dsh-auto-review 0.12.10 → 0.12.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/CHANGELOG.md +9 -0
  2. package/README-es.md +1 -1
  3. package/README-hi.md +1 -1
  4. package/README-pt.md +1 -1
  5. package/README-zh.md +1 -1
  6. package/README.md +1 -1
  7. package/lib/index.js +2 -0
  8. package/lib/types/audit.d.ts.map +1 -1
  9. package/lib/types/audit.js +13 -0
  10. package/lib/types/audit.js.map +1 -1
  11. package/package.json +55 -54
  12. package/src/audit.ts +12 -0
package/CHANGELOG.md CHANGED
@@ -4,6 +4,15 @@ All notable changes to `dsh-auto-review` are documented here. The repo is pre-re
4
4
 
5
5
  ## [Unreleased]
6
6
 
7
+ ## [0.12.11] - 2026-10-04
8
+
9
+
10
+ ### Changed
11
+
12
+ - Host pins move to `0.2.1-alpha.1`; re-verified against that host line. Every `@deepseek-ai/dsh-*` dev/test dependency now pins `0.2.1-alpha.1`, the `dshWorkshop.compatibility.dshVersions` timeline appends `0.2.1-alpha.1`, and the compatibility baseline in every README records the `dsh-v0.2.1-alpha.1` host. The declared host ranges (`engines.dsh` and the `peerDependencies` union) gain the `|| >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0` clauses: the previous upper bound was `<0.2.0`, which under semver rejects every 0.2.x host, so the probe host itself was not installable. Nothing was narrowed — the `0.1.x` clauses are unchanged, in place and in order.
13
+
14
+ ## [0.12.10] - 2026-09-25
15
+
7
16
  ### Changed
8
17
 
9
18
  - Host pins move to `0.1.7-rc.2`; re-verified against that host line. Every `@deepseek-ai/dsh-*` dev/test dependency now pins `0.1.7-rc.2`, the `dshWorkshop.compatibility.dshVersions` timeline appends `0.1.7-rc.2`, and the compatibility baseline in every README records the `dsh-v0.1.7-rc.2` host. The declared host ranges (`engines.dsh` and the `peerDependencies` union) are deliberately **unchanged** — they already admit `0.1.7-rc.2`, and a range is what the manifest accepts, not what has been tested.
package/README-es.md CHANGED
@@ -37,7 +37,7 @@ Este plugin forma parte de la [familia de plugins DSH](https://github.com/PerryL
37
37
 
38
38
  | Superficie | Estado |
39
39
  |---|---|
40
- | Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (verificado el 2026-09-25). Soporte npm de doble línea: pins de desarrollo y dependencias de runtime `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — el código del plugin detecta las líneas de host publicadas (detección de características) y cada línea ejecuta la cadena completa de gates; las dependencias de runtime siguen la línea del host para que una instalación en un perfil nunca sombree el árbol del host. `pnpm-workspace.yaml` fija todo el grafo `@deepseek-ai/dsh-*` a esa línea, porque `autoInstallPeers` si no rellena los peers `^0.1.1-rc.2` del subgrafo congelado `dsh-agent-spine-demo` con previews que carecen de las exportaciones que importan los paquetes 0.1.7. En la línea alpha.2 los fixtures de eval fijan `deepseek-flash` (el id eliminado `deepseek-v4-flash` ya no aparece en `eval/`). |
40
+ | Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (verificado el 2026-09-25). Soporte npm de doble línea: pins de desarrollo y dependencias de runtime `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — el código del plugin detecta las líneas de host publicadas (detección de características) y cada línea ejecuta la cadena completa de gates; las dependencias de runtime siguen la línea del host para que una instalación en un perfil nunca sombree el árbol del host. `pnpm-workspace.yaml` fija todo el grafo `@deepseek-ai/dsh-*` a esa línea, porque `autoInstallPeers` si no rellena los peers `^0.1.1-rc.2` del subgrafo congelado `dsh-agent-spine-demo` con previews que carecen de las exportaciones que importan los paquetes 0.1.7. En la línea alpha.2 los fixtures de eval fijan `deepseek-flash` (el id eliminado `deepseek-v4-flash` ya no aparece en `eval/`). |
41
41
  | Node | `^22.19.0 \|\| >=24.0.0` |
42
42
  | Plataformas | Todas (answerer de host; panel web opcional mediante la capacidad de proyección de sesión) |
43
43
  | Modelo | Cualquiera (el revisor hereda la ruta del agente de sesión; `reviewerModel` la reemplaza) |
package/README-hi.md CHANGED
@@ -37,7 +37,7 @@
37
37
 
38
38
  | सतह | स्थिति |
39
39
  |---|---|
40
- | Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (2026-09-25 को सत्यापित)। दोहरी-लाइन npm समर्थन: dev पिन और रनटाइम निर्भरताएँ `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — प्लगइन कोड प्रकाशित होस्ट लाइनों को फ़ीचर-डिटेक्ट करता है और हर लाइन पूरी गेट श्रृंखला चलाती है; रनटाइम निर्भरताएँ होस्ट लाइन का पालन करती हैं ताकि प्रोफ़ाइल इंस्टॉल होस्ट के अपने ट्री को शैडो न करें। `pnpm-workspace.yaml` पूरे `@deepseek-ai/dsh-*` ग्राफ़ को उस लाइन पर पिन करता है, क्योंकि अन्यथा `autoInstallPeers` फ़्रोज़न `dsh-agent-spine-demo` सबग्राफ़ के `^0.1.1-rc.2` peers को ऐसे प्रीव्यू से भर देता है जिनमें 0.1.7 पैकेज जिन निर्यातों को import करते हैं वे नहीं हैं। alpha.2 लाइन पर eval फ़िक्स्चर `deepseek-flash` पिन करते हैं (हटाया गया `deepseek-v4-flash` अब `eval/` में नहीं है)। |
40
+ | Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (2026-09-25 को सत्यापित)। दोहरी-लाइन npm समर्थन: dev पिन और रनटाइम निर्भरताएँ `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — प्लगइन कोड प्रकाशित होस्ट लाइनों को फ़ीचर-डिटेक्ट करता है और हर लाइन पूरी गेट श्रृंखला चलाती है; रनटाइम निर्भरताएँ होस्ट लाइन का पालन करती हैं ताकि प्रोफ़ाइल इंस्टॉल होस्ट के अपने ट्री को शैडो न करें। `pnpm-workspace.yaml` पूरे `@deepseek-ai/dsh-*` ग्राफ़ को उस लाइन पर पिन करता है, क्योंकि अन्यथा `autoInstallPeers` फ़्रोज़न `dsh-agent-spine-demo` सबग्राफ़ के `^0.1.1-rc.2` peers को ऐसे प्रीव्यू से भर देता है जिनमें 0.1.7 पैकेज जिन निर्यातों को import करते हैं वे नहीं हैं। alpha.2 लाइन पर eval फ़िक्स्चर `deepseek-flash` पिन करते हैं (हटाया गया `deepseek-v4-flash` अब `eval/` में नहीं है)। |
41
41
  | Node | `^22.19.0 \|\| >=24.0.0` |
42
42
  | प्लेटफ़ॉर्म | सभी (होस्ट answerer; सत्र-प्रोजेक्शन क्षमता के ज़रिए वैकल्पिक वेब समीक्षा पैनल) |
43
43
  | मॉडल | कोई भी (समीक्षक सत्र एजेंट का मार्ग विरासत में लेता है; `reviewerModel` उसे बदल देता है) |
package/README-pt.md CHANGED
@@ -37,7 +37,7 @@ Este plugin faz parte da [família de plugins DSH](https://github.com/PerryLink)
37
37
 
38
38
  | Superfície | Status |
39
39
  |---|---|
40
- | Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (verificado em 2026-09-25). Suporte npm de linha dupla: pins de desenvolvimento e dependências de runtime `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — o código do plugin detecta as linhas de host publicadas (detecção de recursos) e cada linha executa a cadeia completa de gates; as dependências de runtime seguem a linha do host para que uma instalação em um perfil nunca sombreie a árvore do host. `pnpm-workspace.yaml` fixa todo o grafo `@deepseek-ai/dsh-*` nessa linha, porque `autoInstallPeers` caso contrário preenche os peers `^0.1.1-rc.2` do subgrafo congelado `dsh-agent-spine-demo` com previews que não têm as exportações que os pacotes 0.1.7 importam. Na linha alpha.2 os fixtures de eval fixam `deepseek-flash` (o id removido `deepseek-v4-flash` não aparece mais em `eval/`). |
40
+ | Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (verificado em 2026-09-25). Suporte npm de linha dupla: pins de desenvolvimento e dependências de runtime `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — o código do plugin detecta as linhas de host publicadas (detecção de recursos) e cada linha executa a cadeia completa de gates; as dependências de runtime seguem a linha do host para que uma instalação em um perfil nunca sombreie a árvore do host. `pnpm-workspace.yaml` fixa todo o grafo `@deepseek-ai/dsh-*` nessa linha, porque `autoInstallPeers` caso contrário preenche os peers `^0.1.1-rc.2` do subgrafo congelado `dsh-agent-spine-demo` com previews que não têm as exportações que os pacotes 0.1.7 importam. Na linha alpha.2 os fixtures de eval fixam `deepseek-flash` (o id removido `deepseek-v4-flash` não aparece mais em `eval/`). |
41
41
  | Node | `^22.19.0 \|\| >=24.0.0` |
42
42
  | Plataformas | Todas (answerer de host; painel web opcional via capacidade de projeção de sessão) |
43
43
  | Modelo | Qualquer (o revisor herda a rota do agente da sessão; `reviewerModel` sobrescreve) |
package/README-zh.md CHANGED
@@ -37,7 +37,7 @@
37
37
 
38
38
  | 方面 | 状态 |
39
39
  |---|---|
40
- | Harness | DeepSeek Harness `dsh-v0.1.7-rc.2`（2026-09-24 已核验）。双线 npm 支持：dev 钉号与运行时依赖均为 `0.1.7-rc.2`、peer 范围 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` —— 插件代码兼容各已发布宿主线（特性探测），各线均跑完整门禁链；运行时依赖钉号随宿主线，避免 profile 安装遮蔽宿主自带树。`pnpm-workspace.yaml` 把整张 `@deepseek-ai/dsh-*` 图钉到该线：否则 `autoInstallPeers` 会用缺少 0.1.7 包所需导出的预览版填补已冻结的 `dsh-agent-spine-demo` 子图的 `^0.1.1-rc.2` peer。alpha.2 线上 eval 夹具钉 `deepseek-flash`（已移除的 `deepseek-v4-flash` 不再出现在 `eval/`）。 |
40
+ | Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1`（2026-09-24 已核验）。双线 npm 支持：dev 钉号与运行时依赖均为 `0.1.7-rc.2`、peer 范围 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` —— 插件代码兼容各已发布宿主线（特性探测），各线均跑完整门禁链；运行时依赖钉号随宿主线，避免 profile 安装遮蔽宿主自带树。`pnpm-workspace.yaml` 把整张 `@deepseek-ai/dsh-*` 图钉到该线：否则 `autoInstallPeers` 会用缺少 0.1.7 包所需导出的预览版填补已冻结的 `dsh-agent-spine-demo` 子图的 `^0.1.1-rc.2` peer。alpha.2 线上 eval 夹具钉 `deepseek-flash`（已移除的 `deepseek-v4-flash` 不再出现在 `eval/`）。 |
41
41
  | Node | `^22.19.0 \|\| >=24.0.0` |
42
42
  | 平台 | 全部（宿主 answerer；可选 Web 审查面板，依赖会话投影能力） |
43
43
  | 模型 | 任意（审查器默认继承会话代理的路由；`reviewerModel` 可覆盖） |
package/README.md CHANGED
@@ -39,7 +39,7 @@
39
39
 
40
40
  | Surface | Status |
41
41
  |---|---|
42
- | Harness | DeepSeek Harness `dsh-v0.1.7-rc.2` (verified 2026-09-25). Dual-line npm support: dev pins and runtime deps `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — the plugin code feature-detects the published host lines and each line runs the full gate chain; the runtime dependency pins follow the host line so a profile install never shadows the host's own tree. `pnpm-workspace.yaml` pins the whole `@deepseek-ai/dsh-*` graph to that line, because `autoInstallPeers` otherwise fills the frozen `dsh-agent-spine-demo` subgraph's `^0.1.1-rc.2` peers with previews that lack the exports the 0.1.7 packages import. On the alpha.2 line the eval fixtures pin `deepseek-flash` (the removed `deepseek-v4-flash` id is gone from `eval/`). |
42
+ | Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (verified 2026-09-25). Dual-line npm support: dev pins and runtime deps `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — the plugin code feature-detects the published host lines and each line runs the full gate chain; the runtime dependency pins follow the host line so a profile install never shadows the host's own tree. `pnpm-workspace.yaml` pins the whole `@deepseek-ai/dsh-*` graph to that line, because `autoInstallPeers` otherwise fills the frozen `dsh-agent-spine-demo` subgraph's `^0.1.1-rc.2` peers with previews that lack the exports the 0.1.7 packages import. On the alpha.2 line the eval fixtures pin `deepseek-flash` (the removed `deepseek-v4-flash` id is gone from `eval/`). |
43
43
  | Node | `^22.19.0 \|\| >=24.0.0` |
44
44
  | Platforms | All (host answerer; optional Web review panel via the session-projection capability) |
45
45
  | Model | Any (the reviewer inherits the session agent's route; `reviewerModel` overrides) |
package/lib/index.js CHANGED
@@ -81,6 +81,8 @@ function isUnmarkedHostVersion(version) {
81
81
  }
82
82
  const line = /^0\.1\.(\d+)(?:-.*)?$/.exec(v);
83
83
  if (line !== null) return Number(line[1]) >= 2;
84
+ const rc02 = /^0\.2\.(\d+)-/.exec(v);
85
+ if (rc02 !== null) return Number(rc02[1]) >= 0;
84
86
  return false;
85
87
  }
86
88
  /**
package/lib/types/audit.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAA;AAElE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA0B9D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAOlD"}
1
+ {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAA;AAElE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsC9D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAOlD"}
package/lib/types/audit.js CHANGED
@@ -91,6 +91,19 @@ export function isUnmarkedHostVersion(version) {
91
91
  // fail-closed is the safe direction.
92
92
  if (line !== null)
93
93
  return Number(line[1]) >= 2;
94
+ // The 0.2 corridor is non-stamping too, verified 2026-10-04 against the
95
+ // published `0.2.1-alpha.1` `dsh-session`: `append(type, data, ...opts)`
96
+ // reads only `sourceEventSeqs`/`surfaceOp` out of the options bag and builds
97
+ // the envelope as `{ type, seq, time, data }` plus that surface metadata, so
98
+ // `{ ignorable: true }` is dropped and the event lands unmarked. Without this
99
+ // clause the line falls through to the "possibly marker-aware" path, whose
100
+ // append probe writes one unmarked event into the log BEFORE discovering the
101
+ // host cannot stamp — the exact pollution this guard exists to prevent.
102
+ // Only PRERELEASES are classified here: a stable `0.2.x` may yet add the
103
+ // append option, and that must fail open into the probe instead.
104
+ const rc02 = /^0\.2\.(\d+)-/.exec(v);
105
+ if (rc02 !== null)
106
+ return Number(rc02[1]) >= 0;
94
107
  return false;
95
108
  }
96
109
  /**
package/lib/types/audit.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAK3C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IACxB,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,kEAAkE;QAClE,iEAAiE;QACjE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,uCAAuC,CAA0B,CAAA;QAC5G,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAK3C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IACxB,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,kEAAkE;QAClE,iEAAiE;QACjE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9C,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,uCAAuC,CAA0B,CAAA;QAC5G,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-auto-review",
3
- "version": "0.12.10",
3
+ "version": "0.12.11",
4
4
  "description": "Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent decides allow/deny on the approval answerer chain, with fail-closed fallback and full session-log audit.",
5
5
  "private": false,
6
6
  "author": {
@@ -111,7 +111,8 @@
111
111
  "0.1.5-rc.2",
112
112
  "0.1.7-alpha.2",
113
113
  "0.1.7-rc.1",
114
- "0.1.7-rc.2"
114
+ "0.1.7-rc.2",
115
+ "0.2.1-alpha.1"
115
116
  ]
116
117
  },
117
118
  "capability": {
@@ -141,25 +142,25 @@
141
142
  ],
142
143
  "engines": {
143
144
  "node": "^22.19.0 || >=24.0.0",
144
- "dsh": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0"
145
+ "dsh": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0"
145
146
  },
146
147
  "peerDependencies": {
147
- "@deepseek-ai/cordis": "^4.0.3",
148
- "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
149
- "@deepseek-ai/dsh-brand": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
150
- "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
151
- "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
152
- "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
153
- "@deepseek-ai/dsh-client-ui-slots": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
154
- "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
155
- "@deepseek-ai/dsh-invariants": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
156
- "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
157
- "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
158
- "@deepseek-ai/dsh-session-projection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
159
- "@deepseek-ai/dsh-subagent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
160
- "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
161
- "@deepseek-ai/dsh-user-approval": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0",
162
- "@deepseek-ai/schemastery": "^3.18.3"
148
+ "@deepseek-ai/cordis": "^4.0.5-alpha.1",
149
+ "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
150
+ "@deepseek-ai/dsh-brand": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
151
+ "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
152
+ "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
153
+ "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
154
+ "@deepseek-ai/dsh-client-ui-slots": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
155
+ "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
156
+ "@deepseek-ai/dsh-invariants": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
157
+ "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
158
+ "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
159
+ "@deepseek-ai/dsh-session-projection": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
160
+ "@deepseek-ai/dsh-subagent": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
161
+ "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
162
+ "@deepseek-ai/dsh-user-approval": ">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0 || >=0.2.0-0 <0.3.0 || >=0.2.1-0 <0.3.0",
163
+ "@deepseek-ai/schemastery": "^3.18.5-alpha.1"
163
164
  },
164
165
  "peerDependenciesMeta": {
165
166
  "@deepseek-ai/dsh-client-connection": {
@@ -176,48 +177,48 @@
176
177
  }
177
178
  },
178
179
  "dependencies": {
179
- "@deepseek-ai/dsh-app-boot": "0.1.7-rc.2",
180
- "@deepseek-ai/dsh-credentials-local": "0.1.7-rc.2",
181
- "@deepseek-ai/dsh-fs-observation-policy": "0.1.7-rc.2",
182
- "@deepseek-ai/dsh-fs-sandbox": "0.1.7-rc.2",
183
- "@deepseek-ai/dsh-home-paths": "0.1.7-rc.2",
184
- "@deepseek-ai/dsh-llm-deepseek": "0.1.7-rc.2",
185
- "@deepseek-ai/dsh-sandbox-local": "0.1.7-rc.2",
186
- "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.2",
187
- "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.7-rc.2",
188
- "@deepseek-ai/dsh-subagent-fork-in-process": "0.1.7-rc.2",
189
- "@deepseek-ai/dsh-subagent-spawn-in-process": "0.1.7-rc.2",
190
- "@deepseek-ai/dsh-subprocess-local": "0.1.7-rc.2",
191
- "@deepseek-ai/dsh-tool-fs": "0.1.7-rc.2",
192
- "@deepseek-ai/dsh-tool-fs-search": "0.1.7-rc.2",
180
+ "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.1",
181
+ "@deepseek-ai/dsh-credentials-local": "0.2.1-alpha.1",
182
+ "@deepseek-ai/dsh-fs-observation-policy": "0.2.1-alpha.1",
183
+ "@deepseek-ai/dsh-fs-sandbox": "0.2.1-alpha.1",
184
+ "@deepseek-ai/dsh-home-paths": "0.2.1-alpha.1",
185
+ "@deepseek-ai/dsh-llm-deepseek": "0.2.1-alpha.1",
186
+ "@deepseek-ai/dsh-sandbox-local": "0.2.1-alpha.1",
187
+ "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
188
+ "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-alpha.1",
189
+ "@deepseek-ai/dsh-subagent-fork-in-process": "0.2.1-alpha.1",
190
+ "@deepseek-ai/dsh-subagent-spawn-in-process": "0.2.1-alpha.1",
191
+ "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.1",
192
+ "@deepseek-ai/dsh-tool-fs": "0.2.1-alpha.1",
193
+ "@deepseek-ai/dsh-tool-fs-search": "0.2.1-alpha.1",
193
194
  "tsdown": "^0.23.0",
194
195
  "typescript": "^7.0.2",
195
196
  "yaml": "^2.8.2",
196
197
  "zod": "^4.4.3"
197
198
  },
198
199
  "devDependencies": {
199
- "@deepseek-ai/cordis": "^4.0.3",
200
- "@deepseek-ai/cordis-plugin-group": "^1.0.3",
201
- "@deepseek-ai/cordis-plugin-include": "^1.0.8",
202
- "@deepseek-ai/cordis-plugin-loader": "^1.0.4",
203
- "@deepseek-ai/dsh-agent": "0.1.7-rc.2",
200
+ "@deepseek-ai/cordis": "^4.0.5-alpha.1",
201
+ "@deepseek-ai/cordis-plugin-group": "^1.0.5-alpha.1",
202
+ "@deepseek-ai/cordis-plugin-include": "^1.0.10-alpha.1",
203
+ "@deepseek-ai/cordis-plugin-loader": "^1.0.6-alpha.1",
204
+ "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
204
205
  "@deepseek-ai/dsh-agent-spine-demo": "0.1.1-rc.2",
205
- "@deepseek-ai/dsh-api-remotes": "0.1.7-rc.2",
206
- "@deepseek-ai/dsh-brand": "0.1.7-rc.2",
207
- "@deepseek-ai/dsh-client-connection": "0.1.7-rc.2",
208
- "@deepseek-ai/dsh-client-locale": "0.1.7-rc.2",
209
- "@deepseek-ai/dsh-client-ui-conversation": "0.1.7-rc.2",
210
- "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.2",
211
- "@deepseek-ai/dsh-commands": "0.1.7-rc.2",
212
- "@deepseek-ai/dsh-invariants": "0.1.7-rc.2",
213
- "@deepseek-ai/dsh-llm": "0.1.7-rc.2",
214
- "@deepseek-ai/dsh-session": "0.1.7-rc.2",
215
- "@deepseek-ai/dsh-session-format-catalog": "0.1.7-rc.2",
216
- "@deepseek-ai/dsh-session-projection": "0.1.7-rc.2",
217
- "@deepseek-ai/dsh-subagent": "0.1.7-rc.2",
218
- "@deepseek-ai/dsh-tools": "0.1.7-rc.2",
219
- "@deepseek-ai/dsh-user-approval": "0.1.7-rc.2",
220
- "@deepseek-ai/schemastery": "^3.18.3",
206
+ "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.1",
207
+ "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
208
+ "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.1",
209
+ "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.1",
210
+ "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.1",
211
+ "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.1",
212
+ "@deepseek-ai/dsh-commands": "0.2.1-alpha.1",
213
+ "@deepseek-ai/dsh-invariants": "0.2.0-rc.2",
214
+ "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
215
+ "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
216
+ "@deepseek-ai/dsh-session-format-catalog": "0.2.1-alpha.1",
217
+ "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.1",
218
+ "@deepseek-ai/dsh-subagent": "0.2.1-alpha.1",
219
+ "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
220
+ "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1",
221
+ "@deepseek-ai/schemastery": "^3.18.5-alpha.1",
221
222
  "@types/node": "^26.2.0",
222
223
  "@types/react": "19.3.0",
223
224
  "@vitest/coverage-v8": "5.0.0",
package/src/audit.ts CHANGED
@@ -96,6 +96,18 @@ export function isUnmarkedHostVersion(version: string): boolean {
96
96
  // stable `0.1.x` cannot be distinguished from its prereleases here, and
97
97
  // fail-closed is the safe direction.
98
98
  if (line !== null) return Number(line[1]) >= 2
99
+ // The 0.2 corridor is non-stamping too, verified 2026-10-04 against the
100
+ // published `0.2.1-alpha.1` `dsh-session`: `append(type, data, ...opts)`
101
+ // reads only `sourceEventSeqs`/`surfaceOp` out of the options bag and builds
102
+ // the envelope as `{ type, seq, time, data }` plus that surface metadata, so
103
+ // `{ ignorable: true }` is dropped and the event lands unmarked. Without this
104
+ // clause the line falls through to the "possibly marker-aware" path, whose
105
+ // append probe writes one unmarked event into the log BEFORE discovering the
106
+ // host cannot stamp — the exact pollution this guard exists to prevent.
107
+ // Only PRERELEASES are classified here: a stable `0.2.x` may yet add the
108
+ // append option, and that must fail open into the probe instead.
109
+ const rc02 = /^0\.2\.(\d+)-/.exec(v)
110
+ if (rc02 !== null) return Number(rc02[1]) >= 0
99
111
  return false
100
112
  }
101
113