dsh-auto-review 0.12.5 → 0.12.6

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to `dsh-auto-review` are documented here. The repo is pre-release; versions follow the DeepSeek Harness `0.1.0-rc.x` target runtime and bump on every behavior change.
 
+## [0.12.6] - 2026-09-19
+
+### Added
+
+- `pnpm run check:lockfile` (`scripts/check-lockfile-drift.mjs`) fails fast when `package.json` and `pnpm-lock.yaml` disagree; the documented checks chain runs it alongside the other gates.
+
+### Changed
+
+- The release workflow now publishes through **npm trusted publishing** (OIDC) instead of the long-lived `NPM_TOKEN` secret: `setup-node` no longer sets `registry-url` (its empty `_authToken` line made the registry answer 404), and the "NPM_TOKEN is not set -> fail" guard is gone so the OIDC exchange is the only path. pnpm performs the OIDC exchange itself.
+
+### Changed
+
+- **Raise the pinned harness line from `0.1.5-rc.2` to `0.1.6-alpha.2`** (31 `@deepseek-ai/dsh-*` pins across `dependencies` and `devDependencies`; only `dsh-agent-spine-demo` stays on `0.1.1-rc.2`, as it has no alpha.2 release). The old pin was not merely cosmetic: on an alpha.2 host the hoisted `dsh-home-paths` came from the rc.2 line and lacks `dshCachePath`, which the alpha.2 host packages (`dsh-attachment-local`) import at module scope, so a scratch profile booted with `SyntaxError: The requested module '@deepseek-ai/dsh-home-paths' does not provide an export named 'dshCachePath'`. The lockfile now resolves a single `dsh-home-paths@0.1.6-alpha.2`. Feature detection for older host lines is untouched.
+
 ## [0.12.5] - 2026-09-18
 
 ### Changed

package/lib/eval-cli.js

@@ -1,4 +1,4 @@
-import { A as parseSuite, a as EvalEngine, i as writeReports, o as evalReviewConfig, r as renderTerminalSummary, t as exitCodeFor } from "./report-DIhvkIxO.js";
+import { A as parseSuite, a as EvalEngine, i as writeReports, o as evalReviewConfig, r as renderTerminalSummary, t as exitCodeFor } from "./report-jx0jVFpG.js";
 import { mkdir, readFile, readdir } from "node:fs/promises";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";

package/lib/eval.js

@@ -1,2 +1,2 @@
-import { A as parseSuite, C as diffLines, D as renderToolCall, E as collectTrace, M as resolveCaseTimeout, O as DslError, S as percentile, T as renderSideBySide, _ as renderArgumentExpectation, a as EvalEngine, b as validateExpectations, c as resolvePromptBaselines, d as EVAL_VERDICT_SCHEMA, f as buildEvalReviewPrompt, g as deepContains, h as argumentsMatchRegexes, i as writeReports, j as resolveCaseModel, k as SuiteSchema, l as sessionHeaderLine, m as runEvalReview, n as renderMarkdownReport, o as evalReviewConfig, p as isEvalReviewFailure, r as renderTerminalSummary, s as renderSessionArtifact, t as exitCodeFor, u as summarizeCaseResult, v as runAssertions, w as hasChanges, x as computeStressMetrics, y as toolNameMatches } from "./report-DIhvkIxO.js";
+import { A as parseSuite, C as diffLines, D as renderToolCall, E as collectTrace, M as resolveCaseTimeout, O as DslError, S as percentile, T as renderSideBySide, _ as renderArgumentExpectation, a as EvalEngine, b as validateExpectations, c as resolvePromptBaselines, d as EVAL_VERDICT_SCHEMA, f as buildEvalReviewPrompt, g as deepContains, h as argumentsMatchRegexes, i as writeReports, j as resolveCaseModel, k as SuiteSchema, l as sessionHeaderLine, m as runEvalReview, n as renderMarkdownReport, o as evalReviewConfig, p as isEvalReviewFailure, r as renderTerminalSummary, s as renderSessionArtifact, t as exitCodeFor, u as summarizeCaseResult, v as runAssertions, w as hasChanges, x as computeStressMetrics, y as toolNameMatches } from "./report-jx0jVFpG.js";
 export { DslError, EVAL_VERDICT_SCHEMA, EvalEngine, SuiteSchema, argumentsMatchRegexes, buildEvalReviewPrompt, collectTrace, computeStressMetrics, deepContains, diffLines, evalReviewConfig, exitCodeFor, hasChanges, isEvalReviewFailure, parseSuite, percentile, renderArgumentExpectation, renderMarkdownReport, renderSessionArtifact, renderSideBySide, renderTerminalSummary, renderToolCall, resolveCaseModel, resolveCaseTimeout, resolvePromptBaselines, runAssertions, runEvalReview, sessionHeaderLine, summarizeCaseResult, toolNameMatches, validateExpectations, writeReports };