dsh-composition-doctor 0.1.0 → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +28 -41
  2. package/README.zh.md +28 -0
  3. package/package.json +2 -1
package/README.md CHANGED
@@ -1,63 +1,50 @@
1
1
  # dsh-composition-doctor
2
2
 
3
- DeepSeek Harness (DSH) 的本地组合与升级预检插件。它只读取用户明确指定的 profile 元数据，输出有证据的 Cordis/插件组合诊断，并在独立临时目录中演练升级；不会修改真实 profile、安装或卸载插件，也不会扩大权限。
3
+ [![npm version](https://img.shields.io/npm/v/dsh-composition-doctor)](https://www.npmjs.com/package/dsh-composition-doctor)
4
+ [![CI](https://github.com/lemonxiny55/dsh-composition-doctor/actions/workflows/ci.yml/badge.svg)](https://github.com/lemonxiny55/dsh-composition-doctor/actions)
4
5
 
5
- ## 中文
6
+ English | [中文](README.zh.md)
6
7
 
7
- ### 功能
8
+ Composition and upgrade preflight doctor for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`). It reads an explicitly selected profile and explains observable Cordis/plugin composition risks with concrete evidence. It never edits a real profile or silently changes permissions.
8
9
 
9
- - `scan`：分析显式 profile 的 composition，输出 JSON/Markdown。
10
- - `snapshot`：生成脱敏、可比较的 profile 快照和 lockfile 哈希。
11
- - `diff`：比较两个快照，识别插件升降级、rows、hooks、UI、peer/platform 变化。
12
- - `preflight`：在 OS 临时目录中进行离线解析和最小 smoke test；没有 `--allow-build` 时只输出构建计划。
13
- - DSH Settings 页面：只读显示最近报告、冲突关系和本地导出按钮。
10
+ ## What the model gets
14
11
 
15
- ### 安装与卸载
12
+ | Command | Purpose |
13
+ |---|---|
14
+ | `dsh-doctor scan` | Detect duplicate Cordis rows, hook-order risks, UI slot/route ownership conflicts, bundle overrides, peer/platform mismatches, and profile drift. |
15
+ | `dsh-doctor snapshot` | Create a redacted, comparable profile snapshot with lockfile hashes. |
16
+ | `dsh-doctor diff` | Summarize added/removed/upgraded plugins, rows, hooks, UI claims, peers, and platforms. |
17
+ | `dsh-doctor preflight` | Rehearse a target DSH upgrade in an isolated temporary profile. |
16
18
 
17
- ```powershell
18
- pnpm install
19
- pnpm build
20
- dsh plugin --profile <profile> add C:\path\to\dsh-composition-doctor
21
- dsh plugin --profile <profile> remove dsh-composition-doctor
22
- ```
19
+ The Web Settings page is display/export only: it reads the latest local report, shows a conflict graph, and exports JSON/Markdown. It has no repair, install, or uninstall action.
23
20
 
24
- 命令行也可直接运行 `node dist/cli/main.js`（或 `pnpm dsh-doctor`）。
25
-
26
- ### 使用
21
+ ## Install
27
22
 
28
23
  ```powershell
29
- dsh-doctor scan --profile .\test\fixtures\healthy --format both --output .\reports\healthy
30
- dsh-doctor snapshot --profile .\test\fixtures\healthy --output .\reports\before.json
31
- dsh-doctor diff --before .\reports\before.json --after .\reports\after.json --format both
32
- dsh-doctor preflight --profile .\test\fixtures\preflight-real-profile --target-dsh 0.1.0-rc.6 --candidate example-plugin@2.0.0
24
+ npm install -g dsh-composition-doctor
25
+ npx @deepseek-ai/dsh plugin --profile web add dsh-composition-doctor
33
26
  ```
34
27
 
35
- `--online` 只记录用户明确选择在线适配器的意图；当前实现仍不调用网络。`--allow-build` 是显式闸门，当前版本没有第三方构建 runner，因此不会执行生命周期脚本。
28
+ Restart the Web UI (`npx @deepseek-ai/dsh web`) after changing a profile. The CLI can also run from a checkout with `node dist/cli/main.js`.
36
29
 
37
- ### 输出示例
30
+ ## Example
38
31
 
39
- ```text
40
- warning runtime-composition-unavailable
41
- evidence: cordis.yml (static)
42
- explanation: 未注入公开的 resolved-composition provider，静态 YAML 不能证明运行时加载结果。
43
- remediation: 在隔离 fixture 中提供公开 provider 后重跑。
32
+ ```powershell
33
+ dsh-doctor scan --profile C:\path\to\profile --format both --output .\reports\profile
34
+ dsh-doctor snapshot --profile C:\path\to\profile --output .\reports\before.json
35
+ dsh-doctor diff --before .\reports\before.json --after .\reports\after.json --format both
36
+ dsh-doctor preflight --profile C:\path\to\profile --target-dsh 0.1.0-rc.6
44
37
  ```
45
38
 
46
- 完整示例见 [`docs/examples/scan-report.md`](docs/examples/scan-report.md)。
47
-
48
- ### 权限与隐私边界
49
-
50
- 默认只读，只读取显式 profile 根目录的 `cordis.yml`、`cordis.patch.yml`、`package.json` 和 lockfile 元数据，并拒绝符号链接。不会读取 `.env`、密钥、token、环境变量值、会话正文或工作区文件内容，不联网，不安装/卸载/迁移，不切换权限模式。快照递归脱敏敏感字段并只保留结构摘要与 SHA-256。工具不提供“安全评分”，也不声称插件本身安全。
51
-
52
- ### 支持范围与限制
39
+ Each finding is `info`, `warning`, or `error` and includes evidence, explanation, and the smallest remediation. Missing runtime evidence is reported as a warning, never as a confirmed failure.
53
40
 
54
- 当前验证过的开发预览范围：DSH `>=0.1.0-rc.5 <0.2.0`、Cordis `>=4 <5`、Node `>=20`，Windows 优先且可在 macOS/Linux 使用。DSH 尚未公开稳定的 resolved composition introspection API；未注入 provider 时结果明确标记为 static，不能证明启动成功或失败。Settings 页面依赖公开 `settings.plugins.tab` slot，不使用私有图标或 loader API。
41
+ ## Safety and privacy
55
42
 
56
- ## English
43
+ Default operations are read-only or isolated under the OS temporary directory. The plugin does not modify profiles, install/remove plugins, migrate configuration, escalate permissions, or perform network I/O by default. It never reads `.env`, keys, tokens, environment values, session bodies, or workspace file contents.
57
44
 
58
- `dsh-composition-doctor` is a local, read-only composition and upgrade preflight plugin for DeepSeek Harness. It analyses an explicitly selected profile, reports evidence-backed Cordis and plugin risks, snapshots redacted metadata, diffs snapshots, and rehearses upgrades in an isolated temporary directory. It never edits a real profile, installs or removes plugins, changes permissions, reads `.env`/keys/tokens/session/workspace contents, or performs network I/O by default. Findings are `info`, `warning`, or `error`; incomplete evidence is a warning, not a confirmed failure.
45
+ ## Support and limitations
59
46
 
60
- Commands are `dsh-doctor scan`, `snapshot`, `diff`, and `preflight`; invocation examples are above. The Web Settings section is display/export only. Verified preview range: DSH `>=0.1.0-rc.5 <0.2.0`, Cordis `>=4 <5`, Node `>=20`. Runtime composition introspection is an injected public-provider boundary; static findings are labelled accordingly. See [`docs/compatibility.md`](docs/compatibility.md) and [`docs/examples/scan-report.md`](docs/examples/scan-report.md).
47
+ Verified preview range: DSH `>=0.1.0-rc.5 <0.2.0`, Cordis `>=4 <5`, Node.js `>=20`; Windows is first-class and macOS/Linux are supported. DSH has not yet exposed a stable resolved-composition introspection API, so static findings are explicitly labelled when no public provider is available.
61
48
 
62
49
  ## Development
63
50
 
@@ -67,4 +54,4 @@ pnpm typecheck
67
54
  pnpm build
68
55
  ```
69
56
 
70
- Fixtures under `test/fixtures` cover healthy, duplicate row id, hook order, UI conflict, peer mismatch, redaction, and preflight isolation cases.
57
+ See [`README.zh.md`](README.zh.md), [`docs/compatibility.md`](docs/compatibility.md), and [`docs/examples/scan-report.md`](docs/examples/scan-report.md). MIT licensed.
package/README.zh.md ADDED
@@ -0,0 +1,28 @@
1
+ # dsh-composition-doctor（中文）
2
+
3
+ [English](README.md) | 中文
4
+
5
+ 面向 DeepSeek Harness（DSH）的本地只读组合与升级预检插件。它读取明确指定的 profile，分析 Cordis/plugin 组合风险，生成脱敏快照，比较升级差异，并在独立临时目录中演练升级。
6
+
7
+ ## 功能
8
+
9
+ | 命令 | 作用 |
10
+ |---|---|
11
+ | `dsh-doctor scan` | 检测重复 row、hook 顺序风险、UI slot/route 冲突、bundle 覆盖、peer/platform 不匹配和 profile 漂移。 |
12
+ | `dsh-doctor snapshot` | 生成脱敏、可比较的 profile 快照和 lockfile 哈希。 |
13
+ | `dsh-doctor diff` | 比较插件、rows、hooks、UI、peer 和平台变化。 |
14
+ | `dsh-doctor preflight` | 在独立临时目录预演目标 DSH 升级。 |
15
+
16
+ Web Settings 只读显示最近报告、冲突图并导出 JSON/Markdown，不提供修复、安装或卸载操作。
17
+
18
+ ## 安装与使用
19
+
20
+ ```powershell
21
+ npm install -g dsh-composition-doctor
22
+ npx @deepseek-ai/dsh plugin --profile web add dsh-composition-doctor
23
+ dsh-doctor scan --profile C:\path\to\profile --format both --output .\reports\profile
24
+ ```
25
+
26
+ 默认操作只读或写入操作系统临时目录，不修改真实 profile，不扩大权限，不默认联网，不读取 `.env`、密钥、token、环境变量值、会话正文或工作区文件内容。证据不足时只报告 warning。
27
+
28
+ 已验证范围：DSH `>=0.1.0-rc.5 <0.2.0`、Cordis `>=4 <5`、Node.js `>=20`；Windows 优先，同时支持 macOS/Linux。
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-composition-doctor",
3
- "version": "0.1.0",
3
+ "version": "0.1.2",
4
4
  "private": false,
5
5
  "description": "Read-only DSH and Cordis composition diagnostics, snapshots, diffs, and isolated preflight.",
6
6
  "license": "MIT",
@@ -14,6 +14,7 @@
14
14
  "dist",
15
15
  "cordis.patch.yml",
16
16
  "README.md",
17
+ "README.zh.md",
17
18
  "LICENSE"
18
19
  ],
19
20
  "dsh": {