3] - 2026-09-04
+
+### Changed
+
+- All `@deepseek-ai/dsh-*` runtime `dependencies` and dev pins moved from the published `0.1.2-alpha.5` line to `0.1.2-rc.1`; `@deepseek-ai/dsh-agent-spine-demo` stays on `0.1.1-rc.2` (no newer spine line is published).
+- `src/audit.ts`: `isUnmarkedHostVersion` now classifies the `0.1.2-rc.x` line as non-stamping (it ships the alpha.5 surface: the third append parameter is `SurfaceIntent` for surface event types only). Previously `0.1.2-rc.1` fell through the rc bound and was probed as marker-aware, which re-enabled session-log audit, broke the per-turn budget fold, and risked appending unmarked verdict events.
+- `scripts/check-host-versions.mjs`: a dev pin on the rc line now counts as covering the npm alpha line (rc outranks alpha within the same minor), keeping the host-compat job green after the bump.
+- Five-language READMEs: the harness table row now states `0.1.2-rc.1`.
+
 ## [0.10.2] - 2026-09-03
 
 ### Changed

package/README.es.md

@@ -26,7 +26,7 @@
 
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `0.1.2-alpha.5` (dependencias fijadas a `0.1.2-alpha.5`; peers `>=0.1.0-rc.8 <0.2.0`) 0.1.2-alpha.5 (adaptado el 2026-09-02): el sobre de sesión conserva su campo ignorable solo para compatibilidad de lectura de logs almacenados - Session.append aún no puede estamparlo, por lo que el comportamiento de la puerta no cambia. |
+| Harness | DeepSeek Harness `0.1.2-rc.1` (dependencias fijadas a `0.1.2-rc.1`; peers `>=0.1.0-rc.8 <0.2.0`) 0.1.2-rc.1 (adaptado el 2026-09-02): el sobre de sesión conserva su campo ignorable solo para compatibilidad de lectura de logs almacenados - Session.append aún no puede estamparlo, por lo que el comportamiento de la puerta no cambia. |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (answerer de host; panel web opcional mediante la capacidad de proyección de sesión) |
 | Modelo | Cualquiera (el revisor hereda la ruta del agente de sesión; `reviewerModel` la reemplaza) |
@@ -317,7 +317,7 @@ El servidor es de solo lectura y determinista: sin red, sin modelo, sin escritur
 
 - **Permisos**: el manifiesto del workshop declara `session:append`, `approval:answer`, `subagent:spawn`, `command:register` y `tools:observe`.
 - **Datos**: nada se guarda en disco; el búfer circular de informes está en memoria y acotado. Sin peticiones de red propias.
-- **Registro de sesión**: los eventos `autoReview/*` llevan identidad del revisor, veredicto, razón, riesgo y duración — añadidos con el marcador de sobre `ignorable: true` para que cualquier compilación cargue el registro. Los hosts cuyo `Session.append` es anterior al marcador (todas las líneas rc publicadas hasta `0.1.1-rc.2` — ninguna versión lo estampa aún) se detectan antes del primer append (precomprobación de la versión del peer y luego sondeo del sobre devuelto) y la auditoría se degrada a un espejo en memoria con comentarios sin marcador, de modo que las sesiones siguen siendo cargables en todas partes.
+- **Registro de sesión**: los eventos `autoReview/*` llevan identidad del revisor, veredicto, razón, riesgo y duración — añadidos con el marcador de sobre `ignorable: true` para que cualquier compilación cargue el registro. Los hosts cuyo `Session.append` es anterior al marcador (todas las líneas rc publicadas hasta `0.1.1-rc.2` — ninguna versión lo estampa aún) se detectan antes del primer append (precomprobación de la versión del peer y luego sondeo del sobre devuelto); el host `0.1.2-rc.1` mantiene el campo `ignorable` en el sobre, pero `Session.append` no ofrece ninguna forma de estamparlo (su tercer parámetro es `SurfaceIntent`, solo para eventos de superficie), y la ruta de lectura de persistencia rechaza los tipos de evento desconocidos sin marcar, por lo que esas líneas — y las versiones irresolubles — también cierran en fallo antes de cualquier append. La auditoría se degrada a un espejo en memoria con comentarios sin marcador, de modo que las sesiones siguen siendo cargables en todas partes.
 
 ## Límites de seguridad
 
@@ -410,6 +410,10 @@ Este proyecto es uno de los [33 complementos de DeepSeek Harness](https://github
 | **[dsh-dsh-test-drive](https://github.com/PerryLink/dsh-dsh-test-drive)** | Pruebas de instalación y humo aisladas para plugins de DeepSeek Harness. | |
 | **[dsh-dsh-translate](https://github.com/PerryLink/dsh-dsh-translate)** | Traducción de parámetros entre proveedores y reparación determinista de JSON para DeepSeek Harness. | |
 
+### Instalar desde el mercado de DSH Desktop
+
+Todos los plugins de PerryLink pueden explorarse en el mercado integrado de DSH Desktop: **Market → Sources → add source → pegar** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ seleccionarlo**. La instalación sigue pasando por la verificación de identidad npm del mercado y tu confirmación.
+
 ## Licencia
 
 [Apache License 2.0](LICENSE) © 2026 dsh-auto-review contributors

package/README.hi.md

@@ -26,7 +26,7 @@
 
 | सतह | स्थिति |
 |---|---|
-| Harness | DeepSeek Harness `0.1.2-alpha.5` (dependencies `0.1.2-alpha.5` पर पिन की गईं; peers `>=0.1.0-rc.8 <0.2.0`) 0.1.2-alpha.5 (2026-09-02 को अनुकूलित): सत्र लिफ़ाफ़ा अपना ignorable फ़ील्ड केवल संग्रहीत-लॉग पठन संगतता के लिए रखता है - Session.append अभी भी इसे स्टैम्प नहीं कर सकता, इसलिए गेट व्यवहार अपरिवर्तित है। |
+| Harness | DeepSeek Harness `0.1.2-rc.1` (dependencies `0.1.2-rc.1` पर पिन की गईं; peers `>=0.1.0-rc.8 <0.2.0`) 0.1.2-rc.1 (2026-09-02 को अनुकूलित): सत्र लिफ़ाफ़ा अपना ignorable फ़ील्ड केवल संग्रहीत-लॉग पठन संगतता के लिए रखता है - Session.append अभी भी इसे स्टैम्प नहीं कर सकता, इसलिए गेट व्यवहार अपरिवर्तित है। |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | प्लेटफ़ॉर्म | सभी (होस्ट answerer; सत्र-प्रोजेक्शन क्षमता के ज़रिए वैकल्पिक वेब समीक्षा पैनल) |
 | मॉडल | कोई भी (समीक्षक सत्र एजेंट का मार्ग विरासत में लेता है; `reviewerModel` उसे बदल देता है) |
@@ -317,7 +317,7 @@ Claude Desktop (`claude_desktop_config.json`) उदाहरण:
 
 - **अनुमतियाँ**: workshop मेनिफ़ेस्ट `session:append`, `approval:answer`, `subagent:spawn`, `command:register` और `tools:observe` घोषित करता है।
 - **डेटा**: डिस्क पर कुछ नहीं लिखा जाता; रिपोर्ट रिंग बफ़र मेमोरी में और सीमित है। अपनी ओर से कोई नेटवर्क अनुरोध नहीं।
-- **सत्र लॉग**: `autoReview/*` घटनाएँ समीक्षक पहचान, निर्णय, कारण, जोखिम और अवधि रखती हैं — लिफ़ाफ़े के `ignorable: true` मार्कर के साथ जोड़ी जाती हैं ताकि कोई भी बिल्ड लॉग लोड कर सके। जिन होस्ट का `Session.append` मार्कर से पुराना है (`0.1.1-rc.2` तक की हर रिलीज़ rc लाइन — कोई रिलीज़ अभी मार्कर नहीं छापती) उन्हें पहले append से पहले ही पहचान लिया जाता है (peer संस्करण पूर्व-जाँच, फिर लौटे लिफ़ाफ़े की जाँच) और ऑडिट बिना मार्कर वाले फीडबैक के साथ इन-मेमोरी मिरर में डिग्रेड हो जाता है — सत्र हर जगह लोड होने योग्य रहते हैं।
+- **सत्र लॉग**: `autoReview/*` घटनाएँ समीक्षक पहचान, निर्णय, कारण, जोखिम और अवधि रखती हैं — लिफ़ाफ़े के `ignorable: true` मार्कर के साथ जोड़ी जाती हैं ताकि कोई भी बिल्ड लॉग लोड कर सके। जिन होस्ट का `Session.append` मार्कर से पुराना है (`0.1.1-rc.2` तक की हर रिलीज़ rc लाइन — कोई रिलीज़ अभी मार्कर नहीं छापती) उन्हें पहले append से पहले ही पहचान लिया जाता है (peer संस्करण पूर्व-जाँच, फिर लौटे लिफ़ाफ़े की जाँच); होस्ट `0.1.2-rc.1` लिफ़ाफ़े पर `ignorable` फ़ील्ड रखता है, लेकिन `Session.append` उसे स्टैम्प करने का कोई तरीका नहीं देता (इसका तीसरा पैरामीटर केवल सतही घटनाओं के लिए `SurfaceIntent` है), और पर्सिस्टेंस रीड पथ बिना-मार्क वाले अज्ञात घटना प्रकारों को अस्वीकार करता है, इसलिए वे लाइनें — और असमाधेय संस्करण — भी किसी भी append से पहले fail closed हो जाते हैं। ऑडिट बिना मार्कर वाले फीडबैक के साथ इन-मेमोरी मिरर में डिग्रेड हो जाता है — सत्र हर जगह लोड होने योग्य रहते हैं।
 
 ## सुरक्षा सीमाएँ
 
@@ -410,6 +410,10 @@ pnpm pack                   # प्रकाशित tarball
 | **[dsh-dsh-test-drive](https://github.com/PerryLink/dsh-dsh-test-drive)** | DeepSeek Harness प्लगिनों के लिए पृथक इंस्टॉल-एंड-स्मोक टेस्ट ड्राइव। | |
 | **[dsh-dsh-translate](https://github.com/PerryLink/dsh-dsh-translate)** | DeepSeek Harness के लिए वेंडर पैरामीटर अनुवाद और नियतात्मक JSON मरम्मत। | |
 
+### DSH Desktop मार्केट से इंस्टॉल करें
+
+सभी PerryLink प्लगइन DSH Desktop के बिल्ट-इन मार्केट में देखे जा सकते हैं: **Market → Sources → add source → पेस्ट करें** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ चुनें**। इंस्टॉलेशन मार्केट के npm-identity सत्यापन और आपकी पुष्टि से ही होता है।
+
 ## लाइसेंस
 
 [Apache License 2.0](LICENSE) © 2026 dsh-auto-review contributors

package/README.md

@@ -27,7 +27,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `0.1.2-alpha.5` (dependencies pinned to `0.1.2-alpha.5`; peers `>=0.1.0-rc.8 <0.2.0`) |
+| Harness | DeepSeek Harness `0.1.2-rc.1` (dependencies pinned to `0.1.2-rc.1`; peers `>=0.1.0-rc.8 <0.2.0`) |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | All (host answerer; optional Web review panel via the session-projection capability) |
 | Model | Any (the reviewer inherits the session agent's route; `reviewerModel` overrides) |
@@ -103,7 +103,7 @@ All tunables are Schemastery `Config` fields (changeable from cordis.yml). An id
 | `verdictCacheTtlMs` | `60000` | Reuse a recent verdict for an identical `tool + arguments` fingerprint; `0` disables the cache. Only applies with `contextBudget.turns: 0` — a transcript-dependent verdict is not replayable from `tool + arguments` alone |
 | `verdictCacheMaxEntries` | `256` | Maximum cached fingerprints before oldest-eviction |
 | `language` | `en` | UI language of the `/auto-review` command output (`en` \| `zh`) |
-| `allowUnmarkedAudit` | `false` | Force session-log audit on hosts that drop the `ignorable` marker or fail-closed on unknown event types (host `0.1.2-alpha.5`+) (dangerous: unmarked events make sessions unresumable elsewhere); default is detect-and-degrade 0.1.2-alpha.5 (adapted 2026-09-02): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. |
+| `allowUnmarkedAudit` | `false` | Force session-log audit on hosts that drop the `ignorable` marker or fail-closed on unknown event types (host `0.1.2-rc.1`+) (dangerous: unmarked events make sessions unresumable elsewhere); default is detect-and-degrade 0.1.2-rc.1 (adapted 2026-09-02): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. |
 
 Example (annotated full form: `fixtures/config/config-full.yaml`):
 
@@ -319,7 +319,7 @@ The server is read-only and deterministic: no network, no model, no writes.
 
 - **Permissions**: the workshop manifest declares `session:append`, `approval:answer`, `subagent:spawn`, `command:register`, and `tools:observe`.
 - **Data**: nothing is stored on disk; the report ring buffer is in-memory and bounded. No network requests of its own.
-- **Session log**: `autoReview/*` events carry reviewer identity, verdict, reason, risk, and duration — appended with the envelope's `ignorable: true` marker so any build loads the log. Hosts whose `Session.append` predates the marker (every released rc line through `0.1.1-rc.2` — no release stamps it yet) are detected before the first append (peer-version pre-check); host `0.1.2-alpha.5` keeps the `ignorable` field on the envelope but `Session.append` offers no way to stamp it (its third parameter is `SurfaceIntent` for surface events only), and the persistence read path refuses unmarked unknown event types, so those lines — and unresolvable versions — also fail closed before any append. Audit then degrades to an in-memory mirror with marker-free feedback, so sessions stay loadable everywhere.
+- **Session log**: `autoReview/*` events carry reviewer identity, verdict, reason, risk, and duration — appended with the envelope's `ignorable: true` marker so any build loads the log. Hosts whose `Session.append` predates the marker (every released rc line through `0.1.1-rc.2` — no release stamps it yet) are detected before the first append (peer-version pre-check); host `0.1.2-rc.1` keeps the `ignorable` field on the envelope but `Session.append` offers no way to stamp it (its third parameter is `SurfaceIntent` for surface events only), and the persistence read path refuses unmarked unknown event types, so those lines — and unresolvable versions — also fail closed before any append. Audit then degrades to an in-memory mirror with marker-free feedback, so sessions stay loadable everywhere.
 
 ## Security boundaries
 
@@ -412,6 +412,10 @@ This project is one of the [33 DeepSeek Harness plugins](https://github.com/Perr
 | **[dsh-dsh-test-drive](https://github.com/PerryLink/dsh-dsh-test-drive)** | Isolated install-and-smoke test drives for DeepSeek Harness plugins. | |
 | **[dsh-dsh-translate](https://github.com/PerryLink/dsh-dsh-translate)** | Vendor parameter translation and deterministic JSON repair for DeepSeek Harness. | |
 
+### Install from the DSH Desktop Market
+
+All PerryLink plugins are browsable in the built-in DSH Desktop Market: **Market → Sources → add source → paste** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ select it**. Installation still goes through the Market's npm-identity verification and your confirmation.
+
 ## License
 
 [Apache License 2.0](LICENSE) © 2026 dsh-auto-review contributors

package/README.pt.md

@@ -26,7 +26,7 @@
 
 | Superfície | Status |
 |---|---|
-| Harness | DeepSeek Harness `0.1.2-alpha.5` (dependências fixadas em `0.1.2-alpha.5`; peers `>=0.1.0-rc.8 <0.2.0`) 0.1.2-alpha.5 (adaptado em 2026-09-02): o envelope de sessão mantém seu campo ignorable apenas para compatibilidade de leitura de logs armazenados - o Session.append ainda não consegue estampá-lo, então o comportamento da porta não muda. |
+| Harness | DeepSeek Harness `0.1.2-rc.1` (dependências fixadas em `0.1.2-rc.1`; peers `>=0.1.0-rc.8 <0.2.0`) 0.1.2-rc.1 (adaptado em 2026-09-02): o envelope de sessão mantém seu campo ignorable apenas para compatibilidade de leitura de logs armazenados - o Session.append ainda não consegue estampá-lo, então o comportamento da porta não muda. |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (answerer de host; painel web opcional via capacidade de projeção de sessão) |
 | Modelo | Qualquer (o revisor herda a rota do agente da sessão; `reviewerModel` sobrescreve) |
@@ -317,7 +317,7 @@ O servidor é somente-leitura e determinista: sem rede, sem modelo, sem gravaç
 
 - **Permissões**: o manifesto do workshop declara `session:append`, `approval:answer`, `subagent:spawn`, `command:register` e `tools:observe`.
 - **Dados**: nada é gravado em disco; o buffer circular de relatórios fica em memória e é limitado. Sem requisições de rede próprias.
-- **Log de sessão**: os eventos `autoReview/*` carregam identidade do revisor, veredito, razão, risco e duração — anexados com o marcador de envelope `ignorable: true` para que qualquer build carregue o log. Hosts cujo `Session.append` é anterior ao marcador (todas as linhas rc publicadas até `0.1.1-rc.2` — nenhuma versão o estampa ainda) são detectados antes do primeiro append (pré-checagem da versão do peer e, em seguida, sondagem do envelope retornado) e a auditoria degrada para um espelho em memória com feedback sem marcador, mantendo as sessões carregáveis em qualquer lugar.
+- **Log de sessão**: os eventos `autoReview/*` carregam identidade do revisor, veredito, razão, risco e duração — anexados com o marcador de envelope `ignorable: true` para que qualquer build carregue o log. Hosts cujo `Session.append` é anterior ao marcador (todas as linhas rc publicadas até `0.1.1-rc.2` — nenhuma versão o estampa ainda) são detectados antes do primeiro append (pré-checagem da versão do peer e, em seguida, sondagem do envelope retornado); o host `0.1.2-rc.1` mantém o campo `ignorable` no envelope, mas o `Session.append` não oferece nenhuma forma de estampá-lo (seu terceiro parâmetro é `SurfaceIntent`, apenas para eventos de superfície), e o caminho de leitura da persistência recusa tipos de evento desconhecidos sem marcação, então essas linhas — e versões irresolvíveis — também falham fechadas antes de qualquer append. A auditoria degrada para um espelho em memória com feedback sem marcador, mantendo as sessões carregáveis em qualquer lugar.
 
 ## Limites de segurança
 
@@ -410,6 +410,10 @@ Este projeto é um dos [33 plugins de DeepSeek Harness](https://github.com/Perry
 | **[dsh-dsh-test-drive](https://github.com/PerryLink/dsh-dsh-test-drive)** | Test drives isolados de instalação e smoke para plugins de DeepSeek Harness. | |
 | **[dsh-dsh-translate](https://github.com/PerryLink/dsh-dsh-translate)** | Tradução de parâmetros entre fornecedores e reparo determinístico de JSON para DeepSeek Harness. | |
 
+### Instalar a partir do mercado do DSH Desktop
+
+Todos os plugins PerryLink podem ser explorados no mercado integrado do DSH Desktop: **Market → Sources → add source → colar** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ selecionar**. A instalação continua passando pela verificação de identidade npm do mercado e pela sua confirmação.
+
 ## Licença
 
 [Apache License 2.0](LICENSE) © 2026 dsh-auto-review contributors

package/README.zh.md

@@ -26,7 +26,7 @@
 
 | 方面 | 状态 |
 |---|---|
-| Harness | DeepSeek Harness `0.1.2-alpha.5`（依赖锁定在 `0.1.2-alpha.5`；peer 范围 `>=0.1.0-rc.8 <0.2.0`） 0.1.2-alpha.5（2026-09-02 已适配）：会话信封保留 ignorable 字段但仅用于存量日志读取兼容——Session.append 仍无法盖章，门控行为不变。 |
+| Harness | DeepSeek Harness `0.1.2-rc.1`（依赖锁定在 `0.1.2-rc.1`；peer 范围 `>=0.1.0-rc.8 <0.2.0`） 0.1.2-rc.1（2026-09-02 已适配）：会话信封保留 ignorable 字段但仅用于存量日志读取兼容——Session.append 仍无法盖章，门控行为不变。 |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | 平台 | 全部（宿主 answerer；可选 Web 审查面板，依赖会话投影能力） |
 | 模型 | 任意（审查器默认继承会话代理的路由；`reviewerModel` 可覆盖） |
@@ -317,7 +317,7 @@ Claude Desktop（`claude_desktop_config.json`）配置示例：
 
 - **权限**：workshop 清单声明 `session:append`、`approval:answer`、`subagent:spawn`、`command:register` 与 `tools:observe`。
 - **数据**：不向磁盘写入任何内容；报告环形缓冲在内存中且有界。自身不发起网络请求。
-- **会话日志**：`autoReview/*` 事件携带审查器身份、裁决、理由、风险与耗时 —— 以信封 `ignorable: true` 标记追加，任何构建都能加载日志。`Session.append` 早于该标记的宿主（迄今发布的所有 rc 版本，至 `0.1.1-rc.2`——任何发布版都还未盖标记）会在首次追加前被探测出来（peer 版本预检 + 返回信封探测），审计降级为内存镜像 + 无标记反馈，会话日志始终保持可加载。
+- **会话日志**：`autoReview/*` 事件携带审查器身份、裁决、理由、风险与耗时 —— 以信封 `ignorable: true` 标记追加，任何构建都能加载日志。`Session.append` 早于该标记的宿主（迄今发布的所有 rc 版本，至 `0.1.1-rc.2`——任何发布版都还未盖标记）会在首次追加前被探测出来（peer 版本预检 + 返回信封探测）；宿主 `0.1.2-rc.1` 在信封上保留 `ignorable` 字段，但 `Session.append` 没有任何方式为其盖章（其第三参数是仅用于 surface 事件的 `SurfaceIntent`），且持久化读取路径拒绝未标记的未知事件类型，因此这些版本线——以及无法解析的版本——同样在首次追加前 fail closed。审计降级为内存镜像 + 无标记反馈，会话日志始终保持可加载。
 
 ## 安全边界
 
@@ -410,6 +410,10 @@ pnpm pack                   # 发布产物
 | **[dsh-dsh-test-drive](https://github.com/PerryLink/dsh-dsh-test-drive)** | DeepSeek Harness 插件的隔离试装冒烟。 | |
 | **[dsh-dsh-translate](https://github.com/PerryLink/dsh-dsh-translate)** | DeepSeek Harness 的厂商参数翻译与确定性 JSON 修复。 | |
 
+### 从 DSH Desktop 市场安装
+
+所有 PerryLink 插件均可在 DSH Desktop 内置市场中浏览：**市场 → 来源 → 添加来源 → 粘贴** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ 选中**。安装仍需通过市场的 npm 身份校验与你的确认。
+
 ## 许可证
 
 [Apache License 2.0](LICENSE) © 2026 dsh-auto-review contributors

package/lib/index.js

@@ -60,7 +60,7 @@ function isUnmarkedHostVersion(version) {
 	if (rc !== null) {
 		const minor = Number(rc[1]);
 		const patch = Number(rc[2]);
-		return minor === 0 && patch <= 8 || minor === 1 && patch <= 2;
+		return minor === 0 && patch <= 8 || minor === 1 && patch <= 2 || minor >= 2;
 	}
 	const line = /^0\.1\.(\d+)(?:-.*)?$/.exec(v);
 	if (line !== null) return Number(line[1]) >= 2;

package/lib/types/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAA;AAElE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAW9D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAOlD"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAA;AAElE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc9D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAOlD"}

package/lib/types/audit.js

@@ -54,7 +54,10 @@ export function isUnmarkedHostVersion(version) {
     if (rc !== null) {
         const minor = Number(rc[1]);
         const patch = Number(rc[2]);
-        return (minor === 0 && patch <= 8) || (minor === 1 && patch <= 2);
+        // `0.1.2-rc.1` ships the alpha.5 surface: the third append parameter is
+        // `SurfaceIntent` for surface event types only, so no rc line in the
+        // 0.1.2 minor stamps the marker either.
+        return (minor === 0 && patch <= 8) || (minor === 1 && patch <= 2) || minor >= 2;
     }
     const line = /^0\.1\.(\d+)(?:-.*)?$/.exec(v);
     if (line !== null)

package/lib/types/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAK3C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IACxB,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,uCAAuC,CAA0B,CAAA;QAC5G,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAK3C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IACxB,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,wEAAwE;QACxE,qEAAqE;QACrE,wCAAwC;QACxC,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,uCAAuC,CAA0B,CAAA;QAC5G,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-auto-review",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent decides allow/deny on the approval answerer chain, with fail-closed fallback and full session-log audit.",
   "private": false,
   "author": {
@@ -105,7 +105,7 @@
     ],
     "compatibility": {
       "dshVersions": [
-        "0.1.2-alpha.5"
+        "0.1.2-rc.1"
       ]
     },
     "capability": {
@@ -138,20 +138,20 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-brand": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-commands": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-invariants": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-session": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-session-projection": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-subagent": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.8 <0.2.0",
-    "@deepseek-ai/dsh-user-approval": ">=0.1.0-rc.8 <0.2.0",
+    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-brand": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-invariants": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-session-projection": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-subagent": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-user-approval": ">=0.1.2-rc.1 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.2"
   },
   "peerDependenciesMeta": {
@@ -169,21 +169,21 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/dsh-app-boot": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-credentials-local": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs-observation-policy": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs-sandbox": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-home-paths": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-settings-file": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subagent-fork-in-process": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subagent-spawn-in-process": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subprocess-local": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tool-fs": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tool-fs-search": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-app-boot": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-credentials-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs-sandbox": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings-file": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-subagent-fork-in-process": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-subagent-spawn-in-process": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tool-fs": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tool-fs-search": "0.1.2-rc.1",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "yaml": "^2.8.2",
@@ -193,22 +193,22 @@
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/cordis-plugin-include": "^1.0.7",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/dsh-agent": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
     "@deepseek-ai/dsh-agent-spine-demo": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-brand": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-commands": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-invariants": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-projection": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subagent": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-user-approval": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "@types/node": "^26.2.0",
     "@types/react": "18.3.31",

package/src/audit.ts

@@ -60,7 +60,10 @@ export function isUnmarkedHostVersion(version: string): boolean {
   if (rc !== null) {
     const minor = Number(rc[1])
     const patch = Number(rc[2])
-    return (minor === 0 && patch <= 8) || (minor === 1 && patch <= 2)
+    // `0.1.2-rc.1` ships the alpha.5 surface: the third append parameter is
+    // `SurfaceIntent` for surface event types only, so no rc line in the
+    // 0.1.2 minor stamps the marker either.
+    return (minor === 0 && patch <= 8) || (minor === 1 && patch <= 2) || minor >= 2
   }
   const line = /^0\.1\.(\d+)(?:-.*)?$/.exec(v)
   if (line !== null) return Number(line[1]) >= 2