dsh-auto-review 0.13.3 → 0.13.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.13.4] - 2026-10-18
+
+### Changed
+
+- Move `tsdown`/`typescript` (and `@types/react` where present) from runtime dependencies to devDependencies. Git installs still build: pnpm installs devDependencies for a git dependency and runs `prepare`; npm tarballs ship the built `lib/`. The runtime tree no longer carries the build chain.
+
 ## [0.13.3] - 2026-10-18
 
 ### Fixed

package/README-es.md

@@ -46,7 +46,7 @@ dsh plugin --profile <name> add dsh-auto-review
 
 Este plugin forma parte de la [familia de plugins DSH](https://github.com/PerryLink) (más de 40, todos Apache-2.0). Si te resulta útil, **dale una estrella**: no desbloquea nada, pero ayuda a que la siguiente persona lo encuentre antes.
 
-*English:* part of a 40+ plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
+*English:* part of a 95 plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
 
 ## What is dsh-auto-review?
 
@@ -64,7 +64,7 @@ Cuando una acción cruza el límite del sandbox, un segundo modelo lee la eviden
 
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (verificado el 2026-09-25). Soporte npm de doble línea: pins de desarrollo y dependencias de runtime `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — el código del plugin detecta las líneas de host publicadas (detección de características) y cada línea ejecuta la cadena completa de gates; las dependencias de runtime siguen la línea del host para que una instalación en un perfil nunca sombree el árbol del host. `pnpm-workspace.yaml` fija todo el grafo `@deepseek-ai/dsh-*` a esa línea, porque `autoInstallPeers` si no rellena los peers `^0.1.1-rc.2` del subgrafo congelado `dsh-agent-spine-demo` con previews que carecen de las exportaciones que importan los paquetes 0.1.7. En la línea alpha.2 los fixtures de eval fijan `deepseek-flash` (el id eliminado `deepseek-v4-flash` ya no aparece en `eval/`). |
+| Harness | DeepSeek Harness `dsh-v0.2.1-rc.2` (verificado 2026-10-18): `engines.dsh >=0.2.1-0 <0.3.0`; las rutas de compatibilidad P0 tienen pruebas de regresión. |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (answerer de host; panel web opcional mediante la capacidad de proyección de sesión) |
 | Modelo | Cualquiera (el revisor hereda la ruta del agente de sesión; `reviewerModel` la reemplaza) |
@@ -434,7 +434,7 @@ Este plugin **no interfiere** con otros plugins, incluidos los de más estrellas
 
 Evidencia estática: `dsh-plugin-doctor` K10–K13 dan `pass` en todas las comprobaciones de este repositorio.
 
-## Familia de plugins DSH de PerryLink
+## PerryLink DSH Plugin Family
 
 Este proyecto es uno de los **87 plugins activamente mantenidos** de DeepSeek Harness de [PerryLink](https://github.com/PerryLink). El registro familiar tiene **95** plugins — **5 congelados**, **3 retirados** — y permanece plegado abajo para que cada README conserve una primera pantalla corta. Expándelo para ver cada fila, con el motivo en la columna Estado.
 
@@ -541,4 +541,6 @@ Este proyecto es uno de los **87 plugins activamente mantenidos** de DeepSeek Ha
 
 </details>
 
-</details>
+</details>
+
+</details>

package/README-hi.md

@@ -44,9 +44,9 @@ dsh plugin --profile <name> add dsh-auto-review
 
 ## ⭐ 如果它帮到了你
 
-यह प्लगइन [DSH प्लगइन परिवार](https://github.com/PerryLink) का हिस्सा है (40+ प्लगइन, सभी Apache-2.0)। अगर यह उपयोगी लगे, तो **एक स्टार दें** — इससे कोई सुविधा अनलॉक नहीं होती, पर अगला व्यक्ति इसे खोज में आसानी से पा लेता है।
+यह प्लगइन [DSH प्लगइन परिवार](https://github.com/PerryLink) का हिस्सा है (95 प्लगइन, सभी Apache-2.0)। अगर यह उपयोगी लगे, तो **एक स्टार दें** — इससे कोई सुविधा अनलॉक नहीं होती, पर अगला व्यक्ति इसे खोज में आसानी से पा लेता है।
 
-*English:* part of a 40+ plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
+*English:* part of a 95 plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
 
 ## What is dsh-auto-review?
 
@@ -64,7 +64,7 @@ DeepSeek Harness के लिए द्वितीय-मॉडल AI अन
 
 | सतह | स्थिति |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (2026-09-25 को सत्यापित)। दोहरी-लाइन npm समर्थन: dev पिन और रनटाइम निर्भरताएँ `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — प्लगइन कोड प्रकाशित होस्ट लाइनों को फ़ीचर-डिटेक्ट करता है और हर लाइन पूरी गेट श्रृंखला चलाती है; रनटाइम निर्भरताएँ होस्ट लाइन का पालन करती हैं ताकि प्रोफ़ाइल इंस्टॉल होस्ट के अपने ट्री को शैडो न करें। `pnpm-workspace.yaml` पूरे `@deepseek-ai/dsh-*` ग्राफ़ को उस लाइन पर पिन करता है, क्योंकि अन्यथा `autoInstallPeers` फ़्रोज़न `dsh-agent-spine-demo` सबग्राफ़ के `^0.1.1-rc.2` peers को ऐसे प्रीव्यू से भर देता है जिनमें 0.1.7 पैकेज जिन निर्यातों को import करते हैं वे नहीं हैं। alpha.2 लाइन पर eval फ़िक्स्चर `deepseek-flash` पिन करते हैं (हटाया गया `deepseek-v4-flash` अब `eval/` में नहीं है)। |
+| हारनेस | DeepSeek Harness `dsh-v0.2.1-rc.2` (2026-10-18 सत्यापित): `engines.dsh >=0.2.1-0 <0.3.0`; P0 संगतता पथ के रिग्रेशन परीक्षण हैं। |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | प्लेटफ़ॉर्म | सभी (होस्ट answerer; सत्र-प्रोजेक्शन क्षमता के ज़रिए वैकल्पिक वेब समीक्षा पैनल) |
 | मॉडल | कोई भी (समीक्षक सत्र एजेंट का मार्ग विरासत में लेता है; `reviewerModel` उसे बदल देता है) |
@@ -283,7 +283,7 @@ dsh-eval eval/cases --model deepseek-flash --timeout-ms 240000 --out .eval-repor
 
 स्थैतिक प्रमाण: इस रिपॉज़िटरी पर `dsh-plugin-doctor` के K10–K13 सभी `pass` हैं।
 
-## PerryLink DSH प्लगइन परिवार
+## PerryLink DSH Plugin Family
 
 यह प्रोजेक्ट [PerryLink](https://github.com/PerryLink) के **87 सक्रिय रूप से अनुरक्षित** DeepSeek Harness प्लगइन में से एक है। पूरा परिवार **95** प्लगइन है — **5 फ़्रोज़न**, **3 सेवानिवृत्त** — और नीचे संक्षिप्त रखा गया है ताकि हर README की पहली स्क्रीन छोटी रहे। हर पंक्ति देखने के लिए इसे खोलें; कारण स्थिति कॉलम में है।
 
@@ -390,6 +390,8 @@ dsh-eval eval/cases --model deepseek-flash --timeout-ms 240000 --out .eval-repor
 
 </details>
 
+</details>
+
 </details>## MCP सर्वर (स्टैंडअलोन)
 
 `dsh-auto-review` एक stdio **MCP सर्वर** (`dsh-auto-review-mcp`) भी देता है ताकि बाहरी MCP क्लाइंट (Claude, Codex, …) बिना harness के एक निर्धारक समीक्षा पथ का उपयोग कर सकें। यह newline-delimited JSON (NDJSON) पर JSON-RPC 2.0 बोलता है — प्रति पंक्ति एक JSON ऑब्जेक्ट, कोई `Content-Length` फ़्रेमिंग नहीं।

package/README-pt.md

@@ -38,7 +38,7 @@ dsh plugin --profile <name> add dsh-auto-review
 
 Este plugin faz parte da [família de plugins DSH](https://github.com/PerryLink) (mais de 40, todos Apache-2.0). Se for útil, **deixe uma estrela**: não desbloqueia nada, mas ajuda a próxima pessoa a encontrá-lo.
 
-*English:* part of a 40+ plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
+*English:* part of a 95 plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
 
 ## What is dsh-auto-review?
 
@@ -56,7 +56,7 @@ Quando uma ação cruza a fronteira do sandbox, um segundo modelo lê as evidên
 
 | Superfície | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (verificado em 2026-09-25). Suporte npm de linha dupla: pins de desenvolvimento e dependências de runtime `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — o código do plugin detecta as linhas de host publicadas (detecção de recursos) e cada linha executa a cadeia completa de gates; as dependências de runtime seguem a linha do host para que uma instalação em um perfil nunca sombreie a árvore do host. `pnpm-workspace.yaml` fixa todo o grafo `@deepseek-ai/dsh-*` nessa linha, porque `autoInstallPeers` caso contrário preenche os peers `^0.1.1-rc.2` do subgrafo congelado `dsh-agent-spine-demo` com previews que não têm as exportações que os pacotes 0.1.7 importam. Na linha alpha.2 os fixtures de eval fixam `deepseek-flash` (o id removido `deepseek-v4-flash` não aparece mais em `eval/`). |
+| Harness | DeepSeek Harness `dsh-v0.2.1-rc.2` (verificado 2026-10-18): `engines.dsh >=0.2.1-0 <0.3.0`; os caminhos de compatibilidade P0 têm testes de regressão. |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (answerer de host; painel web opcional via capacidade de projeção de sessão) |
 | Modelo | Qualquer (o revisor herda a rota do agente da sessão; `reviewerModel` sobrescreve) |
@@ -430,7 +430,7 @@ Este plugin **não interfere** em outros plugins, incluindo os de mais estrelas:
 
 Evidência estática: `dsh-plugin-doctor` K10–K13 retornam `pass` em todas as verificações deste repositório.
 
-## Família de plugins DSH da PerryLink
+## PerryLink DSH Plugin Family
 
 Este projeto é um dos **87 plugins ativamente mantidos** do DeepSeek Harness da [PerryLink](https://github.com/PerryLink). O registro da família tem **95** plugins — **5 congelados**, **3 retirados** — e fica recolhido abaixo para que cada README mantenha uma primeira tela curta. Expanda para ver cada linha, com o motivo na coluna Status.
 
@@ -537,4 +537,6 @@ Este projeto é um dos **87 plugins ativamente mantidos** do DeepSeek Harness da
 
 </details>
 
-</details>
+</details>
+
+</details>

package/README-zh.md

@@ -36,9 +36,9 @@ dsh plugin --profile <name> add dsh-auto-review
 <!-- star-cta -->
 ## ⭐ 如果它帮到了你
 
-这个插件是 [DSH 插件家族](https://github.com/PerryLink)的一员（40+ 个，全部 Apache-2.0）。如果你在用，**给个 star** —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。
+这个插件是 [DSH 插件家族](https://github.com/PerryLink)的一员（95 个，全部 Apache-2.0）。如果你在用，**给个 star** —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。
 
-*English:* part of a 40+ plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
+*English:* part of a 95 plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
 
 ## What is dsh-auto-review?
 
@@ -56,7 +56,7 @@ DeepSeek Harness 的第二模型 AI 审批 —— 一个只读审查子代理在
 
 | 方面 | 状态 |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1`（2026-09-24 已核验）。双线 npm 支持：dev 钉号与运行时依赖均为 `0.1.7-rc.2`、peer 范围 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` —— 插件代码兼容各已发布宿主线（特性探测），各线均跑完整门禁链；运行时依赖钉号随宿主线，避免 profile 安装遮蔽宿主自带树。`pnpm-workspace.yaml` 把整张 `@deepseek-ai/dsh-*` 图钉到该线：否则 `autoInstallPeers` 会用缺少 0.1.7 包所需导出的预览版填补已冻结的 `dsh-agent-spine-demo` 子图的 `^0.1.1-rc.2` peer。alpha.2 线上 eval 夹具钉 `deepseek-flash`（已移除的 `deepseek-v4-flash` 不再出现在 `eval/`）。 |
+| 宿主 | DeepSeek Harness `dsh-v0.2.1-rc.2`（2026-10-18 验证）：`engines.dsh >=0.2.1-0 <0.3.0`；P0 兼容路径已有回归测试。 |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | 平台 | 全部（宿主 answerer；可选 Web 审查面板，依赖会话投影能力） |
 | 模型 | 任意（审查器默认继承会话代理的路由；`reviewerModel` 可覆盖） |
@@ -425,7 +425,7 @@ pnpm pack                   # 发布产物
 
 静态证据：`dsh-plugin-doctor` 的 K10–K13 在本仓全部为 `pass`。
 
-## PerryLink DSH 插件家族
+## PerryLink DSH Plugin Family
 
 本项目是 [PerryLink](https://github.com/PerryLink) 维护的 DeepSeek Harness 插件家族成员：**87 个活跃维护**，名册共 **95** 个，其中 **5 个已冻结**、**3 个已退役**。完整名单默认折叠，避免每个 README 的首屏被长表淹没；点击展开可查看每一行，原因见「状态」列。
 
@@ -534,6 +534,8 @@ pnpm pack                   # 发布产物
 
 </details>
 
+</details>
+
 ### 从 DSH Desktop 市场安装
 
 所有 PerryLink 插件均可在 DSH Desktop 内置市场中浏览：**市场 → 来源 → 添加来源 → 粘贴** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ 选中**。安装仍需通过市场的 npm 身份校验与你的确认。

package/README.md

@@ -46,9 +46,9 @@ dsh plugin --profile <name> add dsh-auto-review
 
 ## ⭐ 如果它帮到了你
 
-这个插件是 [DSH 插件家族](https://github.com/PerryLink)的一员（40+ 个，全部 Apache-2.0）。如果你在用，**给个 star** —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。
+这个插件是 [DSH 插件家族](https://github.com/PerryLink)的一员（95 个，全部 Apache-2.0）。如果你在用，**给个 star** —— 它不会解锁任何功能，但会让下一个人在搜索里更容易找到它。
 
-*English:* part of a 40+ plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
+*English:* part of a 95 plugin family for DeepSeek Harness. If it is useful, **a star helps the next person find it** — nothing is gated behind it.
 
 
 ## What is dsh-auto-review?
@@ -67,7 +67,7 @@ When an action crosses the sandbox boundary, a second model reads the evidence a
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.2.1-alpha.1` (verified 2026-09-25). Dual-line npm support: dev pins and runtime deps `0.1.7-rc.2`, peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0` — the plugin code feature-detects the published host lines and each line runs the full gate chain; the runtime dependency pins follow the host line so a profile install never shadows the host's own tree. `pnpm-workspace.yaml` pins the whole `@deepseek-ai/dsh-*` graph to that line, because `autoInstallPeers` otherwise fills the frozen `dsh-agent-spine-demo` subgraph's `^0.1.1-rc.2` peers with previews that lack the exports the 0.1.7 packages import. On the alpha.2 line the eval fixtures pin `deepseek-flash` (the removed `deepseek-v4-flash` id is gone from `eval/`). |
+| Harness | DeepSeek Harness `dsh-v0.2.1-rc.2` (verified 2026-10-18): `engines.dsh >=0.2.1-0 <0.3.0`; the P0 compatibility paths have regression tests. |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | All (host answerer; optional Web review panel via the session-projection capability) |
 | Model | Any (the reviewer inherits the session agent's route; `reviewerModel` overrides) |
@@ -537,6 +537,8 @@ This project is one of the **87 actively maintained** DeepSeek Harness plugins f
 
 </details>
 
+</details>
+
 ### Install from the DSH Desktop Market
 
 All PerryLink plugins are browsable in the built-in DSH Desktop Market: **Market → Sources → add source → paste** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ select it**. Installation still goes through the Market's npm-identity verification and your confirmation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-auto-review",
-  "version": "0.13.3",
+  "version": "0.13.4",
   "packageManager": "pnpm@11.7.0",
   "description": "Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent decides allow/deny on the approval answerer chain, with fail-closed fallback and full session-log audit.",
   "private": false,
@@ -191,8 +191,6 @@
     "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.1",
     "@deepseek-ai/dsh-tool-fs": "0.2.1-alpha.1",
     "@deepseek-ai/dsh-tool-fs-search": "0.2.1-alpha.1",
-    "tsdown": "^0.23.0",
-    "typescript": "^7.0.2",
     "yaml": "^2.8.2",
     "zod": "^4.4.3"
   },
@@ -226,7 +224,9 @@
     "react": "19.3.0",
     "react-dom": "19.2.8",
     "vitest": "^5.0.0",
-    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.2"
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.2",
+    "tsdown": "^0.23.0",
+    "typescript": "^7.0.2"
   },
   "scripts": {
     "build": "node scripts/prepare.mjs",